3 ms·

Thanks! Very interesting, especially the sandia rapid development tool.Could be really useful in creating low-cost mcu's. I've looked through a few of the exam

by minthd 11y ago

Thanks! Very interesting, especially the sandia rapid development tool.Could be really useful in creating low-cost mcu's. I've looked through a few of the examples, and they are useful, but they require a different toolset from what real-time engineers use(JVM/CodeSEAL), and you probably need to certify your code in order to get eal6+ for your system. All those are big barriers for penetration, which probably creates less incentive for mcu companies to develop eal6+ mcu's with rich peripherials which will appeal to the market. Do you see a way out of this ? maybe using rust(or some other language), an eal6+ certified RTOS and an eal6+ mcu , would enable people creating secure real-time systems without need of certification?

nickpsecurity 11y ago
The toolset differences are a huge barrier to market penetration. It's why technically superior, but architecturally different, products of the past were ignored to our loss. Itanium, with its advanced security, is a recent example. Not all are like that, though. There are a number that just protect pointers, do segments, do address space protection (see INTEGRITY-178B), or vary the granularity of the protection for legacy compatibility. These tend to support a modified UNIX/Linux kernel and/or GCC modifications. Things are otherwise the same. So, there's potential in those. I found the following looking into embedded use and what works with similar tools. This tagging scheme [1] integrates with RTEMS and C albeit with more complexity than some. The guarded pointers [2] from mid-90's probably would work well with microcontrollers given embedded code is often fairly static, esp safety-critical schemes. The critiques shouldn't apply as much except cost of extra bits. The SAFE architecture's PUMP [3] does arbitrary policies with costs that might put it outside of microcontroller range (high end? mid-range?). One can even use the old Burrough's model where 2 tags bits per word are used to ID pointers and code. Writes to either generate an interrupt for security system to approve based on context. Again, embedded is static enough that there should be no such interrupts in normal operation if pointer-arithmetic is avoided, right? Feel free to give your thoughts on these in terms of microcontrollers or low-cost microprocessors. [1] http://www.uidaho.edu/~/media/Files/orgs/ENGR/Research/CSDS/2014/A%20New%20Operating%20System%20for%20Security%20Tagged%20Architecture%20Hardware%20in%20Support%20of%20Multiple%20Independent%20Levels%20of%20Security%202014.ashx http://www.uidaho.edu/~/media/Files/orgs/ENGR/Research/CSDS/... [2] https://www.cs.utexas.edu/users/skeckler/pubs/asplos94.pdf https://www.cs.utexas.edu/users/skeckler/pubs/asplos94.pdf [3] http://www.crash-safe.org/assets/PUMP-ASPLOS-2015.pdf http://www.crash-safe.org/assets/PUMP-ASPLOS-2015.pdf
- minthd 11y ago
  Thanks. The guarded pointers look great , and both them and the Burrough model could work well for micro-controllers, and suffer a relatively small penatly. The SAFE-PUMP would probably need a relatively new manufacturing process to make economical sense for medium-end microcontroller or would be fitting for a high-end microcontroller. >> Again, embedded is static enough that there should be no such interrupts in normal operation if pointer-arithmetic is avoided, right? I think when calling a function and pushing stuff into the stack ,you'll need such interrupts, and maybe in other situations.I'm no sure though, i'm just an hobbyist in embedded, but pretty interested in the industry - and the tension between the fact that everybody says internet-of-things-security is a big issue with no solution and on the other hand ,the availability highly secure research and working systems. Anyway, thanks again for your help!

by minthd 11y ago

nickpsecurity 11y ago

The toolset differences are a huge barrier to market penetration. It's why technically superior, but architecturally different, products of the past were ignored to our loss. Itanium, with its advanced security, is a recent example. Not all are like that, though. There are a number that just protect pointers, do segments, do address space protection (see INTEGRITY-178B), or vary the granularity of the protection for legacy compatibility. These tend to support a modified UNIX/Linux kernel and/or GCC modifications. Things are otherwise the same. So, there's potential in those. I found the following looking into embedded use and what works with similar tools. This tagging scheme [1] integrates with RTEMS and C albeit with more complexity than some. The guarded pointers [2] from mid-90's probably would work well with microcontrollers given embedded code is often fairly static, esp safety-critical schemes. The critiques shouldn't apply as much except cost of extra bits. The SAFE architecture's PUMP [3] does arbitrary policies with costs that might put it outside of microcontroller range (high end? mid-range?). One can even use the old Burrough's model where 2 tags bits per word are used to ID pointers and code. Writes to either generate an interrupt for security system to approve based on context. Again, embedded is static enough that there should be no such interrupts in normal operation if pointer-arithmetic is avoided, right? Feel free to give your thoughts on these in terms of microcontrollers or low-cost microprocessors. [1] http://www.uidaho.edu/~/media/Files/orgs/ENGR/Research/CSDS/2014/A%20New%20Operating%20System%20for%20Security%20Tagged%20Architecture%20Hardware%20in%20Support%20of%20Multiple%20Independent%20Levels%20of%20Security%202014.ashx http://www.uidaho.edu/~/media/Files/orgs/ENGR/Research/CSDS/... [2] https://www.cs.utexas.edu/users/skeckler/pubs/asplos94.pdf https://www.cs.utexas.edu/users/skeckler/pubs/asplos94.pdf [3] http://www.crash-safe.org/assets/PUMP-ASPLOS-2015.pdf http://www.crash-safe.org/assets/PUMP-ASPLOS-2015.pdf

minthd 11y ago
Thanks. The guarded pointers look great , and both them and the Burrough model could work well for micro-controllers, and suffer a relatively small penatly. The SAFE-PUMP would probably need a relatively new manufacturing process to make economical sense for medium-end microcontroller or would be fitting for a high-end microcontroller. >> Again, embedded is static enough that there should be no such interrupts in normal operation if pointer-arithmetic is avoided, right? I think when calling a function and pushing stuff into the stack ,you'll need such interrupts, and maybe in other situations.I'm no sure though, i'm just an hobbyist in embedded, but pretty interested in the industry - and the tension between the fact that everybody says internet-of-things-security is a big issue with no solution and on the other hand ,the availability highly secure research and working systems. Anyway, thanks again for your help!