ICORe: Continuous and proactive extrospection on multi-core IoT devices

Penghui Zhang; Haehyun Cho; Ziming Zhao; Adam Doupe; Gail-Joon Ahn

doi:10.1145/3297280.3297364

ICORe: Continuous and proactive extrospection on multi-core IoT devices

Penghui Zhang, Haehyun Cho, Ziming Zhao, Adam Doupe, Gail-Joon Ahn

Research output: Contribution to conference › Paper › peer-review

Abstract

In this paper, we present ICORE, a novel continuous and proactive extrospection system with high visibility on IoT devices deploying multi-core ARM platforms. Dedicated cores named Isolated Cores are configured to stay in the TrustZone secure world upon system boot to perform monitoring functionalities to extrospect static normal world kernel memory area proactively, continuously, and stealthily. Different from the existing TrustZone paradigm, in which secure world serves as the slave of the normal world, ICORE makes the secure world play a master role. Therefore, ICORE remains stealthy and proactive to perform monitoring functionalities. The evaluation results show that ICORE is effective and imposes negligible performance degradation using the SPEC CPU2017 benchmark.

Original language	English (US)
Pages	851-860
Number of pages	10
DOIs	https://doi.org/10.1145/3297280.3297364
State	Published - Jan 1 2019
Event	34th Annual ACM Symposium on Applied Computing, SAC 2019 - Limassol, Cyprus Duration: Apr 8 2019 → Apr 12 2019

Conference

Conference	34th Annual ACM Symposium on Applied Computing, SAC 2019
Country/Territory	Cyprus
City	Limassol
Period	4/8/19 → 4/12/19

Keywords

ARM TrustZone
CPU isolation
Extrospection

ASJC Scopus subject areas

Software

Access to Document

10.1145/3297280.3297364

Cite this

@conference{3e6941ad076a411f94b9d9a9a6b598c7,

title = "ICORe: Continuous and proactive extrospection on multi-core IoT devices",

abstract = "In this paper, we present ICORE, a novel continuous and proactive extrospection system with high visibility on IoT devices deploying multi-core ARM platforms. Dedicated cores named Isolated Cores are configured to stay in the TrustZone secure world upon system boot to perform monitoring functionalities to extrospect static normal world kernel memory area proactively, continuously, and stealthily. Different from the existing TrustZone paradigm, in which secure world serves as the slave of the normal world, ICORE makes the secure world play a master role. Therefore, ICORE remains stealthy and proactive to perform monitoring functionalities. The evaluation results show that ICORE is effective and imposes negligible performance degradation using the SPEC CPU2017 benchmark.",

keywords = "ARM TrustZone, CPU isolation, Extrospection",

author = "Penghui Zhang and Haehyun Cho and Ziming Zhao and Adam Doupe and Gail-Joon Ahn",

year = "2019",

month = jan,

day = "1",

doi = "10.1145/3297280.3297364",

language = "English (US)",

pages = "851--860",

note = "34th Annual ACM Symposium on Applied Computing, SAC 2019 ; Conference date: 08-04-2019 Through 12-04-2019",

}

TY - CONF

T1 - ICORe

T2 - 34th Annual ACM Symposium on Applied Computing, SAC 2019

AU - Zhang, Penghui

AU - Cho, Haehyun

AU - Zhao, Ziming

AU - Doupe, Adam

AU - Ahn, Gail-Joon

PY - 2019/1/1

Y1 - 2019/1/1

N2 - In this paper, we present ICORE, a novel continuous and proactive extrospection system with high visibility on IoT devices deploying multi-core ARM platforms. Dedicated cores named Isolated Cores are configured to stay in the TrustZone secure world upon system boot to perform monitoring functionalities to extrospect static normal world kernel memory area proactively, continuously, and stealthily. Different from the existing TrustZone paradigm, in which secure world serves as the slave of the normal world, ICORE makes the secure world play a master role. Therefore, ICORE remains stealthy and proactive to perform monitoring functionalities. The evaluation results show that ICORE is effective and imposes negligible performance degradation using the SPEC CPU2017 benchmark.

AB - In this paper, we present ICORE, a novel continuous and proactive extrospection system with high visibility on IoT devices deploying multi-core ARM platforms. Dedicated cores named Isolated Cores are configured to stay in the TrustZone secure world upon system boot to perform monitoring functionalities to extrospect static normal world kernel memory area proactively, continuously, and stealthily. Different from the existing TrustZone paradigm, in which secure world serves as the slave of the normal world, ICORE makes the secure world play a master role. Therefore, ICORE remains stealthy and proactive to perform monitoring functionalities. The evaluation results show that ICORE is effective and imposes negligible performance degradation using the SPEC CPU2017 benchmark.

KW - ARM TrustZone

KW - CPU isolation

KW - Extrospection

UR - http://www.scopus.com/inward/record.url?scp=85065674321&partnerID=8YFLogxK

UR - http://www.scopus.com/inward/citedby.url?scp=85065674321&partnerID=8YFLogxK

U2 - 10.1145/3297280.3297364

DO - 10.1145/3297280.3297364

M3 - Paper

AN - SCOPUS:85065674321

SP - 851

EP - 860

Y2 - 8 April 2019 through 12 April 2019

ER -

ICORe: Continuous and proactive extrospection on multi-core IoT devices

Abstract

Conference

Keywords

ASJC Scopus subject areas

Access to Document

Other files and links

Fingerprint

Cite this