.png){kind=icon}
.png){kind=icon}
Return
Securing Operating Systems Through Fine-Grained Kernel Access Limitation for IoT Systems
.png){kind=icon}
PRE
AI
DOI：10.1109/JIOT.2022.3222074.png)
.png){kind=icon}
Original request for help.png){kind=icon}
Share.png){kind=icon}
Save
Abstract
En 中文
With the development of Internet of Things (IoT), it is gaining a lot of attention. It is important to secure the embedded systems with low overhead. The Linux Seccomp is widely used by developers to secure the kernels by blocking the access of unused syscalls, which introduces less overhead. However, there are no systematic Seccomp configuration approaches for IoT applications without the help of developers. In addition, the existing Seccomp configuration approaches are coarse-grained, which cannot analyze and limit the syscall arguments. In this article, a novel static dependent syscall analysis approach for embedded applications is proposed, which can obtain all of the possible dependent syscalls and the corresponding arguments of the target applications. So, a fine-grained kernel access limitation can be performed for the IoT applications. To this end, the mappings between dynamic library APIs and syscalls according with their arguments are built, by analyzing the control flow graphs and the data dependency relationships of the dynamic libraries. To the best of our knowledge, this is the first work to generate the fine-grained Seccomp profile for embedded applications.
Keywords:
Libraries
Kernel
Internet of Things
Linux
Security
Containers
Systematics
Dependent variable analysis
Internet of Things (IoT) security
shrinking attack surface
systematic static analysis
Journal
IF:
8.9
Papers:
1.4W
Citations:
7.8W