Open Source Summit Europe 2023

In today's world IoT devices, large and small, are managed remotely by device management servers. There are standardized as well as proprietary device management protocols in use, which are comparable in terms of security and functionality. Recently industry has started focusing on improving security of the communication channel including endpoints itself. In addition to the use of various software isolation techniques( for e.g. TrustZone ), attempts have been made to verify the security posture of the device using attestation. Attestation allows a remote party to verify the operating characteristics of a device, including measurements of code running on the device, or the presence of authentic hardware IP itself. Evidence produced by an "attester" is typically used by a relying party to ascertain its security posture, and therefore acts as a building block to establish trust between the parties involved in distributed computations. We want to share the work we have done, showcasing an end-to-end scenario using a high-end IoT device. We have used some of the "off-the-shelf" open source components having attestation capabilities (including attestation verification ) to enhance the security of the whole device management.