IDA: Hybrid Attestation with Support for Interrupts and TOCTOU

IDA: Hybrid Attestation with Support for Interrupts and TOCTOU

Speakers: Fatemeh Arkannezhad

Conference: NDSS Symposium

YouTube: https://www.youtube.com/watch?v=qg1knBIoSVg

Overview

In an era dominated by smart and embedded IoT devices, ensuring the integrity and trustworthiness of their software state is paramount. These devices, ranging from manufacturing equipment to healthcare sensors, are often resource-constrained and highly susceptible to sophisticated attacks. Remote attestation (RA) stands as a critical security primitive, allowing a trusted verifier to cryptographically ascertain the software state of a remote device before establishing trust for further interactions. While high-end systems leverage hardware-based Trusted Execution Environments (TEEs) for RA, their significant overheads render them impractical for the vast majority of low-end IoT devices. This gap has led to the development of software-only (SWATT) and hybrid (software-hardware co-design) methods, which aim to strike a balance between low overhead and strong security guarantees.

However, existing hybrid RA methods grapple with several fundamental limitations. They typically demand stringent protection for attestation keys and code, often requiring them to reside in ROM and be inaccessible during attestation. This makes them vulnerable to attacks like Return-Oriented Programming (ROP) and side-channel attacks, as demonstrated by recent research. Furthermore, most current hybrid RA methods cannot handle interrupts or DMA requests during attestation, necessitating complex memory cleanup procedures and leaving them exposed to Time-Of-Check-Time-Of-Use (TOCTOU) attacks. Addressing these critical shortcomings, Fatemeh Arkannezhad presented IDA, a novel hybrid attestation method, and its extension IDA+, designed to enhance security, flexibility, and efficiency for resource-constrained IoT devices.

IDA introduces a paradigm shift by removing the requirement for disabling interrupts and relaxing restrictive access control for the secret key and attestation code during the hash computation phase. Instead, it relies on hardware monitoring of the attestation process itself, using the secret key only for the final response authentication. IDA+ further extends this by continuously monitoring program memory for modifications, enabling the detection of TOCTOU attacks and providing efficient interrupt handling without constant resets. The work represents a significant step forward in securing the ever-expanding landscape of IoT devices by offering robust attestation capabilities with minimal overhead.

Background

▶ Watch: Introduction to IDA: Hybrid Attestation and its motivation (0:00)

Remote attestation fundamentally operates on a challenge-response paradigm. A trusted verifier initiates the process by sending a challenge to a remote device, known as the prover. The prover then computes a cryptographic measurement—typically a checksum or hash—of its execution environment and returns it to the verifier. The verifier subsequently compares this response against a known good state for a clean system. Crucially, for trust to be established, the verifier must be assured that the response computation itself was not tampered with. This assurance is where different attestation methodologies diverge.

Software Attestation (SWATT) methods, such as those described in various works (39, 51, 52, 57), perform attestation purely in software without any dedicated hardware protection. They primarily rely on measuring the time taken for the request-to-response cycle. If the response is correct and falls within an expected timing threshold, integrity is inferred. While SWATT offers high flexibility and low overhead, its coarse-grained timing measurements make it inherently vulnerable to low-latency attacks, where subtle tampering or memory copy attacks can evade detection.

Hybrid methods emerged to address SWATT's limitations by integrating minimal hardware support. These methods typically compute an authenticated integrity check, often a Message Authentication Code (MAC), over the prover's memory. This MAC computation requires a unique secret key, shared with the verifier, which is stored in secure, hardware-protected memory (like ROM) and is accessible only to the attestation code itself. However, this stringent key protection introduces its own set of significant challenges. It often necessitates disabling interrupts during the attestation process, as memory lines tainted by the secret key must be securely cleaned up afterward to prevent leakage. Furthermore, recent research (12, 58) has exposed these methods to key leakage and side-channel attacks, highlighting the inherent risks of tightly coupling the secret key with the software attestation logic.

IDA aims to bridge the gap between the flexibility of SWATT and the robust security guarantees of hybrid methods, while simultaneously overcoming their existing limitations. Its core innovation lies in leveraging hardware monitoring to guarantee the correct execution of the attestation protocol, rather than relying on a secret key for every memory access during the hash computation. The secret key is instead reserved solely for cryptographically signing the final attestation response, ensuring its authenticity. This architectural shift significantly relaxes the need for strict key access control during the memory hashing phase, thereby enabling seamless handling of interrupts and DMA requests. As highlighted in Table I of the original paper, IDA uniquely supports interrupts and DMA, removes requirements for secure key access control or secure resets, and with IDA+, adds comprehensive TOCTOU protection—all while maintaining robust hardware support.

Key Findings

▶ Watch: IDA's novel approach: hardware monitoring for correct execution (3:00)

The research presented by Fatemeh Arkannezhad introduces IDA and IDA+ as significant advancements in hybrid remote attestation for IoT devices, delivering several key findings and contributions:

1. Novel Hybrid RA Design (IDA): IDA proposes a new hybrid remote attestation architecture that fundamentally rethinks how trust is established. Instead of requiring the secret key to be involved in every memory access during hash computation, IDA employs a dedicated Hardware Module (HWM) to monitor the correct execution of the software attestation (SW-Att) code. The cryptographic secret key is used only by the HWM's authentication unit to sign the final computed hash, significantly relaxing the stringent key access control requirements that plague prior hybrid methods. This design enhances security by reducing the exposure of the secret key to potential software vulnerabilities.

1. Secure Interrupt and DMA Support: A critical limitation of most existing hybrid RA methods is their inability to handle interrupts and DMA requests during attestation, often requiring these mechanisms to be disabled. IDA explicitly addresses this by designing the attestation process to securely support such events. Upon detection of an interrupt or DMA request, the HWM triggers a reset of the attestation procedure, ensuring that any potential tampering or state changes are accounted for by forcing a restart with the original nonce. This provides a baseline level of security for dynamic environments.

1. TOCTOU Attack Detection (IDA+): IDA+ extends the capabilities of IDA by directly confronting the Time-Of-Check-Time-Of-Use (TOCTOU) problem. It achieves this through continuous, always-on monitoring of program memory for any modifications, even when the attestation process is not actively running. A dedicated one-bit modified flag within the HWM is set if any write operation (DMA or CPU write) occurs within the program memory range. During an attestation request, if this flag is set, the HWM authenticates the verifier's nonce directly (HMAC(nonce)) instead of the computed hash, signaling to the verifier that the program memory has been altered. This provides the verifier with crucial historical information about the prover's state, preventing hidden malware.

1. Efficient Interrupt Handling (IDA+): Building on IDA's interrupt support, IDA+ significantly improves efficiency by eliminating the need for full attestation resets after interrupts, provided no memory modifications are detected. This is achieved by securely protecting the intermediate hash value within the HWM's Shared Status Register (CSR), moving interrupt triggering logic to the HWM to ensure it occurs between hash calculations, and verifying memory address continuity after an interrupt. This optimization drastically reduces the runtime and energy overhead in systems experiencing frequent interrupts, making attestation practical in highly dynamic IoT environments.

1. Low Overhead and Robustness: Through comprehensive implementation and evaluation on the OpenMSP430 architecture, IDA and IDA+ demonstrate minimal hardware, runtime, memory, and power overheads compared to state-of-the-art hybrid attestation techniques. IDA introduces approximately 19% hardware overhead (3440 logic cells vs. 2891 baseline), and IDA+ a slightly higher 21% (3506 logic cells). This is comparable to or better than other methods like VRASED (13%) and RATA (14%), and significantly less than SANCUS (79%). Attestation time for an 8KB memory is 61.0 ms for IDA and 61.8 ms for IDA+, which is roughly twice as fast as VRASED and RATA (110.9 ms). Memory overhead is minimal, requiring about 4KB of ROM for the SHA3-256 code. These figures affirm the practicality and feasibility of IDA/IDA+ as robust and efficient solutions for securing resource-constrained IoT devices.

Technical Deep Dive

▶ Watch: Comparative overview of IDA vs. state-of-the-art methods (3:45)

The core of IDA's innovation lies in its novel architecture, comprising a CPU running the Software Attestation (SW-Att) code and a Hardware Module (HWM) that vigilantly monitors and authenticates the attestation process. This design shifts the security burden from strict software-based key protection to hardware-assisted process integrity verification.

The Hardware Module (HWM) is the lynchpin of IDA's security. It interacts minimally but critically with the CPU and memory backbone through a set of dedicated control signals:

• Program Counter (PC): The HWM continuously monitors the CPU's PC to track the currently executing instruction, ensuring it remains within the legitimate SW-Att code segment.
• Memory Address (MemAdr): The HWM monitors the memory address being read by the CPU in every cycle, verifying that SW-Att accesses only the designated attestation range.
• Interrupt Request (IRQ): A signal indicating when an interrupt occurs and when it completes, allowing the HWM to detect and react to dynamic system events.
• DMA Write (DMAw): A signal specifically for DMA write operations, as only writes pose a threat to program memory integrity during attestation.
• Shared Status Register (CSR): A memory-mapped register facilitating secure communication and data exchange between the HWM and the CPU. It is writable by both.

Internally, the HWM is composed of two primary units:

1. Controller Unit: This unit houses a Finite-State Machine (FSM) that orchestrates the monitoring process. It continuously observes the PC, MemAdr, DMAw, and IRQ signals. Its paramount objective is to guarantee the correct execution of SW-Att and to initiate a reset of the attestation procedure if any unauthorized activity, interrupt, or DMA request is detected.
2. Authentication Unit: Based on HMAC-SHA3-256, this unit is responsible for cryptographically validating the integrity and authenticity of the final hash computed by SW-Att. Critically, the unique secret key required for HMAC never leaves this tamper-resistant unit, significantly reducing its exposure to software-based attacks.

The Software Attestation (SW-Att) code, detailed in Algorithm 1, is designed for simplicity and efficiency. Upon receiving a challenge (comprising a nonce and the attestation range), it initializes the hash computation with the provided nonce. It then enters an iterative loop, reading memory lines within the specified range and incrementally updating the hash using a standard hash function, such as SHA3-256 from the HACL library (35). The loop is designed to gracefully terminate if an interrupt or DMA request (inter signal) is detected (line 9). Once the hash computation is complete, the final hash value is written to the HWM's CSR (line 11), allowing the Authentication Unit to process it. After a brief delay for HWM processing (line 12), SW-Att reads the authenticated response from the CSR (line 13) and returns it to the verifier.

The HWM's Finite-State Machine (FSM), outlined in Algorithm 2 and illustrated in Figure 4 of the paper, is central to IDA's control flow. It ensures the attestation process is rigorously monitored and controlled through several distinct states:

• Wait State: The initial state where the HWM continuously monitors the PC. It initializes internal registers like CSR, LC (line counter), inter (interrupt flag), and Repeat (attestation loop control). The FSM transitions to the Monitor State once the PC matches PCbegin, the designated start address of SW-Att.
• Monitor State: In this active monitoring state, the HWM tracks the PC and MemAdr to ensure SW-Att executes strictly within its defined code and memory ranges.
• Any deviation (PC outside SW-Att range or MemAdr outside the attestation range) triggers a transition to the Invalid State (lines 10-12).
• Detection of an interrupt (IRQ == 1) or DMA write (DMAw == 1) leads to the Intr State (lines 13-15), setting the inter flag to signal SW-Att to halt its hashing loop.
• Successful completion of SW-Att (PC == PCend and MemAdr == CSRadr) transitions the FSM to the End State (lines 16-18), incrementing LC for each hashed line.
• Intr State: This state manages interrupts or DMA events. The CSR is cleared, and the HWM waits for IRQ and DMAw signals to become 0, indicating the request has been serviced. Upon clearance, it transitions to the End State (lines 20-22), resetting inter.
• Invalid State: Entered upon detecting an intrusion, this state clears CSR and LC, resets inter, and transitions to the End State (lines 24-27).
• End State: The final state after an attestation segment.
• If LC equals LCAR (total expected lines, signifying successful, uninterrupted attestation), the HWM invokes AUTH(CSR) to authenticate the final hash. It then resets to the Wait State, clears a watchdog (WDog), and sets Repeat = 0, signaling SW-Att to terminate.
• If attestation was incomplete or failed (LC != LCAR), the HWM sets CSR to NULL, resets to the Wait State, and increments WDog. If WDog exceeds a threshold (TH), Repeat is cleared, preventing a deadlock from continuous resets. Otherwise, SW-Att is forced to restart.

IDA+: Supporting TOCTOU and Efficient Interrupts

IDA+ extends IDA to address the TOCTOU problem and enhance interrupt handling efficiency. It introduces continuous monitoring of program memory for modifications, even when attestation is not active. A new one-bit modified flag in the HWM is central to this. This flag is initially clear and is set to 1 whenever a write operation (DMAw or MemAdrw) occurs within the program memory range, irrespective of the HWM's FSM state.

When an attestation request arrives in IDA+:

• If modified is 0 (no changes since last successful attestation), the process proceeds normally, and HWM authenticates the computed hash (HMAC(computed_hash)).
• If modified is 1 (changes detected), HWM directly computes and authenticates the nonce provided by the verifier (HMAC(nonce)), bypassing SW-Att's hash computation. This allows the verifier to distinguish between a clean system, a modified system, or an attestation failure.

For more efficient interrupt handling without full resets, IDA+ incorporates three crucial changes:

1. Intermediate Hash Protection: In Algorithm 3, the intermediate hash variable cHash in the SW-Att loop is replaced with MemCSR. This ensures that critical intermediate hash values reside securely within the HWM's CSR, rendering them immutable by an adversary during an interrupt.
2. Interrupt Trigger Logic in HWM: The responsibility for triggering interrupts is migrated to the HWM. This guarantees that interrupts occur precisely between memory line reads and their corresponding hash calculations, preventing corruption of an ongoing hash operation.
3. Post-Interrupt Address Verification: The HWM records the last memory address (i) read by SW-Att before an interrupt. After the interrupt is serviced, the HWM verifies that the next address requested by SW-Att is i + 1, ensuring seamless continuity of the attestation process.

IDA+ also optimizes DMA handling: if program memory within the attestation range remains unmodified during a DMA request, attestation can resume normally without a reset, significantly reducing overhead. Compared to RATA (26), IDA+ requires only one flag bit for memory modification tracking, is immune to key-related vulnerabilities as the key never leaves HWM, and crucially, supports interrupts and DMA requests, capabilities that RATA currently lacks.

Demo / Proof of Concept

▶ Watch: IDA's threat model and required security properties (4:00)

While the talk did not feature a live, interactive demonstration, the technical article describes a robust proof of concept through its comprehensive implementation and evaluation. IDA and IDA+ were meticulously implemented on the OpenMSP430 (32), an open-source MSP430 architecture that accurately represents the characteristics and constraints of low-end IoT and embedded systems. This implementation serves as a concrete validation of the proposed designs and their practical feasibility.

The entire design, including the HWM and its associated logic, was written in Verilog HDL and subsequently synthesized using the Xilinx/AMD Vivado toolchain on a ZYNQ FPGA. This rigorous hardware-level implementation ensures that the designs are not merely theoretical constructs but are capable of being realized in actual silicon.

Key implementation details include:

• SW-Att: The software attestation code utilizes the SHA3-256 implementation from the HACL library (35). Hardware simulations indicated that the unoptimized SHA operation takes approximately 60 cycles on an 8 MHz clock.
• HWM Authentication Unit: The HMAC-SHA3-256 cryptographic function within the authentication unit was implemented using components from Secworks (54), ensuring cryptographic strength.
• OpenMSP430 Modifications: To integrate IDA/IDA+, the baseline OpenMSP430 architecture underwent several modifications. An 8KB ROM was added to securely store the SW-Att code. The HWM was integrated into the system, and crucial control signals (PC, MemAdr, IRQ, DMAw) from the CPU and memory backbone were directly connected to the HWM for real-time monitoring. For IDA+, the global interrupt flag (sGIE) was directly linked to the HWM to enable fine-grained interrupt handling.

The subsequent evaluation, discussed in detail in the talk, provides quantitative evidence of IDA/IDA+'s performance, overheads, and robustness, effectively serving as the empirical demonstration of its capabilities. The results confirm that the implemented designs achieve competitive hardware, runtime, memory, and power overheads while delivering superior security properties and flexibility compared to existing state-of-the-art methods.

Defensive Implications

▶ Watch: Relaxed properties of IDA compared to prior methods (4:50)

The introduction of IDA and IDA+ provides significant defensive advantages for securing resource-constrained IoT devices, particularly against sophisticated software-based attacks and dynamic environment challenges. Defenders, including device manufacturers, firmware developers, and system integrators, can leverage these innovations to build more resilient and trustworthy systems.

1. Enhanced Integrity Guarantees in Dynamic Environments: IDA's ability to support interrupts and DMA requests during attestation means that devices no longer need to halt critical operations for security checks. This is crucial for real-time systems where disabling interrupts could lead to operational failures or denial-of-service. Defenders can deploy attestation without compromising device functionality, ensuring continuous monitoring even in highly dynamic environments. While IDA restarts attestation after an interrupt, IDA+ refines this by allowing attestation to continue if no program memory modifications are detected, significantly reducing performance impact.

1. Robust TOCTOU Attack Prevention: IDA+'s continuous program memory monitoring offers a strong defense against TOCTOU attacks, a common vulnerability where malware hides during attestation and reappears afterward. By setting a modified flag upon any program memory write, IDA+ provides the verifier with a historical record of integrity. This allows defenders to immediately detect if a device's program memory has been tampered with, even if the attestation itself appears to complete successfully. This shifts the defensive posture from reactive (checking current state) to proactive (detecting past unauthorized changes).

1. Relaxed Key Management and Reduced Attack Surface: Traditional hybrid methods often expose the secret attestation key to the software attestation logic, making it a prime target for ROP and side-channel attacks. IDA's design, where the secret key never leaves the tamper-resistant HWM and is used only for authenticating the final response, drastically reduces the attack surface associated with the key. This simplifies key management requirements for defenders, as they no longer need to implement complex secure memory cleanup routines after key usage or worry about software vulnerabilities leading to key leakage during hash computation.

1. Cost-Effective Security for Low-End Devices: The evaluation demonstrates that IDA and IDA+ achieve their advanced security features with minimal hardware overhead (19-21% on OpenMSP430) and competitive runtime performance. This makes them a viable and cost-effective solution for securing low-end IoT devices that cannot afford the resource demands of full TEEs. Defenders can integrate these designs into their microcontrollers without significantly increasing Bill-of-Materials (BOM) costs or power consumption, facilitating widespread adoption of robust attestation.

1. Foundation for Broader Memory Integrity Applications: The IDA/IDA+ framework can serve as a foundational building block for other memory integrity applications beyond static remote attestation. As highlighted in future work, this includes proof of execution, secure reset, secure code updates, and secure data sensing and actuation. Defenders can extend this framework to secure various aspects of an IoT device's lifecycle and operation, creating a more comprehensive security architecture.

By adopting IDA and IDA+, defenders can significantly enhance the trustworthiness and resilience of their IoT deployments, mitigating critical vulnerabilities and providing greater assurance in the integrity of remote devices.

Key Takeaways

• Novel Hybrid Attestation Design: IDA introduces a new hybrid remote attestation method that uses hardware monitoring to verify the correct execution of software attestation code, only using the cryptographic secret key for the final response authentication, significantly improving key security.
• Secure Interrupt and DMA Support: IDA is designed to securely handle interrupts and DMA requests during attestation, a critical feature missing in most prior hybrid methods, by resetting the attestation process upon detection.
• Robust TOCTOU Attack Detection (IDA+): IDA+ extends the design to continuously monitor program memory for modifications, even when attestation is inactive, effectively detecting and reporting Time-Of-Check-Time-Of-Use (TOCTOU) attacks to the verifier.
• Efficient Interrupt Handling (IDA+): IDA+ significantly improves runtime and energy efficiency in interrupt-heavy environments by allowing attestation to continue after an interrupt if no memory modifications are detected, eliminating the need for constant resets.
• Low Overhead and High Performance: Implemented on OpenMSP430, IDA and IDA+ demonstrate minimal hardware (19-21%), memory (4KB ROM), runtime (61.0-61.8 ms for 8KB), and power overheads, making them practical and efficient for resource-constrained IoT devices.
• Enhanced Security and Flexibility: Compared to state-of-the-art methods, IDA/IDA+ offers superior security properties, including relaxed key access control, and greater flexibility for dynamic IoT environments, positioning it as a robust solution for future IoT security.

About the Speaker(s)

The presenter for this work, titled "IDA: Hybrid Attestation with Support for Interrupts and TOCTOU," was Fatemeh Arkannezhad. Based on the transcript, Fatemeh Arkannezhad is an active researcher in the field of embedded systems security, specifically focusing on remote attestation for IoT devices. The detailed technical nature of the presentation indicates a deep expertise in hardware-software co-design, cryptographic primitives, and the specific challenges of securing resource-constrained environments.