This is the 2021-2022 list of topics for master’s theses (partly) under my supervision at DistriNet/Computer Science, KU Leuven. I’m of course open for individual proposals in embedded security and sustainable ICT. Some of these topics might be a good fit for summer internships with us. I’m also open for students who want to work on technology-and-migration topics.

Exploring use cases of hardware security architectures

Supervisor

  • Jan Tobias Muehlberg
  • Frank Piessens

Daily advisor

  • Job Noorman
  • Jan Tobias Muehlberg

Description

Many modern processors provide Trusted Execution [1] capabilities. For example, Intel x86 processors from 2015 onwards ship with Software Guard Extensions (SGX, [2]), a trusted execution technology which creates completely isolated environments in the computer’s memory, so-called enclaves, where data and programmes can be used securely. Similar technology exists with AMD’s SEV and ARM’s TrustZone processor extensions. Many commercial players [3] claim to be interested in these concepts and are actively working on use cases around “confidential computing.” Also in DistriNet we have a long history of developing Trusted Execution Environments (TEEs), and understanding the security properties and programming approaches that enable their use. But is all this practically relevant already? Is it being used in real-world applications, and to which extent? And what do these real-world applications achieve with TEEs, do they use them how research envisioned it, and what are the current limitations?

This thesis project aims to study real-world applications of TEEs and reveal some insights on the above questions. You can approach this project from studying existing applications such as the Signal messaging system [4], DRM solutions, and Trusted Computing approaches in the cloud [5]. Studying these should reveal a set of requirements regarding the security of modern applications, which you can then map to enclave architectures. Specifically, you should find out:

  • What TEE features are actually being used in real-world use cases?
  • How do these features and use cases relate to real-world security issues? What novel attacks are being mitigated?
  • Are there expectations from application developers for security guarantees that are not actually provided by TEES?
  • Are these use cases new? Or were they being covered before the introduction of TEEs, and how?
  • What extensions to TEEs would be most useful to cover a wider spectrum of use cases or security issues.

A second angle this thesis could investigate are real-world abuses of TEEs. For example, it has already been demonstrated how SGX can be used to stealthily deploy malware [6]. Moreover, trusted computing has come under attack for its potential impact on the users’ digital rights [7] but it is not clear if these criticisms apply to TEEs like SGX. Investigating the features of TEEs that could have a negative impact on users is therefore important.

This thesis project would start with a literature study on modern enclave architectures and a broader survey of applications and general cloud service providers that make use of these architectures. From then on, the study could either focus on a specific applications and their use of enclaves, or remain broad, and include surveys and user studies to gather a general understanding of how software developers perceive and make use of enclave technology.

Literature

  1. Maene, P., Goetzfried, J., De Clercq, R., Mueller, T., Freiling, F. and Verbauwhede, I., 2017. Hardware-based trusted computing architectures for isolation and attestation. IEEE Transactions on Computers, 67(3), pp.361-374.
  2. Costan, V. and Devadas, S., 2016. Intel SGX Explained. IACR Cryptol. ePrint Arch., 2016(86), pp.1-118.
  3. https://confidentialcomputing.io/members/
  4. https://signal.org/blog/private-contact-discovery/
  5. Some idea on active projects: https://hopin.com/events/oc3-2021#schedule
  6. Schwarz M., Weiser S., Gruss D. (2019) Practical Enclave Malware with Intel SGX. In Detection of Intrusions and Malware, and Vulnerability Assessment. DIMVA 2019.
  7. https://www.gnu.org/philosophy/can-you-trust.en.html

Assessing the Footprint of Privacy-Preserving Technologies

Supervisor

  • Jan Tobias Muehlberg
  • Wouter Joosen

Daily advisor

  • Yana Dimova
  • Shirin Kalantari
  • Lennart Oldenburg (ESAT)
  • Jan Tobias Muehlberg

Description

A large part of the internet economy is funded through advertising networks, which rely on collecting consumer data, identifying and tracking consumers over time, and predicting their behaviour in order to display targeted advertisements [1]. The large-scale advertising machinery has generated substantial revenue and produced some of the richest corporations ever to exist, but also spawned substantial concerns over data protection and user privacy from its exploitative practices. Among other things, these concerns have led to new regulatory frameworks such as the GDPR [2], but also technical countermeasures such as ad blockers (e.g., uBlock Origin [3]) and browser fingerprinting protections (e.g., integrated in Tor Browser [4]) to make targeted advertising and user tracking more difficult. In addition to apprehension over privacy implications, recently, concerns have been raised over the substantial environmental footprint of advertising networks [5]. However, Privacy-Enhancing Technologies (PETs) may have an environmental footprint themselves. Assessing the impact of PETs in the context of their their interplay with tracking networks is the topic of this thesis project.

Indeed, we have the hypothesis that implementing privacy as an add-on to a service may lead to an increased environmental footprint and degrade performance, while implementing a service under a privacy-by-design paradigm can result in efficient services with reduced environmental footprints. However, we are lacking a methodology to assess the environmental impact of accessing web services through PETs at similar levels of privacy, either as add-ons or following a privacy-by-design approach. Therefore, this project aims to do initial investigations into this topic, and to develop a methodology to do such impact assessments. Interesting research questions are:

  • How do we measure the environmental footprint of a (web) service?
  • How do we measure the environmental footprint of a Privacy-Enhancing Technology or service?
  • How do we compare the footprint and performance of services? This is relatively easy for a website with/without Tor, but complex for other apps and services.
  • We can only measure impact at the consumer side. How do we estimate the impact of server-side/backend/cloud processing? What existing models would be useful here?
  • How do Privacy-Enhancing Technologies and their footprints correlate with usability?

If you choose this topic, you will most likely begin your work with a literature study around the environmental impact of web services. You would then design an experiment where you might experimentally investigate and compare the measurable impact at the user side (e.g, page weight, data transferred) of an ad-funded web service a) natively, b) with an ad blocker, c) through Tor and other PETs, and d) with an alternative ad-free service. This simple evaluation would certainly have a number of weaknesses that hamper the validity of a direct comparison – and that open up new topics for investigation. Generally, this topic is rather open to your own ideas and other aspects of sustainability and privacy might be assessed.

Literature

  1. Evans, D.S., 2009. The online advertising industry: Economics, evolution, and privacy. Journal of economic perspectives, 23(3), pp.37-60.
  2. Aridor, G., Che, Y.K. and Salz, T., 2020. The economic consequences of data privacy regulation: Empirical evidence from GDPR (No. w26900). National Bureau of Economic Research.
  3. uBlock Origin: https://github.com/gorhill/uBlock
  4. Tor Browser: https://www.torproject.org/
  5. Parssinen, M., Kotila, M., Cuevas, R., Phansalkar, A. and Manner, J., 2018. Environmental impact assessment of online advertising. Environmental Impact Assessment Review, 73, pp.177-200.
  6. Carbon-API-2.0: https://gitlab.com/wholegrain/carbon-api-2-0

Assessing Privacy Risks in Online Games for Minors

Supervisor

  • Jan Tobias Muehlberg
  • Wouter Joosen

Daily advisor

  • Tommaso Crepax (CiTiP)
  • Jan Tobias Muehlberg

Description

Many free-to-download mobile games are designed to nudge players to “play first, pay later”, to buy third party products and to unlock paid features in the game app. Businesses built on these models are flourishing worldwide, as success is oftentimes guaranteed by a perfect mix of circumstances: catchy themes for new incarnations of existing game concepts are easily found and implemented, industrialised frameworks for targeted advertising are readily available, developers obtain game telemetry and use big data analysis to profile players, “dark patterns” designs allow to exploit users’ cognitive biases, while little resistance is expected from unaware targets. Collectively, these circumstances enable extensive user profiling and maximised profits of an audience of minors who deserve special protection. Yet, this audience is often left vulnerable at the mercy of an industry armed with the latest inventions of marketing and psychology to maximise user interactions.

Through online games, medical, sexual, mental and behavioural information can be identified, inferred or just presumed from more or less conscious playing choices and reactions to stimuli. Medical studies demonstrated that machine learning analysis of a child’s gesture patterns during tablet gameplay can identify autism with up to 93% accuracy [1]. In younger children, phenomena of aggressive gaming behaviours towards other players, characters, animals, as well as of gender-swapping, may predict mental disorders or sexual preferences, as psychological and sociological studies showed that “individuals generally behave and represent themselves in video games in ways that are consistent with their real-world tendencies” [2]. Slower than average responses to audio-visual stimuli may hint to neural disorders, while lack of skills in solving puzzles may hint to inferior mental abilities. All such highly delicate, sensitive personal data, however (in)correct, can be collected today, appended to the child’s digital identity, permanently recorded, and be used dozen years into their future to calculate the premium of their car or medical insurance, evaluate their fitness to apply for a job or be part of a community, be denied access to credit or to medical treatment.

With a special emphasis on games for children, this thesis aims to explore the extent to which personal information is processed in online games, and what the gaming platform or third parties could possibly infer from this personal information. You could approach this thesis by investigating popular online games for browsers or mobile platforms, and study the privacy statements of these games. This could be followed by a more in-depth assessment of a small list of games. The latter could also be automated though code analysis or by monitoring the game’s communication in response to a user interaction, following a methodology similar to [3,4]. Approaches to modify an (open-source) online game to minimise Possibilities for data collection are also in scope for this thesis. You will work on this thesis in close collaboration with a legal scholar who is exploring opportunities for a privacy rating systems for these games.

Literature

  1. Anzulewicz, A., Sobota, K. and Delafield-Butt, J.T., 2016. Toward the autism motor signature: Gesture patterns during smart tablet gameplay identify children with autism. Scientific reports, 6(1), pp.1-13.
  2. Worth, N.C. and Book, A.S., 2015. Dimensions of video game behaviour and their relationships with personality. Computers in Human Behaviour, 50, pp.132-140.
  3. Zimmeck, S., Wang, Z., Zou, L., Iyengar, R., Liu, B., Schaub, F., Wilson, S., Sadeh, N.M., Bellovin, S.M. and Reidenberg, J.R., 2017, February. Automated Analysis of Privacy Requirements for Mobile Apps. In NDSS.
  4. Franken, G., Van Goethem, T. and Joosen, W., Reading Between the Lines: An Extensive Evaluation of the Security and Privacy Implications of EPUB Reading Systems. In 2021 IEEE Symposium on Security and Privacy (pp. 247-264). IEEE.

Attestation of IoT scheduling policies with availability guarantees

Supervisor

  • Jan Tobias Muehlberg
  • Frank Piessens

Daily advisor

  • Fritz Alder
  • Jan Tobias Muehlberg

Description

This thesis explores how a secure scheduler can be used to dynamically change the real-time guarantees given to specific processes. We created an IoT operating system that can guarantee the availability of applications and ensure that each application gets a fair share of resources. But what does this mean when requirements change? How can such a guarantee be communicated in practice? How can we prevent attackers from breaking the guarantees of applications without wasting too many resources because we reserve buffer time?

Background

At DistriNet, we have considerable experience implementing and using an enclave architecture for light-weight embedded devices. Our current implementation, Sancus, is based on the MSP430 which consists of low-cost, low-power 20MhZ 16-bit processors. The main feature of an enclave architecture is that it provides a so-called Trusted Execution Environment (TEE) that is isolated from surrounding processes. Running an application in this trusted environment allows to shield it from malicious programs running on the same system. These TEEs also allow isolated programs to perform a so called attestation which proves to a remote user that the program is indeed running in the isolated context and that its outputs can indeed be trusted.

RIOT is an open source operating system for IoT devices that has a low memory footprint and supports third party applications, multi-threading, and can even be used for real-time applications. In the context of IoT, this is very helpful as programs can be loaded to the device after it has been deployed. We ported Sancus to this OS and enabled its scheduler to run in the isolated context. This way, no process can interfere in the scheduling of the next process. We can use this scheduler to create an open system that allows anyone to load applications onto the system and that then guarantees each application (up to a limit of course) that it will receive a fair share of the resources. This has the potential to break open the conventional “Confidentiality-Integrity-Availability” problem since with this system, we can guarantee all three properties.

This topic is perfect for you if you are interested in embedded security and have some interest in IoT. RIOT and Sancus are mostly programmed in C (which you can learn if you don’t know it yet) and the available resources are very limited which results in cool challenges to solve. At the same time, this is an active research topic and you can get an insight into current bleeding edge research. If this sounds cool but you do not know if this thesis is right for you, just get in touch and we discuss.

Goal

The goal of this thesis is to evaluate and improve scheduling on a next-generation open IoT platform that allows any stakeholder to deploy applications. The thesis will investigate the challenges of attesting such a fair scheduling, the implications of guaranteeing some resources, what guarantees can still be given to other applications, what guarantees can be given if some requirements change, and how can these guarantees and changes to them be attested to remote parties?

Possible research questions

  • How can scheduling decisions happen on a fair and open system?
  • Can hard deadlines be enforced for multiple applications?
  • How can attestation work for dynamic deployments?
  • How can scheduling guarantees be included in an attestation guarantee?

Approach

  • Obtain background knowledge on Trusted Execution Environments and Sancus
  • Literature study on schedulability and scheduling policies
  • Familiarisation with RIOT and the Sancus modifications
  • Proposal of a design for a scheduling policy system
  • Analysis of remote attestation for changes in scheduling policies and potential adjustments of the proposal
  • Implementation of the proposal
  • Evaluation

Literature

  • https://www.riot-os.org/
  • Noorman, Job, et al. “Sancus 2.0: A low-cost security architecture for IoT devices.” ACM Transactions on Privacy and Security (TOPS) 20.3 (2017): 7
  • Baccelli, Emmanuel, et al. “RIOT OS: Towards an OS for the Internet of Things.” 2013 IEEE conference on computer communications workshops (INFOCOM Workshops). IEEE, 2013.

Securely Re-purposing Used Mobile Devices

Supervisor

  • Jan Tobias Muehlberg
  • Wouter Joosen

Daily advisor

  • Jan Tobias Muehlberg
  • Veelasha Moonsamy (Ruhr University Bochum)

Description

Electronic devices, specifically mobile phones, have a rather short lifespan. In Europe, these devices are replaced every 18 months on average. Hardly ever, a mobile phone lives for more than three years. Because of this short lifespan, manufacturing, distribution and disposal account for a disproportional 72% of a smartphone’s total climate impact [1]. And this life-cycle impact itself is huge, starting with the environmental damage caused by mining and refining raw materials, the actual production process, energy consumption, and finally the disposal and partial recycling of the device – most of these activities are happening in the Global South under rather different environmental and humanitarian standards than what we are used to. Currently, across the EU, 211 million smartphones are being sold annually [1]. Extending the lifespan of these devices by another three years would safe the world 4.3 Mt CO2 alone, not considering other impacts [2].

In this project you will investigate possibilities for securely reusing (rather than dispose and recycle) used smartphones. This reuse may happen again as a smartphone with another user profile, or, e.g. as an IoT device, where the used phone can provide a general-purpose sensing and processing platform. Albeit the reuse of such devices has been studied in the past (e.g. in [3]), questions around the security and user privacy of re-purposed devices and their suitability for different use cases have not yet been discussed, which is what you will investigate: How can used smartphones be securely recovered and kept secure for an extended lifespan [4], while excluding unwanted interference from a potentially malicious previous owner, or from a device vendor with an economic interest to prevent such secondary uses, or who intends to obtain critical data about the extended use case [5,6].

In the course of this thesis you may investigate the following research questions. This can happen either practical on a set of actual devices, or in the context of an extended study of the requirements and documented possibilities to re-purpose devices securely:

  1. What general challenges to securely reusing smartphones exits?
  2. Can interference of the original device or OS vendor be excluded in re-purposed device?
  3. To what extend are devices equipped with secure elements that can serve as a long-term root of trust to recover compromised devices? Can this be done without relying on support from the device vendor?
  4. Which brands or devices can be particularly easily re-purposed, and why?
  5. To what extend do the “The Seven Properties of Highly Secured Devices” [7] apply to reused smartphones?
  6. Evaluate the idea of re-purposed phones as IoT devices in the context of sustainable security and sustainable dependability [4].

Literature

  1. European Commission. Joint Research Centre. (2020). “Guidance for the assessment of material efficiency: application to smartphones.” LU: Publications Office. https://data.europa.eu/doi/10.2760/037522
  2. Zuloaga, F., Schweitzer, J.-P., Anastasio, M., & Arditi, S. (2019). “Coolproducts don’t cost the Earth – Report.” European Environmental Bureau. https://eeb.org/library/coolproducts-report/
  3. Li, X., Ortiz, P.J., Browne, J., Franklin, D., Oliver, J.Y., Geyer, R., Zhou, Y. and Chong, F.T., 2010. Smartphone evolution and reuse: Establishing a more sustainable model. IEEE. https://ieeexplore.ieee.org/abstract/document/5599108
  4. Pavert, A., Voelp, M., Brasser, F., Schunter, M., Asokan, N., Sadeghi, A.-R., Esteves-Verissimo, P., et al. 2019. “Sustainable Security & Safety: Challenges and Opportunities.” http://www.icri-cars.org/wp-content/uploads/2019/01/s3-vision.pdf
  5. Moonsamy, V., Batten, L. and Shore, M., 2013. Can Smartphone Users Turn Off Tracking Service Settings? International Conference on Advances in Mobile Computing & Multimedia. https://dl.acm.org/doi/abs/10.1145/2536853.2536864
  6. Gamba, J., Rashed, M., Razaghpanah, A., Tapiador, J. and Vallina-Rodriguez, N., 2020, May. An analysis of pre-installed android software. IEEE Security and Privacy. https://ieeexplore.ieee.org/abstract/document/9152633
  7. Hunt, G., Letey, G. and Nightingale, E., 2017. The seven properties of highly secure devices. https://www.microsoft.com/en-us/research/uploads/prod/2020/11/Seven-Properties-of-Highly-Secured-Devices-2nd-Edition-R1.pdf
  8. Groschupp F, Schneider M, Puddu I, Shinde S, Capkun S. Sovereign Smartphone: To Enjoy Freedom We Have to Control Our Phones. arXiv preprint arXiv:2102.02743. 2021 Feb 4.

MS Azure IoT Platform Assessment for Security and Privacy

Supervisor

  • Jan Tobias Muehlberg
  • Wouter Joosen

Daily advisor

  • Jan Tobias Muehlberg
  • Veelasha Moonsamy (Ruhr University Bochum)

Description

The term ‘Internet of things’ (IoT) is used to describe the (continually growing) network of Internet connected devices around the world. The number of currently active IoT devices (including consumer devices and edge nodes) in 2020 is estimated to be around 8.3 billion and this number is expected to grow to 21.5 billion by 2025 [1], with a market share forecasted at 1.6 trillion US dollars [2]. This rapid surge in number of IoT devices, and its ubiquitous and pervasive presence in our daily lives bring forth various security- and privacy-related concerns.

While it is commonly known that Google’s Android (due to its open-source nature) is being widely used for implementation and deployed in the IoT ecosystem, Microsoft recently launched ‘Azure Sphere’ [3] to compete against Android. Azure Sphere includes a certified microcontroller (which is used for the IoT device), a dedicated OS (which also includes a platform for IoT app development) and the AS3 - a cloud-based security service.

For this project, the goal is to investigate the Azure Sphere platform. You will be provided with an Azure Sphere development kit and tasked to set it up so that it can be used for running Azure Sphere apps. As intermediate steps, an evaluation of the security and privacy guarantees will be investigated and evaluated. Necessary testing methods such as fuzzing or side-channel leakages can be applied.

During the course of this project, you will investigate the following questions:

  1. Does Azure Sphere fulfil the requirement of best practice for IoT security, as outlined in [3]?
  2. To what extent do the “7 properties of highly secured devices” [5] formulated by Microsoft hold in practice, i.e. when the Azure Sphere board is actually used in the real-world?
  3. What are the possible attack vectors?
  4. Do the security and privacy guarantees of Azure Sphere apps hold in practice?

Literature

  1. https://www.statista.com/statistics/1101442/iot-number-of-connected-devices-worldwide/
  2. https://www.statista.com/statistics/976313/global-iot-market-size/
  3. https://azure.microsoft.com/en-us/blog/introducing-microsoft-azure-sphere-secure-and-power-the-intelligent-edge/
  4. Bellman, C. and van Oorschot, P.C., 2020. Best Practices for IoT Security: What Does That Even Mean?. arXiv preprint arXiv:2004.12179. https://arxiv.org/abs/2004.12179
  5. https://www.microsoft.com/en-us/research/uploads/prod/2020/11/Seven-Properties-of-Highly-Secured-Devices-2nd-Edition-R1.pdf
  6. Ammar, M., Russello, G. and Crispo, B., 2018. Internet of Things: A survey on the security of IoT frameworks. Journal of Information Security and Applications, 38, pp.8-27.

Hardening enclave programs against side-channel vulnerabilities at compile time

Supervisor

  • Jan Tobias Muehlberg
  • Frank Piessens

Daily advisor

  • Jan Tobias Muehlberg
  • Hans Winderix

Description

Side-channel [1] attacks enable an adversary to infer information about the internal state of a program by observing the execution of that program. For example, attacker can extract secrets by observing the time it takes a system to perform some computation. Recent controlled-channel attacks [2] exploit timing differences in the rudimentary fetch-decode-execute logic of processors, and are capable of extracting application secrets from so-called enclaves. These enclaves are software compartments that are provided by modern processors in hardware, through Trusted Execution Environment) such as Intel SGX, ARM TrustZone or Sancus. The use of enclaves is meant to provide strong authenticity and integrity guarantees for protected software components, which can be jeopardised by side-channel attacks.

There are multiple ways to prevent these vulnerabilities, and our group has been exploring modifications to processor designs [5], approaches to detect vulnerabilities in programs, as well as additional compiler passes that can automatically harden code at compile-time [3]. We are looking for students to investigate these approaches further by, e.g., developing countermeasures against novel side-channel vulnerabilities, comparing the effectiveness of countermeasures on different processor architectures, or looking into optimisations of hardening techniques to improve the performance of the resulting code.

This project requires students to have some background or strong interest in compilers and low-level security and computer architecture.

Literature

  1. David Brumley and Dan Boneh. Remote timing attacks are practical. Computer Networks, 48(5):701–716, 2005.
  2. Jo Van Bulck, Frank Piessens, and Raoul Strackx. Nemesis: Studying microarchitectural timing leaks in rudimentary CPU interrupt logic. In Proceedings of the 2018 ACM SIGSAC Conference on Computer and Communications Security, pages 178–195. ACM, 2018.
  3. Winderix, H., Muehlberg, J.T. and Piessens, F., Compiler-Assisted Hardening of Embedded Software Against Interrupt Latency Side-Channel Attacks. EuroS&P 2021.
  4. Bart Coppens, Ingrid Verbauwhede, Koen De Bosschere, and Bjorn De Sutter. Practical mitigations for timing-based side-channel attacks on modern x86 processors. In 2009 30th IEEE Symposium on Security and Privacy, pages 45–60. IEEE, 2009.
  5. Matteo Busi, Job Noorman, Jo Van Bulck, Letterio Galletta, Pierpaolo Degano, Jan Tobias Muehlberg, and Frank Piessens. Provably secure isolation for interruptible enclaved execution on small microprocessors. In 33rd IEEE CSFW. IEEE Computer Society, 2020.

A Trusted Execution Architecture for RISC-V

Supervisor

  • Frank Piessens

Daily advisor

  • Job Noorman
  • Fritz Alder

Description

This thesis explores how a trusted execution architecture can be implemented on a custom highly-configurable RISC-V processor.

Trusted Execution Environments (TEEs) are security architectures that provide strong isolation guarantees to software modules. These modules are given the guarantee that no other software – including the operating system – can access their data. This is great to protect software from attackers that breach the platform boundaries. At DistriNet, we already have a lot of experience implementing and using a TEE for low-end embedded processors like they are integrated into cars or other platforms where the processors need to be cheap and not consume a lot of power. Some years ago, we created the Sancus TEE which is based on an older architecture (MSP430). But in the recent years, RISC-V has grown to become more mature and we want to investigate how it can be used for light-weight devices.

RISC-V is an open-source ISA founded in 2010 by UC Berkeley. Given its open nature, more and more researchers from many different fields are using it as a basis for their research. We have already developed an open, extensible, and highly configurable RISC-V CPU to be used as the basis for our next security-related research projects. Our CPU is written in SpinalHDL which means that we can write and design computer hardware in Scala. This allows for an easy access to hardware design without the high entry barrier of learning an old hardware description language.

This thesis has two goals: First, you assess the extensibility of the RISC-V CPU by implementing an existing enclave architecture. Since Sancus is also a TEE for light-weight devices, we can reuse some of its design choices and do not need to start from scratch. Second, we want to investigate the challenges of implementing such an enclave architecture on a pipelined processor. Since the RISC-V is not a single cycle processor but is using a pipeline, this will have some implications for the TEE architecture which we want to investigate further.

Literature

  • Noorman, Job, et al. “Sancus 2.0: A low-cost security architecture for IoT devices.” ACM Transactions on Privacy and Security (TOPS) 20.3 (2017): 7
  • https://github.com/SpinalHDL/SpinalHDL

Worst Case Execution Time Prediction for Sancus/MSP430

Supervisor

  • Jan Tobias Muehlberg
  • Frank Piessens

Daily advisor

  • Fritz Alder
  • Hans Winderix

Description

Sancus is a hardware architecture that implements strong isolation of software modules. Sancus further provides means for secure communication and attestation for such isolated modules, effectively counteracting attackers with full control over infrastructure software. We recently worked on extending this architecture with availability and real-time guarantees. For this, one needs to be able to reason about execution times of software components at a fine granularity. In particular, the worst case execution time (WCET) of functional units is of interest so as to be able to make scheduling decisions that guarantee timely handling of system events that have stringent real-time requirements attached to them. This thesis aims at implementing an analysis that determines such worst case execution times for machine code for the TI MSP430 CPU with Sancus extensions.

Background

Several years ago, we built Sancus as a security architecture for light-weight embedded devices that have low power resources and are cheap. These devices run only at 20MHz and are designed on a 16-bit architecture. Still, Sancus provides strong security properties to these devices that can even guarantee the security and integrity of running applications if the device gets compromised by attackers. Since then, we have extended the base security architecture that it can now also guarantee the availability of running applications and ensuring that each application gets a fair share of the resources. For this, applications can register with the secure scheduler on the device and give requirements, such as “I need to run for x cycles every second”. While we can already guarantee that the applications will then get this amount of cycles, it is not trivial yet how one can calculate the execution time that is necessary. This is where the analysis of worst case execution time comes in.

Worst case execution time is typically used in reliable real-time systems, where understanding the worst case timing behaviour of software is important for reliability or correct functional behaviour. Consider an embedded microcontroller that controls the behaviour of an engine, opening and closing valves in response to sensor readings. These readings and actions have to be taken within a specific amount of time so as to guarantee that the engine keeps running, and the time spent executing the control software makes up an important fraction of the response time. Thus, if the software worst case execution time can be determined, then the designer of the system can use this to ensure that the system responds fast enough.

There is a number of manual and automated approaches to calculating the worst case execution time of a program. We are mostly interested in automated analysis techniques, which include analytical approaches to improve test cases so as to increase confidence in end to end measurements, static analysis of the software (“static” meaning without executing the software), as well as combined approaches, often referred to as “hybrid” analysis, which involve a combination of measurements and structural analysis.

Students embracing this task will study literature on static WCET analysis, investigating available tools or re-implementing previously published approaches for the MSP430 architecture. This should then be extended to cover the Sancus primitives. A number of example programs for the MSP430 and for Sancus are available and can be instrumented as test cases for this project.

You should be able to familiarise yourself with the MSP430 and the internals of Sancus, which requires solid background knowledge in computer architecture and the programming language C. If this sounds cool but you do not know if this thesis is right for you, just get in touch and we can discuss.

Goal

This thesis aims at implementing an automated analysis that determines such worst case execution times for machine code for the TI MSP430 CPU with Sancus extensions. The thesis will base on the general topic of WCET analysis and then apply this knowledge to the security architecture and special requirements of the Sancus security extensions. The goal is to be able to perform a worst case execution time analysis on programs with different requirements.

Research Questions

  • How do we do program analysis for WCET to get scheduling needs?
  • What previous work on WCET analysis would be most suitable for different functional units on the MSP430, e.g., interrupt service routines, scheduling components or general application code?
  • Can the Sancus specific instructions be handled by existing approaches to WCET analysis?
  • Would it be advisable to modify the behaviour of the Sancus specific instructions, e.g., assign them fixed execution times, to achieve better prediction results or stronger real-time guarantees?

Literature

  • Noorman et al.: Sancus: Low-cost trustworthy extensible networked devices with a zero-software Trusted Computing Base, USENIX Security 2013
  • Heckmann and Ferdinand, Worst-case execution time prediction by static program analysis, IEEE IPDPS 2004
  • Burns, Alan, and Andrew J. Wellings. Real-time systems and programming languages: Ada 95, Real-Time Java, and Real-Time POSIX. Pearson Education, 2001

Building A Secure and Open IoT Platform with ARM TrustZone

Supervisor

  • Jan Tobias Muehlberg
  • Frank Piessens

Daily advisor

  • Sepideh Pouyanrad
  • Fritz Alder

Description

ARM TrustZone is a trusted execution environment (TEE) that can isolate critical components of software in a secure world and prevent attackers from accessing these secure components. TrustZone devices are usually deployed in mid-range platforms, such as payment terminals, smartphones, smart-home and IoT appliances, or gateways of embedded devices. Usually, these TrustZone devices are too large, powerful, and expensive to be deployed for individual sensors, and too small to operate in the cloud. But they are perfect gateway devices to, for example, connect individual sensors in a smart vehicle, and communicate with a cloud server. There are many challenges that centre around deploying Trusted Applications in TrustZone devices and letting them communicate with a remote service. In this thesis, you will investigate this deployment and communication, specifically how an application can prove to a user and to the cloud service that it is running in an isolated environment. You will be working with open hardware platforms such as development boards or the PinePhone and build a demonstrator to address some of these challenges.

Background

A trusted execution environment (TEE) is usually a hardware mechanism that can isolate software components on a system from other such components, even from the operating system. This allows to perform confidentiality and integrity protected calculations without a hacker or the operating system being able to interfere with this computation. Additionally, TEEs allow to prove (attest) to a remote party, which application is currently running which is great to create a trusted channel to a remote device. This could be a trusted channel between the cloud and some sensor in a smart vehicle or a mobile phone.

One challenge of these systems, and a possible direction of your thesis, is the use of trusted I/O. How can we make sure that input from peripherals (like sensors or even a keyboard) can be brought into the TEE without the hacker being able to interfere with this input? How can an application be sure that the input actually stems from a physical user instead of some hacker that triggered an input through software? How can a user be convinced that they are looking at trustworthy output from a Trusted Application rather than the untrusted part of the system presenting something that looks like the Trusted App? There already exist some research papers and online resources on how to perform secure I/O with ARM TrustZone. The goal of this thesis is to first reproduce trusted I/O on a local experiment and then to evaluate how this trusted I/O can be used by other TEEs and/or shared with local resources on the device.

Another direction could be that of remote attestation between TEE platforms. There are multiple different TEEs for different types of platforms, also including Intel SGX and AMD SEV for high-end platforms such as cloud servers. These TEEs provide different attestation scheme that allow remote participants to verify the software that runs on the device. Building a similar attestation mechanism for TrustZone is not straightforward. This thesis could aim to investigate the feasibility of different approaches to software attestation with TrustZone. Depending on your interests, this thesis can additionally look into more advanced attestation schemes than a 1-to-1 attestation between TrustZone and other nodes. One example of such advanced attestation schemes are swarm attestations, others are dynamic deployments of TrustZone nodes within a network of other TrustZone gateways.

This thesis is perfect for you if you are interested in embedded security and want to know more about security research in this area. Many pieces of this topic are already described well in research papers and online resources, but combining them together takes some research effort and some engineering. Thus, it is very helpful if you have interest in low-level programming such as the C language and have a general interest in security. If you already have heard of TEEs, Intel SGX, or the ARM TrustZone platform then this is even better, but not a must. If all this sounds cool but you do not know if this thesis is right for you, just send us an email and we can discuss it together!

Research questions

  • How does secure I/O work with ARM TrustZone?
  • Can we provide secure input and output with TrustZone on a mobile-phone-like device?
  • How can we convince remote services or users of the security guarantees of a trusted-I/O application?
  • How can trusted I/O be integrated with an (untrusted) mobile OS?
  • How can a TrustZone node perform a mutual attestation with Intel SGX?
  • How can this network communicate and attest to other similar networks?
  • In mobile systems, can we work with transitive trust between known networks?
  • Can swarm attestation for IoT help in establishing trust between one TrustZone and multiple Sancus nodes?

Approach

  • Obtain background knowledge on Trusted Execution Environments and ARM TrustZone
  • Familiarise yourself with implementing TrustZone apps by building some OpenEnclave/OP-TEE enclaves
  • Implement a simple TrustZone application that attests an Intel SGX enclave
  • Implementation of a specific I/O scenario in a simulator or on real hardware
  • Experimentation with more scenarios or with sharing the trusted I/O with attested services

Literature

  • Pinto, S. and Santos, N., 2019. Demystifying ARM TrustZone: A comprehensive survey. ACM Computing Surveys (CSUR), 51(6), pp.1-36.
  • Eskandarian, S., Cogan, J., Birnbaum, S., Brandon, P.C.W., Franke, D., Fraser, F., Garcia, G., Gong, E., Nguyen, H.T., Sethi, T.K. and Subbiah, V., 2019, May. Fidelius: Protecting user secrets from compromised browsers. In 2019 IEEE Symposium on Security and Privacy (SP) (pp. 264-280). IEEE.
  • Lentz, M., Sen, R., Druschel, P. and Bhattacharjee, B., 2018, June. Secloak: Arm TrustZone-based mobile peripheral control. In Proceedings of the 16th Annual International Conference on Mobile Systems, Applications, and Services (pp. 1-13).
  • Ambrosin, M., Conti, M., Ibrahim, A., Neven, G., Sadeghi, A.R. and Schunter, M., 2016, October. SANA: secure and scalable aggregate network attestation. In Proceedings of the 2016 ACM SIGSAC Conference on Computer and Communications Security (pp. 731-742).
  • Asokan, N., Brasser, F., Ibrahim, A., Sadeghi, A.R., Schunter, M., Tsudik, G. and Wachsmann, C., 2015, October. Seda: Scalable embedded device attestation. In Proceedings of the 22nd ACM SIGSAC Conference on Computer and Communications Security (pp. 964-975).
  • Noorman, J., Bulck, J.V., Muehlberg, J.T., Piessens, F., Maene, P., Preneel, B., Verbauwhede, I., Goetzfried, J., Mueller, T. and Freiling, F., 2017. Sancus 2.0: A low-cost security architecture for IoT devices. ACM Transactions on Privacy and Security (TOPS), 20(3), pp.1-33.
  • The PinePhone: https://www.pine64.org/pinephone/
  • Groschupp F, Schneider M, Puddu I, Shinde S, Capkun S. Sovereign Smartphone: To Enjoy Freedom We Have to Control Our Phones. arXiv preprint arXiv:2102.02743. 2021 Feb 4.

Last modified: 2022-06-08 16:16:25 +0200