Vulnerability analysis, fault modeling, and countermeasures towards dependable real-time computing in safety-critical drone systems

Context

Safety-critical systems such as drones have strong dependability requirements, as unexpected functional or timing behavior, due to malicious attacks or non-intended disruptions, can lead to catastrophic consequences [1, 2]. As highlighted in recent work, critical vulnerabilities in drone systems emphasize an urgent need to develop robust dependability frameworks, protecting against fault injection attacks and enhancing drones' dependability [3]. The different dependability requirements –such as security, reliability, and real-time– have not usually been considered altogether in the design of safety-critical embedded systems with timing safety and high security requirements [4], such as drones. However, they profoundly influence each other and require to be simultaneously investigated. For instance, real-time systems have stringent timing requirements to ensure their correct operation, which severely constrain how security countermeasures can be added to these systems without negative impact on timing safety [4]. It is only recently that the interdependency of the design’s security and reliability solutions has been highlighted, emphasizing that they should be investigated together [5]. Similarly, the interplay between timing safety and reliability has only recently started to be explored, showing that the number of execution cycles of an application may increase significantly when a transient fault affects the system [6].

State of the art

Security, reliability, and real-time vulnerability analysis are typically studied independently in different research communities [8, 9, 10]. While security focuses on protecting systems from intentional threats, reliability is related to the protection of the system from unintended faults, and real-time deals with protecting the system's timing behavior from hard-to-predict timing variations. Although for different fault sources the way of impacting the system is different, e.g., radiation vs. ElectroMagnetic (EM) interference in the context of drones [3], the physical impact on the hardware implementation is similar. However, the research communities have proposed fault models considering security, reliability, and real-time aspects, in isolation.  

Security and reliability problems in timing-critical systems differ compared to general-purpose systems, as the requirement for tight timing guarantees brings up new vulnerabilities. For instance, if an external perturbation –intentional or not– introduces a delay into the critical path, the whole mission can be compromised and even introduce significant collateral damage, e.g., in local intervention on (gas or other) pipes, obstacle avoidance, rescue missions, etc. [11]. Recent research has started proposing countermeasures to cover parts of the problem. Most approaches often rely on software protection mechanisms, which may introduce latency or remain vulnerable to certain attacks. A large class of the proposed solutions is centered around the deployment layer, where the scheduler, considered the most important resource management algorithm, has received a lot of attention [4]. Hardware approaches have been studied to detect Hardware Trojans and illegal memory accesses that tamper with program execution flow [12], including runtime monitors [13, 14] using hash functions [15], Hamming codes [16, 17], and machine learning [18, 19].  

Scientific challenges and objectives of the thesis

In this thesis, we focus on the dependability of real-time critical systems by approaching the problems of security, reliability, and real-time in embedded safety-critical systems from a common angle, to advance the state of the art in attack and fault resilience while ensuring real-time guarantees. As opposed to most current art where traditional software and hardware error detection and correction methods do not consider real-time criticality aspects, the main challenge of this work is moving towards co-existing and co-operating countermeasures to protect against fault attacks and unintended faults (e.g., from radiation), to ensure functional and non-functional aspects as security, reliability and real-time guarantees. We tackle the following scientific challenges:

• Propose a set of common dependability-oriented fault models by exploring the compatibility, enhancing, and merging the existing fault models from the different research communities.  
• Study the propagation of fault effects to the application execution using the dependability-oriented fault models to observe the impact on the functional and non-functional system behavior (resilience to attacks and unintended faults, as well as timing guarantees).
• Propose hardware countermeasures offering resilient, predictable, and timing-bounded protection, required for safety-critical embedded systems.

To bridge the gap described and address the scientific challenges, the goal of this thesis is to set a common approach to the analysis of vulnerabilities and the proposal of countermeasures to ensure the dependability of drones in safety-critical scenarios. Our focus is on gaining insights into the interplay among security, reliability, and timing safety. Specifically, we want to analyze the system resiliency and dependability to (1) fault attacks and (2) unintended faults, in terms of functional and timing behaviors, and (3) propose programmable Hardware Dependability Modules (HDMs) that (4) respect timing guarantees and ensure the security and reliability of drone computing platforms. Furthermore, the hardware-level nature of the proposed HDMs provides a significant security advantage: disabling or circumventing them would require physical tampering with the circuit, unlike software countermeasures, which may be remotely bypassed. This characteristic makes hardware-based protections particularly suitable for safety-critical systems like drones, where high assurance against adversarial interference is essential. The main objectives are:

• O1. Accurate and realistic analysis of the system’s resiliency and dependability, considering both functional and non-functional applications’ behavior. Such analysis will involve fault propagation considering both software and hardware characteristics, with respect to functional and non-functional aspects like security, reliability, and real-time [7].
• O2. Investigate the use of Hardware Dependability Modules (HDMs) to guarantee security and reliability while meeting real-time constraints. When intentional and unintentional external threats are considered, having timing-aware hardware countermeasures becomes imperative for mitigation without violating timing constraints.

Methodology

During this PhD, we will follow the following steps.

• Dependability-oriented fault models and analysis framework: We will start with a thorough study of state-of-the-art research work on reliability, security, and real-time fault models. We will perform fault-injection simulation experiments to observe differences and similarities with the objective of finally proposing comprehensive fault models covering all three aspects. To do so, we will use the existing vulnerability analysis framework from IRISA/Inria partners [6] and extend it to include security, reliability, and real-time aspects.
• Error Detection Hardware Mechanisms: We will propose HDM to monitor task execution behavior and protect control-flow integrity. To achieve this, we will leverage our expertise on run-time control mechanisms for timing safety to detect the violations in execution time [20] and activation period of control tasks based on expected system behavior obtained at design time. We will explore (1) statistical learning-based mechanisms [18, 19] to profile the correct execution and memory behavior and detect violations, and (2) hardware-based mechanisms based on Probabilistic Data Structures (e.g., Bloom Filters) [15, 16] to track the actual task control flow and compare it to the expected one.  
• Error Correction Hardware Mechanisms: A hardware-implemented rollback system will store verified "safe" states of the system, enabling quick re-execution from a correct state if errors are detected, inspired by checkpoint techniques used in high-reliability systems [21]. To ensure the real-time constraints, the proposed HDM solutions will be time-bounded, building on the team members' experience on near-zero-timing-overhead techniques [6].

The evaluation of the proposed countermeasures will be measured through dependability-related metrics and indicators such as detection efficiency, false positives and false negatives, and Worst-Case Execution Time (WCET) compliance, i.e., the frequency at which the system meets its WCET targets, after applying countermeasures.

We plan to leverage SoC-FPGA platforms that are already integrated into drone systems. Within these platforms, we will integrate the proposed HDMs directly into the FPGA logic as it allows us to target both the available Arm cores in the SoC-FPGA, and, importantly, soft-core implementations of the RISC-V architecture, which enables their use as an emulation platform for future chips. Moreover, the FPGA reconfigurability enables the programmability of HDMs to be adapted to different vulnerabilities and evolving threat models over time. Since HDMs operate in hardware, their level of access to the processor’s circuitry to monitor and intervene on its program and execution flow is an important factor to study. Therefore, we will study the use of loosely coupled –HDM connected as a peripheral to the core– and tightly coupled approaches –HDM as part of the processor microarchitecture–, and the impact on access to runtime information, timing behavior, programmability, and ease of use for developers, as well as on the performance/overhead tradeoff.

Impact

With this PhD thesis, we expect to contribute to a new class of dependable drone systems ensuring operational safety, including reliability and security, through hardware-level protections. The principles and methodologies investigated are expected to substantially contribute to domains where dependability is paramount, such as drone systems, including autonomous navigation, critical mission deployment, as well as other industries. 

Using an open Instruction Set Architecture (ISA), such as RISC-V, has a strategic importance in European and French sovereignty in computing, highly promoted by the European Commission. It can also enable further research on countermeasures across the computing stack, like, e.g., ISA extensions, adapted microarchitectures, and automated deployment of countermeasures through adapted compilation toolchains.

Supervising team

The supervising team consists of experienced senior researchers and a younger junior colleague, with diverse yet complementary expertise in hardware security, reliability, and real-time systems, each contributing these crucial skills essential for efficient supervision and training of a PhD researcher working in a multi-disciplinary domain. 

• Angeliki Kritikakou, PhD director (TARAN, IRISA, Inria, Univ. Rennes). She is an Associate Professor and holds an Innovation Chair at the Institut Universitaire de France (IUF). Her expertise in reliable and real-time design of embedded systems is fundamental for the design of HDMs that operate not only reliably, but also with bounded execution time.  
• Marcello Traiola (TARAN, IRISA, Inria). He is a CR Inria with a strong background in digital hardware design and reliability, required for dependability analysis and ensuring HDMs are robust and reliable for mission-critical drone operations.
• Rubén Salvador (SUSHI, IRISA, Inria, CentraleSupelec). He is an Associate Professor and specializes in embedded systems security and FPGAs, required for developing flexible, adaptable, and robust HDMs in complex systems like drones. 
• Alessandro Palumbo (SUSHI, IRISA, Inria, CentraleSupelec). He is an Associate Professor with a strong background in hardware security and the application of machine learning and probabilistic data structures to protect microprocessors, which aligns with the development of advanced HDMs with real-time error correction capabilities.

Collaboration

This PhD project includes a collaboration with Maria Méndez Real, Junior Professor Chair on Trusted and Autonomous Drones Swarms from Lab-STICC, UBS (SHAKER team). She is an expert in hardware security and side-channel attacks and has deep knowledge of security vulnerabilities in embedded systems, essential for securing drone systems against external threats. This collaboration will allow the team at large to address the project from multiple perspectives –including security, reliability, operational flexibility, and fault resilience– ensuring the final system is robust, secure, and efficient for demanding drone environments. The current Chair on Trusted and Autonomous Swarm of Drones will complement the project team and bring drone implementation expertise and equipment, especially through another PhD starting in September 2025 on trusted drones' architecture, which is complementary to this work.