Examkin

Question

Difficulty: HardHardware and Embedded Systems Security

An energy company is deploying smart grid Remote Terminal Units (RTUs) in unmonitored utility field enclosures. During a physical security assessment, penetration testers attached high-speed logic analyzers to the exposed printed circuit board (PCB) traces connecting the microcontroller to external system RAM, successfully intercepting plaintext cryptographic keys transmitted across the bus during normal runtime operations. Which of the following hardware security controls should the security architect specify to mitigate this vulnerability?

  1. Bus encryptionAnswer
  2. B
    Secure Boot with a hardware Root of Trust
  3. C
    Network-attached Hardware Security Module (HSM)
  4. D
    Asymmetric RSA-4096 code signing of flash memory partitions

Answer

Bus encryption dynamically encrypts data in transit over physical memory buses between processing units and external RAM, preventing attackers with physical probing tools from intercepting cleartext key material.
Bus encryption (such as inline memory encryption) continuously encrypts data and address lines between the processor and RAM using hardware-based cryptographic engines. This prevents physical side-channel and bus-sniffing attacks from capturing sensitive data or keys from exposed circuit traces.

Step-by-Step Solution

1
Analyze the threat vector described in the deployment scenario.
The attack involves physical probe attachment (logic analyzers) to printed circuit board (PCB) traces between the main microcontroller and external system RAM to capture cleartext data in transit.
Identifying the specific physical attack vector narrows down the required hardware-level security control.
2
Evaluate candidate hardware security mechanisms against physical bus sniffing.
Bus encryption (inline memory encryption) uses hardware engines to encrypt data written to external memory and decrypt it upon read operations, rendering intercepted signals on PCB traces unreadable.
Cryptographic protection must occur at the bus layer to protect signal lines operating outside chip packaging.
3
Differentiate bus encryption from boot integrity and asymmetric signature controls.
Controls like Secure Boot and asymmetric code signing ensure firmware integrity at launch, but do not provide runtime confidentiality across hardware interconnects.
Distinguishing integrity controls from runtime bus confidentiality controls confirms the correct selection.

Key Concept

Bus Encryption and Hardware Bus Protection
Rate this question

Topics

Hardware and Embedded Systems Security

More questions from this topic