Many safety-critical systems require timely processing of sensor inputs to avoid potential safety hazards. Additionally, to support useful application features, such systems increasingly have a large rich operating system (OS) at the cost of potential security bugs. Thus, if a malicious party gains supervisor privileges, they could cause real-world damage by denying service to time-sensitive programs. Many past approaches to this problem completely isolate time-sensitive programs with a hypervisor; however, this prevents the programs from accessing useful OS services. We introduce Ringmaster, a novel framework that enables enclaves or TEEs (Trusted Execution Environments) to asynchronously access rich, but potentially untrusted, OS services via Linux's io_uring. When service is denied by the untrusted OS, enclaves continue to operate on Ringmaster's minimal ARM TrustZone kernel with access to small, critical device drivers. This approach balances the need for secure, time-sensitive processing with the convenience of rich OS services. Additionally, Ringmaster supports large unmodified programs as enclaves, offering lower overhead compared to existing systems. We demonstrate how Ringmaster helps us build a working highly-secure system with minimal engineering. In our experiments with an unmanned aerial vehicle, Ringmaster achieved nearly 1GiB/sec of data into enclave on a Raspberry Pi4b, 0-3% throughput overhead compared to non-enclave tasks.

翻译：许多安全关键系统需要及时处理传感器输入以避免潜在的安全隐患。此外，为支持实用的应用功能，此类系统日益采用功能丰富的大型操作系统（OS），但代价是可能存在安全漏洞。因此，若恶意方获取超级用户权限，可通过拒绝为时间敏感型程序提供服务而造成实际损害。以往针对此问题的诸多方法采用虚拟机监控程序完全隔离时间敏感型程序，但这阻碍了程序访问有用的操作系统服务。本文提出Ringmaster——一种创新框架，使安全飞地或可信执行环境（TEE）能通过Linux的io_uring异步访问功能丰富但可能不可信的操作系统服务。当不可信操作系统拒绝服务时，安全飞地可在Ringmaster基于ARM TrustZone的极简内核上持续运行，并访问少量关键设备驱动程序。该方法在安全的时间敏感型处理需求与丰富操作系统服务的便利性之间取得平衡。此外，Ringmaster支持将大型未修改程序作为安全飞地运行，与现有系统相比具有更低开销。我们展示了Ringmaster如何以最小工程成本构建高安全性可运行系统。在基于树莓派4B的无人机实验中，Ringmaster实现近1GiB/秒的数据传输至安全飞地，与非飞地任务相比吞吐量开销仅为0-3%。