Practical Principle of Least Privilege for Secure Embedded Systems

Jero, Samuel; Furgala, Juliana; Pan, Runyu; Gadepalli, Phani Kishore; Clifford, Alexandra; Ye, Bite; Khazan, Roger; Ward, Bryan C.; Parmer, Gabriel; Skowyra, Richard

doi:10.1109/rtas52030.2021.00009

Cited by 8 publications

(1 citation statement)

References 37 publications

Supporting

Mentioning

Contrasting

Order By: Relevance

“…Jero et al [51] presented Patina, a prototypical real-time operating system API that supports ubiquitous functions in feature-rich OSes, but not in more reliable kernel-based systems. Two Patina implementations are shown, one on Composite and the other on seL4, which aim at boosting system security using the Principle of Least Privilege (PoLP).…”

Section: Related Workmentioning

confidence: 99%

Maximizing the Security Level of Real-Time Software While Preserving Temporal Constraints

et al. 2023

View full text Add to dashboard Cite

Embedded computing systems are becoming increasingly relevant in the Internet of Things (IoT) and edge computing domains, where they are often employed as the control entity of a cyber-physical system. When operating in such interconnected domains, a software system is susceptible to cyber-attacks from external agents, which can compromise the correct behavior of the system. In addition, the software executing in these systems is typically characterized by stringent timing constraints, which must be satisfied during system execution. Enabling software protections to enhance the security level of the embedded software comes at the cost of increasing the computation times of the tasks, introducing the risk of deadline misses that could also jeopardize the system behavior. This paper presents a methodology to optimize the security level of real-time software while preserving system-wide schedulability by leveraging timing analysis. The proposed approach is based on a mixed-integer linear programming (MILP) formulation that maximizes the security level of the tasks and integrates a response-time analysis technique to assess the schedulability of the system whenever additional protections are activated to shield the software against cyber-attacks targeting specific classes of vulnerabilities. An experimental evaluation is presented to assess the performance of the proposed approach on a representative set of tasks included in standard benchmarking suites for embedded software.

show abstract

Section: Related Workmentioning

confidence: 99%