Cryptology ePrint Archive: Report 2017/1216

Probabilistic and Considerate Attestation of IoT Devices against Roving Malware

Xavier Carpent and Norrathep Rattanavipanon and Gene Tsudik

Abstract: Remote Attestation (RA) is a popular means of detecting malware presence (or verifying its absence) on embedded and IoT devices. It is especially relevant to low-end devices that are incapable of protecting themselves against infection. Malware that is aware of ongoing or impending attestation and aims to avoid detection can relocate itself during computation of the attestation measurement. In order to thwart such behavior, prior RA techniques are either non-interruptible or explicitly forbid modification of storage during measurement computation. However, since the latter can be a time-consuming task, this curtails availability of device's other (main) functions, which is especially undesirable, or even dangerous, for devices with time- and/or safety-critical missions.

In this paper, we propose SMARM, a light-weight technique, based on shuffled measurements, as a defense against roving malware. In SMARM, memory is measured in a randomized and secret order. This does not impact device's availability -- the measurement process can be interrupted, even by malware, which can relocate itself at will. We analyze various malware behaviors and show that, while malware can escape detection in a single attestation instance, it is highly unlikely to avoid eventual detection.

Category / Keywords: applications /

Date: received 12 Dec 2017, last revised 18 Dec 2017

Contact author: xcarpent at gmail com

Available format(s): PDF | BibTeX Citation

Version: 20171219:001457 (All versions of this report)

Short URL: ia.cr/2017/1216

Discussion forum: Show discussion | Start new discussion


[ Cryptology ePrint archive ]