Remote Attestation of IoT devices using a discrete TPM 2.0
summary
A working remote‑attestation pipeline for constrained IoT devices uses a discrete TPM 2.0 as root of trust, enrolls chips by EK certificate, and publishes code on GitHub; a modified TF‑M agent (not OP‑TEE) measures u‑boot and selected files, builds PCRs, signs evidence, and sends it to a dashboard that verifies integrity and flags bad states. Design notes: avoids OP‑TEE for size, integrates with PKI (Keyfactor), handles enroll/TPM vs device issues, and the demo detects config tampering.
AI-written summary · about
chapters (8)
- 0:00Introduction and motivation
- 2:52Remote attestation overview
- 7:48TPM 2.0 as root of trust
- 10:14Enrolling TPM and challenges
- 14:50Design choices and trade-offs
- 16:55TFM and network stack issues
- 18:00Live demo walkthrough
- 22:38Q&A session
related talks
42mTPM based attestation - how can we use it for good?
40mUsing TPMs to Cryptographically Verify Devices at Scale
19mBoF: Simple Remote Attestation with Secure & Attested Communication Channels
40mHas My IoT Device Been Hacked? Establishing Trust w/ Remote Attestation
29mA Simple Protocol for Remote Attestation of System Integrity
41mThe privacy aspect of TPM attestation
41mKeylime - An Open Source TPM Project for Remote Trust of IoT
14mUsing DevIDs and TPMs for Node Attestation