Some Recent Advances in Security and Privacy for Low-End IoT/Embedded/Smart Devices

Our society is increasingly reliant upon a wide range of Cyber-Physical Systems (CPS), Internet-of-Things (IoT), embedded, and so-called “smart”, devices. They often perform safety-critical functions in numerous settings, e.g., home, office, medical, automotive and industrial. Some devices are small, cheap and specialized sensors and/or actuators. They tend to have meager resources, run simple software, sometimes upon “bare metal”.

If such devices are left unprotected, consequences of forged sensor readings or ignored actuation commands can be catastrophic, particularly, in safety-critical settings. This prompts the following three questions: (1) How to trust data produced by a simple remote embedded device? (2) How to ascertain that this data was produced via execution of expected software? And, (3) Is it possible to attain (1) and (2) under the assumption that all software on the remote device might be modified or compromised? 

In the first part of this talk, we partially answer the above questions by describing APEX: (Verified) Architecture for Proofs of Execution, the first of its kind technique for low-end devices. APEX has a range of applications, especially, authenticated sensing and trusted actuation, APEX incurs low overhead, making it affordable even for tiniest devices.

In the second part of the talk, we start by observing that most security approaches for low-end devices operate reactively: they can prove whether a desired action (e.g., software update or program execution) was performed on a specific device. However, they do not guarantee that a desired action will be performed, since malware controlling the device can trivially ignore or discard received commands and other trigger events.

This is an important problem because it allows malware to effectively “brick” or incapacitate a potentially huge number of (possibly mission-critical) devices. Though recent work made progress in terms of incorporating more active behavior atop existing RoTs, much of it relies on extensive hardware support in the form of Trusted Execution Environments (TEEs), which are too costly for low-end devices. To this end, we set out to systematically design a minimal active Root-of-Trust (RoT). We begin with three questions: (1) What functionality is required to guarantee actions in the presence of malware? (2) How to implement
it efficiently? and (3) What are the security benefits of an active RoT architecture? We then design, implement, formally verify, and evaluate GAROTA: Generalized Active Root-Of-Trust Architecture. GAROTA is the first clean-slate design of an active RoT for low-end MCU-s. It guarantees that even a fully compromised low-end MCU performs a desired action. We demonstrate its practicality by implementing GAROTA in the context of three types of applications where actions are triggered by: sensing hardware, network events, and timers.

In the third part of this talk, we focus on privacy of data collected by low-end IoT devices. There are many well-known techniques to secure sensed data, e.g., by authenticating communication end-points, encrypting data before transmission, and obfuscating traffic patterns. Such techniques protect sensed data from external adversaries, while assuming that the sensing device itself is secure. Meanwhile, both scale and frequency of IoT-focused attacks are growing. This prompts a natural question: how to protect sensed data even if all software on the device is compromised? Ideally, in order to achieve this, sensed data must be protected  from its genesis, i.e., from the time when a physical analog quantity is converted into its digital counterpart and becomes accessible to software. We refer to this property as PfB: Privacy from Birth.

In this work, we formalize PfB and design Verified Remote Sensing Authorization (VERSA) – a provably secure and formally verified sensor architecture guaranteeing that only correct execution of expected and explicitly authorized software can access and manipulate sensing interfaces, specifically, General Purpose Input/Output (GPIO), which is the usual boundary between analog and digital worlds on embedded devices.  This guarantee is obtained with minimal hardware support and holds even if all device software is compromised. VERSA ensures that malware can neither gain access to sensed data on the GPIO-mapped memory nor obtain any trace thereof.  VERSA is formally verified and its open-source implementation targets resource-constrained IoT edge devices, commonly used for sensing. Experimental results show that PfB is both achievable and affordable for such devices.

We end this talk with an overview of current and near-future research directions and open problems.

BIO

Gene Tsudik is a Distinguished Professor of Computer Science at the University of California, Irvine (UCI). He obtained his PhD in
Computer Science from USC in 1991. Before coming to UCI in 2000, he was at the IBM Zurich Research Laboratory (1991-1996) and USC/ISI (1996-2000). His research interests include numerous topics in security, privacy and applied cryptography. Gene Tsudik is a Fulbright Scholar, Fulbright Specialist (thrice), a fellow of ACM, IEEE, AAAS, IFIP and a foreign member of Academia Europaea. From 2009 to 2015 he served as Editor-in-Chief of ACM TOPS: Transactions on Privacy and Security. He was the recipient of the 2017 ACM SIGSAC Outstanding Contribution Award, and the 2020 IFIP Jean-Claude Laprie Award. His magnum opus is the first ever rhyming crypto-poem published as a refereed paper. Gene Tsudik is unfriendly to machine learning and blockchains. He also has no social media presence.