Root Of Trust Research Articles

Lightweight Mutually Authenticated Key Exchange with Physical Unclonable Functions

Authenticated key exchange is desired in scenarios where two participants must exchange sensitive information over an untrusted channel but do not trust each other at the outset of the exchange. As a unique hardware-based random oracle, physical unclonable functions (PUFs) can embed cryptographic hardness and binding properties needed for a secure, interactive authentication system. In this paper, we propose a lightweight protocol, termed PUF-MAKE, to achieve bilateral mutual authentication between two untrusted parties with the help of a trusted server and secure physical devices. At the end of the protocol, both parties are authenticated and possess a shared session key that they can use to encrypt sensitive information over an untrusted channel. The PUF’s underlying entropy hardness characteristics and the key-encryption-key (KEK) primitive act as the root of trust in the protocol’s construction. Other salient properties include a lightweight construction with minimal information stored on each device, a key refresh mechanism to ensure a fresh key is used for every authentication, and robustness against a wide range of attacks. We evaluate the protocol on a set of three FPGAs and a desktop server, with the computational complexity calculated as a function of primitive operations. A composable security model is proposed and analyzed considering a powerful adversary in control of all communications channels. In particular, session key confidentiality is proven through formal verification of the protocol under strong attacker (Dolev-Yao) assumptions, rendering it viable for high-security applications such as digital currency.

Elevating Security in Migration: An Enhanced Trusted Execution Environment-Based Generic Virtual Remote Attestation Scheme

Cloud computing, as the most widely applied and prominent domain of distributed systems, has brought numerous advantages to users, including high resource sharing efficiency, strong availability, and excellent scalability. However, the complexity of cloud computing environments also introduces various risks and challenges. In the current landscape with numerous cloud service providers and diverse hardware configurations in cloud environments, addressing challenges such as establishing trust chains, achieving general-purpose virtual remote attestation, and ensuring secure virtual machine migration becomes a crucial issue that traditional remote attestation architectures cannot adequately handle. Confronted with these issues in a heterogeneous multi-cloud environment, we present a targeted solution—a secure migration-enabled generic virtual remote attestation architecture based on improved TEE. We introduce a hardware trusted module to establish and bind with a Virtual Root of Trust (VRoT), addressing the challenge of trust chain establishment. Simultaneously, our architecture utilizes the VRoT within TEE to realize a general-purpose virtual remote attestation solution across heterogeneous hardware configurations. Furthermore, we design a controller deployed in the trusted domain to verify migration conditions, facilitate key exchange, and manage the migration process, ensuring the security and integrity of virtual machine migration. Lastly, we conduct rigorous experiments to measure the overhead and performance of our proposed remote attestation scheme and virtual machine secure migration process. The results unequivocally demonstrate that our architecture provides better generality and migration security with only marginal overhead compared to other traditional remote attestation solutions.

A Trusted Execution Environment RISC-V System-on-Chip Compatible with Transport Layer Security 1.3

The Trusted Execution Environment (TEE) is designed to establish a safe environment that prevents the execution of unauthenticated programs. The nature of TEE is a continuous verification process with hashing, signing, and verifying. Such a process is called the Chain-of-Trust, derived from the Root-of-Trust (RoT). Typically, the RoT is pre-programmed, hard-coded, or embedded in hardware, which is locally produced and checked before booting. The TEE employs various cryptographic processes throughout the boot process to verify the authenticity of the bootloader. It also validates other sensitive data and applications, such as software connected to the operating system. TEE is a self-contained environment and should not serve as the RoT or handle secure boot operations. Therefore, the issue of implementing hardware for RoT has become a challenge that requires further investigation and advancement. The main objective of this proposal is to introduce a secured RISC-V-based System-on-Chip (SoC) architecture capable of securely booting a TEE using a versatile boot program while maintaining complete isolation from the TEE processors. The suggested design has many cryptographic accelerators essential for the secure boot procedure. Furthermore, a separate 32-bit MicroController Unit (MCU) is concealed from the TEE side. This MCU manages sensitive information, such as the root key, and critical operations like the Zero Stage BootLoader (ZSBL) and key generation program. Once the RoT is integrated into the isolated sub-system, it becomes completely unavailable from the TEE side, even after booting, using any method. Besides providing a secured boot flow, the system is integrated with essential crypto-cores supporting Transport Layer Security (TLS) 1.3. The chip is finally fabricated using the Complementary Metal–Oxide–Semiconductor (CMOS) 180 nm process.

Morpheus: An efficient timing-based attestation framework for safeguarding hypervisor integrity with dynamic trust

Hypervisor, the core software in cloud computing, is susceptible to malicious intrusions, potentially jeopardizing overall platform security. Physical hosts within the cloud computing environment constantly face persistent attacks, and not all hosts are equipped with essential security hardware. The prolonged latency of previous software-based detection methods could not comprehensively address these cloud threats. Furthermore, the widespread deployment of security hardware incurs substantial costs for hardware-based detection. To address these challenges, we introduce Morpheus, an efficient framework ensuring hypervisor integrity in the current cloud. This framework rapidly employs software-based methods to detect malicious hosts, utilizing a subset of hosts equipped with security hardware as the Root of Trust. Efficiency is augmented through a Neural Network scheduling module, and an embedded exponential aging mechanism fortifies time-aging trust against consistent cloud threats. Evaluation results demonstrate that it can promptly identify threatened hosts with acceptable system overhead loss, solidifying its position as a robust cloud security solution.

Blockchain-based Crowdsourcing for Human Intelligence Tasks with Dual Fairness

Human intelligence tasks (HITs) are widely utilized for crowdsourcing human knowledge, such as labeling images for machine learning. Centralized crowdsourcing platforms face challenges of a single point of failure and a lack of service transparency. Existing blockchain-based crowdsourcing approaches overlook the low scalability problem of permissionless blockchains or inconveniently rely on existing ground-truth data as the root of trust to evaluate quality of workers' answers. We propose a blockchain-based crowdsourcing scheme for ensuring dual fairness (i.e., preventing false-reporting and free-riding) and improving on-chain efficiency concerning on-chain storage and smart contract computation. The proposed scheme does not rely on trusted authorities but rather depends on a public blockchain to guarantee the dual fairness. An efficient and publicly verifiable truth discovery scheme is designed based on majority voting and cryptographic accumulators. This truth discovery scheme aims at inferring ground truth from workers' answers. The ground truth is further utilized to estimate the quality of workers' answers. Additionally, a novel blockchain-based protocol is designed to further reduce on-chain costs while ensuring truthfulness. The scheme has O(n) complexity for both on-chain storage and smart contract computation, regardless of the number of questions, where n denotes the number of workers. Formal security analysis is provided, and extensive experiments are conducted to evaluate effectiveness and performance.

Coherence Attacks and Countermeasures in Interposer-based Chiplet Systems

Industry is moving towards large-scale hardware systems that bundle processor cores, memories, accelerators, and so on. via 2.5D integration. These components are fabricated separately as chiplets and then integrated using an interposer as an interconnect carrier. This new design style is beneficial in terms of yield and economies of scale, as chiplets may come from various vendors and are relatively easy to integrate into one larger sophisticated system. However, the benefits of this approach come at the cost of new security challenges, especially when integrating chiplets that come from untrusted or not fully trusted, third- party vendors. In this work, we explore these challenges for modern interposer-based systems of cache-coherent, multi-core chiplets. First, we present basic coherence-oriented hardware Trojan attacks that pose a significant threat to chiplet-based designs and demonstrate how these basic attacks can be orchestrated to pose a significant threat to interposer-based systems. Second, we propose a novel scheme using an active interposer as a generic, secure-by-construction platform that forms a physical root of trust for modern 2.5D systems. The implementation of our scheme is confined to the interposer, resulting in little cost and leaving the chiplets and coherence system untouched. We show that our scheme prevents a range of coherence attacks with low overheads on system performance, ∼4%. Further, we demonstrate that our scheme scales efficiently as system size and memory capacities increase, resulting in reduced performance overheads.

The shadow of the family: Historical roots of social trust in Europe.

This study provides new evidence on how historical patterns of household formation shape the present-day level of trust. We test two distinct features of historical family arrangements that might be harmful to trust towards out-groups: (a) family extendedness in terms of the number of household members, and (b) generational hierarchy and gender relations within the household. To conduct our study, we compiled a historical database that reflects family structure and socio-economic development, mostly in the 19th century. The analysis was performed on a sample of 94 historical subnational units within eight contemporary Western and Eastern European countries that participated in the Life in Transition Survey in 2010. We find that cohabitation of several generations within the historical family and power of older generations over the younger are detrimental for out-group trust today. By contrast, family extendedness per se was revealed to have no impact on trust.

Design Methodology and Metrics for Robust and Highly Qualified Security Modules in Trusted Environments

Cyberattacks and cybercriminal activities constitute one of the biggest threats in the modern digital era, and the frequency, efficiency, and severity of attacks have grown over the years. Designers and producers of digital systems try to counteract such issues by exploiting increasingly robust and advanced security mechanisms to provide secure execution environments aimed at preventing cyberattacks or, in the worst case, at containing intrusions by isolation. One of the most significative examples comes from General Purpose Processor (GPP) manufacturers such as Intel, AMD, and ARM, which in the last years adopted the integration of dedicated resources to provide Trusted Execution Environments (TEEs) or secure zones. TEEs are built layer by layer on top of an implicitly trusted component, the Root-of-Trust (RoT). Since each security chain is only as strong as its weakest link, each element involved in the construction of a TEE starting from the RoT must be bulletproof as much as possible. In this work, we revise and propose a design methodology to implement in both hardware (HW) and software (SW) highly featured and robust security blocks by highlighting the key points that designers should take care of, and the key metrics that should be used to evaluate the security level of the developed modules. We also include an analysis of the state of the art concerning RoT-based TEEs, and we illustrate a case study that documents the implementation of a cryptographic coprocessor for the secure subsystem of the Rhea GPP from the European Processor Initiative (EPI) project, according to the presented methodology. This work can be used by HW/SW security module designers as a cutting-edge guideline.

R/B-SecArch: A strong isolated SoC architecture based on red/black concept for secure and efficient cryptographic services

Cryptographic chips usually act as a secure base for information security systems and provide corresponding cryptographic services. Trusted execution environment (TEE) techniques for on-chip security have been widely proposed and effectively validated in academia and industry. However, existing mainstream TEEs still have certain security risks, especially in the face of emerging microarchitectural attacks. To address this issue, this paper proposes a strong isolation SoC architecture for high-security application requirements based on the red/black concept. Meanwhile, to provide efficient cryptographic services, we design an isolation interface that separates data and cryptographic tasks, and a cryptographic service descriptor that matches the isolation interface is defined. In addition, we designed a secure boot mechanism with OTP as the root of trust to ensure the system's power on security. Finally, we conduct performance tests and security analysis; the results show that the architecture can still provide efficient cryptographic services while ensuring security.

Fragile Trust, Stable Mistrust: A Theory of the Formation and Sustainability of Social Trust

The roots of social trust have long been a scholarly concern. Some argue that it is a disposition gained in early socialization that is stable despite social experiences. Others argue that social arrangements that structure prosocial interactions can cultivate it. Analyzing in-depth interview data, I contribute to this literature by developing a theory of fragile trust, stable mistrust. The results suggest interviewees understand early socialization as an important factor in the development of their own social trust. They also suggest these early experiences are structured by important socioeconomic factors. In addition, many interviewees recount a loss of social trust because of significant negative experiences, whereas none relate an experience building trust. I argue that these dynamics are driven by trustors being more interested in the kinds of activities theorized to enhance social trust than mistrusting individuals and by the cognitive mechanisms of the negativity and confirmation biases.

A Lightweight True Random Number Generator for Root of Trust Applications

There are many schemes proposed to protect integrated circuits (ICs) against an unauthorized access and usage, or at least to mitigate security risks. They lay foundations for hardware roots of trust whose crucial security primitives are generators of truly random numbers. In particular, such generators are used to yield one-time challenges (nonces) supporting the IC authentication protocols employed to counteract potential threats such as untrusted users accessing ICs. However, IC vendors raise several concerns regarding the complexity of these solutions, both in terms of area overhead, the impact on the design flow, and testability. These concerns have motivated this work presenting a simple, yet effective, all-digital lightweight and self-testable random number generator to produce a nonce. It builds on a generic ring generator architecture, i.e., an area and time optimized version of a linear feedback shift register, driven by a multiple-output ring oscillator. A comprehensive evaluation, based on three statistical test suits from NIST and BSI, show feasibility and efficiency of the proposed scheme and are reported herein.

Smaug: A TEE-Assisted Secured SQLite for Embedded Systems

As one of the most popular relational databases for embedded devices, SQLite is lightweight to be embedded into applications without installing a specific database management system. However, simplicity and easy-to-use are double-edged swords; while bringing convenience, they also make data processing and storage risky. For example, an attacker can obtain data from a database file or memory and tamper with it once he has gained higher privileges, threatening the database's confidentiality and integrity. To address such security issues, based on a trusted execution environment (TEE) and a trusted platform module (TPM), we have proposed Smaug, a general secure scheme to ensure the confidentiality and integrity of SQLite and similar databases. With Smaug, all the critical data is stored in ciphertext, and data integrity protection is also provided. Besides, with TEE, all the sensitive operations are isolated from the untrusted environment, which can effectively resist attacks against memory. In addition, we use TPM to provide a solid root-of-trust (RoT) for the system. Finally, we have implemented a prototype system, and the performance evaluations have clarified the dominant factors that affect the system availability, providing a reference to the design and implementation of similar systems.

A novel architecture to virtualise a hardware-bound trusted platform module

Security and trust are particularly relevant in modern softwarised infrastructures, such as cloud environments, as applications are deployed on platforms owned by third parties, are publicly accessible on the Internet and can share the hardware with other tenants. Traditionally, operating systems and applications have leveraged hardware tamper-proof chips, such as the Trusted Platform Modules (TPMs) to implement security workflows, such as remote attestation, and to protect sensitive data against software attacks. This approach does not easily translate to the cloud environment, wherein the isolation provided by the hypervisor makes it impractical to leverage the hardware root of trust in the virtual domains. Moreover, the scalability needs of the cloud often collide with the scarce hardware resources and inherent limitations of TPMs. For this reason, existing implementations of virtual TPMs (vTPMs) are based on TPM emulators. Although more flexible and scalable, this approach is less secure. In fact, each vTPM is vulnerable to software attacks both at the virtualised and hypervisor levels. In this work, we propose a novel design for vTPMs that provides a binding to an underlying physical TPM; the new design, akin to a virtualisation extension for TPMs, extends the latest TPM 2.0 specification. We minimise the number of required additions to the TPM data structures and commands so that they do not require a new, non-backwards compatible version of the specification. Moreover, we support migration of vTPMs among TPM-equipped hosts, as this is considered a key feature in a highly virtualised environment. Finally, we propose a flexible approach to vTPM object creation that protects vTPM secrets either in hardware or software, depending on the required level of assurance.

Scalable and Secure Virtualization of HSM With ScaleTrust

Hardware security modules (HSMs) have been utilized as a trustworthy foundation for cloud services. Unfortunately, existing systems using HSMs fail to meet multi-tenant scalability arising from the emerging trends such as microservices, which utilize frequent cryptographic operations. As an alternative, cloud vendors provide HSMs as a service. However, such cloud-managed HSM usage models raise security concerns due to their untrusted and shared operating environment. We propose ScaleTrust, a scalable and secure system for key management. ScaleTrust allows us to scale the number of virtual HSM partitions, each of which is isolated with respect to each other and is robust against cloud insider attacks, while preserving physical isolation of the root of trust. To enable this, ScaleTrust uses Intel SGX and multiple HSM features, such as restricting key usage by controlling key attributes of in-HSM keys and establishing a secure channel using only HSM commands. Finally, we apply ScaleTrust to four real-world systems: Keyless SSL for TLS private key offloading, JSON Web Token authentication for microservices, key provisioning, and encryption in database systems. Our evaluation shows that ScaleTrust achieves multi-tenancy in a scalable way by providing multiple virtual HSMs with legacy HSM devices that are designed to support a single tenant. ScaleTrust provides security against insider threats while incurring 11.9% and 39.0% of end-to-end throughput and latency overhead for Keyless SSL compared to stand-alone HSMs.

Better Safe Than Sorry: Constructing Byzantine-Robust Federated Learning with Synthesized Trust

Byzantine-robust federated learning empowers the central server to acquire high-end global models amidst a restrictive set of malicious clients. The general idea of existing learning methods requires the central server to statistically analyze all local parameter (gradient or weight) updates, and to delete suspicious ones. The drawback of these approaches is that they lack a root of trust that would allow us to identify which local parameter updates are suspicious, which means that malicious clients can still disrupt the global model. The machine learning community has recently proposed a new method, FLTrust (NDSS’2021), where the server achieves robust aggregation by using a tiny, uncontaminated dataset (denoted as the root dataset) to generate the root of trust; however, the global model’s accuracy will significantly decline if the root dataset greatly deviates from the client’s dataset. To address the above problems, we propose FLEST: a Federated LEarning with Synthesized Trust method. Our method considers that trust and anomaly detection methods can complementarily solve their respective problems; therefore, we designed a new robust aggregation rule with synthesized trust scores (STS). Specifically, we propose the trust synthesizing mechanism, which can aggregate trust scores (TS) and confidence scores (CS) into STS through a dynamic trust ratio γ, and we use STS as the weight for aggregating the local parameter updates. Our experimental results demonstrated that FLEST is capable of resisting existing attacks, even when the root dataset distribution significantly differs from the total dataset distribution: for example, the global model trained by FLEST is 41% more accurate than FLTrust for adaptive attacks using the mnist-0.5 dataset with the bias probability set to 0.8.

A lightweight remote attestation using PUFs and hash-based signatures for low-end IoT devices

Remote attestation is a powerful mechanism that allows a verifier to know if the hardware of an IoT (Internet-of-Thing) device (acting as a prover) has been counterfeited or tampered with and if its firmware has been altered. Remote attestation is based on collecting and reporting measurements in a trusted way, and should be lightweight for resource-constrained IoT devices. This work proposes to include a low-cost Root of Trust for Measuring and Reporting (RoTMR) in the prover, based on the combination of a Physically Unclonable Function (PUF) and an Attestation Read-Only Memory (A-ROM), and to use hash-based digital signatures in the attestation protocol. The proposed RoTMR is addressed to IoT devices based on a microcontroller that executes some application code (the measurable object) located in an external non-volatile memory accessible by an attacker. The secret keys required by the digital signatures are not stored but reconstructed using the PUF. The A-ROM contains the attestation instructions and ensures that its contents cannot be altered and that its instructions are executed sequentially without modification. The use of hash-based digital signatures makes the solution quantum-resistant and very robust because its security relies solely on the unidirectionality of a hash function. The proposed attestation protocol takes advantage of the fact that One-Time Signature (OTS) generation and Many-Time Signature (MTS) verification are very well suited for low-end devices, and the MTS scheme is suitable for the verifier application context. The proposal was validated experimentally with the ESP32 microcontroller, which is widely employed in IoT devices, by using its SRAM as PUF and implementing WOTS+, which is a type of Winternitz One-Time Signature scheme (WOTS), the One-Time Signature of Smart Digital Signatures scheme (SDS-OTS), and the MTS schemes constructed with them. The OTS schemes require smaller codes and thus smaller A-ROM than MTS and ECDSA (Elliptic Curve Digital Signature Algorithm). The code of one of the WOTS+ takes about 4 times less space than ECDSA. In terms of execution times, the OTS schemes are very fast. One of the WOTS+ performs all the signature operations in a few tens of milliseconds. The OTS schemes (especially the SDS-OTS) are also very efficient in terms of communication bandwidth because they use small signatures compared to other post-quantum solutions.

SRAM-Based PUF Readouts

Large-scale parameter characterization of Physical Unclonable Functions (PUFs) is of paramount importance in order to assess the quality and thus the suitability of such PUFs which would then be developed as an industrial-grade solution for hardware root of trust. Carrying out a proper characterization requires a large number of devices that need to be repeatedly sampled at various conditions. These prerequisites make PUF characterization process a very time-consuming and expensive task. Our work presents a dataset for the study of SRAM-based PUFs on microcontrollers; it includes full SRAM readouts along with internal voltage and temperature sensors of 84 microcontrollers of STM32 type. Data has been gathered with a custom-made and open platform designed for the automatic acquisition of SRAM readouts of such devices. This platform also provides possibilities of experimenting aging and reliability properties.

Security Verification of the OpenTitan Hardware Root of Trust

We describe the security verification of OpenTitan. We illustrate how information flow tracking turns human knowledge of assets and security requirements into formal security properties verified using Cycuity’s Radix. The verification uncovered weaknesses and helped produce hardware fixes to eliminate vulnerabilities.

Impact of Emerging Hardware on Security and Privacy

The articles in this special issue focus on ongoing research efforts in the development, use, and evaluation of emerging hardware features and techniques to improve system security. We have seen the emergence of new hardware features to improve software security by limiting memory access within an address space, such as Intel’s memory protection keys (MPKs) and extended page table (EPT) switching, among others. Researchers have also proposed hardware-assisted roots of trust using trusted execution environments (TEEs), such as Intel’s software guard extensions (SGXs), so some questions are what the utility is of such techniques and what limitations they still face. The papers in this special issue provide guidance in these areas, which can be helpful in examining future research directions and future applications of such techniques.

Self-verifiable content using decentralized identifiers

We propose a self-sovereign and decentralized naming scheme for Information-Centric Networking (ICN) architectures that makes content items self-verifiable. Our scheme is based on Decentralized Identifiers (DIDs), an emerging identification scheme under standardization by the W3C. With our solution, DIDs are used as content name prefixes and act as the root of trust for the corresponding namespaces. A content item in our scheme includes tamper-proof metadata that can be used to verify its authenticity and integrity based only on the content’s name, without relying on a trusted third party. The owner of a DID can authorize content providers to publish items under a sub-space of its namespace, or even fully delegate the management of a sub-space of its namespace to a controlling entity. We implement our scheme for the Named Data Networking (NDN) architecture and show that it removes the need for trusted third parties, enables hassle-free key rotation, and allows joint namespace ownership and namespace management delegation, with negligible computational and space overhead.