Secure Edge Computing with Lightweight Control-Flow Property-based Attestation

Abstract

The Internet of Things (IoT) is rapidly evolving, while introducing several new challenges regarding security, resilience and operational assurance. In the face of an increasing attack landscape, it is necessary to cater for the provision of efficient mechanisms to collectively verify software-and deviceintegrity in order to detect run-time modifications. Towards this direction, remote attestation has been proposed as a promising defense mechanism. It allows a third party, the verifier, to ensure the integrity of a remote device, the prover. However, this family of solutions do not capture the real-time requirements of industrial IoT applications and suffer from scalability and efficiency issues. In this paper, we present a lightweight dynamic control-flow property-based attestation architecture (CFPA) that can be applied on both resource-constrained edge and cloud devices and services. It is a first step towards a new line of security mechanisms that enables the provision of control-flow attestation of only those specific, critical software components that are comparatively small, simple and limited in function, thus, allowing for a much more efficient verication. Our goal is to enhance run-time software integrity and trustworthiness with a scalable and decentralized solution eliminating the need for federated infrastructure trust. Based on our findings, we posit open issues and challenges, and discuss possible ways to address them, so that security do not hinder the deployment of intelligent edge computing systems.

Orchestrating SDN Control Plane towards Enhanced IoT Security

“…Although, standard classification algorithms are not designed with such requirement in mind, in this paper we assessed their accuracy in presence of data infected with adversarial samples. We strongly believe that this work can be the basis of future research that will attempt to address two main challenges within the IoT security and privacy field: (a) accuracy, in the context of concept drift, of IoT data and how this can be balanced with computational complexity; and (b) near real-time performance of any proposed data trustworthiness framework in the presence of vast volume of IoT data processed; e.g., in the cloud in the form of big data or at the edge of a network Speaking about improving data verification, future work in the field can be geared towards proposing a combination of machine learning techniques to enhance classification accuracy within the investigated model with other advanced data verification approaches [35]. One shall use ensemble learning to utilize multiple classifiers so that they can leverage their advantages and enhance the overall accuracy of IoT data verification [36].…”

CloudVaults: Integrating Trust Extensions into System Integrity Verification for Cloud-Based Environments

“…In the context of CloudVaults, a detailed dynamic tracing of the kernel shared libraries, low-level code, etc., and an in-depth investigation of the VF's configuration is performed to detect any cheating attempts or integrity violations. Such a T rce can be realized either as: (i ) a static binary analyzer for extracting hashed binary data measurements (i.e., digests) [1], or (ii ) a general, lightweight tracer with kernel-based code monitoring capabilities based on the use of "execution hooks" (e.g., extended Berkeley Filters) [15].…”

“…However, if this were to be possible, then we could never trust the measurements in T C. The enforcement of P-4 and P-5 on a VF overcomes such attacks. P-4 ensures that Adv cannot tamper with the execution of T rce, and can in practice be achieved using more complicated (and resource-heavy) attestation methods, such as Control Flow Attestation (CFA) [15]. The latter, P-5, requires that a VF always enforces the LTL invariant given in Eq.…”

Building Trust for Smart Connected Devices: The Challenges and Pitfalls of TrustZone

“…Utilizing the above core capabilities, TrustZone TEEs can provide a wide range of functionalities such as: verification of kernel integrity, access to secure credential generation, secure storage (Android Keystore, dm-verity), secure element emulation for secure mobile payments, enforcement of corporate policies, implementation and verification of secure boot, content protection, digital rights management solutions (PlayReady, Widevine, etc.) and device integrity attestation in the scope of IoT and ARM Cortex-M; although its performance could be optimized for low powered devices with novel attestation schemes [ 54 ].…”