Paper 2017/1216

Probabilistic and Considerate Attestation of IoT Devices against Roving Malware

Xavier Carpent, Norrathep Rattanavipanon, and Gene Tsudik


Remote Attestation (RA) is a popular means of detecting malware presence (or verifying its absence) on embedded and IoT devices. It is especially relevant to low-end devices that are incapable of protecting themselves against infection. Malware that is aware of ongoing or impending attestation and aims to avoid detection can relocate itself during computation of the attestation measurement. In order to thwart such behavior, prior RA techniques are either non-interruptible or explicitly forbid modification of storage during measurement computation. However, since the latter can be a time-consuming task, this curtails availability of device's other (main) functions, which is especially undesirable, or even dangerous, for devices with time- and/or safety-critical missions. In this paper, we propose SMARM, a light-weight technique, based on shuffled measurements, as a defense against roving malware. In SMARM, memory is measured in a randomized and secret order. This does not impact device's availability -- the measurement process can be interrupted, even by malware, which can relocate itself at will. We analyze various malware behaviors and show that, while malware can escape detection in a single attestation instance, it is highly unlikely to avoid eventual detection.

Available format(s)
Publication info
Contact author(s)
xcarpent @ gmail com
2017-12-19: received
Short URL
Creative Commons Attribution


      author = {Xavier Carpent and Norrathep Rattanavipanon and Gene Tsudik},
      title = {Probabilistic and Considerate Attestation of IoT Devices against Roving Malware},
      howpublished = {Cryptology ePrint Archive, Paper 2017/1216},
      year = {2017},
      note = {\url{}},
      url = {}
Note: In order to protect the privacy of readers, does not use cookies or embedded third party content.