Securing Real-Time Microcontroller Systems through Customized Memory View Switching

25th Annual Network and Distributed System Security Symposium, NDSS 2018

Volumn , Issue , 2018, Pages

  Kim, Chung Hwan ^a   Kim, Taegyu ^b   Choi, Hongjun ^b   Gu, Zhongshu ^c   Lee, Byoungyoung ^b   Zhang, Xiangyu ^b   Xu, Dongyan ^b  

^a NEC LABORATORIES AMERICA   (United States)

^b PURDUE UNIVERSITY   (United States)

^c IBM T J WATSON RESEARCH CENTER   (United States)

Author keywords

[No Author keywords available]

Indexed keywords

ACCESS CONTROL; CONTROLLERS; CYBERSECURITY; EMBEDDED SYSTEMS; FIRMWARE; MEMORY ARCHITECTURE; MICROCONTROLLERS; NETWORK SECURITY; REAL TIME SYSTEMS;

CUSTOMIZED MEMORY; CYBE-PHYSICAL SYSTEMS; CYBER-PHYSICAL SYSTEMS; MEMORY ACCESS; MEMORY ISOLATION; MEMORY SPACE; MICROCONTROLLER SYSTEMS; PERFORMANCE; REAL TIME PERFORMANCE; REAL- TIME;

STATIC ANALYSIS;

EID: 85126212428     PISSN: None     EISSN: None     Source Type: Conference Proceeding    
DOI: 10.14722/ndss.2018.23107     Document Type: Conference Paper

References (53)

1. “CVE-2002-1633,” 2002, https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2002-1633.
2. “CVE-2002-2041,” 2002, https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2002-2041.
3. “CVE-2005-3928,” 2005, https://cve.mitre.org/cgi-bin/cvename.cgi?name=2005-3928.
4. “CVE-2006-0621,” 2006, https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2006-0621.
5. “Ftrace: Function Tracer,” 2008, https://www.kernel.org/doc/Documentation/trace/ftrace.txt.
6. ARM Security Technology - Building a Secure System using TrustZone Technology. ARM Limited, 2009.
7. ARMv7-M Architecture Reference Manual. ARM Limited, 2010.
8. Cortex-M4 Technical Reference Manual. ARM Limited, 2010.
9. “Cppcheck - A tool for static C/C++ code analysis,” 2010, http://cppcheck.sourceforge.net/.
10. Cortex-R4 and Cortex-R4F Technical Reference Manual. ARM Limited, 2011.
11. “Express Logic Introduces Memory-Protected Application Modules for ThreadX RTOS,” 2011, http://www.eetimes.com/document.asp?doc_id= 1316596.
12. “Hijacking drones with a MAVLink exploit,” 2015, http://diydrones.com/profiles/blogs/hijacking-quadcopters-with-a-mavlink-exploit.
13. ARMv8-M Architecture Reference Manual. ARM Limited, 2016.
14. “FreeRTOS-MPU,” 2016, http://www.freertos.org/FreeRTOS-MPUmemory-protection-unit.html.
15. “Open Source for Drones - PX4 Pro Open Source Autopilot,” 2016, http://px4.io/.
16. “3DR IRIS+,” 2017, http://3dr.com/support/articles/207358106/iris/.
17. “3DR Pixhawk,” 2017, http://3dr.com/support/articles/207358096/3dr_pixhawk/.
18. “ArduPilot,” 2017, http://ardupilot.org/.
19. “ArduPilot: ArduPlane, ArduCopter, ArduRover source,” 2017, https://github.com/ArduPilot/ardupilot.
20. “Mbed OS,” 2017, https://www.mbed.com/en/development/mbed-os/.
21. “Mbed uVisor,” 2017, https://www.mbed.com/en/technologies/security/uvisor/.
22. “NuttX Real-Time Operating System,” 2017, http://nuttx.org/.
23. “UAVCAN,” 2017, http://uavcan.org/.
24. T. Abera, N. Asokan, L. Davi, J.-E. Ekberg, T. Nyman, A. Paverd, A.-R. Sadeghi, and G. Tsudik, “C-FLAT: Control-Flow Attestation for Embedded Systems Software,” in Proceedings of the 2016 ACM SIGSAC Conference on Computer and Communications Security (CCS), Vienna, Austria, Oct. 2016.
25. A. M. Azab, P. Ning, J. Shah, Q. Chen, R. Bhutkar, G. Ganesh, J. Ma, and W. Shen, “Hypervision Across Worlds: Real-time Kernel Protection from the ARM TrustZone Secure World,” in Proceedings of the 2014 ACM SIGSAC Conference on Computer and Communications Security (CCS), Scottsdale, AZ, Nov. 2014.
26. F. Bellard, “QEMU, a Fast and Portable Dynamic Translator,” in Proceedings of the Annual Conference on USENIX Annual Technical Conference (ATC), Anaheim, CA, 2005.
27. E. Bertino, “Data Security and Privacy: Concepts, Approaches, and Research Directions,” in Proceedings of the 40th IEEE Computer Society International Conference on Computers, Software & Applications (COMPSAC), Atlanta, GA, Jun. 2016.
28. F. Brasser, B. El Mahjoub, A.-R. Sadeghi, C. Wachsmann, and P. Koeberl, “TyTAN: Tiny Trust Anchor for Tiny Devices,” in Proceedings of the 52nd Annual Design Automation Conference (DAC), San Francisco, CA, Jun. 2015.
29. S. Chen, J. Xu, E. C. Sezer, P. Gauriar, and R. K. Iyer, “Non-Control-Data Attacks Are Realistic Threats,” in Proceedings of the 14th USENIX Security Symposium (Security), Baltimore, MD, Aug. 2005.
30. Y. Chen, S. Reymondjohnson, Z. Sun, and L. Lu, “Shreds: Fine-Grained Execution Units with Private Memory,” in Proceedings of the 2016 IEEE Symposium on Security and Privacy (S&P), San Jose, CA, May 2016.
31. A. A. Clements, N. S. Almakhdhub, K. S. Saab, P. Srivastava, J. Koo, S. Bagchi, and M. Payer, “Protecting Bare-Metal Embedded Systems with Privilege Overlays,” in Proceedings of the 38th IEEE Symposium on Security and Privacy (S&P), San Jose, CA, May 2017.
32. D. Davidson, H. Wu, R. Jellinek, V. Singh, and T. Ristenpart, “Controlling UAVs with Sensor Input Spoofing Attacks,” in Proceedings of the 10th USENIX Workshop on Offensive Technologies (WOOT), Austin, TX, Aug. 2016.
33. E. Deligne, “ARDrone corruption,” Journal in Computer Virology, vol. 8, no. 1, pp. 15–27, 2012.
34. K. Eldefrawy, G. Tsudik, A. Francillon, and D. Perito, “SMART: Secure and Minimal Architecture for (Establishing Dynamic) Root of Trust,” in Proceedings of the 19th Annual Network and Distributed System Security Symposium (NDSS), San Diego, CA, Feb. 2012.
35. A. Francillon, Q. Nguyen, K. B. Rasmussen, and G. Tsudik, “A Minimalist Approach to Remote Attestation,” in Proceedings of the Conference on Design, Automation & Test in Europe (DATE), Dresden, Germany, Mar. 2014.
36. Z. Gu, B. Saltaformaggio, X. Zhang, and D. Xu, “FACE-CHANGE: Application-Driven Dynamic Kernel View Switching in a Virtual Machine,” in Proceedings of the 2014 44th Annual IEEE/IFIP International Conference on Dependable Systems and Networks (DSN), Atlanta, GA, Jun. 2014.
37. Z. Gu, W. N. Sumner, Z. Deng, X. Zhang, and D. Xu, “DRIP: A Framework for Purifying Trojaned Kernel Drivers,” in Proceedings of the 43rd Annual IEEE/IFIP International Conference on Dependable Systems and Networks (DSN), Budapest, Hungary, Jun. 2013.
38. K. Gudka, R. N. Watson, J. Anderson, D. Chisnall, B. Davis, B. Laurie, I. Marinos, P. G. Neumann, and A. Richardson, “Clean Application Compartmentalization with SOAAP,” in Proceedings of the 22Nd ACM SIGSAC Conference on Computer and Communications Security (CCS), Denver, CO, Oct. 2015.
39. K. Highnam, K. Angstadt, K. Leach, W. Weimer, A. Paulos, and P. Hurley, “An Uncrewed Aerial Vehicle Attack Scenario and Trustworthy Repair Architecture,” in The 46th Annual IEEE/IFIP International Conference on Dependable Systems and Networks Workshop (DSN-W), Los Alamitos, CA, Jun. 2016.
40. M. Hooper, Y. Tian, R. Zhou, B. Cao, A. P. Lauf, L. Watkins, W. H. Robinson, and W. Alexis, “Securing Commercial WiFi-Based UAVs From Common Security Attacks,” in Proceedings of 2016 IEEE Military Communications Conference (MILCOM), Baltimore, MD, Nov. 2016.
41. T. C.-H. Hsu, K. Hoffman, P. Eugster, and M. Payer, “Enforcing Least Privilege Memory Views for Multithreaded Applications,” in Proceedings of the 23rd ACM Conference on Computer and Communications Security (CCS), Vienna, Austria, Oct. 2016.
42. P. Koeberl, S. Schulz, A.-R. Sadeghi, and V. Varadharajan, “TrustLite: A Security Architecture for Tiny Embedded Devices,” in Proceedings of the 9th European Conference on Computer Systems (EuroSys), Amsterdam, The Netherlands, Apr. 2014.
43. A. Kurmus, S. Dechand, and R. Kapitza, “Quantifiable Run-Time Kernel Attack Surface Reduction,” in Proceedings of the 11th International Conference on Detection of Intrusions and Malware, and Vulnerability Assessment (DIMVA), Egham, UK, Jul. 2014.
44. A. Kurmus, R. Tartler, D. Dorneanu, B. Heinloth, V. Rothberg, A. Ruprecht, W. Schröder-Preikschat, D. Lohmann, and R. Kapitza, “Attack Surface Metrics and Automated Compile-Time OS Kernel Tailoring,” in Proceedings of the 20th Annual Network and Distributed System Security Symposium (NDSS), San Diego, CA, Feb. 2013.
45. C. Lattner and V. Adve, “LLVM: A Compilation Framework for Lifelong Program Analysis & Transformation,” in Proceedings of the International Symposium on Code Generation and Optimization (CGO), Palo Alto, CA, Mar. 2004.
46. C.-K. Luk, R. Cohn, R. Muth, H. Patil, A. Klauser, G. Lowney, S. Wallace, V. J. Reddi, and K. Hazelwood, “Pin: Building Customized Program Analysis Tools with Dynamic Instrumentation,” in Proceedings of the 2005 ACM SIGPLAN Conference on Programming Language Design and Implementation (PLDI), Chicago, IL, Jun. 2005.
47. N. Nethercote and J. Seward, “Valgrind: A Framework for Heavyweight Dynamic Binary Instrumentation,” in Proceedings of the 28th ACM SIGPLAN Conference on Programming Language Design and Implementation (PLDI), San Diego, CA, Jun. 2007.
48. J. Noorman, P. Agten, W. Daniels, R. Strackx, A. Van Herrewege, C. Huygens, B. Preneel, I. Verbauwhede, and F. Piessens, “Sancus: Low-cost Trustworthy Extensible Networked Devices with a Zero-software Trusted Computing Base,” in Proceedings of the 22nd USENIX Security Symposium (Security), Washington, DC, Aug. 2013.
49. S. Pastrana, J. Tapiador, G. Suarez-Tangil, and P. Peris-Lopez, “AVRAND: A Software-Based Defense Against Code Reuse Attacks for AVR Embedded Devices,” in Proceedings of the 13th International Conference on Detection of Intrusions and Malware, and Vulnerability Assessment (DIMVA), San Sebastián, Spain, Jul. 2016.
50. A. Ruprecht, B. Heinloth, and D. Lohmann, “Automatic Feature Selection in Large-scale System-software Product Lines,” in Proceedings of the 2014 International Conference on Generative Programming: Concepts and Experiences (GPCE), Västerås, Sweden, Sep. 2014.
51. Y. Son, H. Shin, D. Kim, Y. Park, J. Noh, K. Choi, J. Choi, and Y. Kim, “Rocking Drones with Intentional Sound Noise on Gyroscopic Sensors,” in Proceedings of the 24th USENIX Security Symposium (Security), Washington, DC, Aug. 2015.
52. R. Strackx, F. Piessens, and B. Preneel, “Efficient Isolation of Trusted Subsystems in Embedded Systems,” in Proceedings of the 6th International ICST Conference on Security and Privacy in Communication Networks (SecureComm), Singapore, Sep. 2010.
53. Y. Sui and J. Xue, “SVF: Interprocedural Static Value-flow Analysis in LLVM,” in Proceedings of the 25th International Conference on Compiler Construction (CC), Barcelona, Spain, Mar. 2016.