SaTC: NSF-BSF: CORE: Small: Attacking and Defending the Lifespan of Mobile and Embedded Flash Storage

该项目探讨了攻击和防御小型移动的设备中闪存存储寿命的方法。虽然该项目的重点是智能手机，但该研究适用于任何允许用户安装应用程序的小型闪存设备，包括智能手表，物联网（IoT）设备，计算机化医疗设备和计算机管理的关键基础设施。众所周知，随着时间的推移，写入闪存将在物理上磨损设备。 对于企业级固态硬盘（SSD）而言，此问题被视为不存在的问题。然而，这项研究的初步结果表明，在智能手机的背景下，磨损是未解决的。 一个恶意的、没有特权的应用程序可以在短短几天或几周内秘密地使手机永久无法操作，而当前的移动的系统对这种攻击没有任何保护。移动终端用户通常信任他们的应用程序商店生态系统，并且习惯于尝试具有安全感的第三方应用程序，这一事实加剧了风险。我们的社会正迅速进入普适计算的时代。用户依赖智能手机进行广泛的方面（如商业，教育和医疗保健），可穿戴设备和互联网连接的小工具也同样激增。此外，越来越多的关键基础设施通过小型嵌入式设备连接到互联网，从而可以控制物理系统。这项研究确定并解决了一个严重的漏洞，严重破坏了用户的信任，下载一个新的应用程序不会破坏他们的移动的设备的能力。如果不加以缓解，此漏洞可能会严重妨碍此类设备的可用性。为了解决这个问题，本项目正在研究移动的设备和应用程序的输入/输出行为。基于这种行为分析，该项目探索了对闪存磨损的新攻击和防御。最终目标是创建对最终用户的破坏性最小的防御，但提供设备预期寿命的下限。这项工作通过创建管理永久消耗资源的技术来推进操作系统的最新技术水平。该奖项反映了NSF的法定使命，并通过使用基金会的知识价值和更广泛的影响审查标准进行评估，被认为值得支持。

This project explores approaches to attack and defend the lifespan of flash storage in small mobile devices. While the project focuses on smartphones, the research is applicable to any small flash-based device that allows users to install applications, including smart watches, Internet-of-Things (IoT) devices, computerized medical equipment, and computer-managed critical infrastructure. It is well understood that, over time, writing to flash storage will physically wear out the device. This problem is considered a nonissue with respect to enterprise Solid State Drives (SSDs). However, preliminary findings of this research indicate that wear is unresolved in the context of smartphones. A malicious, unprivileged application can secretly render a phone permanently inoperable in a few short days or weeks, and current mobile systems have no protection against this attack. The risk is exacerbated by the fact that mobile device users typically trust their app store ecosystem and are in the habit of trying out third-party apps with a sense of safety. The goal of this project is to develop ways to alleviate the problem.Our society is rapidly moving into the era of ubiquitous computing. Users depend on smartphones for wide-ranging aspects (such as commerce, education, and healthcare), and wearables and internet-connected gadgets likewise proliferate. Moreover, an increasing amount of critical infrastructure is internet-connected via small embedded devices, which may thus control physical systems. This research identifies and addresses a critical vulnerability that seriously undermines the ability of users to trust that downloading a new application will not ruin their mobile devices. If unmitigated, this vulnerability might severely hamper the usability of such devices. To address the problem, this project is studying the input/output behavior of mobile devices and applications. Based on this behavioral analysis, the project explores new attacks on and defenses for flash wear. The end goal is to create defenses that are minimally disruptive to end users, yet provide a lower bound on the lifetime expectancy of the device. This work advances the state of the art of operating systems by creating techniques to manage permanently consumable resources.This award reflects NSF's statutory mission and has been deemed worthy of support through evaluation using the Foundation's intellectual merit and broader impacts review criteria.