Secure Resource Sharing for Embedded Protected Module Architectures

Jo Van Bulck (1) , Job Noorman (1) , Jan Tobias Mühlberg (1) , Frank Piessens (1)

1 KU Leuven - Catholic University of Leuven = Katholieke Universiteit Leuven

Low-end embedded devices and the Internet of Things (IoT) are becoming increasingly important for our lives. They are being used in domains such as infrastructure management, and medical and healthcare systems, where business interests and our security and privacy are at stake. Yet, security mechanisms have been appallingly neglected on many IoT platforms. In this paper we present a secure access control mechanism for extremely lightweight embedded microcontrollers. Being based on Sancus, a hardware-only Trusted Computing Base and Protected Module Architecture for the embedded domain, our mechanism allows for multiple software modules on an IoT-node to securely share resources. We implement and evaluate our approach for two application scenarios, a shared memory system and a shared flash drive. Our implementation is based on a Sancus-enabled TI MSP430 microcontroller. We show that our mechanism can give high security guarantees at small runtime overheads and a moderately increased size of the Trusted Computing Base.

Mots clés: Protected module architecture; Internet of things; Embedded file system; Access control; Resource sharing; Trusted computing

Domaines: Informatique [cs]

Jo Van Bulck, Job Noorman, Jan Tobias Mühlberg, Frank Piessens. Secure Resource Sharing for Embedded Protected Module Architectures. 9th Workshop on Information Security Theory and Practice (WISTP), Aug 2015, Heraklion, Crete, Greece. pp.71-87, ⟨10.1007/978-3-319-24018-3_5⟩. ⟨hal-01442554⟩