GRAMMATECH INC — Department of Defense SBIR Phase I: AF161-079

Description

ABSTRACT: Embedded systems vastly outnumber conventional computing platforms such as enterprise servers and personal computers. Many applications of embedded systems are critical to national security and personal safety. However, the level of security provided by the embedded systems is embarrassingly low: researchers successfully compromised embedded systems that control cars, medical devices, voting machines, smart televisions, internet phones, and many others. This lapse in security is caused, in part, by difficulties in developing and testing of embedded software: embedded platforms are much more diverse than desktop and server ones, have more stringent operational requirements, often have detailed timing constraints, and communicate with a wide range of physical peripheral devices. While the importance of functional testing for embedded systems is well-understood, this diversity makes testing for anomalous out-of-band behavior that creates security vulnerabilities much more difficult than for desktop applications.We propose a tool for conducting large-scale, massively-parallel testing of embedded-system software for security problems. The tool will combine systematic automated test generation with full-system emulation based on an industrial strength simulator. Automated test generation will systematically explore and exercise program behaviors, including unexpected behaviors that often harbor security vulnerabilities. Emulation will enable the tool to perform large-scale, massively parallel testing effectively.; BENEFIT: GrammaTechs overall vision is to provide a tool for conducting large-scale, massively-parallel testing of embedded-system software for security problems. The tool will combine automated test generation with full-system emulation based on an industrial strength simulator, identifying test runs with potential vulnerabilities. The company already markets static analysis tools, enabling teams to identify software application weaknesses, and developers of embedded system software are GrammaTechs largest market. The proposed testing tool fits perfectly with our existing static analysis solutions, extending our software assurance portfoliohelping identify issues using both static and dynamic techniques.The primary target market for the proposed technology is cyber-physical systems (CPS) and safety and security-critical software development organizations, supporting both government and commercial applications. The testing solution provides new capability required for efficient embedded software validation, identifying critical defects and vulnerabilities that could be exploited in todays highly connected embedded and machine-to-machine (M2M) devices.This is the same market space that is addressed by GrammaTechs existing software assurance products.We believe the market is in need of a testing platform that can perform large-scale, massively parallel testing without the need to acquire and configure expensive hardware, relying on sound simulations on general purpose computing clusters, such as Amazon EC2.