Commercial hypervisor-based task sandboxing mechanisms are unsecured? But we can fix it!

Cyber–Physical–Social Systems are frequently prescribed for providing valuable information on personalized services. The foundation of these services is big data which must be trustily collected and efficiently processed. Though High Performance Computing Communication technique makes great contributions to addressing the issue processing, its effectiveness still relies veracity generated from Internet Things (IoT) devices. Nevertheless, IoT devices, as basic production facilities ensure data’s security, unable deploy expensive security extensions. Consequently, it causes implementation task sandboxing, fundamental mechanism in Real-Time Operating (RTOSs), much simpler more vulnerable. In this paper, we take ARM Mbed uVisor an example system, utilizing hypervisor-based sandboxing mechanisms, presents three new findings: First, discover vulnerabilities against can exploited compromise system-maintained structure manipulate any tasks’ data. Second, present LIPS (Lightweight Intra-Mode Privilege Separation), building a special protection domain isolate particular structures. Finally, thorough evaluation experimental tests show efficiency defeat attacks, with small runtime overheads good portability.