Secure Microkernel for Deeply Embedded Devices

Secure Microkernel for Deeply Embedded Devices

Secure Microkernel for Deeply Embedded Devices Jim Huang ( 黃敬群 )*, Louie Lu ( 呂紹榕 ) *National Cheng Kung University, Taiwan Feb 4, 2017 / FOSDEM Secure Mi croker nel for Deeply E m bedded Device s • The promise of the IoT won’t be ful;lled until integrated software platforms are available that allow software developers to develop these devices e<ciently and in the most cost-e=ective manner possible. • F9 microkernel, new open source and secure implementation built from scratch, which deploys modern kernel techniques dedicated to deeply embedded devices. • Characteristics of F9 microkernel / BitSec – Efficiency: performance + power consumption – Security: memory protection + isolated execution – Flexible development environment “Security is not a product, but a process” – Bruce Schneier (American cryptographer, computer security and privacy specialist) 3 Case Study: Attack iOS through USB charger! • BlackHat 2013 – MACTANS: INJECTING MALWARE INTO IOS DEVICES VIA MALICIOUS CHARGERS • "w e dem onstrate how an iO S device can be com prom ised within one minute of being plugged into a malicious charger. We first examine Apple’s existing security m echanisms to protect against arbitrary software in s ta lla tio n , th e n d e s c rib e h o w U S B c a p a b ilitie s c a n b e leveraged to bypass these defense m echanism s." 4 Source:http://www.blackhat.com/us-13/brie7ngs.html#Lau Case Study: BadUSB • BlackHat 2014 BadUSB — On accessoriesth a ttu rn e v il https://srlabs.de/badusb/ Keyboard emula[on is enough for infec[on and privilege escala[on (without need for software vulnerability) Restart screensaver with password stealer added via an LD_PRELOAD 5 library • USB Redirection via RDP Easy Print / Drive Redirection / Smart Card Redirection Plug-and-Play Device Redirection / Input Redirection / Audio Redirection / Port Redirection Source:USB attacks need physical6 access right? Andy Davis Users Really Do Plug in USB Drives They Find • “end users will pick up and plug in US B flash drives they find by com pleting a controlled experiment in which we drop 297 flash drives on a large university cam pus.” • “We find that the attack is effective with an estimated success rate of 45–98% a n d e x p e d itio u s w ith th e fi rs t d riv e connected in less than six minutes.” • Researchers at University of Illinois, Urbana Champaign, University of Michigan, Google, Inc. Related talk at OpenIoT 2016 Handling Top Security Threats for Connected Embedded Devices - Eystein Stenberg, Mender Source: 7 https://zakird.com/papers/usb.pdf TrustZone for ARMv8-M • Enablesbuslevelprotectioninhardware – ARM v7-M requires software API filters for DM A access and other security critical operations – ARM v8-M can filter for DM A access for requests initiated by unprivileged code on bus level • MPU banking reduces complexity of secure ta rg e t O S – Secure OS partition own a private MPU with full control – OS keeps the privileged mode for fast IRQs – Fast interrupt routing and register clearing in hardware – Fast cross-box calls on TrustZone for ARM v8M – optimized call gatew ays 10 source: https://twitter.com/manisha72617183/status/ 816329693494317056 Wait! Why do we need yet another kernel? TCB (Trusted Computing Base) traditional Linux/ Microkernel System embedded Windows based TCB all code 100,000 LoC 10,000 LoC source: Diagram from Kashin Lin (NEWS Lab) Bugs inside “Bigger than Bigger” • Drivers cause 85% of Windows XP crashes. Kernels – Michael M. Swift, Brian N. Bershad, Henry M. Levy: “Improving the Reliability of Commodity Operating Systems”, SOSP 2003 • Error rate in Linux drivers is 3x (maximum: 10x) – Andy Chou, Junfeng Yang, Benjamin Chelf, Seth Hallem, Dawson R. Engler: “An Empirical Study of Operating System Errors”, SOSP 2001 • Causes for driver bugs – 23% programming error – 38% mismatch regarding device speci;cation – 39% OS-driver-interface misconceptions – Leonid Ryzhyk, Peter Chubb, Ihor Kuz and Gernot Heiser: “Dingo: Taming device drivers”, EuroSys 2009 Linux Device Driver bugs [Dingo: Taming deviCe drivers, 2009] Microkernel • Minimalist approach – IPC, virtual memory, thread scheduling • Put the rest into user space – Device drivers, networking, ;le system, user interface • Disadvantages – Lots of system calls and context switches • Examples: Mach, L4, QNX, MINIX, IBM K42 prinCiple of least privilege (POLA) A capability is a communicable, unforgeable token of authority. It refers to a value that references an object along with an associated set of access rights. A user program on a capability-based operating system must use a capability to access an object. Microkernel Concepts • Minimal kernel and hardware enforce separation • Only kernel runs in CPU privileged mode • Components are user level processes • No restrictions on component software • Reuse of legacy software • “A concept is tolerated inside the microkernel only if moving it outside the kernel, i.e., permitting competing implementations would prevent the implementation of the systems' required functionality. “ – Jochen Liedtke “Worse Is Better", Richard P. Gabriel New Jersey style MIT style [UNIX, Bell Labs] [Multics] Simplicity No.1 consideration Implementation > Interface > Interface Implementation Correctness mostly 100% Consistency mostly 100% Completeness de facto mostly • Design competition between New Jersey and MIT style • Interface ;rst [Multics] → Implementation ;rst [Unix] → Interface ;rst [Mach] → Implementation ;rst [Linux] → Interface ;rst [seL4] Microkernel • Put the rest into user space – Device drivers, networking, ;le system, user interface Process File Networking Windowing Multi-media Manager System Message Bus microkernel Application Microkernel Applications anD Drivers + . Are processes which plug into a message bus Process Manager Reside in their own memory-protected address space are the only trusteD • Have a well de;ned message interface components • Cannot corrupt other software components • Can be started, stopped and upgraded on the Wy Microkernel: De9nitions • A kernel technique that provides only the minimum OS services. – Address Spacing – Inter-process Communication (IPC) – Thread Management – Unique Identi;ers • All other services are done at user space independently. 3 Generations of Microkernel • Mach (1985-1994) – replace pipes with IPC (more general) – improved stability (vs monolithic kernels) – poor performance • L3 & L4 (1990-2001) – order of magnitude improvement in IPC performance • written in assembly, sacri;ced CPU portability • only synchronus IPC (build async on top of sync) – very small kernel: more functions moved to userspace • seL4, Fiasco.OC, Coyotos, NOVA (2000-) – platform independence – veri;cation, security, multiple CPUs, etc. 3 Generations of Microkernel • Generation 1: Mach (1985-1994) • Generation 2: L3 & L4 (1990-2001) • Generation 3: seL4, Fiasco.OC, NOVA (2000-) Performance of 1st Generation CMU Mach (1985), Chorus (1987), MkLinux (1996) • Does not prohibit caching • Reduce number of copies of data occupying memory – Copy-to-use, copy-to-kernel – More memory for caching • I/O operations reduced by a factor of 10 • Context switch overhead – Cost of kernel overhead can be up to 800 cycles. • Address Space Switches – Expensive Page Table and Segment Switch Overhead – Untagged TLB = Bad performance L4: the 2nd Generation • Similar to Mach – Started from scratch, rather than monolithic – But even more minimal • minimality principle for L4: A concept is tolerated inside the microkernel only if moving it outside the kernel, i.e., permitting competing implementations, would prevent the implementation of the system's required functionality. • Tasks, threads, IPC – Uses only 12k of memory – API size of Mach: 140 functions (Asynchronus IPC, Threads, Scheduling, Memory management, Resource access permissions) – API size of L4: 7 function (Synchronous IPC, Threads, Scheduling, Memory management) Performance Gain (1st to 2nd Generation) • Reason of being slow kernels: Poor design [Liedtke SOSP'95] – complex API – Too many features – Poor design and implementation – Large cache footprint ⇒ memory-bandwidth limited • L4 is fast due to small cache footprint – 10–14 I-cache lines – 8 D-cache lines – Small cache footprint ⇒ CPU limited L4 Family (incomplete) Source: Microkernel-based Operating Systems – Introduction, Carsten Weinhold, TU Dresden (2012) CommerCial L4: from NICTA to OKLabs • L4::Pistachio microkernel was originally developed at Karlsruhe University. NICTA had ported it to a number of architectures, including ARM, had optimized it for use in resource-constrained embedded systems. • In 2004, Qualcomm engaged NICTA in a consulting arrangement to deploy L4 on Qualcomm's wireless communication chips. • The engagement with Qualcomm grew to a volume where it was too signi;cant a development/engineering e=ort to be done inside the research organization. – Commercized! Open Kernel Labs • Acquired by General Dynamics in 2012 Source: http://microkerneldude.wordpress.com/2012/10/02/ giving-it-away-part-2-on-microkernels-and-the-national-interes/ OKL4 Use Cases Each secure cell in the system o=ers isolation from software in other cells Existing software components can be reused in new designs Microvisor tames the complexity of dispatching multi-OS workloads across multiple physical CPUs Moving from 2nd to 3rd Generation seL4 • All memory management at user level OKL4 – no kernel heap! • Dumped recursive address-space model – reduced kernel complexity • Formal proof of functional correctness – First L4 kernel with capability-based •

View Full Text

Details

  • File Type
    pdf
  • Upload Time
    -
  • Content Languages
    English
  • Upload User
    Anonymous/Not logged-in
  • File Pages
    70 Page
  • File Size
    -

Download

Channel Download Status
Express Download Enable

Copyright

We respect the copyrights and intellectual property rights of all users. All uploaded documents are either original works of the uploader or authorized works of the rightful owners.

  • Not to be reproduced or distributed without explicit permission.
  • Not used for commercial purposes outside of approved use cases.
  • Not used to infringe on the rights of the original creators.
  • If you believe any content infringes your copyright, please contact us immediately.

Support

For help with questions, suggestions, or problems, please contact us