Automatic Compartments for Embedded Systems

Abstract

ACES is a modified version of LLVM for ARMv7-M micro controllers that enables automatic application of compartments to bare-metal system code. It breaks the single monolithic binary of these systems into multiple execution domains using a developer selected policy. This increases the difficulty of compromising the entire system, as the data, code, and peripherals accessible at any given point in execution limited to the subset identified by the policy.