EnsuringCodeSafetyWithoutRuntimeChecksforRealti.pptVIP

Ensuring Code Safety Without Run-time Checks for Real-time Control Systems -Presented by Sumant Kowshik Joint Work With Dinakar Dhurjati and Vikram Adve. University of Illinois at Urbana-Champaign Motivation Reliable online upgrade of control software. Control code upgrade can have Timing errors Logical errors Runtime software faults Violate memory safety. Bugs or attacks due to memory errors. Platforms with limited address protection Malicious upgrades compromise system and the framework for reliable upgrade. Insider attacks: SANS/FBI report. Motivation Reliable online upgrade of control software. Control code upgrade can have Timing errors Logical errors Runtime software faults Violate memory safety. Attacks disguised as upgrades. Platforms with limited address protection Malicious upgrades compromise system and the framework for reliable upgrade. Insider attacks: SANS/FBI report. Motivation II Memory safety: static checking? Avoid run-time overhead Early bug detection Static checking for general languages difficult. Impose restrictions on the language – Control-C Rationale: Structure of control code Computationally intensive, use dense arrays Simple data structures, dynamic memory. Mostly in C. Related work What’s wrong with existing solutions? Java, RT-Java, Ccured, Safe-C etc. Runtime checks Garbage collection Current Alternatives Vault [PLDI01], Cyclone[PLDI02] Target general applications Annotations: cumbersome. Runtime checks. Complementary techniques Proof carrying code: compiler untrusted. Vault, Engler et al [OSDI00], Wagner et al. Checking library code. Contributions of control-C Targets embedded/control code. 100% static checking to guarantee safety. Easy portability: As close to C as possible. Novel language features Region-based dynamic memory: single region active at a time. Array sizes, index expressions and loop bounds affine expressions. Outline of Talk Introduction Context System assumptions Attacks. Language rules Imp