A.A. Chechulin, V.A. Desnitsky, I.V. Kotenko

Embedded devices provide a wide range of possibilities to malefactors to carry out various attacks, including a direct connection to the interfaces and elements of the device. Resources - limitation entails the complexity of applying the traditional cryptographic or other security methods that are used to protect workstations and servers. Therefore, systems with embedded devices require new approaches for security design solutions that would ensure stability of the system to attack not only by additional protection mechanisms, but also by architecture decisions. One of the ways to achieve this goal is to analyze the system at all stages of design, thus avoiding the architectural defects, which, in turn, reduce the level of protection systems. The paper proposes an integrated approach to the analysis of information flows in systems that include embedded devices. Security-critical information flow analysis can be applied at various levels, including schematic diagrams of electronic circuitry (hardware flows), data flow models of computer software (software flows), and entire communications network layouts (network flows). This paper also considers two ways of information flow analysis of a security-critical system - static and dynamic approach. Dynamic approach allows analyzing information flows by tracking how information actually flows through the system when it is in operation. This is often easy to implement, by inserting sensors and monitors into the system, but has the disadvantage that even if no insecure flows have been observed to date we can never be certain that no security problems will arise in future. Static approach, in turn, carries out by analyzing the structure of the system itself. This has the advantage of providing absolute guarantees about all of the system-s potential behaviors, but it is often computationally expensive and produces "false-positives", i.e., alerts about potential information flows identified statically that never actually occur dynamically. The essential idea of static information flow analysis is to allow an infosec evaluator to see where classified data could propagate when the system is in operation. This is usually done by selecting some point in the system to be a source of high-security data, and then using a connectivity graph model of the system to trace possible pathways for this data. This is sometimes referred to as "taint analysis" and is helpful in evaluating a system-s weak points and mechanisms for protecting data confidentiality and integrity. The primary disadvantages of the approach is that it is computationally expensive for large system models and tends to overapproximate the possible data flow pathways, resulting in false-positive results that can waste an infosec evaluator-s time (although this is preferable to underestimating potential data flow, which could result in security-critical pathways being overlooked). Topological analysis techniques, based on conventional graph theory, and model checking methods are applied for security assessment. The task which is considered in this paper is the part of the security engineering process for embedded devices. An integrated approach to the information flow analysis proposed in the paper allows to enhance the security level of standalone embedded devices and systems containing embedded devices. In contrast to existing approaches, the proposed approach provides a comprehensive evaluation of the system-s security level toward information flows.