Nested compartmentalisation for constrained devices

Abstract

This paper presents a framework and implementation guidelines to set up nested compartmentalisation in constrained devices. All memory spaces are protected by the Memory Protection Unit (MPU). Current MPU-based systems offer efficient memory protection but are mostly tied to the fixed permission model provided by their operating system, kernel, hypervisor or by code instrumentation. New use cases evolve with the rise of the Internet of Things (IoT) ecosystems where software components could benefit from locally and dynamically established permissions. This includes a temporary nested subspace with restricted memory access rights. Our framework integrates subspace creation and management for runtime dynamic changes of the permission model for any level of abstraction. Global security policies of fixed permission models are reflected in the software architecture and the implementation of the framework. We also demonstrate the feasibility of providing nested compartmentalisation by showing how to leverage the MPU features.

From MMU to MPU: Adaptation of the Pip Kernel to Constrained Devices

“…The framework proposed in [10] provides design guidelines for setting up nested compartmentalisation as well as an API to call the services provided by the compartmentalisation entity. In the framework, userland components can create subdomains out of their own memory space.…”

“…In Section 4, we present Pip-MPU's requirements that include Pip's requirements plus some requirements specific to constrained devices. In Section 5, we verify which requirements are already satisfied by the use of the nested compartmentalisation framework [10]. We then derive and specialise this framework in the light of Pip's system calls and metadata structures to fulfil the security requirements.…”

“…The motivation of this work is to make constrained devices more secure and more flexible, given the ubiquity of these devices and the emerging complex IoT applications. We propose to achieve flexible memory isolation for constrained devices with an MPU by adapting Pip's MMU-based memory isolation to be MPU-based and by leveraging Dejon et al's framework [10]. Indeed, this framework proposes to use the memory access permissions on memory blocks provided by the MPU in order to create multiple levels of isolation.…”

“… We capture and define Pip's requirements that are landmarks to our adaptation.  We specialise the framework presented in [10] to match the aforementioned requirements. We also conduct a preliminary study of compatibility between Pip and the framework.…”

Untitled

“…The goal of this work is to engage in the formal verification of Pip-MPU's isolation property, since Pip-MPU's high-level design and conceptual foundations have been introduced in earlier works [2,3]. Indeed, the motivation follows recent increases in cyber-threats on constrained devices (also referred to as low-end devices, of type microcontroller) and especially connected devices.…”