# Study of autonomous response and recovery mechanisms for embedded systems

Zoé Lagache, Pierre-Henri Thevenon, Maxime Puys, Oum-El-Kheir Aktouf

► To cite this version:

Zoé Lagache, Pierre-Henri Thevenon, Maxime Puys, Oum-El-Kheir Aktouf. Study of autonomous response and recovery mechanisms for embedded systems. Rendez-vous de la Recherche et de l'Enseignement de la Sécurité des Systèmes d'Information, RESSI 2023, May 2023, Neuvy-sur-Barangeon, France. hal-05124436

HAL Id: hal-05124436

https://uca.hal.science/hal-05124436v1

Submitted on 21 Jun 2025

HAL is a multi-disciplinary open access
archive for the deposit and dissemination of sci-
entific research documents, whether they are pub-
lished or not. The documents may come from
teaching and research institutions in France or
abroad, or from public or private research centers.

L'archive ouverte pluridisciplinaire HAL, est
destinée au dépôt et à la diffusion de documents
scientifiques de niveau recherche, publiés ou non,
émanant des établissements d'enseignement et de
recherche français ou étrangers, des laboratoires
publics ou privés.

<figure><img src="image_1.png" /></figure>

Distributed under a Creative Commons Attribution 4.0 International License
# Study of autonomous response and recovery mechanisms for embedded systems

Zoé Lagache*†, Pierre-Henri Thévenon*, Maxime Puys† and Oum-El-Kheir Aktouf‡,

*Univ. Grenoble Alpes, CEA-Leti, 38000 Grenoble, France
zoe.lagache@cea.fr, pierre-henri.thevenon@cea.fr

†Univ. Clermont Auvergne, LIMOS, 63178 Aubières, France
maxime.puys@uca.fr

‡Univ. Grenoble Alpes, Grenoble INP, LCIS, 26000 Valence, France
oum-el-kheir.aktouf@lcis.grenoble-inp.fr

***Abstract***—Embedded systems are increasingly numerous, complex and connected, and are used in critical environments such as healthcare systems and industrial systems. The security of embedded systems is essential to ensure the proper functioning of these applications. Conventional security mechanisms often rely on human intervention, which can be impractical or ineffective in real-time scenarios. Autonomous recovery mechanisms, which can mitigate, repair and respond to security attacks without human intervention, offer a promising approach to improve the security of embedded systems. This article presents a state of the art of autonomous recovery and response for the security of embedded devices after the detection of an undesirable event with consideration of their critical functions.

***Index Terms***—Response, recovery, embedded systems, cybersecurity

## I. INTRODUCTION

The ubiquity of embedded systems in everyday life as well as in critical systems introduces an increasing threat in terms of cybersecurity. Standards already exist, like the Cybersecurity Framework from NIST [1], which considers the functions of detection, response, and recovery of systems as priorities for the security of embedded systems. While the topics of protection or detection are well developed in the scientific literature, the field of post-attack recovery still needs to be studied in the embedded systems field. This is a very important topic as nowadays cyber attacks incorporate measures that enable them to bypass existing protection and detection systems.

Over the past decades, many researchers have focused their efforts on the development of restoration solutions to improve the safety of embedded or distributed systems [2], [3], but the adaptation of these concepts to the field of security is recent and concerns only a few works [4], [5].

## II. RECOVERY AND RESPONSE SYSTEMS TAXONOMY

Recovering a system to a functional or secure state can be done by various means, which we will present in this section. Although other techniques such as reconfiguration or reset systems have also been developed [6], we will be talking in particular about checkpointing, operation replay, isolation and resource deletion. Recent work often presents hybrid systems, which combine several of the aforementioned techniques to adapt to the encountered events.

### A. Response mechanisms

The response to the detection of an event can be based on many different techniques, most often adapted to the threat encountered. It therefore relies on a consistent detection or monitoring system. This is the part of a system that allows the most configuration of the survivability aspect of the target devices, i. e. the trade-off between availability and security.

The **isolation** of the affected components affected can constitute a response or a basis for a response. It can be carried out at a software level, as in [4], in which the author uses a containerisation tool to isolate each of the running services. Hardware isolation is also possible, as shown in [5]. This paper exposes an architecture which, when a detection occurs, loads the current, and therefore corrupted, state save onto a 'sacrificial' microcontroller<fnref n="1" />, while restoring the state of the microcontroller to be secured. The advantage of this method is that it allows to collect data on the attack in progress.

In systems with access control management such as the Linux kernel, we can opt for a response in the form of a **privilege reduction**. This method is used in the article [4] and a similar method can be found in the paper [6] which disconnects users from a session.

Finally, the **reduction of computing resources** like CPU or RAM, also proposed in [4], is a response that can be effective in more specific circumstances, such as *ransomware* attacks or attacks aimed at compromising system availability.

### B. Checkpoint and rollback systems

The most typical recovery solution described in literature is the checkpoint and rollback one, which allows a system to be reloaded to a previous state when a threat occurs. This method firstly consist in creating a save of the system to be recovered. We often speak of a *snapshot* when saving a file system and a *checkpoint* for the state of a process, memory or processor.

The saving phase can be done on a regular basis or triggered by events. In the thesis [7] the author presents a **periodic** state checkpointing tool. The checkpoints frequency depends on the concerned element in the distributed system, with the

<footnote n="1">¹'sacrificial' microcontroller meaning, in the context of the article, an additional microcontroller used as a 'sacrifice' by transferring the attack to it.</footnote>
possibility of performing **one-time** checkpoints depending on the events. The paper [3] proposes a checkpointing system whose regularity is at the assembly code level, through **code injection**. Indeed, the saves are made at each *basic block*, blocks of instructions which contain no jumps to other memory addresses.

To recover the system, a loading step of the saved data into the targeted system is then necessary. Checkpoints can be loaded either partially or completely. For optimisation reasons, this stage is most often triggered by the detection of a threat. In both works described above [7], [3], an anomaly detection system is implemented, enabling this phase to be triggered.

Sometimes, as in the case of [7], a **replay** of the operations carried out between checkpointing and loading can be planned. The author takes into account the hazards of the real world, in which it is not possible to rollback to a previous state. It is therefore necessary, when a recovery is carried out, to have the system actuators replay their last actions. The article [8] presents another example of the use of this technique, but this time with the aim of preserving a stream of legitimate operations.

### III. DISCUSSION

Response and recovery mechanisms must meet certain criteria in order to be applicable to the security of embedded systems. First, they must be able to react when a threat is detected to limit its impact while ensuring the system's survivability. To this end, it is necessary to identify the affected elements and their dependencies, but also to apply a response adapted to this threat, making it essential to rely on the information gathered from the detection system. In addition, the system must be recovered with its critical functions preserved. Finally, it is important to guarantee the trust in the global recovery mechanism, notably by ensuring that the system is recovered in the right state and that the recovery is done at a relevant point in time. It also means to protect it intrinsically against various attacks such as bypass attempts or false checkpoints injection.

Among the techniques presented, **isolation** methods can highly help to slow down the spread of an attack as well as to protect critical elements and the recovery system. We have also seen that they can enable longer-term recovery by gathering data on the current attack that can improve system security. Nevertheless, isolation can slow down inter-service communications or add physical constraints to the embedded system in the case of hardware isolation.

**Privilege reduction** is most effective in systems that support access management modules such as SELinux<fnref n="2" /> which enables precise and enforced privilege management.

Moreover, **resource reduction** is effective, but cannot be used alone due to the limited number of concerned attacks.

Finally, regular **checkpoints** can provide a basis for an autonomous recovery mechanism. However, it can be difficult to implement, due to the memory space taken up by saves

and because of its potential extensive execution time. It can be specifically problematic with the real-time constraints of embedded systems, even though incremental checkpointing, saving only the modifications made to the system, can be used as optimisation. This also raises the issue of the location of the checkpoints so that they cannot be corrupted by the attacker. Lastly, this technique alone cannot limit the impact of an attack, nor can it permanently restore the system, which could be attacked again.

### IV. CONCLUSION

Autonomous recovery mechanisms offer a promising approach to improve the security of embedded systems. By combining the presented techniques, these mechanisms can help to limit the impact of attacks, restore the system to a functional state, and enhance the protection of critical functions. However, there are still challenges to be addressed, such as the trade-off between the availability of a service and the risk generated by maintaining its execution, as well as the need to integrate these mechanisms into the overall security architecture of an embedded system. The self-protection of the recovery and response system, allowing trust in the solution, is also an important topic to highlight. Our future research will focus on defining an attack model, with a variety of threat scenarios, directing the main responses to develop for embedded systems, developing more efficient checkpointing techniques for embedded systems' critical functions and survivability, and exploring new techniques that are lightweight and can be applied to a wide range of embedded systems, including the heterogeneous and distributed ones.

### V. ACKNOWLEDGEMENT

This work was supported by the French National Research Agency under the France 2030 program projects IRT Nanoelec (ANR-10-AIRT-05), MIAI@Grenoble Alpes (ANR-19-P3IA-0003) and SUPERVIZ (ANR-22-PECY-0008).

### REFERENCES

[1] National Institute of Standards and Technology, "NIST Cybersecurity Framework," 2023. [Online]. Available: https://www.nist.gov/cyberframework

[2] B. Cassottana, M. M. Roomi, D. Mashima, and G. Sansavini, "Resilience analysis of cyber-physical systems: A review of models and methods," *Risk Analysis*, vol. 43, no. 11, pp. 2359-2379, 2023.

[3] M. Bashiri, S. G. Miremadi, and M. Fazeli, "A Checkpointing Technique for Rollback Error Recovery in Embedded Systems," in *2006 International Conference on Microelectronics*. IEEE, 2006, pp. 174-177.

[4] R. Chevalier, D. Plaquin, C. Dalton, and G. Hiet, "Intrusion Survivability for Commodity Operating Systems," Ph.D. dissertation, Université Paris-Saclay, 2020. [Online]. Available: https://inria.hal.science/hal-03085774

[5] P. R. DaSilva and P. J. Fortier, "Hardware Based Detection, Recovery, and Tamper Evident Concept to Protect from Control Flow Violations in Embedded Processing," in *2019 IEEE International Symposium on Technologies for Homeland Security (HST)*, 2019, pp. 1-6.

[6] B. Abdulrazak, J. A. Codjo, and S. Paul, "Self-healing Approach for IoT Architecture: AMI Platform," in *Participative Urban Health and Healthy Aging in the Age of AI*, 2022, vol. 13287, pp. 3-17.

[7] U. I. Z. Ozeer, "Autonomic resilience of distributed IoT applications in the Fog," *phdthesis*, Université Grenoble Alpes, 2019. [Online]. Available: https://theses.hal.science/tel-02570825

[8] A. Goel, K. Po, K. Farhadi, Z. Li, and E. De Lara, "The taser intrusion recovery system," in *Proceedings of the Twentieth ACM Symposium on Operating Systems Principles*, 2005, pp. 163-176.

<footnote n="2">²https://github.com/SELinuxProject, visited on 15/01/2024</footnote>