RADIS: Remote Attestation of Distributed IoT Services

Abstract

Remote attestation is a security technique by which a potentially untrusted device called Prover can evidence its current state to an external trusted party called Verifier. The main goal of a remote attestation protocol is to guarantee the reliability of the evidence, such that the Verifier can verify remotely the trustworthiness of the Prover. In the Internet of Things (IoT) systems, which are increasingly becoming exposed to a broad range of exploitations, the existing remote attestation protocols aim to check the integrity of each individual IoT device by detecting the modified softwares and physical tampering attacks. However, in an interconnected IoT system, in which IoT devices interact autonomously among themselves, a compromised IoT service can influence the genuine operation of other invoked service, without changing the software.In this paper, we show how a compromised service in a distributed IoT service can induce malicious behavior on genuine services, and we highlight the need for distributed services attestation. We propose a protocol for Remote Attestation of Distributed IoT Services (RADIS), which provides a complete evidence about the trustworthiness of distributed IoT services. RADIS relies on a control-flow attestation technique to detect IoT services that perform an unexpected operation due to their interactions with a malicious remote service. Additionally, RADIS traces the interactions between IoT distributed services, allowing the Verifier to check whether the activities follow a legitimate interaction model. We discuss the effectiveness of our protocol in validating the integrity status of a distributed IoT service.

Collective Remote Attestation at the Internet of Things Scale: State-of-the-Art and Future Challenges

“…Finally, as acknowledged by the authors, MTRA works only for static networks. [35], a CRA scheme that turns the CRA problem into a distributed service attestation problem. RADIS aims to detect compromised devices in a distributed IoT service and the legitimate IoT devices that are performing a malicious operation due to corrupted communication data exchanged with the compromised devices.…”

“…SALAD [28], for example, trades security for higher overhead, making the proposal potentially impractical for very large node deployments. Similarly, HEALED [43] introduces a healing phase for compromised devices, incurring in additional overhead; it is thus more suitable for small to medium sized deployments: from Table II we can see it takes approximately 1.8 seconds to attest (and heal) 20 devices, an order of magnitude larger than the time taken by RADIS [35] or LISAα, LISAs [26] for a comparable network size.…”

“…Moreover, we sum up a few open challenges associated with CRA that the research community is currently working on, but that still need practical and complete solutions. SEDA [7] LISA [26] DARPA [9] SeED [24] SCAPI [27] ERASMUS [13] SALAD [28] PADS [25] WISE [29] slimIoT [30] SAP [32] MTRA [33] RADIS [35] ESDRA [39] US-AID [40] EAPA [41] SHeLA [42] HEALED [43] SARA [44] Key Management. Choosing the most appropriate key mechanism is critical.…”

SHeLA: Scalable Heterogeneous Layered Attestation

“…In this section, we list the goals that we aim to achieve through the SHeLA mechanism. Note that some of these goals are also reached in existing swarm attestation protocols [5], [6], [20], [21].…”

State-of-the-Art Software-Based Remote Attestation: Opportunities and Open Issues for Internet of Things

“…Typically, in these approaches, autonomous devices act also as verifiers to attest other devices they interact with. In addition, the RA schemes of distributed IoT services, RADIS [ 25 ] and SARA [ 26 ], aim to attest, respectively synchronous and asynchronous distributed services of IoT systems. All the aforementioned collective RA schemes rely on hybrid architecture.…”