Embedded devices face an ever-expanding threat landscape: vulnerabilities in application software, operating system kernels, and peripherals threaten the embedded device integrity. Existing computer-architectural defenses fully consider at most two of these threat vectors in their security model. This paper aims at addressing this gap using a novel capability architecture. To this end, we combine a token capability approach suitable for building an untrusted operating system with protection against malicious devices without requiring hardware changes to peripherals. First, we develop and evaluate a full FPGA implementation of our capability architecture around legacy hardware components. Further, we present a soft real-time operating system based on Zephyr that has no run-time software TCB. To this end, we disaggregate Zephyr's subsystems into small, mutually isolated components. All subsystems that exist at run time, including scheduler, allocator and DMA drivers, and all peripherals are fully untrusted. We believe that our work offers a foundation for more rigorous security-by-design in tomorrow's security-critical embedded devices.

翻译：嵌入式设备面临着日益扩大的威胁格局：应用软件、操作系统内核及外设中的漏洞均可能危及嵌入式设备完整性。现有计算机架构防御方案在其安全模型中至多仅全面考量其中两种威胁向量。本文旨在通过一种新型能力架构填补这一空白。为此，我们将适用于构建不可信操作系统的令牌能力方法与无需修改外设硬件的恶意设备防护机制相结合。首先，我们围绕传统硬件组件开发并评估了完整的能力架构FPGA实现。进一步，我们提出了基于Zephyr的软实时操作系统，该系统在运行时不存在软件可信计算基。为实现这一目标，我们将Zephyr的子系统解耦为小型、相互隔离的组件。所有运行时存在的子系统——包括调度器、分配器、DMA驱动程序以及所有外设——均完全不可信。我们相信，本研究为未来安全关键型嵌入式设备中更严格的安全设计提供了基础。