Type of Publication: Article in Collected Edition

SCAtt-man: Side-Channel-Based Remote Attestation for Embedded Devices that Users Understand

Author(s):

Surminski, Sebastian; Niesler, Christian; Linsner, Sebastian; Davi, Lucas; Reuter, Christian

Title of Anthology:

Proc. of the 13th ACM Conference on Data and Application Security and Privacy (CODASPY)

Publisher:

ACM

Location(s):

Charlotte, NC, United States

Publication Date:

2023

Citation:

Download BibTeX

Abstract

From the perspective of end-users, IoT devices behave like a black box: As long as they work as intended, the user will not detect any compromise. The user has minimal control over the software. Hence, it is very likely that the user misses that illegal recordings and transmissions occur if a security camera or a smart speaker is hacked. In this paper, we present SCAtt-man, the first remote attestation scheme that is specifically designed with the user in mind. SCAtt-man deploys software-based attestation to check the integrity of remote devices, allowing users to verify the integrity of IoT devices with their smartphone. The key novelty of SCAtt-man resides in the utilization of user-observable side-channels such as light or sound in the attestation protocol.
Our proof-of-concept implementation targets a smart speaker and an attestation protocol that is based on a data-over-sound protocol. Our evaluation demonstrates the effectiveness of SCAtt-man against a variety of attacks and its usability based on a comprehensive user study with 20 participants.