Commercial hypervisor-based task sandboxing mechanisms are unsecured? But we can fix it!

Cyber–Physical–Social Systems are frequently prescribed for providing valuable information on personalized services. The foundation of these services is big data which must be trustily collected and efficiently processed. Though High Performance Computing and Communication technique makes great contributions to addressing the issue of data processing, its effectiveness still relies on the veracity of data generated from Internet of Things (IoT) devices. Nevertheless, IoT devices, as basic production facilities to ensure data's security, are unable to deploy expensive security extensions. Consequently, it causes the implementation of the task sandboxing, the fundamental security mechanism in Real-Time Operating Systems (RTOSs), much simpler and more vulnerable. In this paper, we take ARM Mbed uVisor as an example system, utilizing hypervisor-based task sandboxing mechanisms, and presents three new findings: First, we discover vulnerabilities against Mbed task sandboxing, which can be exploited to compromise system-maintained data structure to manipulate any tasks’ data. Second, we present LIPS (Lightweight Intra-Mode Privilege Separation), building a special protection domain to isolate particular system-maintained data structures. Finally, thorough evaluation and experimental tests show the efficiency of LIPS to defeat these attacks, with small runtime overheads and good portability.

Files

Metadata

Work Title Commercial hypervisor-based task sandboxing mechanisms are unsecured? But we can fix it!
Access
Open Access
Creators
  1. Dongdong Huo
  2. Chen Cao
  3. Peng Liu
  4. Yazhe Wang
  5. Mingxuan Li
  6. Zhen Xu
License In Copyright (Rights Reserved)
Work Type Article
Publisher
  1. Journal of Systems Architecture
Publication Date June 1, 2021
Publisher Identifier (DOI)
  1. https://doi.org/10.1016/j.sysarc.2021.102114
Deposited November 15, 2021

Versions

Analytics

Collections

This resource is currently not in any collection.

Work History

Version 1
published

  • Created
  • Added Commercial_hypervisor-based_task_sandboxing_mechanisms_are_unsecured_But_we_can_fix_it_.pdf
  • Added Creator Dongdong Huo
  • Added Creator Chen Cao
  • Added Creator Peng Liu
  • Added Creator Yazhe Wang
  • Added Creator Mingxuan Li
  • Added Creator Zhen Xu
  • Published
  • Updated
  • Updated