ITERATOR: Interruptible Remote Attestation Through Cuckoo Filters

IEEE Internet of Things Journal, vol. 12, pp. 54746–54758

Abstract

Remote attestation (RA) is emerging as a promising security mechanism that establishes trust in IoT devices by detecting the malware presence. Typically, RA consists of computing a hash over the device’s memory and is executed as anatomicprocedure to guarantee the reliability of the attestation evidence. However, in real-world situations, such as those involving real-time systems, energy-harvesting devices, or mission-critical operations, the IoT device may not be able to complete the attestation procedure due to various factors like task scheduling, limited battery life, or higher priority tasks. In such scenarios where flexibility, adaptability, and security are paramount, enablinginterruptibilityof RA is crucial. This paper presents a novel approach called ITERATOR which leverages hash-based storage to enable interruptible RA without any additional hardware requirements. Our proposal transforms the device attestation procedure from the traditional approach of memory hash computation to a lookup operation in a hash-based storage, namely, Cuckoo filter. The ITERATOR protocol divides the device’s memory into blocks associated with a Cuckoo filter bucket. This approach allows the device to perform RA in multiple rounds, ensuring secure interruptible attestation. We perform software simulations of ITERATOR, demonstrating its high effectiveness in detecting the malware presence. Due to its interruptible design, ITERATOR cannot guarantee 100% detection in a single attestation round; however, repeated rounds make long-term evasion by malware highly unlikely. In particular, the experiments showed that the probability of evading the detection ranges between 37% and less than 1%, depending on the protocol configuration. Moreover, we validate ITERATOR’s efficiency through two hardware proof-of-concept implementations that rely on ESP32 and FPGA platforms. The FPGA implementation shows the high efficiency of the protocol, with 34.3ns to attest a single memory block.

Authors 6

1. Nicoló Sponziello

   Technical University of Denmark

   Affiliation as printed

   Technical University of Denmark, Lyngby, Denmark

   Technical University of Denmark, Denmark

2. Arish Sateesan Aachen Department of Mobile Communications and Computing Mobile Communications and Computing (MCC)

   RWTH Aachen University

   Affiliation as printed

   Department of Mobile Communications and Computing, RWTH Aachen University, Aachen, Germany

   Mobile Communications and Computing, RWTH Aachen University, Germany

3. Md Masoom Rabbani

   Chalmers University of Technology · University of Gothenburg

   Affiliation as printed

   Chalmers University of Technology, Gothenburg, Sweden

   Chalmers University of Technology and University of Gothenburg, Sweden

4. Nele Mentens

   KU Leuven

   Affiliation as printed

   ES&S, COSIC, ESAT, KU Leuven, Leuven, Belgium

   ES&S, COSIC, ESAT, KU Leuven, Belgium

5. Nicola Dragoni

   Technical University of Denmark

   Affiliation as printed

   Technical University of Denmark, Lyngby, Denmark

   Technical University of Denmark, Denmark

6. Edlira Dushku

   Aalborg University

   Affiliation as printed

   Aalborg University, Copenhagen, Denmark