English (United Kingdom)

https://curated-unify.zendy.io/wp-json/zendy-region/v1/featured_content/oa?rat=en

https://curated-unify.zendy.io/wp-json/zendy-region/v1/highlighted_journal/

Global: Zendy Plus annual

Presents the access of premium content as premium feature

Premium Content

Presents the keyphrase highlighting as premium feature

Keyphrase Highlighting

Presents the summarisation as premium feature

Summarisation

Insights

Presents the pdf analysis as premium feature

PDF Analysis

Presents the zaia usage as premium feature

ZAIA

Global: Zendy Plus monthly

Global: Zendy Tools annual

Global: Zendy Tools monthly

Global: Zendy Free Plan

MMU-less Linux variant lacks security because it does not have protection orisolation mechanisms. It also does not use MPUs as they do not fit with itssoftware model because of the design drawbacks of MPUs (\ie coarse-grainedprotection with fixed number of protected regions). We secure the existingMMU-less Linux version of the RISC-V port using CHERI. CHERI is ahardware-software capability-based system that extends the ISA, toolchain,programming languages, operating systems, and applications in order to providecomplete pointer and memory safety. We believe that CHERI could providesignificant security guarantees for high-end dynamic MMU-less embedded systemsat lower costs, compared to MMUs and MPUs, by: 1) building the entire softwarestack in pure-capability CHERI C mode which provides complete spatial memorysafety at the kernel and user-level, 2) isolating user programs as separateELFs, each with its own CHERI-based capability table; this provides spatialmemory safety similar to what the MMU offers (\ie user programs cannot accesseach other's memory), 3) isolating user programs from the kernel as the kernelhas its own capability table from the users and vice versa, and 4)compartmentalising kernel modules using CompartOS' linkage-basedcompartmentalisation. This offers a new security front that is not possibleusing the current MMU-based Linux, where vulnerable/malicious kernel modules(\eg device drivers) executing in the kernel space would not compromise or takedown the entire system. These are the four main contributions of this paper,presenting novel CHERI-based mechanisms to secure MMU-less embedded Linux.

Case Study: Securing MMU-less Linux Using CHERI