Harbor: Software based Memory Protection for Sensor Nodes Ram Kumar, Akhilesh Singhania, Eddie Kohler and Mani Srivastava Introduction: Memory protection required to build robust sensor software Introduction: Memory protection required to build robust sensor software Memory Corruption in Motes Memory Map System Overview UCLA – UCR – Caltech – USC – CSU – JPL – UC Merced Center for Embedded Networked Sensing Protection Domains MMU is not the solution Solution Analysis: Memory Protection Primitives Solution Analysis: Memory Protection Primitives Proposed Solution: Software based Fault Isolation Proposed Solution: Software based Fault Isolation Resource Utilization Run-time Stack Sensor Node Address Space Globals and Heap (Apps., drivers, OS) No Protection 0x0000 0x0200 CoreMMUCacheArea (mm 2 ) 0.13umW/MHz ARM7-TDMINo ARM720TYes8 Kb2.40 (~10x)0.2 (~2x) MMU hardware requires lot of RAM Increases area and power consumption Poor performance - High context switch overhead Cost is key factor in microcontroller designs Single address space CPU Shared by apps., drivers and OS Many bugs in deployed systems come from memory corruption Corrupted nodes trigger network-wide failures Data RAM - Non contiguous partitions Program FLASH - Contiguous partitions Domains –Logical partitioning of address space –One or more applications per domain Protect domains from corrupting one another 0x0200 0x0000 Fine-grained layout and ownership information User xxx Domain Kernel Domain Partition address space into blocks Allocate memory in segments (Set of contiguous blocks) More protection domains  More bits per block  Larger memory map Larger protected address range  Larger memory map Larger block size  Smaller memory map Larger block size  Greater internal fragmentation Cross Domain Call Program Memory Domain A call fooJT foo_ret: Domain B foo: … ret Register exported function fooJT:jmp foo Jump Table Cross Domain Call Stub  Verify call into jump table  Compute callee domain ID  Determine return address  Verify call into jump table  Compute callee domain ID  Determine return address Data Memory Stack Grows Down Stack Bounds RUN-TIME STACK SAFE STACK HEAP and GLOBALS Safe Stack Stores cross domain call frames Stores return addresses 9.5% 5.1% 5.8% 3.4% Performance Tests CPU intensive applications Sandbox has lesser overhead than VM Experiment Setup –3-hop linear network simulated in Avrora –Tree Routing and Surge modules –Data pkts. transmitted every 4 seconds –Control packets transmitted every 20 seconds 1.7% increase in relative CPU utilization –Absolute increase in CPU % to 8.56% –164 run-time checks introduced –Checks executed ~20000 times Detected and prevented corruption during deployment Data Collector Application Binary Re-Writer Binary Re-Writer Sandbox Binary Raw Binary Memory Map Memory Map Control Flow Mgr. Control Flow Mgr. Memory Safe Binary Binary Verifier Binary Verifier Desktop Sensor Node Challenges No static address space partitions Limited address space - No MMU Very little physical memory Harbor’s Approach –Maintain fine-grained map of layout –Validate accesses using map at run-time –Sandbox on desktop –Verify on sensor node