Quest-V: A Secure and Predictable System for IoT and Beyond - PowerPoint PPT Presentation

Quest-V: A Secure and Predictable System for IoT and Beyond Richard West richwest@cs.bu.edu Computer Science

Goals • Develop system for high-confidence (embedded) systems – Mixed criticalities (timeliness and safety) • Predictable – real-time support • Secure – resistant to component failures & malicious attacks • Self-healing • Online recovery of software component failures 2

Target Applications • Healthcare • Avionics • Automotive • Factory automation • Robotics • Space exploration • Secure/safety-critical domains • Internet-of-Things (IoT) 3

Internet of Things l Number of Internet-connected devices > 12.5 billion in 2010 l World population > 7 billion (2015) l Cisco predicts 50 billion Internet devices by 2020 Challenges: • Secure management of vast quantities of data • Reliable + predictable data exchange b/w “smart” devices 4

In the Beginning...Quest • Initially a “small” RTOS • ~30KB ROM image for uniprocessor version • Page-based address spaces • Threads • Dual-mode kernel-user separation • Real-time Virtual CPU (VCPU) Scheduling • Later SMP support • LAPIC timing FreeRTOS, Linux, Windows, Quest uC/OS-II etc Mac OS X etc 5

From Quest to Quest-V • Quest-V for multi-/many-core processors – Distributed system on a chip – Time as a first-class resource • Cycle-accurate time accountability – Separate sandbox kernels for system components – Memory isolation using h/w-assisted memory virtualization – Also CPU, I/O, cache partitioning • Focus on safety , efficiency , predictability + security 6

Related Work • Existing virtualized solutions for resource partitioning – Wind River Hypervisor, XtratuM, PikeOS, Mentor Graphics Hypervisor – Xen, Oracle PDOMs, IBM LPARs – Muen, (Siemens) Jailhouse 7

Problem Traditional Virtual Machine approaches too expensive – Require traps to VMM (a.k.a. hypervisor) to mux & manage machine resources for multiple guests – e.g., ~1500 clock cycles VM-Enter/Exit on Xeon E5506 Traditional Virtual Machine approaches too memory intensive for embedded systems in areas such as IoT! 8

Traditional Approach (Type 1 VMM) ... VM VM VM VM VM Type 1 VMM / Hypervisor Hardware (CPUs, memory, devices) 9

Quest-V Approach Eliminates hypervisor intervention during normal virtual machine operations ... VM VM VM VM VM Hardware (CPUs, memory, devices) 10

Quest-V Architecture Overview . . . Sandbox M Sandbox 1 Sandbox 2 Communication + Migration VCPU VCPU VCPU VCPU VCPU Sandbox Monitor Monitor Monitor Address Space PCPU(s) PCPU(s) PCPU(s) Thread IO Devices IO Devices IO Devices 11

Memory Partitioning • Guest kernel page tables for GVA-to-GPA translation • EPTs (a.k.a. shadow page tables) for GPA-to- HPA translation – EPTs modifiable only by monitors – Intel VT-x: 1GB address spaces require 12KB EPTs w/ 2MB superpaging 12

Quest-V Memory Partitioning Quest-V Memory Partitioning 13

I/O Partitioning • Device interrupts directed to each sandbox – Use I/O APIC redirection tables – Eliminates monitor from control path • EPTs prevent unauthorized updates to I/O APIC memory area by guest kernels • Port-addressed devices use in/out instructions • VMCS configured to cause monitor trap for specific port addresses • Monitor maintains device "blacklist" for each sandbox – DeviceID + VendorID of restricted PCI devices 14

CPU Partitioning • Scheduling local to each sandbox – partitioned rather than global – avoids monitor intervention • Uses real-time VCPU approach for Quest native kernels [RTAS'11] 15

Predictability l VCPUs for budgeted real-time execution of threads and system events (e.g., interrupts) l Threads mapped to VCPUs l VCPUs mapped to physical cores l Sandbox kernels perform local scheduling on assigned cores l Avoid VM-Exits to Monitor – eliminate cache/ TLB flushes 16

VCPUs in Quest(-V) Address Threads Space Main VCPUs I/O VCPUs PCPUs (Cores) 17

Example VCPU Schedule Example VCPU Schedule 18

Utilization Bound Test • Sandbox with 1 PCPU, n Main VCPUs, and m I/O VCPUs – Ci = Budget Capacity of Vi – Ti = Replenishment Period of Vi – Main VCPU, Vi – Uj = Utilization factor for I/O VCPU, Vj n − 1 m − 1 Ci ( ) n ∑ ∑ ( ) ⋅ Uj + 2 − Uj ≤ n ⋅ 2 − 1 Ti i= 0 j= 0 19

Cache Partitioning • Shared caches controlled using color-aware memory allocator [COLORIS – PACT'14] • Cache occupancy prediction based on h/w performance counters – E' = E + (1-E/C) * m l – E/C * m o – Enhanced with hits + misses [Book Chapter, OSR'11, PACT'10] 20

Linux Front End • For low criticality legacy services • Based on Puppy Linux 3.8.0 • Runs entirely out of RAM including root filesystem • Low-cost paravirtualization – less than 100 lines – Restrict observable memory – Adjust DMA offsets • Grant access to VGA framebuffer + GPU • Quest native SBs tunnel terminal I/O to Linux via shared memory using special drivers 21

Quest-V Linux Screenshot 1 CPU + 512 MB No VMX or EPT flags 22

Quest-V Performance Quest-V Performance 100 Million Page Faults 1 Million fork-exec-exit Calls 23

Quest-V Summary • Separation kernel built from scratch – Distributed system on a chip – Uses (optional) h/w virtualization to partition resources into sandboxes – Protected comms channels b/w sandboxes • Sandboxes can have different criticalities – Linux front-end for less critical legacy services • Sandboxes responsible for local resource management – avoids monitor involvement 24

Proposed Work • Port of Quest to Intel Galileo [Done] • Qduino API [Ongoing] • Port of Quest(-V) to Intel Edison and Minnowboard Max [Started] • IoT Applications: 3D printing / manufacturing, robotics, secure home automation, etc [To Do] • (Secure) Information Flow Analysis [To Do] • Real-time Communication [Ongoing] 25

Quest on Galileo • Porting Quest to the Galileo board: – Added multiboot support back to 32-bit GRUB EFI (GRUB Legacy) – Developed I2C, SPI controller drivers – Developed Cypress GPIO Expander and AD7298 ADC drivers • Original Arduino API Support • New real-time multithreaded Qduino API 26

Qduino • Qduino – Enhanced Arduino API for Quest – Parallel and predictable loop execution – Real-time communication b/w loops – Predictable and efficient interrupt management – Real-time event delivery – Simplifies multithreaded real-time programming 27

Qduino Multi-loop Example • Multiple loop sketch example: loop (1, 40, 100) { /* VCPU: C = 40, T = 100 */ digitalWrite (LED1, HIGH); ... /* Blink LED1 */ } loop (2, 20, 100) { /* VCPU: C = 20, T = 100 */ analogWrite (LED2, brightness); ... /* Change brightness of LED2 */ } setup () { pinMode (LED1, OUTPUT); pinMode (LED2, OUTPUT); } 28

Qduino Organization Sketch ... loop1 loopN Quest Quest ... Native Native App App QDuino Libs User Kernel GPIO Driver VCPU SPI Driver Scheduler I2C Driver x86 SoC Galileo Edison Minnowboard 29

Qduino New APIs Function Signatures Category l loop(loop_id, C, T) Structure l interruptsVcpu(C,T) Interrupt l attachInterruptVcpu(pin,ISR,mode,C,T) l spinlockInit(lock) Spinlock l spinlockLock(lock) l spinlockUnlock(lock) l channelWrite(channel,item) Four-slot l item channelRead(channel) l ringbufInit(buffer,size) Ring buffer l ringbufWrite(buffer,item) l ringbufRead(buffer,item) 30

Qduino Event Handling Sketch Handler pthread_create Real Time Event attachInterrupt User Kernel Main Main Pin State VCPU VCPU Monitoring IO VCPU GPIO Driver Scheduler CPU Core(s) GPIO Expander 31

Qduino Temporal Isolation 60 (50,100),2 (70,100),2 (90,100),2 Linux,2 (50,100),4 (70,100),4 (90,100),4 Linux,4 l Foreground loop increments counter during loop period 50 l 2-4 background loops act Counter (x10 4 ) 40 as potential interference, consuming remaining 30 CPU capacity 20 l No temporal isolation or timing guarantees w/ Linux 10 0 100T 200T 300T 400T 500T Time (Periods) 32

Possible Use Cases l Mixed-criticality automotive system l Secure home automation l 3D printer controller l IoT interoperability sandboxing l Secure virtual networks of untrusted devices l Many others... 33

Mixed-Criticality Automotive System More Critical Less Critical Real-time User Real-time Display & Comms Sensor Data Command & External Processing Control Comms Kernel V2V, V2I VCPU(s) VCPU(s) ... Infotainment INTERNET Monitor Monitor Monitor Core(s) Core(s) Core(s) Sandboxes on Hardware multicore Memory Memory Memory ... platform replace I/O Devices I/O Devices I/O Devices CAN bus nodes e.g. Motors, e.g. Cameras, e.g. GPU, Servos LIDAR NIC ... Sandbox 1 Sandbox 2 Sandbox M 34

Secure Home Automation More Secure Less Secure 3 rd Party untrusted services Real-time User Comms Web Server / Sensor Data App “Plugins” Processing Kernel VCPU(s) ... INTERNET Linux Monitor Monitor Core(s) Core(s) Hardware Memory Memory ... I/O Devices I/O Devices e.g. Cameras, e.g. NIC CO+Fire Alarm Sandbox M Sandbox 1 35