Advanced System Resiliency Based on Virtualization Techniques for IoT Devices - Röckl, Jonas; Protsenko, Mykolai; Huber, Monika; Müller, Tilo; Freiling, Felix (ACSAC: Annual Computer Security Applications Conference, 2021)
An increasing number of powerful devices are equipped with network connectivity and are connected to the Internet of Things (IoT). Influenced by the steady growth of computing power of the devices, the paradigm of IoT-based service deployment is expected to change, following the example of cloud-based infrastructure: An embedded platform can be provided as-a-service to several independent application service suppliers. This fosters additional challenges concerning security and isolation. At the same time, recently revealed critical vulnerabilities like Ripple20 and Amnesia:33 show that embedded devices are not spared from wide-spread attacks. In this paper, we define new trusted computing concepts, focusing on privilege separation among several entities sharing one physical device. The concepts guarantee remote recovery capabilities within a bounded amount of time, even if notable portions of the software stack have been compromised. We derive a resilient system architecture suitable for the secure operation of multiple isolated services on one embedded device. We integrate an interface for detecting intrusions and anomalies to enable the automatic recovery of compromised devices and prototype our system on a Nitrogen8M development board. Our evaluation shows that the overhead in terms of network throughput and CPU performance is low so that we believe that our concept is a meaningful step towards more resilient future IoT devices.

BarriCCAde: Isolating Closed-Source Drivers with ARM CCA - Schulze, Sven Matti; Lindenmeier, Christian; Röckl, Jonas (2024 IEEE European Symposium on Security and Privacy Workshops (EuroS&PW), 2024)
Due to the nature of monolithic kernels, a driver's vulnerability always results in a vulnerable kernel, as disas-trous examples show. Some research aims to solve this issue by isolating drivers from the main kernel. The most promising approaches rely on virtualization techniques. However, as they usually require driver and kernel modification, they can only be applied to open-source drivers. As closed-source drivers are also standard these days, e.g., for GPUs or anti-cheat tools, we propose BarriCCAde, a new design for isolating even closed -source drivers from the kernel. Most notably, BarriCCAde allows driver isolation without adding a hypervisor to the TCB. Relying on upcoming confidential computing techniques, we only add small-scale memory protection components to our TCB. Contemporary approaches focus on deciding which of the kernel's resources the driver may access and how they can be synchronized between the kernel and the driver. However, one aspect mainly ignored is cases in which the driver misuses kernel resources it can access to attack the system, e.g., by crafting malicious inputs for kernel functions. To cover such cases, we integrate an eBPF -based filter into our system architecture, which allows a fine-granular specification of which kernel-level resource can be accessed in which way. We believe that BarriCCAde is an important step towards isolating future closed-source drivers and, thus, strengthening the confidentiality, integrity, and availability of future kernel

CCKex: High Bandwidth Covert Channels over Encrypted Network Traffic - Lindenmeier, Christian; Gebhard, Sven; Röckl, Jonas; Freiling, Felix (Secure IT Systems, 2025)
Covert channels, such as the timing behavior of a process or the lowest order bit in a network protocol nonce, can be used to exchange information in a stealthy manner. Storage covert channels are a class of covert channels that modulate data onto unused or redundant protocol fields of existing network communication. Because of this restriction, but also because of the ubiquity of encrypted communication, such channels usually suffer from severe bandwidth limitations. We propose a novel storage-based covert channel that enables the transmission of data inside encrypted network traffic, thus both drastically increasing bandwidth and stealth. In contrast to prior work, we assume the availability of encryption keys on the sender side, a condition usually met by strong attackers applying key extraction from memory. In this way, we are able to embed information into encrypted network traffic, experimentally increasing covert bandwidth by a factor of 11. We demonstrate the practical feasibility of our approach targeting the Android app Signal on a real-world smartphon
Keywords: computer crime; computer forensics; computer hardware; computer networks; communication systems; computer science; computer security; computer systems; cryptography; data communication systems; data security; identity management systems; network protocols; network security; privacy; data protection; artificial intelligence; cyber security; machine learning

Compiler-Aided Development of Trusted Enclaves with Rust - Dreissig, Felix; Röckl, Jonas; Müller, Tilo (ACM International Conference Proceeding Series, 2022)
To optimally utilize Intel SGX, programs must be partitioned into trusted and untrusted parts. Writing the trusted part of a program with Intel's SDK, however, requires manual effort that often becomes an obstacle for programmers. In this work, we investigate how compiler-level tooling can assist with the semi-automatic separation of code into a trusted and an untrusted partition. We present Cadote, a solution that generates SGX enclaves from programs written in Rust. Application developers are expected to mark functions as trusted, for which enclaves are then generated automatically. All other functions remain untrusted and are executed outside Intel SGX in the normal world. We implemented this concept using compiler optimization passes of the LLVM framework. Targeting Rust as input language allows us to benefit from high-level concepts, such as memory safety, which enable us to safely copy function parameters between the normal and trusted world in practice.
CRIS-Team Scopus Importer:2022-09-09
Keywords: Intel Software Guard Extensions (SGX); LLVM; Partitioning; Rust; TEEs

Conditional Network Availability: Enhancing Connectivity Guarantees for TEE-Based Services - Röckl, Jonas; Lindenmeier, Christian; Schulze, Sven Matti; Müller, Tilo (2024 IEEE European Symposium on Security and Privacy Workshops (EuroS&PW), 2024)
Trusted Execution Environments (TEEs) are widely available, allowing the isolation of security-sensitive trusted services from an untrusted commodity OS. Driven by manifold use cases, more and more trusted services requiring network connectivity are developed. Typically, the traffic of trusted services is routed through the OS, while cryptography ensures confidentiality and integrity. However, the extent to which TEEs can also help to provide network availability for trusted services remains underexplored. We introduce Conditional Network Availability (CNA) as a novel concept for TEE-based networking, ensuring that a trusted service can process network traffic, whenever the potentially malicious OS can do so. Our concept prevents an attacker from monopolizing the network channel (e.g., for a botnet campaign). TEE-based remote device management, system monitoring, and intrusion detection systems can profit from our concept. Proposing a split-driver model, we implement a proof-of-concept on real hardware, multiplexing a complex Ethernet interface between the OS and the ARM TrustZone TEE. Our evaluation shows that our system achieves near-native throughput while keeping the additions to the TCB small.<br
Keywords: Multiplexing; Manifolds; Program processors; Intrusion detection; Ethernet; Telecommunication traffic; Throughput

IlluminaTEE: Effective Man-At-The-End Attacks from within ARM TrustZone - Schulze, Sven Matti; Lindenmeier, Christian; Röckl, Jonas; Freiling, Felix (CheckMATE '24: Proceedings of the 2024 Workshop on Research on offensive and defensive techniques in the context of Man At The End (MATE) attacks, 2024)
To break end-to-end encryption used by apps (e.g., messengers) today, attackers must obtain code execution directly on an end device to access data before it is encrypted, resulting in Man-At-The-End (MATE) attacks. The effectiveness of such attacks rises with the privilege level the code is executed on, e.g., the system or hypervisor level employing techniques such as virtual machine introspection (VMI). Another option to perform MATE attacks is to place software in trusted execution environments (TEEs), as on many platforms, these have the highest privilege while also providing security guarantees. However, unlike hypervisors, TEEs were primarily built to achieve isolation and not introspection. For this reason, TEEs usually lack technical means like hardware breakpoints, apparently limiting the possibilities of fine-grained system monitoring. By presenting IlluminaTEE, a sophisticated TEE-based introspection tool, we show that TEE-based introspection is as powerful as VMI. By applying a novel technique which we call state-change trapping, we show that IlluminaTEE can extract highly ephemeral personal data from arbitrary applications. We implement IlluminaTEE as an extension to the TEE firmware of real hardware with a stock version of Android and demonstrate that we can extract the encryption keys of the Signal messenger, one of the most highly ephemeral and privacy-critical bits of data existing on personal devices today. This highlights the need to implement better software protection mechanisms to mitigate the risks of powerful MATE attacker

Key extraction-based lawful access to encrypted data: Taxonomy and survey - Lindenmeier, Christian; Hammer, Andreas; Gruber, Jan; Röckl, Jonas; Freiling, Felix (Forensic Science International: Digital Investigation, 2024)
The rise of end-to-end encryption has enabled end-users to protect their data to a point that classical techniques of lawful access (seizure of devices, wiretaps) are futile. While there is a heated discussion about regulating the access primitive to end-user devices for law enforcement, little attention is given to the technical design of how evidence should be collected. This is especially critical during remote surveillance, as law enforcement may have unrestricted access to end-user devices over longer periods of time. In this paper, we propose the novel category of key extraction-based lawful interception (KEX-LI), meaning that instead of directly accessing plaintext data, law enforcement only extracts the necessary key material from end-user devices, thus minimizing the requirements of data extraction on end-user devices. When subsequently collecting encrypted data (e.g., via wiretapping), law enforcement can use these keys for decryption. We structure and survey the state-of-the-art of key extraction techniques, thus embedding KEX-LI in the broader context of device forensics. Furthermore, we describe specific requirements for a practical solution to conduct KEX-LI and evaluate currently available technical implementations. Our results are intended to help practitioners select the most suitable techniques as well as to identify research gaps.
Created from Fastlane, Scopus look-up
Keywords: Encrypted data; Key extraction; Lawful access; Memory acquisition; Taxonomy

Performance Evaluation of Policy-Based SQL Query Classification for Data-Privacy Compliance - Schwab, Peter; Röckl, Jonas; Langohr, Maximilian; Meyer-Wegener, Klaus (Datenbank-Spektrum, 2021)
Data science must respect privacy in many situations. We have built a query repository with automatic SQL query classification according to data-privacy directives. It can intercept queries that violate the directives, since a JDBC proxy driver inserted between the end-users’ SQL tooling and the target data consults the repository for the compliance of each query. Still, this slows down query processing. This paper presents two optimizations implemented to increase classification performance and describes a measurement environment that allows quantifying the induced performance overhead. We present measurement results and show that our optimized implementation significantly reduces classification latency. The query metadata (QM) is stored in both relational and graph-based databases. Whereas query classification can be done in a few ms on average using relational QM, a graph-based classification is orders of magnitude more expensive at 137 ms on average. However, the graphs contain more precise information, and thus in some cases the final decision requires to check them, too. Our optimizations considerably reduce the number of graph-based classifications and, thus, decrease the latency to 0.35 ms in 87% of the classification case
Keywords: Query classification; Policy rules; Data privacy; Performance

Profiling with trust: system monitoring from trusted execution environments - Eichler, Christian; Röckl, Jonas; Jung, Benedikt; Schlenk, Ralph; Müller, Tilo; Hönig, Timo (Design Automation For Embedded Systems, 2024)
Large-scale attacks on IoT and edge computing devices pose a significant threat. As a prominent example, Mirai is an IoT botnet with 600,000 infected devices around the globe, capable of conducting effective and targeted DDoS attacks on (critical) infrastructure. Driven by the substantial impacts of attacks, manufacturers and system integrators propose Trusted Execution Environments (TEEs) that have gained significant importance recently. TEEs offer an execution environment to run small portions of code isolated from the rest of the system, even if the operating system is compromised. In this publication, we examine TEEs in the context of system monitoring and introduce the Trusted Monitor (TM), a novel anomaly detection system that runs within a TEE. The TM continuously profiles the system using hardware performance counters and utilizes an application-specific machine-learning model for anomaly detection. In our evaluation, we demonstrate that the TM accurately classifies 86% of 183 tested workloads, with an overhead of less than 2%. Notably, we show that a real-world kernel-level rootkit has observable effects on performance counters, allowing the TM to detect it. Major parts of the TM are implemented in the Rust programming language, eliminating common security-critical programming errors.<br
Keywords: Trusted execution environment; Hardware performance counter; Machine learning; Anomaly detection; Malware detection; Rust

Query-Driven Enforcement of Rule-Based Policies for Data-Privacy Compliance - Schwab, Peter; Langohr, Maximilian; Röckl, Jonas; Vöhringer, Demian; Wahl, Andreas Maximilian; Meyer-Wegener, Klaus (Proc. Conf. "Lernen, Wissen, Daten, Analysen", 2019)
Keywords: Classification Rules; Data Privacy; Query-Driven

SyncEmu: Enabling Dynamic Analysis of Stateful Trusted Applications - Lindenmeier, Christian; Schulze, Sven Matti; Röckl, Jonas; Busch, Marcel (2024 IEEE European Symposium on Security and Privacy Workshops (EuroS&PW), 2024)
Modern mobile devices leverage ARM TrustZone to implement a Trusted Execution Environment (TEE). The security-critical services, called Trusted Applications (TAs), deployed in these TEEs form the backbone of those devices' security architectures. Unfortunately, TAs are not free from bugs and constitute the biggest attack surface of the TEE. A vulnerability in a TA can have devastating consequences, fundamentally compromising the whole system's security. Given the locked-down nature of COTS smartphones, the analysis of closed-source TAs remains challenging for independent security researchers. In this paper, we present SyncEmu to enable dynamic analysis of proprietary TAs found on COTS Android devices. To this end, we develop a framework to execute unmodified TEE firmware in an emulated environment (so-called rehosting). Using SyncEmu, we successfully rehost TrustedCore, a closed-source TEE implementation found on older Huawei devices. Furthermore, we propose and implement a novel technique called CA-in-the-loop, that allows SyncEmu to forward realistic requests of Client Applications (CAs) running on a physical smartphone to the rehosted TAs, pushing the boundaries of state-of-the-art in TEE rehosting.<br

TeeFilter: High-Assurance Network Filtering Engine for High-End IoT and Edge Devices based on TEEs - Röckl, Jonas; Bernsdorf, Nils; Müller, Tilo (Proceedings of the 19th ACM Asia Conference on Computer and Communications Security, 2024)
Large botnets like Mirai, with 600,000 infected devices, prove that cyber criminals have recognized the potential of attacks against the fast-growing Internet of Things. Moreover, recent critical vulnerabilities like Ripple20 and Amnesia:33 show that taking over a remote system via the network is a real threat. Alarmingly, modern strains of malware rely on exploiting such vulnerabilities to spread, with an increasing tendency. Hence, effective techniques to mitigate the consequences of modern IoT malware are necessary. To that end, we propose TeeFilter, a novel network filtering engine that allows manufacturers and operators of IoT devices to restrict the network traffic of their devices. By selectively executing parts of the network stack in a Trusted Execution Environment, TeeFilter remains untampered even if the operating system is compromised. The operators can specify filtering rules in an LLVM-compatible programming language and compile them into eBPF code. Subsequently, TeeFilter can load and enforce the rules. We formally verify the majority of TeeFilter for correctness and memory safety to eradicate whole classes of vulnerabilities and prototype our system on real hardware to show that the network overhead is negligible. Therefore, we believe that our system is an impactful step to enhance the resiliency of future IoT infrastructure.
Keywords: ARM TrustZone; traffic filtering; ethernet drivers; eBPF

Trusted Monitor: TEE-Based System Monitoring - Jung, Benedikt; Eichler, Christian; Röckl, Jonas; Schlenk, Ralph; Hönig, Timo; Müller, Tilo (Brazilian Symposium on Computing Systems Engineering, 2022)

Veto: Prohibit Outdated Edge System Software from Booting - Röckl, Jonas; Wagenhäuser, Adam; Müller, Tilo (In Proceedings of the 9th International Conference on Information Systems Security and Privacy (ICISSP), 2023)
Edge computing emerges as a trend, forming a link between the Internet of Things and cloud-based services. Large-scale edge deployments are already in place today in the context of communication network providers that offload more and more tasks to the edge to ensure high flexibility and low latencies. By relying on remote attestation and disk encryption techniques, we design a novel system architecture that protects confidential data on edge nodes in the case of device theft. Recent vulnerabilities like Ripple20 and Amnesia:33 show the consequences and costs of critical security bugs stemming from outdated system software. Thus, we design our system in a way that a node can derive its decryption key if and only if a trusted remote party (e.g., a network operator) can verify that it is running the latest software. This is a security feature that prevalent implementations like Linux’s dm-crypt lack. To secure the early-boot communication, we rely on a trusted execution environment, hardware offloading, and Rust device drivers. We prototype our system on two recent ARMv8 devices and show that the performance overhead (≈ 2%) and the boot delay (1s) are low. Thus, we believe that our concept is a meaningful step towards more secure future edge devices. <br
Keywords: Trusted Execution Environment; Full Disk Encryption; Remote Attestation; Edge Computing.