On-Board Computer Microkernel Access Control for Vulnerability Detection

Resolve Bottlenecks,
Find Innovative Solutions
Generate Solutions

Solution Overview

Problem

Existing methods for detecting vulnerabilities in embedded systems, such as buffer overflows and integer overflows, are inadequate and cannot detect all potential threats, leaving on-board computers in critical systems vulnerable to attacks that can compromise confidentiality or render them inoperable.

Innovation Solution

A method for controlling an on-board computer using a microkernel with a control unit isolated from the microkernel, which includes a memory management unit and access control mechanisms to analyze and restrict access to hardware components, generating an access configuration to minimize necessary interactions and block modifications, ensuring higher security by detecting abnormal access requests.

Engineering Contradictions & Design Principles

VSEngineering Contradiction Analysis

1Reliability

If traditional vulnerability detection techniques (unit testing, fuzzer, static/dynamic code analysis) are used, then some vulnerabilities can be detected, but they cannot detect all vulnerabilities and leave the system vulnerable to attacks

Engineering Contradiction:
Improvevulnerability detection capabilityVSAvoidundetected vulnerabilities
Core Design Contradiction:
ReliabilityVSObject-affected harmful factors

Solution Approach 1:

The system is segmented into multiple isolated virtual machines, each running a specific function. This segmentation allows vulnerability detection at the virtual machine level rather than requiring comprehensive detection of the entire system, enabling detection of vulnerabilities that would otherwise remain undetected by traditional techniques.

Inventive Principle:
Principle #1Segmentation

Solution Approach 2:

A hypervisor is introduced as an intermediary layer between the hardware and the microkernel/tasks. This hypervisor creates virtual machines that can monitor and detect vulnerabilities independently, providing an additional detection mechanism that complements traditional techniques and identifies vulnerabilities that escape conventional analysis.

Inventive Principle:
Principle #24Intermediary (Mediator)

2Ease of operation

If the microkernel has broad access to hardware components for normal operation, then operational flexibility is maintained, but security is compromised due to potential unauthorized access and modifications

Engineering Contradiction:
Improvehardware access flexibilityVSAvoidsecurity against unauthorized access
Core Design Contradiction:
Ease of operationVSReliability

Solution Approach 1:

Hardware access rights are segmented and distributed to different virtual machines based on their specific operational needs. Each virtual machine receives only the minimum necessary access permissions, maintaining operational flexibility for each component while preventing unauthorized access to other hardware resources.

Inventive Principle:
Principle #1Segmentation

Solution Approach 2:

Different virtual machines are assigned different access rights to hardware components according to their specific functional requirements. This local quality approach ensures that each component has the flexibility it needs for normal operation while the overall system maintains security through restricted access control.

Inventive Principle:
Principle #3Local quality

3Adaptability or versatility

If the microkernel code can be modified for updates and improvements, then system adaptability is improved, but security is reduced due to risk of introducing vulnerabilities

Engineering Contradiction:
Improvecode update capabilityVSAvoidsecurity against vulnerabilities
Core Design Contradiction:
Adaptability or versatilityVSReliability

Solution Approach 1:

The microkernel code is compiled and analyzed in advance to generate a binary representation. This preliminary action allows the system to verify code integrity before execution, ensuring that updates and modifications do not introduce vulnerabilities while maintaining the ability to adapt the system through controlled code changes.

Inventive Principle:
Principle #10Preliminary action

Solution Approach 2:

Instead of directly modifying the running microkernel, the system uses copied binary representations for analysis and verification. This copying approach allows adaptability through code updates while maintaining security by verifying the integrity of copied versions before applying changes to the actual running system.

Inventive Principle:
Principle #26Copying

4Reliability

If comprehensive access monitoring is implemented to detect all vulnerabilities, then security detection capability is improved, but system complexity increases

Engineering Contradiction:
Improvevulnerability detection capabilityVSAvoidcontrol system complexity
Core Design Contradiction:
ReliabilityVSDevice complexity

Solution Approach 1:

The monitoring function is segmented and distributed across multiple virtual machines rather than implemented as a single comprehensive control system. Each virtual machine monitors its own access patterns independently, achieving comprehensive vulnerability detection while keeping individual monitoring components simple and manageable.

Inventive Principle:
Principle #1Segmentation

Solution Approach 2:

Each virtual machine performs self-monitoring of its own hardware access patterns. This self-service approach enables comprehensive vulnerability detection across the system without requiring a complex centralized control mechanism, as each component monitors itself autonomously.

Inventive Principle:
Principle #25Self-service

Data Source

PatentEP4394631A1Method for controlling an on-board computer able to control a critical system, associated computer and vehicle
Publication Date: 2024.07.03 THALES SA
  • EP4394631A1 patent drawingFigure 1
  • EP4394631A1 patent drawingFigure 2
  • EP4394631A1 patent drawing

AI summary

The present invention relates to a method of controlling an embedded computer (18) suitable for controlling a critical system (16), the embedded computer (18) comprising: - a single microkernel (20) adapted to implement a set of operations, - hardware components (22, 28, 30) to which the microkernel (20) has access to implement the set of operations, and - a control unit (26), the control unit (26) being suitable for controlling the access of the microkernel (20) to the hardware components (22, 28, 30), the control unit (26) being isolated from the microkernel (20), the control method comprising a step of controlling by the control unit (26) the access of the microkernel (20) to the hardware components (22, 28, 30).