TeeFilter: High-Assurance Network Filtering Engine for High-End IoT and Edge Devices based on TEEs

Abstract

Large botnets like Mirai, with 600,000 infected devices, prove that cyber criminals have recognized the potential of attacks against the fast-growing Internet of Things. Moreover, recent critical vulnerabilities like Ripple20 and Amnesia:33 show that taking over a remote system via the network is a real threat. Alarmingly, modern strains of malware rely on exploiting such vulnerabilities to spread, with an increasing tendency. Hence, effective techniques to mitigate the consequences of modern IoT malware are necessary.To that end, we propose TeeFilter, a novel network filtering engine that allows manufacturers and operators of IoT devices to restrict the network traffic of their devices. By selectively executing parts of the network stack in a Trusted Execution Environment, TeeFilter remains untampered even if the operating system is compromised. The operators can specify filtering rules in an LLVM-compatible programming language and compile them into eBPF code. Subsequently, TeeFilter can load and enforce the rules. We formally verify the majority of TeeFilter for correctness and memory safety to eradicate whole classes of vulnerabilities and prototype our system on real hardware to show that the network overhead is negligible. Therefore, we believe that our system is an impactful step to enhance the resiliency of future IoT infrastructure.
mehr

Mehr zum Titel

Titel	TeeFilter: High-Assurance Network Filtering Engine for High-End IoT and Edge Devices based on TEEs
Medien	Proceedings of the 19th ACM Asia Conference on Computer and Communications Security (ASIA CCS '24)
Verlag	Association for Computing Machinery (ACM)
Band	2024
ISBN	9798400704826
Verfasser	Jonas Röckl, Nils Bernsdorf, Prof. Dr. Tilo Müller
Seiten	1568-1583
Veröffentlichungsdatum	01.07.2024
Zitation	Röckl, Jonas; Bernsdorf, Nils; Müller, Tilo (2024): TeeFilter: High-Assurance Network Filtering Engine for High-End IoT and Edge Devices based on TEEs. Proceedings of the 19th ACM Asia Conference on Computer and Communications Security (ASIA CCS '24) 2024, 1568-1583. DOI: 10.1145/3634737.3637643