Securing networked embedded systems code through distributed systems analysis

The growing importance of Internet of Things (IoT) calls for tools able to provide users with secure systems. Traditional approaches to analyze distributed systems are not expressive enough to address this challenge. As a solution, we present a framework to analyze networked embedded systems. Our key insight is to look at a distributed system as a single body, and not as separate programs that exchange messages. We then can crosscheck information inferred from different nodes. To construct this global view of a distributed system, we introduce a novel algorithm that discovers inter-program links efficiently. Such links lets us build an inter-program view, a knowledge that we can thus forward to a traditional static analysis tool. We prove that our algorithm always terminates and that it correctly models the semantics of a distributed system. We have implemented our solution on top of the LLVM compiler, and have used it to secure six ContikiOS applications against buffer overflow attacks. Our solution produces code that is as safe as code secured by more traditional analyses; however, our binaries are on average 18% more energy-efficient.