2017/06/18 by Thomas Nyman, Nyman, Thomas, Jan-Erik Ekberg +5 · 2 citations
Computer Science · Materials Science · #Cloud Data Security Solutions #Cryptography and Security (cs.CR) #Diamond and Carbon-based Materials Research #FOS: Computer and information sciences #Security and Verification in Computing
paper · pdf · doi:10.48550/arxiv.1706.05715
openalex publication_date 2017/06/18 · openalex created_date 2025/10/10 · openalex updated_date 2026/07/28
With the increasing scale of deployment of Internet of Things (IoT), concerns about IoT security have become more urgent. In particular, memory corruption attacks play a predominant role as they allow remote compromise of IoT devices. Control-flow integrity (CFI) is a promising and generic defense technique against these attacks. However, given the nature of IoT deployments, existing protection mechanisms for traditional computing environments (including CFI) need to be adapted to the IoT setting. In this paper, we describe the challenges of enabling CFI on microcontroller (MCU) based IoT devices. We then present CaRE, the first interrupt-aware CFI scheme for low-end MCUs. CaRE uses a novel way of protecting the CFI metadata by leveraging TrustZone-M security extensions introduced in the ARMv8-M architecture. Its binary instrumentation approach preserves the memory layout of the target MCU software, allowing pre-built bare-metal binary code to be protected by CaRE. We describe our implementation on a Cortex-M Prototyping System and demonstrate that CaRE is secure while imposing acceptable performance and memory impact.