SentryBus: A Multi-Vantage Observability Model and Validated Instrument for I2C Sensor-Interface Manipulation
Sensor-driven systems in medical Internet of Things devices, drones, and cyber-physical systems commonly trust a measurement once it reaches the embedded processor. An adversary on the digital interface between sensor and processor can supply a plausible value that correct firmware accepts and reports as ordinary telemetry. The hypothesis is that sensor interface manipulation leaves observable evidence on the acquisition path, that the evidence appears at different vantages depending on attacker position, and that a passive host-side monitor therefore has a measurable boundary beyond which manipulation becomes indistinguishable from legitimate acquisition. SentryBus models acquisition behavior on the I2C sensor bus using transaction timing, read and write sequences, transfer lengths, address behavior, register and FIFO state access, and raw data transitions. The adversary is modeled as an inline interposer, parallel controller, sensor replacement, or compromised host, because a commodity target-only sensor cannot initiate transfers or stretch, reorder, or delay bus transactions. A dual sided testbed captures both busses, host memory, and telemetry, and the detector consumes the host facing bus alone while the remaining vantages serve as ground truth. A physiological instantiation reports three measured results: an inline interposer bounded at 0.842 percent of acquisition service time while preserving acquisition schedule and payload content, clean acquisition stability sustained over 6304 seconds at the telemetry vantage with no clock regression, and a negative result establishing that data-transition features encode session specific signal statistics and do not transfer across capture sessions. Instrument characterization shows that a low-cost analyzer can truncate captures without kernel visible error. Controlled attack trials are still outstanding, so no detection rate is claimed.