ITERATOR: interruptible remote attestation through cuckoo filters

Sponziello, N.; Sateesan, A.; Rabbani, M.M.; Mentens, N.; Dragoni, N.; Dushku, E.

doi:doi:10.1109/JIOT.2025.3621016

Remote attestation (RA) is emerging as a promising security mechanism that establishes trust in Internet of Things (IoT) devices by detecting malware presence. Typically, RA consists of computing a hash over the device's memory and is executed as an atomic procedure to guarantee the reliability of the attestation evidence. However, in real-world situations, such as those involving real-time systems, energy-harvesting devices, or mission-critical operations, the IoT device may not be able to complete the attestation procedure due to various factors like task scheduling, limited battery life, or higher priority tasks. In such scenarios where flexibility, adaptability, and security are paramount, enabling interruptibility of RA is crucial. This article presents a novel approach called ITERATOR, which leverages hash-based storage to enable interruptible RA without any additional hardware requirements. Our proposal transforms the device attestation procedure from the traditional approach...Show moreRemote attestation (RA) is emerging as a promising security mechanism that establishes trust in Internet of Things (IoT) devices by detecting malware presence. Typically, RA consists of computing a hash over the device's memory and is executed as an atomic procedure to guarantee the reliability of the attestation evidence. However, in real-world situations, such as those involving real-time systems, energy-harvesting devices, or mission-critical operations, the IoT device may not be able to complete the attestation procedure due to various factors like task scheduling, limited battery life, or higher priority tasks. In such scenarios where flexibility, adaptability, and security are paramount, enabling interruptibility of RA is crucial. This article presents a novel approach called ITERATOR, which leverages hash-based storage to enable interruptible RA without any additional hardware requirements. Our proposal transforms the device attestation procedure from the traditional approach of memory hash computation to a lookup operation in a hash-based storage, namely, a Cuckoo filter. The ITERATOR protocol divides the device's memory into blocks associated with a Cuckoo filter bucket. This approach allows the device to perform RA in multiple rounds, ensuring secure interruptible attestation. We perform software simulations of ITERATOR, demonstrating its high effectiveness in detecting malware presence. Due to its interruptible design, ITERATOR cannot guarantee 100% detection in a single attestation round; however, repeated rounds make long-term evasion by malware highly unlikely. In particular, the experiments showed that the probability of evading the detection ranges between 37% and less than 1%, depending on the protocol configuration. Moreover, we validate ITERATOR's efficiency through two hardware proof-of-concept (PoC) implementations that rely on ESP32 and FPGA platforms. The FPGA implementation shows the high efficiency of the protocol, with 34.3 ns to attest a single memory block.Show less

Leiden University Scholarly Publications

View statistics

Documents

In Collections

ITERATOR: interruptible remote attestation through cuckoo filters