Distributed Attestation for Device Swarms in IoTs Under the Guidance - - PowerPoint PPT Presentation

Samuel Wedaj(2014CSZ8390)

Distributed Attestation for Device Swarms in IoTs

Under the Guidance of

• Prof. Vinay Ribeiro and
• Prof. Kolin Paul

Background:

 The term “Internet of

things” was first coined in 1999

 A hybrid network of

the Internet and resource- constrained networks

Adapted from: Website. http://slideplayer.com/slide/4680231/

Distributed Attestation for IoTs

2

Background:

 IoT devices connected to our day to day lives  Connected devices

 2012: 9 billion 2020: 24 billion

 Nature of the devices  Application domain

aeronautics, space, rail, electronic transaction

systems , health, military …

Distributed Attestation for IoTs

3

Background:

 security, life and privacy critical data  ultimate target of attackers

Distributed Attestation for IoTs

4

Attestation

 Verifying correct and

safe operation

Distributed Attestation for IoTs

5

Smart interconnected devices operate in swarms: large, dynamic, and self-organizing networks

 Challenges

 Device nature  Number of devices to be attested  What to verify?

Distributed Attestation for IoTs

6

Distributed Attestation for IoTs 7

Issues in previous works

Single prover approach

 Y. Li et al. [2010] (Software-based attestation for peripherals. In International Conference on

Trust and Trustworthy Computing, pages 16{29. Springer,2010.)

 Firmware of peripheral devices

 A . Francillon et al. [2014](. A minimalist approach to remote attestation. In Proceedings

• f the conference on Design, Automation & Test in Europe, page 244. European Design and Automation Association,
• 2014. )

 Minimalistic approach based on desired service checking  T. Rauter et al. [31-2015] (Privilege-based remote attestation: Towards integrity assurance for

lightweight clients. In Proceedings of the 1st ACM Work- shop on IoT Privacy, Trust, and Security, pages 3{9. ACM, 2015)

 Light weight solution based on privilege checking

Issue:

 scalability and efficiency

Challenges with number of devices to be attested

D2

V

D3 D4 D7 D6 D1 D5 D8 D1 D2 D3

Verifier attdev

Swarm Communication link Attestation request Attestation response D6 D5 D4 D2 D8 D2 D7

attest

D8 D8 D8 D8 D8 D8 D8 D8 D8 D8 D8

Swarm attestation (Contd..)

 N. Asokan et al. [2015 ] -SEDA

Distributed Attestation for IoTs

8

Distributed Attestation for IoTs 9

Swarm attestation (Contd..)

 N. Asokan et al. [4-2015 ] -SEDA

Distributed Attestation for IoTs 10

Proposal Overview

 A swarm S is a set of s devices with possibly

different hardware and software configurations Attestation Properties:

 resilient  Be more efficient

 Not require VRF to know the detailed configuration of S  Support multiple attestation protocol instances.

 Be independent of the underlying integrity measurement

Swarm Attestation

Distributed Attestation for IoTs

11

Device Requirements: (SMART/TrustLite)

 Integrity measurement:

 It must be infeasible for ADV to tamper with the

mechanism that attests integrity of D’s software.

 Integrity reporting:

 It must be infeasible for ADV to forge the integrity

measurement report sent from D to VRF.

 Secure storage:

 It must be infeasible for ADV to access any cryptographic

secret(s) used by D as part of attestation

Swarm Attestation

Distributed Attestation for IoTs

12

Assumptions

 each D in S satisfies minimal requirements for secure

remote attestation

 D can communicate with all its neighboring devices in

S, and that the network is connected

 cryptographic primitives and their implementations

are secure

 OP is trusted  swarm topology remains static for the duration of a

given attestation protocol instance

Swarm Attestation

Distributed Attestation for IoTs

13

PROTOCOL DESCRIPTION

Offline Phase

• Initialization

Training

• Registration

Online Phase

• Attestation

Distributed Attestation for IoTs

14

Distributed Attestation for IoTs 15

Protocol Overview

Distributed attestation

Distributed Attestation for IoTs

Protocol Overview (Contd…)

Distributed attestation Initialization

Each Device, Di , is initialized with the following parameters

• Software configuration Ci : hash digest of SW of Di
• Code certificate Cert(Ci)
• Identity certificate Cert(pKi); where Ki is device identity given by

manufacturer

• Pair of signing Key (sKi, pKi)
• Public key of Operator/Central Verifier, for verifying cert(c) and cert

(pK)

• System parameters, p and q

For shared key calculation (all devices in the swarm can have same value)

16

Distributed Attestation for IoTs

Protocol Overview (Contd…)

Distributed attestation Registration

 E sends join request  Devices check certificates

If valid

 Exchange parent information  shared key (KEB) established

If not valid

 Reject join

17

Distributed Attestation for IoTs

Protocol Overview (Contd…)

Distributed attestation Attestation

• Verifier sends, Nonce and session id
• Prover sends back mac digest
• Attested node becomes verifier and

thus run attest

• Up on node compromise
• broadcast error message
• Restructure network through join

18

Distributed Attestation for IoTs

Results

Preliminary Results:

 Simulation Environment and assumptions used

• OMNeT++ simulation environment
• Measured run time performances
• values of TrustLite[3] implementation used as delays in
• ur simulation
• end-to-end delay
• average in ZigBee sensor networks[39].
• Low-power, low-cost, low-complexity networking for the Internet
• f Things

19

Distributed Attestation for IoTs

Run-time Performance

20

 Preliminary Results

Distributed Attestation for IoTs

21

Preliminary Results (Contd…) Run-time Performance

Distributed Attestation for IoTs

Proposal Overview

22

Run-time Performance

Computation cost

 Dominating component is cryptographic operations

Communication cost Memory cost

 Each Di must store at least: q, signing key pair (sk; pk), its identity

certificate cert(pk), code certificate cert(c), the set of attestation keys K shared with its neighbors and identification for their parent nodes

 TI MSP430  provide at least 1024 bytes of non-volatile Flash

Energy costs

PERFORMANCE EVALUATION

Distributed Attestation for IoTs

23

no single-point of failure;  assures systems resilience well suited to inherent properties of device

swarms

no prior information regarding total number of

devices in the swarm is required.

Advantages

Distributed Attestation for IoTs

24

References:

[1]. N. Asokan, F. Brasser, A. Ibrahim, A.-R. Sadeghi, M. Schunter, G. Tsudik, and C.

• Wachsmann. Seda: Scalable embedded device attestation. In Proceedings of the 22nd

ACM SIGSAC Conference on Computer and Communications Security, pages 964{975. ACM, 2015. [2]. K. Eldefrawy, G. Tsudik, A. Francillon, and D. Perito. SMART: Secure and minimal architecture for (establishing a dynamic) root of trust. In Network and Distributed System Security Symposium, 2012. [3]. P. Koeberl, S. Schulz, A.-R. Sadeghi, and V. Varadharajan. TrustLite: A security architecture for tiny embedded devices. In European Conference on Computer Systems, 2014.

Distributed Attestation for IoTs

25