Leveraging ARM v9 Confidential Compute Architecture (CCA) for Secure and Isolated Avionics Integrated Modular Avionics (IMA) Applications

A Whitepaper

Executive Summary

As avionics systems become increasingly consolidated, the challenge of ensuring robust security and isolation grows. Integrated Modular Avionics (IMA) frameworks allow multiple critical applications to share hardware while ensuring independence, but this requires advanced partitioning and isolation mechanisms. ARM’s Confidential Compute Architecture (CCA) in ARM v9 introduces Realms, a new, hardware-enforced security state that could revolutionize partitioning in avionics by moving isolation from software to hardware. This paper examines the integration of ARM v9 CCA Realms in IMA environments, assessing its alignment with safety standards like DO-178C and DO-297, and considering the evolution of ARINC 653 standards to incorporate these hardware-based isolation mechanisms.

Inspired By

This whitepaper draws inspiration from the insights shared in Enabling Realms in ARM Confidential Compute Architecture by "?Xupeng Li, Xuheng Li, Christoffer Dall, Ronghui Gu, Jason Nieh, Yousuf Sait, Gareth Stockwell", on Usenix, which provides an in-depth look at the architecture, design, and security model of ARM’s Confidential Compute Architecture (CCA) and its Realms. For further technical details on the foundational aspects of CCA, refer to the original article here.

Thank you all for covering ARM CCA in your insightful paper : https://www.usenix.org/publications/loginonline/enabling-realms-arm-confidential-compute-architecture

1. Introduction

Avionics systems are traditionally designed with strict isolation between applications to ensure safety, integrity, and reliability. Conventional federated avionics architectures achieve this by dedicating separate hardware resources to each function. However, as avionics systems scale, the Integrated Modular Avionics (IMA) approach offers a streamlined alternative by allowing shared hardware resources across applications, managed by partitioning techniques such as those defined by the ARINC 653 standard.

The evolution of ARM’s architecture from v8 to v9 with the introduction of CCA offers a promising avenue for secure, hardware-enforced isolation. ARM v9 CCA’s Realms can provide an efficient and secure partitioning method, reducing the reliance on hypervisor-only approaches and aligning well with safety-critical avionics applications. This paper explores how CCA Realms enhance avionics security and whether ARINC 653 standards should evolve to incorporate hardware-based isolation.

2. Understanding Federated Avionics and IMA

1. Federated Avionics Architecture: Federated avionics designs rely on separate, dedicated hardware for each avionics function, ensuring inherent physical isolation. This architecture simplifies fault management and safety certification but can increase weight, power requirements, and maintenance overhead as systems scale.
2. Integrated Modular Avionics (IMA): IMA architectures share hardware resources across multiple applications, employing standardized communication and strict partitioning to maintain isolation. This allows avionics systems to consolidate functionality, reducing costs and power consumption while maintaining fault tolerance and predictability.
3. ARINC 653 Standard: ARINC 653 provides guidelines for partitioning in real-time operating systems. By defining spatial and temporal partitioning, ARINC 653 ensures that IMA systems can maintain application isolation even in shared environments. Currently, most IMA systems use hypervisor-based virtual machines (VMs) to achieve these requirements.

3. Avionics Standards Governing IMA Security

1. DO-178C: "Software Considerations in Airborne Systems and Equipment Certification" provides guidelines for developing and certifying avionics software. It includes software assurance levels (SWALs) with increasingly stringent requirements based on an application’s criticality, ensuring robust testing, verification, and risk assessment.
2. DO-297: "Integrated Modular Avionics (IMA) Development Guidance and Certification Considerations" offers standards for the modular development and certification of IMA systems, focusing on the need for secure partitioning, resource allocation, and fault containment.
3. CAST-32A Guidelines: These guidelines address multicore interference in safety-critical applications. Ensuring minimal interference across multicore processors is essential for avionics, as core-sharing applications could lead to timing interference and affect performance predictability.
4. ARINC 653 Compliance: ARINC 653-compliant hypervisors enforce both spatial and temporal partitioning to isolate applications on shared hardware. However, as hardware-based isolation matures, standards like ARINC 653 could evolve to support hardware isolation, such as ARM v9 CCA Realms, reducing reliance on hypervisor-only solutions.

4. ARM v9 Confidential Compute Architecture (CCA) Overview

ARM v9’s CCA introduces Realms, a new hardware-enforced security state that operates independently of the hypervisor and OS. Below are the key technical features of CCA and Realms relevant to avionics applications:

1. Hardware-Enforced Isolation: Realms bypass hypervisor-managed isolation, instead using hardware-level controls for secure partitioning. This approach limits attack vectors associated with hypervisor vulnerabilities and reduces software complexity.
2. Realms as Separate Security States: CCA Realms operate outside the traditional Secure and Non-Secure states in ARM architecture, creating a distinct, independent environment suitable for sensitive applications.
3. Memory Encryption and Integrity Verification: CCA supports memory encryption and integrity checks, protecting data within Realms from unauthorized access or tampering, which is critical for compliance with safety and privacy regulations.
4. Realm Manager (RM): A separate Realm Manager is responsible for Realm lifecycle management, including creation and destruction, without exposing Realms to the OS or hypervisor. This minimizes potential interference and simplifies resource management.
5. Reduced Complexity and Lower Overhead: By handling isolation through hardware, Realms minimize the need for complex hypervisor configurations, resulting in lower latency and predictable performance suitable for safety-critical applications like avionics.

5. Differentiating ARM v8 Hypervisor-Based VMs from ARM v9 CCA Realms

1. Isolation Mechanism: ARM v8: Relies on hypervisor-based virtual machines for partitioning and isolation, with the hypervisor enforcing ARINC 653 rules. ARM v9 CCA: Achieves isolation at the hardware level, independently of the hypervisor, creating secure environments directly through Realms.
2. Security Model: ARM v8: Requires full trust in the hypervisor, which manages access to shared hardware. ARM v9 CCA: Realms enforce security boundaries in hardware, reducing reliance on hypervisor integrity and lowering the risk of compromise.
3. Performance Overhead: ARM v8: Hypervisor-based partitioning adds performance overhead, which can impact critical real-time applications. ARM v9 CCA: Hardware-driven isolation via Realms lowers overhead and ensures high performance and predictable timing, crucial for avionics.
4. Standards Compatibility: ARM v8: Aligns with current ARINC 653 hypervisor-based partitioning standards. ARM v9 CCA: Encourages an evolution in ARINC 653 to incorporate hardware-based isolation for flexibility and enhanced security.
5. Implementation Complexity: ARM v8: Complex hypervisor configurations require maintenance, adding to development and operational overhead. ARM v9 CCA: Reduces complexity with hardware-level isolation, streamlining development and certification in compliance-focused environments.

6. Implications for ARINC 653 and the Future of Avionics Standards

Given the capabilities of ARM v9 CCA, the current hypervisor-based ARINC 653 standard could be expanded to include hardware-based isolation as a recognized method of partitioning. This evolution would allow avionics systems to benefit from the efficiency and security of direct, hardware-enforced partitioning, paving the way for simpler, more robust IMA implementations. ARM v9 CCA’s Realms could complement or replace hypervisor-managed isolation, reducing reliance on software and ensuring compliance with multicore interference guidelines under CAST-32A.

7. Application of ARM v9 CCA Realms in Avionics IMA Systems

1. Security and Isolation: CCA Realms provide secure domains for critical applications, ensuring data confidentiality and integrity within a hardware-enforced environment. This secure setup meets DO-178C and DO-297 requirements for avionics software certification.
2. Enhanced Multicore Management: Realms enable predictable, secure resource allocation across multicore processors, reducing interference as required by CAST-32A and enabling parallel processing without performance degradation.
3. Future-Ready Compliance: Integrating CCA into avionics allows manufacturers to comply with emerging standards that recognize hardware-based isolation, preparing systems for long-term compatibility and security.

8. Conclusion

ARM v9’s Confidential Compute Architecture with Realms provides avionics IMA systems with a hardware-enforced solution for secure, efficient partitioning. By potentially expanding ARINC 653 standards to include hardware-based isolation, the avionics industry can adopt this streamlined approach, optimizing security, performance, and compliance in a consolidated environment.

?