Improving Security for Time-Triggered Real-Time Systems against Timing Inference Based Attacks by Schedule Obfuscation

Covert timing channels in real-time systems allow adversaries to not only exfiltrate application secrets but also to mount timing inference based attacks. Much effort has been put into improving real-time system predictability with the additional benefit of reducing the former class of confidentiality attacks. However, the more predictable the system behaves, the easier timing inference based attacks become. Time-triggered scheduling is particularly vulnerable to these types of attacks due to offline constructed tables that are scheduled with clock synchronization and OS-timer predictability. In this paper, we obfuscate timetriggered scheduling to complicate timing inference based attacks while maintaining strong protection against exfiltration attacks. I. APPLICATION DOMAIN & CHALLENGE Time-triggered (TT) real-time systems [1] are often used in safety-critical environments where they provide highly predictable scheduling behavior to meet stringent timing constraints. While online scheduling provides predictability, i.e, guarantees that deadlines will be met, but not exact times of execution, TT systems provide determinism, i.e., given schedule and time, the task executing is known. Leaking the scheduling information of safety-critical tasks enables adversaries to mount targeted attacks misusing this knowledge to defy detection and jeopardize the timeliness and thereby the safety that these tasks contribute to. Security is thus of high concern for safety-critical systems. Having compromised a large enough set of non real-time or low safety-critical tasks, an attacker can make use of leaked scheduling-related information to fine-tune its behavior such that the set generates maximum interference on subsequently executing victims. For example, to stay undetected, an adversary could continue normal operation of its compromised tasks up to the point when one of its tasks is executed immediately before a safety-critical task. At this time the compromised task exploits all of its accessible memory to create a cache and memory access pattern that maximizes cache-related delays of the safety-critical task. Naturally, tools analyzing only the legitimate task behavior to determine cacherelated preemption delays are blind to such malicious behavior. Short of anticipating maximum preemption delays for all tasks, TT schedules remain susceptible to such attacks. Furthermore, due to its predictability, TT scheduling is inherently vulnerable to timing inference based attacks [2]. In this work, we show how we can use an offline constructed TT schedule to impede timing inference based attacks.