Predictable Virtualization on Memory Protection Unit-Based Microcontrollers

Pan, Runyu; Peach, Gregor; Ren, Yuxin; Parmer, Gabriel

doi:10.1109/rtas.2018.00012

Cited by 15 publications

(7 citation statements)

References 21 publications

Supporting

Mentioning

Contrasting

Order By: Relevance

“…Classic approaches to provide isolation and implement reliable systems on low-end embedded devices have been evolving from constructive (language/compiler-based) memory protection [58]- [62] and hardware-enforced RTOS mechanisms [21], [63], [64], to lightweight virtualization infrastructures [4], [5], [65], [66]. Tock [59] leverages limited hardware protection mechanisms as well as the type-safety features of the Rust programming language to provide a reliable multiprogramming environment for MCUs.…”

Section: Reliable Systems For Mcu-powered Iot Devicesmentioning

confidence: 99%

“…Complex functional requirements are met by integrating multiple codebases, drivers, and libraries from different 3rd party entities with distinct assurance levels. Such problems are exacerbated in devices composed by microcontrollers (MCUs) that typically lack reliable mechanisms to enforce the separation among these multi-source and mixed-criticality components [4], [5]. Therefore, with the IoT ecosystem evolving at a breathtaking pace, the need for reliable security architectures is rising; however, due to the heterogeneity and limitation of computational resources on MCUs, creating and adopting these architectures still challenges most IoT system developers [6]- [9].…”

Section: Introductionmentioning

confidence: 99%

See 1 more Smart Citation

uTango: An Open-Source TEE for IoT Devices

2022

View full text Add to dashboard Cite

Security is one of the main challenges of the Internet of Things (IoT). IoT devices are mainly powered by low-cost microcontrollers (MCUs) that typically lack basic hardware security mechanisms to separate security-critical applications from less critical components. Recently, Arm has started to release Cortex-M MCUs enhanced with TrustZone technology (i.e., TrustZone-M), a system-wide security solution aiming at providing robust protection for IoT devices. Trusted Execution Environments (TEEs) relying on TrustZone hardware have been perceived as safe havens for securing mobile devices. However, for the past few years, considerable effort has gone into unveiling hundreds of vulnerabilities and proposing a collection of relevant defense techniques to address several issues. While new TEE solutions built on TrustZone-M start flourishing, the lessons gathered from the research community appear to be falling short, as these new systems are trapping into the same pitfalls of the past. In this paper, we present uTango, the first multi-world TEE for modern IoT devices. uTango proposes a novel architecture aiming at tackling the major architectural deficiencies currently affecting TrustZone(-M)-assisted TEEs. In particular, we leverage the very same TrustZone hardware primitives used by dual-world implementations to create multiple and equally secure execution environments within the normal world. We demonstrate the benefits of uTango by conducting an extensive evaluation on a real TrustZone-M hardware platform, i.e., Arm Musca-B1. uTango will be open-sourced and freely available on GitHub in hopes of engaging academia and industry on securing the foreseeable trillion IoT devices.

show abstract

Section: Reliable Systems For Mcu-powered Iot Devicesmentioning

confidence: 99%

Section: Introductionmentioning

confidence: 99%

uTango: An Open-Source TEE for IoT Devices

2022

View full text Add to dashboard Cite

show abstract

“…Reliable systems for the IoT. Classic approaches to provide isolation and implement reliable systems on resourceconstrained devices have been evolving from constructive (language/compiler-based) memory protection [52]- [56] and hardware-enforced RTOS mechanisms [21], [57], [58], to lightweight virtualization infrastructures [5], [6], [59], [60]. Tock [53] leverages limited hardware protection mechanisms as well as the type-safety features of the Rust programming language to provide a reliable multiprogramming environment for MCUs.…”

Section: Related Workmentioning

confidence: 99%

“…F. Paci et al [60] proposed a lightweight I/O virtualization approach using the MPU support on FreeRTOS to create a task which mediates all I/O accesses. F. Bruns et al [59] and R. Pan et al [5] have proposed virtualization infrastructures leveraging the MPU. Pinto et al [6] have also proposed a TrustZone-based virtualization solution for Cortex-M MCUs.…”

Section: Related Workmentioning

confidence: 99%

uTango: an open-source TEE for IoT devices

Oliveira¹,

Gomes²,

Pinto³

2021

Preprint

View full text Add to dashboard Cite

Security is one of the main challenges of the Internet of Things (IoT). IoT devices are mainly powered by low-cost microcontrollers (MCUs) that typically lack basic hardware security mechanisms to separate security-critical applications from less critical components. Recently, Arm has started to release Cortex-M MCUs enhanced with TrustZone technology (i.e., TrustZone-M), a system-wide security solution aiming at providing robust protection for IoT devices. Trusted Execution Environments (TEEs) relying on TrustZone hardware have been perceived as safe havens for securing mobile devices. However, for the past few years, considerable effort has gone into unveiling hundreds of vulnerabilities and proposing a collection of relevant defense techniques to address several issues. While new TEE solutions built on TrustZone-M start flourishing, the lessons gathered from the research community appear to be falling short, as these new systems are trapping into the déjà vu pitfalls of the past. In this paper, we present UTANGO, the first multi-world TEE for modern IoT devices. UTANGO proposes a novel architecture aiming at tackling the major architectural deficiencies currently affecting TrustZone(-M)-assisted TEEs. In particular, we leverage the very same TrustZone hardware primitives used by dual-world implementations to create multiple, equally-secure execution environments within the normal world. We demonstrate the benefits of UTANGO by conducting an extensive evaluation on a real TrustZone-M hardware platform, i.e., Arm Musca-B1. UTANGO will be open-sourced and freely available on GitHub in hopes of engaging academia and industry on securing the foreseeable trillion IoT devices.

show abstract

“…A crucial guarantee that the kernel ensures (independent of any component's logic) is that memory that has been typed as kernel (i.e., that backs kernel data-structures) cannot also be typed as user memory (thus accessible to components) -this has the effect of ensuring the consistency of kernel data-structures. Pan et al [17] introduced the use of the space-efficient Path-Compressed Radix Trie (PCTrie) datastructure to program MPU regions. MxU uses PCTries as the uniform data-structure to describe both MMU and MPU systems (page tables are a specific configuration of PCTries).…”

Section: Mxu-enabled Composite Kernelmentioning

confidence: 99%

MxU

Pan

Parmer

2019

ACM Trans. Embed. Comput. Syst.

Self Cite

View full text Add to dashboard Cite

The advanced functionality requirements of modern embedded and Internet of Things (IoT) devices -- from autonomous vehicles, to city and power-grid management -- are driving an ever-increasing software complexity. At the same time, the pervasive internet connections of these systems necessitate the fundamental design of security into these devices. The isolation of complex features from those that are critical through protection domains is an effective means to constrain the scope of faults and security breaches. Common hardware-provided memory facilities to enforce protection domains through memory access control -- including Memory Management Units (MMUs) usually found in microprocessors, and Memory Protection Units (MPUs) usually found in microcontrollers -- must meet the goals of enabling flexible, efficient and dynamic management of memory , and must enable tight bounds on the worst-case execution of critical code. Unfortunately, current system memory management facilities are ill-prepared to handle this challenge: MMUs that use extensive caches to achieve strong average-case performance suffer from debilitating worst-case and even average-case behavior under hefty interference, while MPUs struggle to provide flexible memory management. This paper details MxU, a memory protection and allocation abstraction that integrates temporal specifications into the memory management subsystem, to enable portable code to achieve both predictable, tightly-bounded execution and dynamic management across both MMU- and MPU-based systems. We implement MxU in the Composite microkernel, and evaluate its flexibility and predictability over two different architectures: a MPU-based Cortex-M7 microcontroller and a MMU-based Cortex-A9 microprocessor using a suite of modern applications including neural network-based inference, SQLite, and a javascript runtime. For MMU-based systems, MxU reduces application TLB stall by up to 68.0%. For MPU-based systems, MxU enables flexible dynamic memory management often with application overheads of 1%, increasing to 6.1% under significant interference.

show abstract

Predictable Virtualization on Memory Protection Unit-Based Microcontrollers

Cited by 15 publications

References 21 publications

uTango: An Open-Source TEE for IoT Devices

uTango: An Open-Source TEE for IoT Devices

uTango: an open-source TEE for IoT devices

MxU

Contact Info

Product

Resources

About