Lightweight and Flexible Trust Assessment Modules for the Internet of Things

Jan Tobias Mühlberg, Job Noorman and Frank Piessens
iMinds-DistriNet, KU Leuven, Celestijnenlaan 200A, B-3001 Belgium


This page contains suplementary material for ESORICS 2015 submission 168: "Lightweight and Flexible Trust Assessment Modules for the Internet of Things"

Abstract. In this paper we describe a novel approach to securely obtain measurements with respect to the integrity of software running on a low-cost and low-power computing node autonomously or on request. We propose to use these measurements as an indication of the trustworthiness of that node. Our approach is based on recent developments in Program Counter Based Access Control. Specifically, we employ Sancus, a light-weight hardware-only Trusted Computing Base and Protected Module Architecture, to integrate trust assessment modules into an untrusted embedded OS without using a hypervisor. Sancus ensures by means of hardware extensions that code and data of a protected module cannot be tampered with, and that the module's data remains confidential. Sancus further provides cryptographic primitives that are employed by our approach to enable the trust management system to verify that the obtained trust metrics are authentic and fresh. Thereby, our trust assessment modules can inspect the OS or application code and securely report reliable trust metrics to an external trust management system. We evaluate a prototypic implementation of our approach that integrates Sancus-protected trust assessment modules with the Contiki OS, running on a Sancus-enabled TI MSP430 microcontroller.

Contiki and Trust Assessment Module. Below we provide the trust assessment scenario that we evaluate in the paper, and a version of Contiki that has been adapted to run on our Sancus-enabled MSP430. To compile the code you will need the Sancus tools and MSP430-GCC installed on your system. The code of the trust assessment scenario (ta_mod.tar.gz) must be extracted to sancus-contiki-3x/examples/ta_mod. The demo scenario may then either be executed in the Sancus simulator (sancus-sim, comes with the Sancus tools) or on an FPGA programmed with the Sancus core. In our experiments we used a Spartan 6 FPGA.

Description Download Size
Trust assessment scenario ta_mod.tar.gz 17 KiB
Contiki 3.x with extensions for Sancus sancus-contiki-3x.tar.gz     16 MiB


For convenience we provide quick links to the entry point functions of the trust assessment module, as described in the paper:

Function Name Description Start Line
TAMainFunc main entry point controlling initialisation and periodic behaviour 56
TARegisterInvar can be used by application code and internally to register an address range for regular integrity checks 77
TASecureCallProcess used by the OS scheduler to invoke application functions; the trust assessment module extends the call with counting the number of invocations and measuring time 34
TAInvarsStatus returns an encrypted status report on the integrity checked address ranges 162
TAProcessStatus returns an encrypted status report on the processes currently running on a node 164

Jan Tobias Mühlberg, Thu, 17 Sep 2015 16:58:11 +0200