2019/09/20 by De Simone, Luigi, Giovanni Mazzeo, Mazzeo, Giovanni
Computer Science · #Real-Time Systems Scheduling #Security and Verification in Computing #Embedded Systems Design Techniques
paper · pdf · doi:10.48550/arxiv.1909.09486
A promising approach for designing critical embedded systems is based on\nvirtualization technologies and multi-core platforms. These enable the\ndeployment of both real-time and general-purpose systems with different\ncriticalities in a single host. Integrating virtualization while also meeting\nthe real-time and isolation requirements is non-trivial, and poses significant\nchallenges especially in terms of certification. In recent years, researchers\nproposed hardware-assisted solutions to face issues coming from virtualization,\nand recently the use of Operating System (OS) virtualization as a more\nlightweight approach. Industries are hampered in leveraging this latter type of\nvirtualization despite the clear benefits it introduces, such as reduced\noverhead, higher scalability, and effortless certification since there is still\nlack of approaches to address drawbacks. In this position paper, we propose the\nusage of Intel's CPU security extension, namely SGX, to enable the adoption of\nenclaves based on unikernel, a flavor of OS-level virtualization, in the\ncontext of real-time systems. We present the advantages of leveraging both the\nSGX isolation and the unikernel features in order to meet the requirements of\nsafety-critical real-time systems and ease the certification process.\n