Remote Runtime Attestation of Driver Operations

Personal computers rely on drivers on a daily basis to communicate with a variety of peripheral devices.

With the rise of cloud computing, users can access cloud-based services and issue commands to connected

periphery. The secure transmission between cloud and periphery is essential for guaranteeing integrity of

messages, and requires runtime attestation for verification. Approaches for remote verification include the

ability to dump the enclaves memory or log the process control flow, and compare those against valid values.

However, cloud-based attestation protocols are not designed to support peripheral communication. Here, we

show the potential of combining remote attestation with runtime attestation protocols to address this gap. We

found when designing dynamic attestation protocols, that significant overhead is inevitable. However, we argue

that a driver hub device that is solely responsible for hosting the peripheral communication protocol to resemble

write-trough’s with less overhead. Our research indicates that an attack can be detected more reliably when the

attestation process is conducted in isolation, such as in a separate enclave or coprocessor.