WARP: Weaving Application-specific Runtime Policies

Embedded systems are critical to national security and personal safety. However, the level of security provided by most embedded systems is low. In this project, we are building WARP, a tool for Weaving Application-specific Runtime Policies into embedded systems binaries. WARP enables end users to formulate and enforce custom run-time policies that protect the software from external attacks and internal misuse. The tool combines a versatile framework for specifying the desired software behavior with a robust static binary transformation infrastructure for integrating run-time integrity checks into the software. In Phase I, we built a prototype of WARP and used it to effectively enforce several interesting security policies for a selected real-world embedded system: the firmware for a small quadcopter. In Phase II, we will extend the prototype to build a robust and effective tool for incorporating runtime integrity checks into embedded system software. In this effort, we collaborate with Prof. Oleg Sokolskys team at the University of Pennsylvania, recognized experts in runtime verification and formal reasoning about real-time and cyber-physical systems. The University of Pennsylvania team will focus on mechanisms for policy specification and monitor generation. GrammaTech will focus on effective integration of policy monitoring into firmware binaries.