Skip to content

Presentation

presentation

Functionality

Piception is a two-node Raspberry Pi cybersecurity system designed around layered isolation.

The first Raspberry Pi, Piawake, acts as the gateway between the outside network and the protected system. The second Raspberry Pi, Piception, has no WiFi connection and can only be reached through its Ethernet connection to Piawake.

Inside Piception, an encrypted QEMU virtual machine called Dream2 contains another encrypted layer, the Totem. An encrypted USB drive called Dream1 acts as a visible decoy.

As a final defensive layer, the system includes a physical trap that can cut the Ethernet cable and completely disconnect Piception from the rest of the network.

system

Design Flow Summary

The project evolved through four design spirals. Each iteration expanded the system and provided an opportunity to evaluate and improve the design. Spiral Two focused on hardening, while Spiral Four evaluated the final design and analyzed its remaining vulnerabilities.

Spiral One: Network Isolation

  • Connected two Raspberry Pis through Ethernet.
  • Piawake connects to the normal network through WiFi.
  • Piception has no direct WiFi or Internet connection.
  • Access to Piception must pass through Piawake.

Spiral Two: Secure Remote Access

  • Hardened SSH access using key authentication.
  • Disabled unnecessary services and reduced the attack surface.
  • Added a firewall, Fail2ban and automatic security updates.
  • Configured remote access through a single forwarded SSH port.
  • Used SSH tunnels for services such as VNC.

vnc

Hardening Summary

Layer Hardening Purpose
Operating System Updates, unattended upgrades Reduce known vulnerabilities
Remote Access SSH keys, Fail2ban Prevent unauthorized access
Network UFW, single forwarded port Minimize exposed services
Architecture Two-node Raspberry Pi design Network isolation
Storage LUKS, encrypted VM, encrypted Totem Protect confidential data
Physical Ethernet cutting trap Emergency physical isolation
Monitoring Persistent logs, watchdog Analysis and troubleshooting

Spiral Three: The Dream

  • Created an encrypted QEMU virtual machine called Dream2.
  • Stored the protected information inside the VM.
  • Added an encrypted file container called Totem inside Dream2.
  • Added the encrypted Dream1 USB drive as a decoy.

dream2

Spiral Four: Add a Trap and Analyze

  • Evaluated the remaining attack surfaces.
  • Bash history
  • Added a servo-controlled mechanical Ethernet cutter.
  • The trap can physically disconnect Piception from Piawake.
  • Uses a fake decrypt_wallet C program and an altered ls command as bait

Would both atacers fall for the trap?

Human attacker AI attacker
Creative Systematic
Curious Tireless
Notices unusual patterns Executes many files automatically

trap