ACES: Automatic Compartments for Embedded Systems
summary
ACES is an LLVM-based compiler that auto-infers compartments for bare‑metal embedded code, uses static analysis plus a micro‑emulator and the MPU to enforce least‑privilege, and maps functions, globals and peripherals into compartments under three policies (naive filename, optimized filename, peripheral). Evaluation on a Cortex‑M4 across five apps shows low runtime overhead (as little as 13% runtime overhead on the largest app), and claims 59% less Flash and 84% less RAM than Mbed μVisor while cutting ROP exposure ~94%.
AI-written summary · about
chapters (17)
- 0:00Intro
- 0:31PROBLEM STATEMENT
- 2:19ACES OVERVIEW
- 3:18RELATED WORK
- 4:05COMPARTMENTS
- 5:19CREATING COMPARTMENT
- 6:44PROGRAM DEPENDENCY GRAPH
- 7:26REGION GRAPH
- 8:20COMPARTMENTALIZATION POLICY
- 9:33OPTIMIZE
- 9:57LOWERING
- 11:06MAPPING TO MEMORY
- 11:35RESTRICTING CONTROL-FLOW
- 12:13MICRO-EMULATOR
- 15:40RUNTIME EVALUATION
- 16:36MEMORY OVERHEAD
- 17:52CONCLUSION
related talks
10mNative Parity for Development & Testing of SOAFEE Software-Defined Vehicle
15mA Pre-silicon Development & Analysis for SOAFEE to Accelerate Product Development
19mCoSMIX: A Compiler-based System for Secure Memory Instrumentation and Execution in Enclaves
02mexplains Ada's shrinking footprints
14mSecure Caches for Compartmentalized Software
48mDemystifying the Secure Enclave Processor
29mTowards Practical Tools for Side Channel Aware Software Engineering...
20mArchitectural Extensions for a RISC V Processor for Embedded Security