SMARM+: Analyzing and Enhancing Shuffled Measurements for Remote Attestation in Real-Time IoT Settings

2026-07-26

AI Summary

This work addresses the incompatibility of traditional remote attestation with real-time systems due to its reliance on atomic memory measurements, and the trade-off between real-time performance and storage overhead in existing SMARM schemes caused by fixed block sizes in RTOS environments. For the first time, the authors implement SMARM on FreeRTOS and Zephyr and propose a suite of enhanced approaches termed SMARM+. They introduce the FAR metric to quantitatively assess real-time compatibility and design two variants—SMARM+PRNG and SMARM+FPE—leveraging techniques such as memory block shuffling, pseudorandom number generation (PRNG), and format-preserving encryption (FPE). Experimental results demonstrate that SMARM+ significantly reduces secure storage requirements, timing overhead, and energy consumption while preserving both security guarantees and real-time responsiveness.

Abstract

Remote attestation (RA) is a lightweight security primitive for detecting software compromise on IoT devices. Traditional RA schemes require atomic, non-interruptible memory measurements, making them difficult to deploy alongside real-time workloads. SMARM addresses this limitation by measuring memory in a secret, shuffled block order, reducing the non-interruptibility period to the duration of a single block measurement. However, SMARM was originally designed for microkernel-based systems and has not been studied in RTOS-driven real-time environments. In this work, we present the first systematic study of SMARM in real-time RTOS-based setups. We implement SMARM on commodity ARM TrustZone-M hardware running FreeRTOS and Zephyr, and introduce the Frequency Accuracy Ratio (FAR) to quantify the extent to which attestation can coexist with real-time execution under varying workloads. Our evaluation shows that SMARM's real-time compatibility is highly sensitive to block size: large blocks significantly degrade real-time availability, while small blocks incur substantial secure-storage overhead, limiting deployability on memory-constrained devices. To address this limitation, we propose SMARM+, a family of enhanced SMARM variants consisting of SMARM+PRNG and SMARM+FPE. They are designed to reduce secure-storage requirements while preserving SMARM's security guarantees and real-time behavior. Our evaluation highlights the trade-off between secure-storage reduction, attestation runtime, and energy overhead, and provides guidance on selecting among SMARM, SMARM+PRNG, and SMARM+FPE for different deployment settings.

Problem

• Remote Attestation
• Real-Time Systems
• IoT Security
• Secure Storage Overhead
• RTOS

Innovation

• SMARM+
• Remote Attestation
• Real-Time RTOS
• Secure Storage Optimization
• Frequency Accuracy Ratio