POSE: Phase I: An Open-Source Approach to Measure and Analyze Embedded Systems Security

Computer systems are embedded and integrated into everyday items such as cars, smart cards, and medical devices. The security properties of these systems are crucial to keep their users safe and secure, and thorough testing of those properties is needed before deployment. This project explores the creation of an open-source ecosystem (OSE) for the measurement and analysis of embedded systems security. The OSE is based on Chipwhisperer, an existing open-source project that has grown over the past decade into a collection of hardware and software to support every aspect of embedded security testing. The project identifies a path for ChipWhisperer to become a conduit between developers of testing hardware and software for embedded systems and their users and use cases. This project organizes a set of concrete scoping activities to identify the main roles in the ChipWhisperer OSE, including (a) the managing organization, (b) the users, and (c) the developers. To support governance, the project seeks to integrate the ChipWhisperer developers and with OSE experts to establish a technical charter and to identify techniques for continuous development and sustainability. With a series of workshops and tutorials, co-located with major conferences on embedded security, the project explores use cases of interest to the research community. The project engages open-source contributors to improve the embedded security testing process by contributing open interfaces for measurement hardware, standard data formats, analysis software, and embedded testing targets. Furthermore, the project develops and promotes use cases that benefit from the OSE, including academic research, artifact exchange, crypto competitions, standard testing techniques, and embedded security beyond cryptography. This award reflects NSF's statutory mission and has been deemed worthy of support through evaluation using the Foundation's intellectual merit and broader impacts review criteria.