| Abstract | Security of embedded devices is a timely and important issue, due to their proliferation into numerous and diverse settings, and growing popularity of these devices as attack targets, especially via remote malware infestations. One important defense mechanism is attestation, whereby a trusted, and possibly remote, party (verifier) checks the internal state of an untrusted, and potentially compromised, device (prover).Despite much prior work, attestation remains a vibrant research topic. However, most attestation schemes naturally focus on the scenario where the verifier is trusted and the prover is not. The opposite setting - where the prover is benign, and the verifier is malicious - has not received any attention. This paper considers this important issue of prover security, including: verifier impersonation, denial-of-service (DoS) and replay attacks, all of which allow the adversary to incapacitate the prover at a critical moment. We argue that protection of the prover from these attacks must be treated as an important component of any remote attestation method. We formulate a new roaming adversary model for this scenario and present the trade offs involved in countering this threat. We also identify new features and methods needed to protect the prover with minimal additional requirements. |
|---|
