Distributed Attestation Service for IoT

Abstract

Internet of Things (IoT) systems are usually composed of a multitude of devices that may differ greatly in their hardware and software capabilities. Very often, IoT devices are used in critical applications in which the integrity and confidentiality of the gathered data need to be ensured. Due to the large number of devices that compose these systems and their constant change of state, keeping an up-to-date list of the participating devices at any given time is a fundamental problem. At the same time, there is also the problem of ensuring joining devices satisfy the high-level security requirements defined for critical IoT applications. However, the existent work focuses on tackling one of these issues at a time and no complete solution exists. Therefore, we aim to design a system capable of providing a reliable source of information about which devices can participate in an application and to which extent these devices satisfy certain properties to ensure the security requirements are kept. The objective is to significantly increase the trust between interacting IoT devices by regulating their participation in these applications. We developed SIRE, a Byzantine fault-tolerant system that supports remote attestation, coordination primitives, membership management and auditable integrity-protected storage in a single system designed for IoT. Using this solution, we have a system that possesses the necessary features and is adapted to the dynamism and heterogeneity of IoT in a secure, efficient and fault-tolerant implementation. We evaluated SIRE’s performance, both as a coordination service and as a remote attestation service, demonstrating the scalability and efficiency of the system. The results obtained were favourable, asserting it as a viable alternative to the existent work with more features and yet, good performance.