TM-Coin: Trustworthy management of TCB measurements in IoT

Abstract

Remote attestation is used to enable verifiers to check if an underlying Trusted Computing Base (TCB) of a device and data from the TCB are trustworthy. However, the current remote attestation has limitations to be deployed in IoT from the perspective of the management in a massive and diverse collection of TCB measurements and the redundant execution of remote attestation. To mitigate these limitations, we present a trustworthy management of TCB measurements called TM-Coin (TCB Measurement-Coin) using the blockchain and ARM TrustZone. The TM-Coin transactions and protocol are presented to manage the TCB measurements of IoT devices using the blockchain, a decentralized database. The trusted execution environment provided by ARM TrustZone is used as the TCB to generate the TM-Coin transactions securely. Based on TM-Coin, the verifiers launch remote attestation of sensed data from the devices using the TCB measurements published in the blockchain without attesting to the TCB. We implemented a prototype to evaluate the performance overhead caused by TM-Coin.