research-article Challenges for the design of a privacy-preserving, multi-domain telemetry system for widely-spread network security appliances Share on Authors: Christophe Bacara Stormshield, CRIStAL - Université de Lille Stormshield, CRIStAL - Université de LilleView Profile , Damien Deville Stormshield StormshieldView Profile , Michaël Hauspie CRIStAL - Université de Lille CRIStAL - Université de LilleView Profile , Gilles Grimaud CRIStAL - Université de Lille CRIStAL - Université de LilleView Profile Authors Info & Affiliations W-P2DS'18: Proceedings of the 1st Workshop on Privacy by Design in Distributed SystemsApril 2018 Article No.: 4Pages 1–6https://doi.org/10.1145/3195258.3195262Published:23 April 2018 0citation83DownloadsMetricsTotal Citations0Total Downloads83Last 12 Months9Last 6 weeks0 Get Citation AlertsNew Citation Alert added!This alert has been successfully added and will be sent to:You will be notified whenever a record that you have chosen has been cited.To manage your alert preferences, click on the button below.Manage my AlertsNew Citation Alert!Please log in to your account Save to BinderSave to BinderCreate a New BinderNameCancelCreateExport CitationPublisher SiteGet Access

This paper presents two ways of building dedicated embedded operating systems. The constructive approach consists in starting from a minimal kernel and adding abstractions as they are needed, whereas the destructive approach promotes the idea of customizing an existing operating system by removing unnecessary abstractions. We compare these two approaches on the example of building an embedded Java operating system and discuss the pros and cons of each method. We conclude by exhibiting the weakness of each approaches concerning dynamic adaptation of the system. Key-words: System customization, embedded system, JavaOS ∗ IRCICA/LIFL, Univ. Lille 1, UMR CNRS 8022, INRIA Futurs, POPS research group. This work is partially supported by grants from the CPER Nord-Pas-de-Calais TACT LOMC C21, the French Ministry of Education and Research (ACI Sécurité Informatique SPOPS), and Gemplus Research Labs. Deux approches pour la construction de systèmes d’exploitation embarqués Résumé : Ce document présente deux approches pour la construction de systèmes d’exploitation embarqués. L’approche constructive consiste à partir d’un noyau minimaliste auquel on ajoute les abstractions systèmes requises, alors que l’approche destructive se base sur l’idée de personnaliser un système existant en retirant les abstractions inutiles. Nous comparons ces deux approches en prennant l’exemple d’un système d’exploitation Java embarqué, et évaluons les avantages et inconvénients de chaque approche. Nous concluons en montrant les limitations des deux approches en ce qui concerne l’adaptation dynamique du système. Mots-clés : Personnalisation de système, système embarqué, système Java Alternative schemes for low-footprint operating systems building 3

This paper explores the use of execution-based Web content analysis to protect users from Internet-borne malware. Many anti-malware tools use signatures to identify malware infections on a user's PC. In contrast, our approach is to render and observe active Web content in a disposable virtual machine before it reaches the user's browser, identifying and blocking pages whose behavior is suspicious. Execution-based analysis can defend against undiscovered threats and zero-day attacks. However, our approach faces challenges, such as achieving good interactive performance, and limitations, such as defending against malicious Web content that contains non-determinism. To evaluate the potential for our execution-based technique, we designed, implemented, and measured a new proxy-based anti-malware tool called SpyProxy. SpyProxy intercepts and evaluates Web content in transit from Web servers to the browser. We present the architecture and design of our SpyProxy prototype, focusing in particular on the optimizations we developed to make on-the-fly execution-based analysis practical. We demonstrate that with careful attention to design, an execution-based proxy such as ours can be effective at detecting and blocking many of today's attacks while adding only small amounts of latency to the browsing experience. Our evaluation shows that SpyProxy detected every malware threat to which it was exposed, while adding only 600 milliseconds of latency to the start of page rendering for typical content.

Abstract This article proposes a solution to guarantee safe interaction to components that are willing to collaborate in an extensible operating system, dedicated to small embedded systems such as smart cards, that guarantees isolation. We propose a simple way to verify the behaviour of some components using an extension of the type system by adding information about argument-passing modes to the method signatures (e.g., is an argument read or written?). We present a formalization of a PCC-like algorithm (off-card proof generator and on-card proof verifier) to statically check the passing modes of the components in the CAMILLE exokernel for smart cards. We apply our technique to ensure trust between collaborative real-time extensions with the aim of supporting safe dynamic loading of scheduling policy.

This paper presents the work we have conducted concerning real time scheduling in Camille, an exokernel dedicated to smart cards. We show that it is possible to embedded a flexible real-time operating system despite the important hardware limitations of the smart card platform. We present the major difficulties one has to face when integrating real time support in an exokernel embedded on a very resource-limited platform. We first present a naive solution consisting in allocating an equal time slice to every system extensions and letting each one share it as needed amongst its tasks. We show that this solution does not account for loading of new extensions in the system, and that it can fail if some extensions have much more work to carry out than the others. We then present a more complex solution based upon collaborative schedulers grouped as virtual extensions. We show that this solution supports dynamic loading of new extensions and works even for very unbalanced task repartitions. We finally address the issue of trust between the collaborating extensions and we propose a solution based on exhaustive testing and formal proving of the plan functions.

This paper presents the binding model implemented in Camille, an extensible operating system for resource-limited devices. Modern embedded systems need on the first hand to fully exploit the limited hardware on which they run and on the other hand to dynamically adapt themselves to changes in their runtime environment. Camille is an exokernel which support static customization of components and dynamic loading of system extensions. Dynamic kernel and application adaptation is implemented by an inter-component communication model. This model is based on flexible bindings which permit to fully customize the way components interact with each others. Bindings can be static, virtual or compiled to guarantee performances of inter-component communications. This paper shows that it is possible to build a flexible operating system without sacrificing runtime performances, even for devices as constrained as smart cards. We first present the architecture of the Camille exokernel and the intermediate language Facade into which applications and system components are translated to ease type verification. We then describe the component model implemented in Camille and the inter-component communication scheme based on embedded binding factories. We then details the binding generation process and the various verifications which can be enforced when implementing bindings. We present some experimental results we have obtained when monitoring the performances of our native code generator. Finally, we conclude and discuss the future work we plan to conduct concerning extraction of selected properties from generated code.

Smart cards and embedded devices are well known for being low end platforms with limited resources and computing power. Thus they are not provided with embedded compilers which are said to be expensive and prefer using byte code interpreters rather than just in time or on the fly compilers. The following paper will challenge this idea and motivate the expected benefits of an embedded on the fly compilation process. Tracks will be given to succeed in compiling in the very small. This paper presents the component binding model implemented inCAMILLE , an extensible operating system for resource-limited devices. Modern embedded systems need on the first hand to fully exploit the limited hardware on which they run and and the other hand to dynamically adapt themselves to changes in their runtime environment. CAMILLE is an exokernel which support static customization of components and dynamic loading of system extensions. Dynamic kernel and application adaptation is implemented by an inter-component communication model. This model is based on flexible bindings which permit to fully customize the way components interact with each others. Bindings can be static, virtual or compiled to guarantee performances of intercomponent communications. This paper shows that it is possible to build a flexible operating system without sacrificing runtime performances, even for devices as constrained as smart cards. Some architectural and experimental results will be extracted from the CAMILLE generic embedded on the fly code compiler.

This paper presents two ways of building dedicated embedded operating systems. The constructive approach consists in starting from a minimal kernel and adding abstractions as they are needed, whereas the destructive approach promotes the idea of customizing an existing operating system by removing unnecessary abstractions. We compare these two approaches on the example of building an embedded Java operating system and discuss the pros and cons of each method. We conclude by exhibiting the weakness of each approaches concerning dynamic adaptation of the system.

Abstract: This paper presents the binding model implemented in Camille, an extensible operating systemfor resource-limited devices. Modern embedded systems need on the first hand to fullyexploit the limited hardware on which they run and on the other hand to dynamically adaptthemselves to changes in their runtime environment. Camille is an exokernel which supportstatic customization of components and dynamic loading of system extensions. Dynamic kerneland application adaptation is implemented by an...

Computing WCET in a resource-constrained device such as a smart card in a safe manner raises some difficulties. In- deed, most of the classical algorithms for computing WCET do not address resource-limitation or security issues. In this article, we propose to distribute the computation process between the off-card part running on a powerful workstation and the on-card part specific to the hardware included in the smart card. We also guarantee the safety of our com- putation process by inserting assertions in the generated code and preventing information leaks from the card to the outside.

Considering the typical amount of memory available on a smart card, it is essential to minimize the size of the runtime environment to leave as much memory as possible to applications. This paper shows that on-the-fly constant pool packing can result in a significant reduction of the memory footprint of an embedded Java runtime environment. We first present JITS, an architecture dedicated to building fully-customized Java runtime environments for smart cards. We then detail the optimizations we have implemented in the class loading mechanism of JITS to reduce the size of the loaded class constant pool. By suppressing constant pool entries as they become unnecessary during the class loading process, we manage to compact constant pools of loaded classes to less than 8% of their initial size. We then present the results of our mechanism in term of constant pool and class size reductions, and conclude by suggesting some more aggressive optimizations.

Computing WCET in a resource-constrained device such as a smart card in a safe manner raises some difficulties. Indeed, most of the classical algorithms for computing WCET do not address resource-limitation or security issues. In this article, we propose to distribute the computation process between the off-card part running on a powerful workstation and the on-card part specific to the hardware included in the smart card. We also guarantee the safety of our computation process by inserting assertions in the generated code and preventing information leaks from the card to the

Over the last twenty years, the software in smart cards has radically changed. This has happened for several reasons, smart card software was initially rigid and monolithic and has now become more flexible with a clear separation between “operating system level” and “application level” parts. What is more, application-level resources are now much more accessible (nearly to end user level). Nevertheless, smart cards have evolved separately from an ever more distributed “outside world”. This paper presents two contributions to next-generation smart card operating systems. The first, called CAMILLE, relies on the exo-kernel approach to obtain extensibility, without compromising security, raising making operating systems accessible to application designers. The second, called AWARE, reveals the mismatch between the smart card execution model and the role it is expected to play in distributed systems. We propose solutions that allow for multi-tasking and reactivity. Beyond these projects, there are a number of obstacles that need to be overcome before we can reach what might be the ultimate step in smart card operating system design. In conclusion, this paper presents current work around two related challenges, namely resource control and real-time operation.

Les cartes a puces sont des petits objets portables axes principalement sur la securite ($10^9$ unites vendues principalement en Asie et en Europe). Afin de permettre aux logiciels encartes de supporter plus de services, les systemes d'exploitation pour cartes ont evolue d'une plateforme d'execution monolithique dediee vers des architectures systemes plus ouvertes qui supportent le chargement dynamique de code. Cet article presente les problemes temps-reel du systeme d'exploitation pour carte Camille, qui presente les caracteristiques suivantes : chargement dynamique de code, verification de type embarquee, compilation a la volee, et chargement dynamique de composants systemes. D'une maniere plus generale, il traite des difficultes a accorder les extensions temps-reel avec les principes des exo-noyaux.