Paper 2012/713

Systematic Treatment of Remote Attestation

Aurelien Francillon, Quan Nguyen, Kasper B. Rasmussen, and Gene Tsudik


Embedded computing devices (such as actuators, controllers and sensors of various sizes) increasingly permeate many aspects of modern life: from medical to automotive, from building and factory automation to weapons, from critical infrastructures to home entertainment. Despite their specialized nature as well as limited resources and connectivity, these devices are now becoming increasingly popular and attractive targets for various attacks, especially, remote malware infestations. There has been a number of research proposals to detect and/or mitigate such attacks. They vary greatly in terms of application generality and underlying assumptions. However, one common theme is the need for Remote Attestation, a distinct security service that allows a trusted party (verifier) to check the internal state of a remote untrusted embedded device (prover). This paper provides a systematic treatment of Remote Attestation, starting with a precise definition of the desired service and proceeding to its systematic deconstruction into necessary and sufficient properties. These properties are, in turn, mapped into a minimal collection of hardware and software components that results in secure Remote Attestation. One distinguishing feature of this line of research is the need to prove (or, at least argue) architectural minimality; this is rarely encountered in security research. This work also offers some insights into vulnerabilities of certain prior techniques and provides a promising platform for attaining more advanced security services and guarantees.

Available format(s)
Publication info
Published elsewhere. N/A
Remote AttestationEmbedded DevicesArchitectural MinimalityAuthentication
Contact author(s)
gene tsudik @ uci edu
2012-12-27: revised
2012-12-27: received
See all versions
Short URL
Creative Commons Attribution


      author = {Aurelien Francillon and Quan Nguyen and Kasper B.  Rasmussen and Gene Tsudik},
      title = {Systematic Treatment of Remote Attestation},
      howpublished = {Cryptology ePrint Archive, Paper 2012/713},
      year = {2012},
      note = {\url{}},
      url = {}
Note: In order to protect the privacy of readers, does not use cookies or embedded third party content.