Remote attestation allows for validating the trustworthiness of a remote device. Existing attestation schemes either require hardware changes, trusted computing components or rely on strict timing constraints. In this paper, we present a novel remote attestation approach, called DMA’N’PLAY, that tackles these practical limitations by leveraging DMA (direct memory access).
Since DMA does not require CPU time, DMA’N’PLAY even allows attestation of devices with real-time constraints. To prevent the exploitation of side-channels which potentially could determine if the attestation is running, we developed DMA’N’PLAY TO-GO, a small, mobile attestation device that can be plugged into the attested device. We evaluated DMA’N’PLAY on two real-world devices, namely a syringe pump and a drone. Our evaluation shows that DMA’N’PLAY adds negligible performance overhead and prevents data-only attacks, by validating critical data in memory.
We will present this work on the 21. ACM International Conference on Applied Cryptography and Network Security (ACNS) in Kyoto, Japan.