Paper Info
Title
On the Pitfalls and Vulnerabilities of Schedule Randomization Against Schedule-Based Attacks
Abstract
Schedule randomization is one of the recently introduced security defenses against schedule-based attacks, i.e., attacks whose success depends on a particular ordering between the execution window of an attacker and a victim task within the system. It falls into the category of information hiding (as opposed to deterministic isolation-based defenses) and is designed to reduce the attacker's ability to infer the future schedule. This paper aims to investigate the limitations and vulnerabilities of schedule randomization-based defenses in real-time systems. We first provide definitions, categorization, and examples of schedule-based attacks, and then discuss the challenges of employing schedule randomization in real-time systems. Further, we provide a preliminary security test to determine whether a certain timing relation between the attacker and victim tasks will never happen in systems scheduled by a fixed-priority scheduling algorithm. Finally, we compare fixed-priority scheduling against schedule-randomization techniques in terms of the success rate of various schedule-based attacks for both synthetic and real-world applications. Our results show that, in many cases, schedule randomization either has no security benefits or can even increase the success rate of the attacker depending on the priority relation between the attacker and victim tasks.
Year
DOI
Venue
2019
10.1109/RTAS.2019.00017
2019 IEEE Real-Time and Embedded Technology and Applications Symposium (RTAS)
Keywords
DocType
ISSN
Real-time systems security,schedule-based attack,schedule randomization,cyber physical systems
Conference
1545-3421
ISBN
Citations 
PageRank 
978-1-7281-0679-3
2
0.37
References 
Authors
27
4
Name
Order
Citations
PageRank
Mitra Nasri16710.09
Thidapat Chantem233324.48
Gedare Gedarebloom320.37
Ryan M. Gerdes44112.72