Successfully reported this slideshow.
We use your LinkedIn profile and activity data to personalize ads and to show you more relevant ads. You can change your ad preferences anytime.

Fosdem 18: Securing embedded Systems using Virtualization

453 views

Published on

Hypervisors were once seen as purely cloud and server technologies, but have slowly seeped into the embedded space providing extra layers of security. This discussion will showcase how companies from security vendors to automotive are using open source hypervisors (particularly Xen Project) to secure embedded systems, what challenges they face and how they have overcome it. We will also explore what this might mean to IoT at large and how to get started in securing your embedded system with a hypervisor-first approach.

Hypervisors were once seen as purely cloud and server technologies, but have slowly seeped into the embedded space providing extra layers of security. This discussion will showcase how companies from security vendors to automotive are using open source hypervisors (particularly Xen Project) to secure embedded systems, what challenges they face and how they have overcome it. We will also explore what this might mean to IoT at large and how to get started in securing your embedded system with a hypervisor-first approach.

The topic will cover content such as: * Why virtualisation in embedded * Hypervisor architectures on ARM and a quick roundup of examples * Relevant security technologies * Specific requirements for embedded systems * Example usage of FOSS based hypervisors in embedded * Challenges such as safety certification and how this may be approached

Published in: Technology
  • Be the first to comment

  • Be the first to like this

Fosdem 18: Securing embedded Systems using Virtualization

  1. 1. Lars Kurth Community Manager, Xen Project Chairman, Xen Project Advisory Board Director, Open Source, Citrix lars_kurth larskurth www.slideshare.net/xen_com_mgr/presentations
  2. 2. Consolidation Reduce cost, size, weight and power consumption Reduce development costs: platform independence Security and Safety Support mixed criticality compositions (Apps with differing safety, security & real-time requirements) Safety Certification of the Hypervisor Embedded Requirements Minimal IRQ latency Low or 0 scheduling overhead Drivers for special I/O devices Flexible architecture
  3. 3. EL0/PL0 least privileged mode used for applications (user mode) EL1/PL1 privileged mode used for running kernels such as the Linux kernel EL2/PL2 This has a higher level of privilege and can be used to run a hypervisor which takes control of the system and can host multiple "guest" operating systems
  4. 4. EL2 EL1 EL0 Guest Kernel Guest Kernel Guest Userspace Guest Userspace Host Userspace Host Kernel + Hypervisor Native DDs Type 2 with VHE/ARMv8.1 (e.g. KVM) Guest Kernel Guest Kernel Guest Userspace Guest Userspace Guest Userspace Guest Kernel Hypervisor Traditional Embedded Type 1 Hypervisor Native DDs
  5. 5. A dual license (GPLv2) “microvisor” implementation by KernKonzept l4re.org & kernkonzept.com/l4re.html (10-20 employees) No public repositories (only code snapshots) Requires CLA (Grant of © and patent license) Written specifically for mixed criticality compositions Typical µkernel design Kernel: address spaces, threads and IPC Everything else in user space (device drivers, apps, policy) Solid feature set: PV Linux implementation (L4Linux) ● µApps (native & Posix) ● device pass-through ● … Also see: – The L4Re Open Source Microvisor System: goo.gl/SNczQ2
  6. 6. github.com/siemens/jailhouse Lightweight (sub 10k LoC) partitioning hypervisor by Siemens Linux used for bootstrap and control of partitions Focus is on partitioning and not on virtualization No scheduler, no IO emulator, etc. Appears to have good basic feature set, with key areas WIP: cache region, config tools, ARM64 support fairly new Also see: – AGL Talk May2017: goo.gl/6HHY5a
  7. 7. xenproject.org General purpose hypervisor used in a wide range of supported use- cases and products in different markets (including embedded, military/aviation, medical, automotive) Linux or NetBSD used for bootstrap, control plane and drivers Expansive feature set, that is highly customizable and flexible Strong and diverse open source community
  8. 8. EL2 EL1 EL0 Xen Project Hypervisor Guest Kernel Guest Kernel Guest Userspace Guest Userspace Strong Isolation Device Drivers run in EL1, not EL2 Protected Address Spaces: Grant tables Trusted Computing Base (TCB) Dom0 Kernel Native DDs Dom0 Userspace Toolstack
  9. 9. EL1 EL2 EL0 Xen Project Hypervisor Guest Kernel Guest Kernel Guest Userspace Guest Userspace Control Plane Server: sysadmin Embedded: config/setup, system health monitoring (watchdog), maintenance, SW updates, … Dom0 Kernel Native DDs Dom0 Userspace Toolstack
  10. 10. Existing net, block, console keyboard, mouse, USB framebuffer, GPU sharing* New in Xen 4.9, more in 4.11 9pfs (share a filesystem between VMs) Pvcalls (forward POSIX calls across VMs) multitouch, sound, display, DRM Developing New Ones Easy to write (GPL and BSD samples) Kernel and User Space *) A number of different approaches by different vendors in different market segments are being deployed, which are PV-like, but not strictly a PV protocol
  11. 11. System Partitioning Sandboxing drivers & system components Fine-grain control of VM capabilities Enables multi-layered security approach Other Security Features Trusted Execution Environment (TEE) Virtual Machine Introspection, alt2pm Live Patching
  12. 12. Meltdown Cannot be exploited from a fully virtualized (i.e. ARM, HVM or PVH) ➜ Fully virtualized VMs offer significant protection against Meltdown Spectre On current information: substantially harder to exploit under Xen than under monolithic kernels because there are significantly fewer options for the attacker to interact with the hypervisor – Attacker needs a suitable "gadget" running inside of the Hypervisor GPZ use the eBPF engine to execute a gadget written by them, designed to 'leak' the maximum amount of information – Initial analysis: Xen has nothing similar to eBPF
  13. 13. Guest Kernel Xen Project Hypervisor Driver Domain Guest OS*: Linux, BSD, MiniOS, unikernel, … Disk Controller Guest Kernel* Storage Domain Disk Driver Guest Kernel* Network Domain Network Driver Network Controller BlockFront Driver BlockBack Driver Dom0 Kernel Application NetFront Driver NetBack Driver
  14. 14. Attack Surface Reduction Similar to Linux Security Modules/SELinux Same policy syntax as SELinux Different types, roles, users and attributes Same tools for policy compilation / verification (checkpolicy) Enabled by KCONFIG VM hypervisor domain(self) domain(other) memory (grant, mmu, shadow) inter-VM communicationpassthroughsecurity config Fine-grained policy, controlling which hypervisor functionality is accessible to this (class of) VM Effect: limit what an exploit in this VM could do
  15. 15. Pratap Sankar @ Flickr Documentation wiki.xenproject.org/wiki/Dom0_Disaggregation wiki.xenproject.org/wiki/Xen_Security_Modules_:_XSM-FLASK
  16. 16. Pratap Sankar @ Flickr Crucible:Defense starlab.io Xen Project based virtualization platform for technology protection, cyber-hardening, and system integrity for aerospace & defense systems Qubes OS www.qubes-os.org Secure OS OpenXT www.openxt.org FOSS Platform for security research, security applications and embedded appliance integration building on Xen & OpenEmbedded Virtual Machine Introspection based security Solutions Bitdefender Hypervisor Introspection Zentific Zazen
  17. 17. User defined App VMs for individual apps or groups of apps USB Service Domain Banking Domain Personal Domain Firewall VM enforces network policies Network Domain Dom0 Secure UI and sysadmin domain
  18. 18. Xen supports several different schedulers with different properties.
  19. 19. Xen supports several different schedulers with different properties. Regular VM scheduler (Credit) Hard real-time (ARINC653) Dedicated to 1 VM via pinning and Null scheduler  no scheduler overheads Soft real-time (RTDS)
  20. 20. Scheduler Use-cases Today Future plans Credit General Purpose Supported Default Supported Optional Credit 2 General Purpose Optimized for lower latency, higher VM density Supported Default RTDS Soft & Firm Real-time Multicore Embedded, Automotive, Graphics & Gaming in the Cloud, Low Latency Workloads Experimental Better XL support <1μs granularity Supported Hardening Optimization ARINC 653 Hard Real-time Single core Avionics, Drones, Medical Supported Enable via KCONFIG Null Hard Real-time Experimental (Xen 4.10) Supported
  21. 21. vCPU 0 pCPU 0 vCPU 1 pCPU 1 irq 109 virq 109 IRQ injection Always on the CPU running the vCPU
  22. 22. vCPU 0 pCPU 0 irq 109 virq 109 vCPU 1 pCPU 1 IF vIRQ target changes or vCPU is moved THEN vIRQ is moved immediately virq 109
  23. 23. vCPU 0 pCPU 0 vCPU 1 pCPU 1 irq 109 virq 109 IRQs always shadow the vIRQ  minimizes latency Xilinx ZynqMP board (four Cortex A53 cores, GICv2) WARM_MAX (excluding the first 3 interrupts): <2000ns Without Null scheduler See blog.xenproject.org/2017/03/20/xen-on-arm- interrupt-latency/
  24. 24. Code Quality: compliance CERT/MISRA coding standards Typically enforced through static analysis tools Xen Project is working through issues partnering with a tools vendor Certification Artefact Preparation: Retrofitting required artefacts covering use-case requirements to code Access to original developers can be key (otherwise rely solely on git/mailing list archaeology) Development Process: OSS development process is non-compliant with safety standards But there are routes to assess non-compliant code (e.g. IEC 61508-3 Route 3s) ➜ extra artefacts Cost/Sharing Cost: The cost of safety certification is high (25-75% of development cost) ➜ disincentive to share cost Could be done through a consortium sharing the cost of certifying an official minimal base configuration Domain specific certification standards ➜ limits ability to share cost Liability/Accountable owner: Someone to blame and deal with issues ➜ makes sharing costs harder
  25. 25. Pratap Sankar @ Flickr AIS ainfosec.com BAE Systems baesystems.com Galois galois.com Maintain FreeRTOS Xen Port Developed and maintain HalVM Dornerworks dornerworks.com/xen Consulting Xen Embedded Distros Virtuosity for Xilinx Zynq Virtuosity for NXP i.MX 8 Virtuosity (formerly ARLX) DO-178 (EAL6+), IEC 62304, ISO 26262 MILS EAL FACE, VICTORY, ARINC 653 Starlab starlab.io Crucible and Crucible:Defense Xen embedded hypervisor In progress: DO-178, MILS EAL Uses a minimal Dom0, disaggregation and XSM/FLASK Precedents of safety certification for Xen based systems www.slideshare.net/xen_com_mgr/art-certification & www.youtube.com/watch?v=UyW5ul_1ct0 www.linux.com/news/xen-project/2017/2/how-shrink-attack-surfaces-hypervisor
  26. 26. Pratap Sankar @ Flickr LG Electronics Demo bit.do/lg-xen-demo-2016 Bosch Car GmbH Contributions 10 smaller features in 2016 Perseus Founded by Xen maintainer bit.do/perseus-2017 GlobalLogic Product: Nautilus bit.do/gl-nautilus First product in production expected in 2018 Supports: HW: Renesas R-Car Gen2 & Gen3, TI Jacinto6, Intel Apollo Lake, Qualcomm 410C, Sinlinx A33 Guests: Linux up to 4.9  Android M, N, N-Car  QNX, ThreadX, FreeRTOS PV Drivers for: GPU, Audio, HW accelerated Video codecs, DRM, … Contributions: 27 smaller features from 2013 to 2016 EPAM Demo Next slide Interesting Features: Container based telematics applications running in a Xen VM that can be downloaded from a cloud service Ongoing Contributions: ABIs for PV Sound, PV Display & PV DRM Leading development of co-processor sharing framework
  27. 27. Pratap Sankar @ Flickr xenbits.xenproject.org/people/larsk/ LCC17 - The Internet of Transportation[1080P].MP4
  28. 28. Pratap Sankar @ Flickr
  29. 29. AWS Dom0 - Control DomD – HW Drivers & Cluster Wayland/Weston OpenGL ES Linux Kernel with GPU and other HW Drivers ALSA w PV_ALSAS_BE DomU Fusion Container mgmt tool Linux Kernel w/o HW Drivers Minimal rootfs with systems library Telematics simulation Agent (Acceleration, Braking, Corning, GPS) DomU – Linux IVI MW Frameworks PV DISPLAY Linux Kernel with GPU and w/o other HW Drivers PV EVENTS PV SOUND IVI Simulation App Trusted Apps TrustZone Hypervisor R-Car H3 Platform OP-TEE OS TZ monitor Driver Behavior Based Insurance Backend Telematics Simulation Agent ver 2.0 Telematics Simulation Agent ver 1.0 Monitoring Dashboard Wayland BE (Events/Display) Cluster Simulation AppDom0 Services Minimal rootfs Linux Kernel w/o HW Drivers Containers
  30. 30. Picture by Lars Kurth
  31. 31. Extremely Flexible and Versatile Proven in many different markets Easy to port to new environments Easy to develop new PV drivers Highly customizable Security and Resilience Isolation, Partitioning, Security Features Functional Safety Examples of Safety Certification Looking at ways to make this easier and cheaper Engaging with other groups looking at this (e.g. AGL, …) Challenges still being addressed Standardization of more I/O devices via PV protocols Standardization of GPU and co-processor sharing RTOS or other minimal OS as Dom0 Testing of embedded Hardware by the project Picture by Lars Kurth
  32. 32. xenbits.xenproject.org/people/larsk Picture by Lars Kurth
  33. 33. Developer Portal: bit.do/xen-devs Xen on ARM whitepaper: bit.do/xenarm-white Xen on ARM wiki: bit.do/xenarm-wiki Port Xen to a new SOC: bit.do/xenarm-porting Add Xen support Xen to your OS: bit.do/xenarm-os Device Passthrough presentation: bit.do/xenarm-pt OE meta-virtualization Xen recipe: bit.do/xenmeta OpenXT (Xen + OpenEmbedded): openxt.org Xenbedded presentation: bit.do/xenbedded Monthly ARM Community Call: bit.do/xenarm-call

×