Quest-V: A Secure and Predictable System for IoT and Beyond - - PowerPoint PPT Presentation
Quest-V: A Secure and Predictable System for IoT and Beyond Richard West richwest@cs.bu.edu Computer Science Goals Develop system for high-confidence (embedded) systems Mixed criticalities (timeliness and safety) Predictable
Computer Science
2
3
4
l Number of Internet-connected devices
l World population > 7 billion (2015) l Cisco predicts 50 billion Internet devices by
5
6
7
8
9
10
11
Sandbox M Monitor Sandbox 1
VCPU
. . .
Monitor Sandbox 2
VCPU VCPU
Monitor Communication + Migration
VCPU VCPU
Sandbox Address Space Thread IO Devices PCPU(s) IO Devices PCPU(s) IO Devices PCPU(s)
12
13
14
15
16
l VCPUs for budgeted real-time execution of
l Threads mapped to VCPUs l VCPUs mapped to physical cores l Sandbox kernels perform local scheduling on
l Avoid VM-Exits to Monitor – eliminate cache/
17
Main VCPUs I/O VCPUs Threads PCPUs (Cores) Address Space
18
19
Ci Ti
i=0 n−1
+ 2 −Uj
( )⋅Uj
j=0 m−1
≤ n⋅ 2 n −1
20
21
22
No VMX or EPT flags 1 CPU + 512 MB
23
100 Million Page Faults 1 Million fork-exec-exit Calls
24
25
26
27
28
loop (1, 40, 100) { /* VCPU: C = 40, T = 100 */ digitalWrite (LED1, HIGH); ... /* Blink LED1 */ } loop (2, 20, 100) { /* VCPU: C = 20, T = 100 */ analogWrite (LED2, brightness); ... /* Change brightness of LED2 */ } setup () { pinMode (LED1, OUTPUT); pinMode (LED2, OUTPUT); }
29
Sketch Kernel User ... Quest Native App Quest Native App Galileo QDuino Libs
loop1 loopN
... x86 SoC Edison Minnowboard VCPU Scheduler GPIO Driver SPI Driver I2C Driver
30
Function Signatures Category
l loop(loop_id, C, T)
Structure
l interruptsVcpu(C,T) l attachInterruptVcpu(pin,ISR,mode,C,T)
Interrupt
l spinlockInit(lock) l spinlockLock(lock) l spinlockUnlock(lock)
Spinlock
l channelWrite(channel,item) l item channelRead(channel)
Four-slot
l ringbufInit(buffer,size) l ringbufWrite(buffer,item) l ringbufRead(buffer,item)
Ring buffer
31
Main VCPU
Scheduler
Main VCPU
Sketch
IO VCPU
Handler GPIO Driver Pin State Monitoring CPU Core(s) GPIO Expander Kernel User
Real Time Event
attachInterrupt pthread_create
32
10 20 30 40 50 60 100T 200T 300T 400T 500T
Counter (x104) Time (Periods)
(50,100),2 (50,100),4 (70,100),2 (70,100),4 (90,100),2 (90,100),4 Linux,2 Linux,4
l Foreground loop increments
counter during loop period
l 2-4 background loops act
as potential interference, consuming remaining CPU capacity
l No temporal isolation or
timing guarantees w/ Linux
33
l Mixed-criticality automotive system l Secure home automation l 3D printer controller l IoT interoperability sandboxing l Secure virtual networks of untrusted
l Many others...
34
Real-time Command & Control Real-time Sensor Data Processing Memory Monitor ... ... Core(s) Core(s) Core(s) Display & External Comms Comms Monitor Monitor Memory Memory I/O Devices e.g. Motors, Servos I/O Devices e.g. Cameras, LIDAR I/O Devices e.g. GPU, NIC Hardware Kernel VCPU(s) VCPU(s) User More Critical Less Critical Sandbox 1 Sandbox 2 Sandbox M ...
V2V, V2I Infotainment
INTERNET Sandboxes on multicore platform replace CAN bus nodes
35
Real-time Sensor Data Processing Linux ... ... Core(s) Core(s) Web Server / App “Plugins” Comms Monitor Monitor Memory Memory I/O Devices e.g. Cameras, CO+Fire Alarm I/O Devices e.g. NIC Hardware Kernel VCPU(s) User More Secure Less Secure Sandbox 1 Sandbox M
INTERNET 3rd Party untrusted services
36
l Home equipped w/ cameras, alarms, window/
l “Home owner” sandbox(es) for localized control
l e.g., smartphone çè appliance control l 3rd party sandbox(es) for plugin app services l e.g., Emergency (police/fire/ambulance)
37
l Challenges: l Prevent homeowner generating false
l Apply penalties from service provider
l Prevent 3rd parties accessing sensitive
l Enforce secure inter-sandbox comms l Require services across sandboxes to be
38
l External system interface via public Internet only
l Internal system interface via home network accesses
l Replicated monitors observe suspicious activity l e.g., high frequency access to “root” mode
l Monitors akin to security guards l An attacker would have to compromise all such
39
Real-time Sensing & Control Real-time Job Scheduling Linux Memory Monitor Core(s) Core(s) Core(s) Web Server / Verification Comms Monitor Monitor Memory Memory I/O Devices e.g. Motors, Extruder, Temp Sensors I/O Devices e.g. Flash Storage I/O Devices e.g. NIC Hardware Kernel VCPU(s) VCPU(s) User Untrusted Trusted Sandbox 1 Sandbox 2 Sandbox 3
DUAL CORE ATOM SILVERMONT QUARK MCU INTERNET
40
l Extend 3D print service to distributed “customizable”
l A “Kinkos” 3D printing/manufacturing service l Submit requests via web interface l Need to verify correctness l Verified requests spooled for processing l Use real-time comms + Qduino for real-time machine
l Possible to form “job shop” style assembly lines
41
l Collaborative open-source frameworks l IoTivity (Open Interconnect Consortium:
l Alljoyn (Allseen Alliance), 160+ partners l Communication across different transport
l Microsoft Device System Bridges (DSBs)
l Google's Brillo Weave, Apple Home Kit
42
l Use Quest-V sandboxes to isolate IoTivity /
l Promote secure isolation of networks of
l Use replicated / distributed monitor network to
43
l Continue port of Quest(-V) to Edison and
l Develop 3D printer controller l Investigate techniques to quarantine and verify 3rd
l Develop autonomous vehicle system l Look at real-time control in presence of injected
l Home automation prototype l Provide secure services for 3rd party plugins
44
l Quest-V uses one monitor per sandbox l Heightens security & safety l Monitors are small
l Not needed for resource multiplexing
l Can potentially exploit this to build new
l Monitors like multiple system guards
l Chip-level distributed system l Real-time inter-sandbox communication l Isolation of 3rd party services
45