 ICACT20220401 Slide.01
[Big Slide]
|
Chrome  Click!! |
 |
Hello, I’m Kyeong Tae Kim. I work at Electronics and Telecommunications Research Institute in Korea.
I would like to talk about the title “An IoT Device-trusted Remote Attestation Framework “.
This work was supported by Institute for Information & communications Technology Promotion(IITP) grant funded by the Korea government(MSIT). |
| ICACT20220401 Slide.02
[Big Slide]
|
Chrome Click!! |
 |
Here are contents that I’ll cover.
|
| ICACT20220401 Slide.03
[Big Slide]
|
Chrome Click!! |
 |
There was a crash with IoT devices easily leaking personal information due to a malicious DDoS attack. CCTV cameras (around 150,000 devices) were hacked to become part of a bot and attack a French web hosting company.
If we periodically monitor the status of IoT devices such as CCTV cameras (the internal situation if the device has been infected with malicious code by a malicious hacker), then this type of damage can be prevented. |
| ICACT20220401 Slide.04
[Big Slide]
|
Chrome Click!! |
 |
One of the technology to mitigate this problem is remote attestation.
Remote attestation uses a protocol to verify its integrity by sending it to the verifier, which determines the level of trust for the system health of the IoT device.
The goal of remote attestation is to enable a remote system (Verifier) to determine the level of trust in the integrity of platform of another system (Prover)
An interaction between two parties through which the verifier ascertains the current state and/or behaviour of the prover.
|
| ICACT20220401 Slide.05
[Big Slide]
|
Chrome Click!! |
 |
One of the implementation for the remote attestation is TPM(Trusted Platform Module).
IBM proposed an integrity measurement architecture in based on the TPM.
The objective is to have an accurate fingerprint of every piece of software which can affect the runtime environment of the system.
To achieve this, there has to be a core root of trust, which is usually the first few bytes of BIOS. This is known has Core Root of Trust of Measurement (CRTM)
CRTM calculates the hash of the BIOS and extends this hash to PCRs.
A system’s measurement list has a list of hashes (one for every piece of executable), and the PCR has the incremental hash of all these hashes.
|
| ICACT20220401 Slide.06
[Big Slide]
|
Chrome Click!! |
 |
In this paper, we propose an IoT device-trusted remote attestation framework, which includes a device-trusted remote verification and trust management service for a large group of devices to prevent remote control and zombieization due to firmware forgery.
It remotely verify whether individual objects (files) in the IoT device are damaged in real-time.
The contribution of this paper is twofold: real-time monitoring of massive malware infections of IoT devices and heterogeneous support of the TEE (Trusted Execution Environment) platform.
|
| ICACT20220401 Slide.07
[Big Slide]
|
Chrome Click!! |
 |
In the remote attestation (integrity verification), the remote attestation server verifies whether the integrity of the files is compromised with the trust verification agent operating in the remote attestation device.
The goal of the protocol is to allow an honest (not compromised) device to create an authentication token, that convinces server that the measurement is in some well-defined (expected) state.
Whereas, if the device has been compromised and its state has been modified, the authentication token must reflect this.
|
| ICACT20220401 Slide.08
[Big Slide]
|
Chrome Click!! |
 |
Device-trusted remote attestation framework is composed of the RAS (Remote Attestation System) RA (Remote Attestation) server subsystem, which is the subject of remote attestation for each device, and the RAS RA device subsystem, which generates device verification information and communicates with the RAS RA server subsystem.
|
| ICACT20220401 Slide.09
[Big Slide]
|
Chrome Click!! |
 |
The RAS RA device subsystem verifies the integrity of itself and delivers verification information to the RAS RA server.
It contains an application that executes remote attestation using the trusted device element and registers itself with the RAS RA server during initial boot.
It periodically receives remote verification requests and performs integrity verification.
The main functions are to generate individual or integrated verification information for devices through remote attestation agents and the integrated verification information is transmitted as a signed verification value using the device security element before being sent to the RAS RA server subsystem.
It obtains integrity verification values for files existing in the monitoring directory stored in the configuration file.
It also calculates a hash value for device integrity using a trusted device element-based interface. Finally, it creates a measurement list and chained hash value (using SHA256 Hash function) |
| ICACT20220401 Slide.10
[Big Slide]
|
Chrome Click!! |
 |
The RAS RA sever subsystem is a subject requesting to perform remote verification by communicating with the RA device subsystem, it checks the integrity using the remote attestation and manages the result.
Main function are as follows:
Verification of individual/integrated verification information transmitted from the device.
Generation of individual verification information: Hash value for each object (program, etc.) to be verified.
Generation of integrated verification information: Hash value chain for individual verification information.
Management of verification information and verification results for each device.
To provide device validation status via a web interface.
|
| ICACT20220401 Slide.11
[Big Slide]
|
Chrome Click!! |
 |
This figure illustrates a schematic diagram of the interaction between subsystems. There are four states : device register, integrity generation, attestation verification, and recovery DB store.
I want to point out the object recovery and saving verification results phases, which is recovery DB store state.
The RAS RA server subsystem compares the individual verification information received from the device with the individual verification information stored when the device is registered, checks whether the object is damaged, and requests recovery from the trusted device element (steps 17 and 18).
After performing full or individual recovery on the detected damaged object, remote verification information is created and delivered to the RAS RA server subsystem (steps 19, 20, 21, and 22).
|
| ICACT20220401 Slide.12
[Big Slide]
|
Chrome Click!! |
 |
As seen in Figure, the testbed is constructed for the verification of individual/integrated verification information delivered from 3 types of devices: TPM (30 units), OP-TEE (5 units), and OPEN-TEE (1 unit).
TPM-based IoT device (RPi platform) generate individual or integrated verification information for devices through remote verification agents .
It delivered as signed Quote through PCR of TPM Utilize TPM for reliability of verification information (based on TCG v1.2 API)
OP-TEE/OPEN-TEE based IoT device (ARM platform/ RPi platform) creates individual or integrated verification information for devices in TA (Trusted Application)
It performs object backup and recovery using Secure Storage in TA.
|
| ICACT20220401 Slide.13
[Big Slide]
|
Chrome Click!! |
 |
In TPM, secure cryptographic services (encryption, decryption, hash, etc.) are implemented in HW. A lightweight remote verification protocol supports large-scale IoT environments. The remote verification is based on global standards (TCG v1.2).
In OP-TEE(SW), secure cryptographic services are implemented in SW. It is based on global standards (GlobalPlatform TEE API). An execution environment guarantees authentication and integrity and increases security stability by isolating user executable code and data access.
|
| ICACT20220401 Slide.14
[Big Slide]
|
Chrome Click!! |
 |
In OPEN-TEE(SW), secure cryptographic services are implemented in SW. It is based on global standards (GlobalPlatform TEE API) It supports a ”virtual TEE” that complies with the GP (GlobalPlatform) TEE specification using a hypervisor. Trusted applications developed using a virtual TEE can be compiled and run against any target that conforms to the specification.
|
| ICACT20220401 Slide.15
[Big Slide]
|
Chrome Click!! |
 |
Figure shows the attack scenario for 3 types of devices: TPM, OP-TEE, and OPEN-TEE. The system checks the results of remote attestation after adding/deleting/modifying files for remote verification of TPM-based devices. It also monitors remote verification after performing the malicious code infection process.
When the malware infection on OP-TEE and OPEN-TEE-based devices through a malicious code infection emulation script occurs, malicious code installation detection and recovery results are confirmed through remote attestation.
|
| ICACT20220401 Slide.16
[Big Slide]
|
Chrome Click!! |
 |
The RA Server shows the GUI for the status of the remote attestation monitoring server. According to the scenario, it shows the result of each device remote verification through the web interface.
|
| ICACT20220401 Slide.17
[Big Slide]
|
Chrome Click!! |
 |
The system recovers (or deletes) damaged objects using secure storage existing in TA (Trusted Application). As a result of remote verification, it is confirmed that the integrity is damaged due to malicious code download. Object backup and recovery are performed under secure storage in TA.
|
| ICACT20220401 Slide.18
[Big Slide]
|
Chrome Click!! |
 |
We show how the framework performs remote attestation for object forgery attacks. The testbed is constructed for the verification of individual/integrated verification information delivered from 3 types of devices: TPM (30 units), OP-TEE (5 units), and OPEN-TEE (1 unit).
|
| ICACT20220401 Slide.19
[Big Slide]
|
Chrome Click!! |
 |
SEDA is first swarm attestation solution based on hybrid model.
SANA is attestation protocol based on asymmetric primitives (aggregated signatures verifiable in constant time). It uses Optimistic Aggregate Signature (OAS) scheme
A tale of Two LISA-s exploits Quality of Swarm Attestation (QoSA): binary; count; list; full and Improve SEDA with respect to scalability and resiliency to physical adversaries.
RADIS improves the state of the art by tackling runtime attacks.
SARA aims to attest distributed IoT services running on IoT devices (Publish/Subscribe).
DARPA proposed for device attestation resilient to physical attacks. It uses absence detection to detect physical attacks
SCAPI Improves DARPA and mitigates against physical attacks.
|
| ICACT20220401 Slide.20
[Big Slide]
|
Chrome Click!! |
 |
In short, we propose a device-trusted remote attestation framework that supports various heterogeneous IoT devices
It achieves real-time detection of malware infection and its recovery can be archived by integrity verification using remote attestation
In the recovery, as soon as tampered objects are detected, the framework recovers them using TEE secure storage. The framework can recover any or all of the objects from the detected damaged objects
Malware detection and device health verification are security-critical infrastructure services. It can be used as a security monitoring and control framework for security threats in large-scale IoT infrastructures, such as enterprises, institutions, and national defense.
Thank you for attention.
|
| ICACT20220401 Slide.21
[Big Slide]
|
Chrome Click!! |
 |
Here are references. |
