# Internal Interface Diversification as a Security Measure in Sensor Networks +
## 4 Diversifiable Interfaces in IoT Operating Systems
#### Diversifiable Interfaces in IoT Operating Systems
Although 6 loWPAN can be used with encryption [58], diversification can be used in combination with encryption to provide additional security. ARM's _mbed_ operating system can include a supervisor to isolate system components from each other without a full MMU in the hardware [40] but instead with a lightweight memory protection unit (MPU) support found in many ARM processors. This isolation is achieved using supervisor calls that are mostly analogous to system calls and therefore, are an interesting subject of study concerning use of diversification as an additional security reinforcement layer. The supervisor allows different isolated components to communicate with each other, which can be regarded as an internal interface that then could be attacked and exploited. This interface could be diversified in order to make it impossible for injected code to even be able to reach the supervisor functions. The proprietary operating systems listed--_Integrity_, _Neutrino_, _VxWorks_ and _Windows IoT_--claim to support the MMU and appear to have a possibility for system calls. These calls could probably be diversified for similar additional security as in ARM's mbed depending on how they are implemented. Licensing may potentially limit the diversification of commercial systems due to restrictions on reverse engineering and modifications, but that topic is beyond the scope of this paper. _Amazon FreeRTOS_ is a Real Time Operating System (RTOS) with a very minimal kernel but great extensibility. Although MMU support does not exist so the OS can be run on the supported hardware without an emulation, extensive MPU support similar to ARM's mbed [59] does exist. Essentially, the kernel and device peripheral access can be protected from memory reads and writes, which means there has to be an interface to talk to the kernel, which could then be diversified to make it more difficult for malicious code to interface with the kernel. FreeRTOS itself is relatively minimal and does not have much to diversify, but when actual functionality beyond core kernel functions is added, diversification becomes much more viable. The technique used in our proof-of-concept implementation on the Thingsee NuttX OS should also be applicable. _ChibiOS_ appears to have a very specific use case for system calls. It has only seven system calls within its source code [34], which is not enough to apply any effective interface-level diversification. ChibiOS does not appear to use any memory protection functionality, which makes the system insecure. Combining layout diversification and even minimal system call diversification could be beneficial. The kernel may not be protected, but its location is not known, which forces the attacker to use a brute force approach on each device. Diversifying system calls in this case further protects the whole system as now the attacker also has to use brute force to be able to use the system calls to interface with the kernel. _Zephyr_ is an operating system developed by the Linux Foundation, which runs on multiple platforms ranging from x86 to ARM. Zephyr has a few similarities to Linux but does not necessarily require an MMU. An MMU is used only for the limited purpose of MPU functionality as used in mbed and FreeRTOS to achieve similar functionality as MPU-supported devices. As the operating system supports MPU-based kernel isolation, Zephyr has implemented a system call interface, which should be diversifiable. Most of the studied operating systems include some type of command shell. Several real-world vulnerabilities, such as Imagemagick (CVE-2016-3714 [60]), are based on unescaped input, which makes it appealing to study the possibility of diversifying the shell language. However, many IoT operating systems currently do not expose the shell for use to the rest of the system, and the command shell is mainly geared toward debugging. Although not covered in this study in detail, on a more fine-grained level, there are some operating system-specific APIs (Application User Interfaces) that could be diversified.