Fraunhofer-Gesellschaft

Publica

Hier finden Sie wissenschaftliche Publikationen aus den Fraunhofer-Instituten.

Dominance as a New Trusted Computing Primitive for the Internet of Things

 
: Xu, M.; Huber, M.; Sun, Z.; England, P.; Peinado, M.; Lee, S.; Marochko, A.; Mattoon, D.; Spiger, R.; Thom, S.

:

Institute of Electrical and Electronics Engineers -IEEE-:
IEEE Symposium on Security and Privacy, 2019 SP. Proceedings : San Francisco, California, 19-23 May 2019
Piscataway, NJ: IEEE, 2019
ISBN: 978-1-5386-6660-9
ISBN: 978-1-5386-6661-6
pp.1415-1430
Symposium on Security and Privacy (SP) <40, 2019, San Francisco/Calif.>
English
Conference Paper
Fraunhofer AISEC ()

Abstract
The Internet of Things (IoT) is rapidly emerging as one of the dominant computing paradigms of this decade. Applications range from in-home entertainment to large-scale industrial deployments such as controlling assembly lines and monitoring traffic. While IoT devices are in many respects similar to traditional computers, user expectations and deployment scenarios as well as cost and hardware constraints are sufficiently different to create new security challenges as well as new opportunities. This is especially true for large-scale IoT deployments in which a central entity deploys and controls a large number of IoT devices with minimal human interaction. Like traditional computers, IoT devices are subject to attack and compromise. Large IoT deployments consisting of many nearly identical devices are especially attractive targets. At the same time, recovery from root compromise by conventional means becomes costly and slow, even more so if the devices are dispersed over a large geographical area. In the worst case, technicians have to travel to all devices and manually recover them. Data center solutions such as the Intelligent Platform Management Interface (IPMI) which rely on separate service processors and network connections are not only not supported by existing IoT hardware, but are unlikely to be in the foreseeable future due to the cost constraints of mainstream IoT devices. This paper presents CIDER, a system that can recover IoT devices within a short amount of time, even if attackers have taken root control of every device in a large deployment. The recovery requires minimal manual intervention. After the administrator has identified the compromise and produced an updated firmware image, he/she can instruct CIDER to force the devices to reset and to install the patched firmware on the devices. We demonstrate the universality and practicality of CIDER by implementing it on three popular IoT platforms (HummingBoard Edge, Raspberry Pi Compute Module 3 and Nucleo-L476RG) spanning the range from high to low end. Our evaluation shows that the performance overhead of CIDER is generally negligible.

: http://publica.fraunhofer.de/documents/N-568433.html