Poster: Towards Extensible Memory Isolation for Low-End Microcontrollers Marton Bognar DistriNet, KU Leuven 3001 Leuven, Belgium Jo Van Bulck DistriNet, KU Leuven 3001 Leuven, Belgium Abstract—In today’s interconnected world, specialized mem- ory isolation mechanisms for low-end embedded micro- controllers are becoming vital. Responding to this need, Texas Instruments has developed the promising Intellectual Property Encapsulation (IPE) feature for their popular ultra- low-power MSP430 microcontrollers. Academic researchers have, furthermore, implemented many trusted execution prototypes on the related openMSP430 open-source softcore. Recent research has shown, however, that these diverging code bases suffer from critical hardware and software vul- nerabilities that we believe could have been avoided with more coordination. Hence, we present our work in progress on an openly accessible and extensible research platform based on the specification of the proprietary IPE feature. We implement mature hardware support for IPE on open- MSP430, extending it with a fully configurable firmware layer, striving for extensible open-source building blocks that provide a solid foundation for future research. 1. Introduction In contrast to high-end servers and desktops, special- ized memory isolation features for ubiquitous ultra-low- end embedded devices are generally not as widespread and more limited in functionality. Specifically, some vendors are shipping limited hardware features for code protection and, in certain cases, data isolation in selected microcon- trollers. At the same time, a long line of academic research prototypes has explored specialized isolation mechanisms for trusted execution environments (TEEs) specifically aimed at low-end microcontrollers. A key driver behind these academic innovations has been the availability of open-source softcore implemen- tations, facilitating the rapid prototyping of hardware- software co-designs. OpenMSP430 [8], an open-source reimplementation of the popular line of ultra-low-power MSP430 microcontrollers from Texas Instruments (TI), is such a platform. While openMSP430 itself lacks any built-in security features, it has served as the basis for numerous academic TEE prototypes [6], [7], [12], [13]. Interestingly, newer MSP430 devices produced by TI ship with advanced security features that are not implemented by openMSP430, including a memory protection unit and Intellectual Property Encapsulation (IPE) [18]. IPE utilizes a capable program-counter-based hardware memory iso- lation mechanism to establish a secluded enclave memory region for confidential code and data. This approach has drawn explicit comparisons to the isolation guarantees offered by TEEs [3], and IPE itself has been used as a building block of academic proposals on secure intermit- tent computing [10], [11]. The emergence and popularity of these security fea- tures point to the importance of including hardware mem- ory isolation mechanisms in low-end microcontrollers. Unfortunately, however, current systems have been shown to suffer from critical vulnerabilities, including design flaws and implementation errors [4], improper input sani- tization [4], [19], and microarchitectural side channels [4], [20]. Even TI’s IPE has been shown vulnerable to different code and data extraction attacks [3], [14], [15], ultimately compromising the security of systems building on it. Crucially, we observe a large overlap in the impacted security features and hypothesize that many attacks could have been avoided with more coordination. For example, the most crucial vulnerability on IPE, controlled call corruption [3], assigned high severity by TI, was found to be already mitigated via a minimal hardware change in both Sancus and VRASED, two research systems built on openMSP430. Similarly, IPE does not enforce a sin- gle entry point, a well-understood design requirement for embedded TEEs [7], [9], [12], [13], [16]. IPE has, furthermore, been