492
B. Russell
Examples of RTOS include those from VXWorxs, FreeRTOS, and Windows 10 IoT
Core, among many others. Security features to look for in the chosen RTOS include:
Microkernel The likelihood of security vulnerabilities expands when code
becomes bloated with unneeded features. An important component of a secure
RTOS is a microkernal that has been optimized for use. Optimization should
include removal of all unneeded features from the kernel. A microkernel may
provide interprocess communication (IPC), memory management, and central
processing unit (CPU) management. Features outside of these are then pushed up
to run within the user space, including device drivers.
Kernel Separation IoT Machines that operate in high threat environments can
make use of a separation kernel. A separation kernel implements secure partitions
within the machine and controls the flow of information across those partitions.
Information flows across partitions must be explicitly allowed in order to execute
[22].
Secure Memory RTOS that make use of a separation kernel can implement secure
memory protections. For example, the INTEGRITY RTOS available from Green
Hills Software uses the separation kernel to prevent processes from accessing data
from outside a specified partition.
Trusted Applications Applications that run within a Trusted Execution Environment can be specified as trusted applications and the operating system can validate
the integrity of the application prior to executing.
Process Isolation Process isolation techniques prevent one process from interacting with another process. Each process is assigned a separate memory space [23].
Application Sandboxing Sandboxing allows the RTOS to manage the privileges
of an application. For example, a sandboxed application may not be able to access
the sandbox of another application. This effectively limits the spread of malware
that might have entered through one application.
Hardware Abstraction One of the primary functions of an operating system
is management of hardware resources. An RTOS may implement a Hardware
Abstraction Layer (HAL). A Secure RTOS can restrict which processes and
applications have access to the hardware on the machine.
10.4.3 Implement Physical Security Controls
Since IoT machines operate so often in unprotected spaces, the physical security of
those machines becomes important. Physical Security Controls designed into IoT
machines at the edge should include:
Tamper Protections For machines that warrant additional protections, implement
tamper protections that restrict access to the computing hardware. These can range
B. Russell
Examples of RTOS include those from VXWorxs, FreeRTOS, and Windows 10 IoT
Core, among many others. Security features to look for in the chosen RTOS include:
Microkernel The likelihood of security vulnerabilities expands when code
becomes bloated with unneeded features. An important component of a secure
RTOS is a microkernal that has been optimized for use. Optimization should
include removal of all unneeded features from the kernel. A microkernel may
provide interprocess communication (IPC), memory management, and central
processing unit (CPU) management. Features outside of these are then pushed up
to run within the user space, including device drivers.
Kernel Separation IoT Machines that operate in high threat environments can
make use of a separation kernel. A separation kernel implements secure partitions
within the machine and controls the flow of information across those partitions.
Information flows across partitions must be explicitly allowed in order to execute
[22].
Secure Memory RTOS that make use of a separation kernel can implement secure
memory protections. For example, the INTEGRITY RTOS available from Green
Hills Software uses the separation kernel to prevent processes from accessing data
from outside a specified partition.
Trusted Applications Applications that run within a Trusted Execution Environment can be specified as trusted applications and the operating system can validate
the integrity of the application prior to executing.
Process Isolation Process isolation techniques prevent one process from interacting with another process. Each process is assigned a separate memory space [23].
Application Sandboxing Sandboxing allows the RTOS to manage the privileges
of an application. For example, a sandboxed application may not be able to access
the sandbox of another application. This effectively limits the spread of malware
that might have entered through one application.
Hardware Abstraction One of the primary functions of an operating system
is management of hardware resources. An RTOS may implement a Hardware
Abstraction Layer (HAL). A Secure RTOS can restrict which processes and
applications have access to the hardware on the machine.
10.4.3 Implement Physical Security Controls
Since IoT machines operate so often in unprotected spaces, the physical security of
those machines becomes important. Physical Security Controls designed into IoT
machines at the edge should include:
Tamper Protections For machines that warrant additional protections, implement
tamper protections that restrict access to the computing hardware. These can range