Comparison of Trusted Execution Environments for Attestation of Dynamic Software Stacks

Description

During recent years, the need for trusted computing has drastically increased, as more confidential data is progressively transferred to the digital realm. The main goal of trusted computing is to develop technologies which are able to guarantee the expected behavior of a user’s device, under any circumstances. Each trusted technology offers one or more trusted execution environments (TEEs), built to isolate private contents and processing from the untrusted world. For a TEE to prove its trustworthiness to external third-party entities, it must send reports regarding its state and data through a process named attestation. Most trusted technologies to date support one-time attestation, also known as static attestation. However, static attestation can be easily bypassed by runtime attacks, such as return-oriented programming. Consequently, the academia and the industry have started making increasingly more efforts in developing runtime attestation, also known as dynamic attestation.

Even though there is no publicly available technology equipped with a fully-functional dynamic attestation protocol, some existing ones could already possess the right means to implement such concept. In this thesis we examine 25 trusted technologies spanning across multiple device platforms with the scope of identifying which ones are best suited for the task. After stating a set of criteria for this scope, we filter out the non-compliant technologies and we pursue with developing prototypes for the remaining, in order to prove that they are indeed capable of runtime attestation. To our surprise, we find out that our practical results do not overlap perfectly with our theoretical conclusion, so we analyze and explain this discrepancy. Lastly, taking into consideration all previous results, we answer our initial question: Which trusted technology is best suited for dynamic attestation?