Abstract:The number of Internet-of-Things (IoT) devices has been increasing rapidly every year. Most of these devices have access to important personal data such as health, daily activities, location, and finance. However, these devices have security problems since they have limited processing power and memory to implement complex security measures. Therefore, they possess weak authentication mechanisms and a lack of encryption. Additionally, there are no widely accepted standards for IoT security. Device Identifier Composition Engine (DICE) was proposed as a standard that enables adding a security layer to low-cost microcontrollers with minimal silicon overhead. However, previous studies show that DICE-based attestation is vulnerable to some remote attacks. In this study, we present a novel method called DICEguard to address the security problems of DICE. One of the key innovations of DICEguard is its incorporation of periodic memory forensics (PMF) technique, leveraging a hardware-based hash engine to detect and mitigate potential security breaches resulting from firmware vulnerabilities. DICEguard enhances the overall resilience of IoT devices against attacks by swiftly detecting alterations indicative of malicious activity through periodic calculation and comparison of firmware digests. Furthermore, DICEguard introduces a one-time programmable (OTP) memory component to safeguard critical security parameters, such as public keys used for signature verification, against tampering by adversaries. This ensures the integrity of essential security measures even in the face of sophisticated attacks. We implemented the enhanced DICE architecture using the open-source RISC-V platform Ibex and the mbedTLS library for cryptographic operations. We performed the hash operations required by DICE in a hardware-based manner on a commercial Field Programmable Gate Array (FPGA) platform rather than firmware, which is more vulnerable to attacks. Our test results show that with negligible area overhead to a standard microcontroller system, the proposed method can detect the simulated attacks.

FEDTIC: A Security Design for Embedded Systems with Insecure External Memory

Security Memory System for Mobile Device or Computer Against Memory Attacks

Architecture Support for Memory Confidentiality and Integrity in Embedded Systems

A Cost-Effective Tag Design For Memory Data Authentication In Embedded Systems

MIPE: a Practical Memory Integrity Protection Method in a Trusted Execution Environment.

Encryption scheme design and implementation of embedded processor off-chip memory access

SecureD: A Secure Dual Core Embedded Processor

ProtFe: Low-Cost Secure Power Side-Channel Protection for General and Custom FeFET-Based Memories

Analyzing the Vulnerabilities of External SDRAM on System-on-Chip Field Programmable Gate Array Devices

High-Efficiency Parallel Cryptographic Accelerator for Real-Time Guaranteeing Dynamic Data Security in Embedded Systems

Securing Embedded System from Code Reuse Attacks: A Lightweight Scheme with Hardware Assistance

SecDDR: Enabling Low-Cost Secure Memories by Protecting the DDR Interface

Dynamic encryption key design and management for memory data encryption in embedded systems

Protecting In-memory Data Cache with Secure Enclaves in Untrusted Cloud.

Hardware-Assisted Monitoring For Instruction Security In Embedded System

Memory Optimization System for SGXv2 Trusted Execution Environment

Partial Reconfiguration for Run-time Memory Faults and Hardware Trojan Attacks Detection

DICEguard: enhancing DICE security for IoT devices with periodic memory forensics

Embedding Security into Ferroelectric FET Array via In-Situ Memory Operation

A New Architecture of Sensitive File Management Based on Dual-Core and EFI

Low-latency DAE: A Configurable Lightweight Hybrid Data and Address Encryption Engine for IoT Real-time NVM Protection