Survey of Control-flow Integrity Techniques for Real-time Embedded Systems
Survey of Control-flow Integrity Techniques for Real-time Embedded Systems
复制标题
DOI：
10.1145/3538275
复制
发表时间：
2021-11
期刊：
影响因子：
--
通讯作者：
Tanmaya Mishra;Thidapat Chantem;Ryan M. Gerdes
中科院分区：
文献类型：
--
作者：
Tanmaya Mishra;Thidapat Chantem;Ryan M. Gerdes
计算系统，包括实时嵌入式系统，正变得越来越连接，以允许更先进和更安全的操作。这样的嵌入式系统通常也是资源受限的，例如，与台式机或服务器等通用计算系统相比，处理能力较低。随着物联网(IoT)等范式的出现，商业和工业环境中的嵌入式系统正越来越多地互联并暴露在外部网络中，以提高操作的自动化和效率。然而，允许此类嵌入式系统的外部接口会增加它们对攻击者的风险。随着针对嵌入式系统的攻击增加，从家用电器到操作具有实时要求的关键设备的工业控制系统，创建明确考虑此类资源和实时约束的防御机制势在必行。控制流完整性(CFI)是一系列防御机制，可防止攻击者修改执行流。我们调查了为嵌入式系统和实时嵌入式系统构建的从基础到最新的CFI技术，发现CFI机制非常缺乏，特别是对于实时嵌入式系统。然后，我们向社区提出开放的挑战，以帮助推动该领域的未来研究。
Computing systems, including real-time embedded systems, are becoming increasingly connected to allow for more advanced and safer operation. Such embedded systems are also often resource-constrained, for example, with lower processing capabilities compared to general-purpose computing systems like desktops or servers. With the advent of paradigms such as internet-of-things (IoT), embedded systems in both commercial and industrial contexts are being increasingly interconnected and exposed to the external networks to improve automation and efficiency of operation. However, allowing external interfaces to such embedded systems increases their exposure to attackers. With an increase in attacks against embedded systems ranging from home appliances to industrial control systems operating critical equipment that have real-time requirements, it is imperative that defense mechanisms be created that explicitly consider such resource and real-time constraints. Control-flow integrity (CFI) is a family of defense mechanisms that prevent attackers from modifying the flow of execution. We survey CFI techniques, ranging from the basic to state of the art, that are built for embedded systems and real-time embedded systems and find that there is a dearth, especially for real-time embedded systems, of CFI mechanisms. We then present open challenges to the community to help drive future research in this domain.