Fernando A. Teixeira
Fernando M. Q. Pereira
ABSTRACT
The Internet of Things (IoT) is increasingly more relevant. This growing importance calls for tools able to provide users with correct, reliable and secure systems. In this paper, we claim that traditional approaches to analyze distributed systems are not expressive enough to address this challenge. As a solution to this problem, we present SIoT, a framework to analyze networked systems. SIoT's key insight is to look at a distributed system as a single body, and not as separate programs that exchange messages. By doing so, we can crosscheck information inferred from different nodes. This crosschecking increases the precision of traditional static analyses. To construct this global view of a distributed system we introduce a novel algorithm that discovers inter-program links efficiently. Such links lets us build a holistic view of the entire network, a knowledge that we can thus forward to a traditional tool. We prove that our algorithm always terminates and that it correctly models the semantics of a distributed system. To validate our solution, we have implemented SIoT on top of the LLVM compiler, and have used one instance of it to secure 6 ContikiOS applications against buffer overflow attacks. This instance of SIoT produces code that is as safe as code secured by more traditional analyses; however, our binaries are on average 18% more energy-efficient.
- F. E. Allen. Control flow analysis. ACM Sigplan Notices, 5: 1--19, 1970. Google Scholar
Digital Library
- K. Ashton. That 'Internet of Things' Thing. RFiD Journal, 22: 97--114, 2009.Google Scholar
- L. Atzori, A. Iera, and G. Morabito. The Internet of Things: A survey. Computer Networks, 54(15): 2787--2805, 2010. Google ScholarDigital Library
- S. Babar, P. Mahalle, A. Stango, N. Prasad, and R. Prasad. Proposed security model and threat taxonomy for the Internet of Things (IoT). In Recent Trends in Network Security and Applications. Springer, 2010.Google ScholarCross Ref
- D. Balzarotti, M. Cova, V. Felmetsger, N. Jovanovic, E. Kirda, C. Kruegel, and G. Vigna. Saner: Composing static and dynamic analysis to validate sanitization in web applications. In Symposium on Security and Privacy (S&P). IEEE, 2008. Google ScholarDigital Library
- G. Bronevetsky. Communication-sensitive static dataflow for parallel message passing applications. In International Symposium on Code Generation and Optimization (CGO). IEEE, 2009. Google ScholarDigital Library
- H. Chen, W. Chen, J. Huang, B. Robert, and H. Kuhn. MPIPP: An automatic profile-guided parallel process placement toolset for smp clusters and multiclusters. In International Conference on Supercomputing. ACM, 2006. Google ScholarDigital Library
- B. Chess and J. West. Secure Programming with Static Analysis. Addison-Wesley Professional, first edition, 2007. Google ScholarDigital Library
- N. Cooprider, W. Archer, E. Eide, D. Gay, and J. Regehr. Efficient memory safety for tinyos. In Conference on Embedded Networked Sensor Systems (SenSys). ACM, 2007. Google ScholarDigital Library
- C. Cowan, F. Wagle, C. Pu, S. Beattie, and J. Walpole. Buffer overflows: attacks and defenses for the vulnerability of the decade. In DARPA Information Survivability Conference and Exposition, (DISCEX). DARPA, 2000.Google Scholar
- R. Cytron, J. Ferrante, B. K. Rosen, M. N. Wegman, and F. K. Zadeck. Efficiently computing static single assignment form and the control dependence graph. Transactions on Programming Languages and Systems, (TOPLAS), 13(4): 451--490, 1991. Google ScholarDigital Library
- J. Devietti, C. Blundell, M. M. Martin, and S. Zdancewic. Hardbound: architectural support for spatial safety of the c programming language. ACM SIGOPS Operating Systems Review, 42(2): 103--114, 2008. Google ScholarDigital Library
- D. Dhurjati, S. Kowshik, and V. Adve. SAFECode: enforcing alias analysis for weakly typed languages. In Conference on Programming Language Design and Implementation, (PLDI). ACM, 1996. Google ScholarDigital Library
- A. Dunkels, B. Gronvall, and T. Voigt. Contiki - a lightweight and flexible operating system for tiny networked sensors. In International Conference on Local Computer Networks (LCN). IEEE, 2004. Google ScholarDigital Library
- P. Feautrier. Automatic parallelization in the polytope model. In The Data Parallel Programming Model. Springer, 1996. Google ScholarDigital Library
- S. Ghose, L. Gilgeous, P. Dudnik, A. Aggarwal, and C. Waxman. Architectural support for low overhead detection of memory violations. In Design, Automation & Test in Europe (DATE). IEEE, 2009. Google ScholarDigital Library
- T. Heer, O. Garcia-Morchon, R. Hummen, S. L. Keoh, S. S. Kumar, and K. Wehrle. Security challenges in the IP-based Internet of Things. Springer Wireless Personal Communications, 61(3): 527--542, 2011. Google ScholarDigital Library
- S. L. Kinney. Trusted platform module basics: using TPM in embedded systems. Newnes, 2006. Google ScholarDigital Library
- T. Kothmayr, W. Hu, C. Schmitt, M. Bruenig, and G. Carle. Poster: Securing the internet of things with DTLS. In Conference on Embedded Networked Sensor Systems, (SenSys). ACM, 2011. Google ScholarDigital Library
- C. Lattner and V. S. Adve. LLVM: A compilation framework for lifelong program analysis & transformation. In International Symposium on Code Generation and Optimization (CGO). IEEE, 2004. Google ScholarDigital Library
- P. Li and J. Regehr. T-check: bug finding for sensor networks. In International Conference on Information Processing in Sensor Networks (IPSN). ACM, 2010. Google ScholarDigital Library
- S. Nagarakatte, M. M. Martin, and S. Zdancewic. Watchdog: Hardware for safe and secure manual memory management and full memory safety. Computer Architecture News, 40(3): 189--200, 2012. Google ScholarDigital Library
- S. Nagarakatte, M. M. Martin, and S. Zdancewic. Watchdoglite: Hardware-accelerated compiler-based pointer checking. In International Symposium on Code Generation and Optimization (CGO). IEEE, 2014. Google ScholarDigital Library
- N. Nethercote and J. Seward. Valgrind: a framework for heavyweight dynamic binary instrumentation. In Conference on Programming language design and implementation, (PLDI). ACM, 2007. Google ScholarDigital Library
- F. Nielson, H. R. Nielson, and C. Hankin. Principles of program analysis. Springer Science & Business Media, 1999. Google ScholarDigital Library
- L. Oliveira, M. Scott, J. Lopez, and R. Dahab. Tinypbc: Pairings for authenticated identity-based non-interactive key distribution in sensor networks. In International Conference on Networked Sensing Systems,(INSS)., pages 173--180. IEEE, 2008.Google ScholarCross Ref
- K. J. Ottenstein, R. A. Ballance, and A. B. MacCabe. The program dependence web: a representation supporting control-, data-, and demand-driven interpretation of imperative languages. In Conference on Programming Language Design and Implementation, (PLDI). ACM, 1990. Google ScholarDigital Library
- V. Pascual and L. Hascoët. Native handling of Message-Passing communication in Data-Flow analysis. In Springer Recent Advances in Algorithmic Differentiation. Springer, 2012.Google ScholarCross Ref
- S. Pellegrini. On Simplifying and Optimizing Message Passing Programs: A Compiler and Runtime-Based Approach. PhD thesis, University of Innsbruck, 2011.Google Scholar
- A. Perrig, R. Szewczyk, V. Wen, D. Culler, and J. D. Tygar. SPINS: Security protocols for sensor networks. Wireless Networks, 8(5): 521--534, 2002. Also in MobiCom'01. Google ScholarDigital Library
- R. Preissl, T. Köckerbauer, M. Schulz, D. Kranzlmüller, B. R. d. Supinski, and D. J. Quinlan. Detecting patterns in mpi communication traces. In International Conference on Parallel Processing (ICPP). ICPP, 2008. Google ScholarDigital Library
- R. E. Rodrigues, V. H. S. Campos, and F. M. Q. Pereira. A fast and low overhead technique to secure programs against integer overflows. In International Symposium on Code Generation and Optimization (CGO). IEEE, 2013. Google ScholarDigital Library
- R. Sasnauskas, O. Landsiedel, M. H. Alizai, C. Weise, S. Kowalewski, and K. Wehrle. Kleenet: discovering insidious interaction bugs in wireless sensor networks before deployment. In International Conference on Information Processing in Sensor Networks (IPSN). ACM, 2010. Google ScholarDigital Library
- E. J. Schwartz, T. Avgerinos, and D. Brumley. All you ever wanted to know about dynamic taint analysis and forward symbolic execution (but might have been afraid to ask). In Symposium on Security and Privacy (S&P). IEEE, 2010. Google ScholarDigital Library
- K. Serebryany, D. Bruening, A. Potapenko, and D. Vyukov. AddressSanitizer: a fast address sanity checker. In Annual Technical Conference (ATA). USENIX, 2012. Google ScholarDigital Library
- D. Singh and W. J. Kaiser. The atom LEAP platform for energy-efficient embedded computing. Technical Report 88b146bk, UCLA, 2010.Google Scholar
- M. Sridharan, S. Artzi, M. Pistoia, S. Guarnieri, O. Tripp, and R. Berg. F4F: taint analysis of framework-based web applications. In Conference on Object-Oriented Programming (OOPSLA). ACM, 2011. Google ScholarDigital Library
- O. Tripp, M. Pistoia, S. J. Fink, M. Sridharan, and O. Weisman. TAJ: Effective taint analysis of web applications. In Conference on Programming Language Design and Implementation (PLDI). ACM, 2009. Google ScholarDigital Library
- X. Wu and F. Mueller. Scalaextrap: Trace-based communication extrapolation for spmd programs. In Symposium on Principles and Practice of Parallel Programming (PPoPP). ACM, 2011. Google ScholarDigital Library
Index Terms
- SIoT: securing the internet of things through distributed system analysis
Recommendations
Tainting is not pointless
Pointer tainting is a form of Dynamic Information Flow Tracking used primarily to prevent software security attacks such as buffer overflows. Researchers have also applied pointer tainting to malware and virus analysis.
A recent paper by Slowinska and ...
Tracking pointers with path and context sensitivity for bug detection in C programs
This paper proposes a pointer alias analysis for automatic error detection. State-of-the-art pointer alias analyses are either too slow or too imprecise for finding errors in real-life programs. We propose a hybrid pointer analysis that tracks actively ...
SIoT: Securing Internet of Things through distributed systems analysis
AbstractThe Internet of Things (IoT) is increasingly more relevant. This growing importance calls for tools able to provide users with correct, reliable and secure systems. In this paper, we claim that traditional approaches to analyze ...
Highlights- A Buffer Overflow prevention mechanism tailor-made for Internet of Things.
- An ...
Comments