Micro-controller units (MCUs) implement the de facto interface between the physical and digital worlds. As a consequence, they appear in a variety of sensing/actuation applications, from smart personal spaces to complex industrial control systems and safety-critical medical equipment. While many of these devices perform safety- and time-critical tasks, they often lack support for security features compatible with their importance to overall system functions. This lack of architectural support leaves them vulnerable to run-time attacks that can remotely alter their intended behavior, with potentially catastrophic consequences. In particular, we note that MCU software often includes untrusted third-party libraries (some of them closed-source) that are blindly used within MCU programs, without proper isolation from the rest of the system. In turn, a single vulnerability (or intentional backdoor) in one such third-party software can often compromise the entire MCU software state. In this paper, we tackle this problem by proposing, demonstrating security, and formally verifying the implementation of UCCA: an Untrusted Code Compartment Architecture. UCCA provides flexible hardware-enforced isolation of untrusted code sections (e.g., third-party software modules) in resource-constrained and time-critical MCUs. To demonstrate UCCA's practicality, we implement an open-source version of the design on a real resource-constrained MCU: the well-known TI MSP430. Our evaluation shows that UCCA incurs little overhead and is affordable even to lowest-end MCUs, requiring significantly less overhead and assumptions than prior related work.

翻译：微控制器单元（MCU）作为物理世界与数字世界的实际接口，广泛应用于从智能个人空间到复杂工业控制系统及安全关键医疗设备等多种传感/执行应用中。尽管许多此类设备执行安全关键与时间关键任务，但它们通常缺乏与其系统功能重要性相匹配的安全特性架构支持。这种架构支持的缺失使其易受运行时攻击，攻击者可远程篡改其预期行为，造成潜在的灾难性后果。值得注意的是，MCU软件常包含未经验证的第三方库（部分为闭源），这些库被盲目集成至MCU程序而未与系统其余部分充分隔离。因此，第三方软件中的一个漏洞（或蓄意后门）往往可能危及整个MCU软件状态。本文针对该问题提出了一种不可信代码隔离架构UCCA，并对其安全性进行了论证与形式化验证。UCCA在资源受限且时间关键的MCU中，为不可信代码段（如第三方软件模块）提供由硬件强制的灵活隔离机制。为验证UCCA的实用性，我们在真实资源受限MCU平台——知名TI MSP430上实现了设计的开源版本。评估表明，UCCA开销极低，即使对最低端MCU也可承受，较之先前相关工作大幅减少了开销与假设要求。