Dominance as a New Trusted Computing Primitive for the IoT

### Overview In large-scale IoT deployments—such as smart cities, supply chains, and Industry 4.0—thousands of identical devices are deployed across wide geographic areas. Because these devices share identical software and configurations, an attacker exploiting a single software vulnerability or weak password can compromise an entire fleet, sever communication with central management hubs, and recruit devices into botnets. Recovering such fleets currently requires costly manual servicing, such as dispatching field workers to manually reflash firmware. To solve this problem without manual intervention, the speaker presents Cider, a system designed to establish "dominance" over IoT devices.

Dominance is defined as the capability of an IoT hub to force a remote device to execute arbitrary code (such as a patched firmware) within a bounded timeframe (e.g., within four hours of discovering an attack), even under a strong adversarial model where application software, network communications, and the OS kernel have been fully rooted.

### Key Topics - **Dominance as an IoT Security Primitive**: Allowing a central management hub to unconditionally regain control and patch compromised IoT devices. - **Minimal Hardware Primitives**: Building root-of-trust and recovery guarantees using read/write latches, read-write latches, and authenticated watchdog timers instead of heavyweight trusted execution environments. - **Isolation in Time**: Alternating between trusted and untrusted software states rather than relying on complex concurrent hardware isolation. - **Unconditional Recovery Guarantees**: Enforcing recovery via cryptographic attestation and watchdog-driven hardware resets when an attacker refuses commands.

### Technical Details Cider assumes only the underlying hardware is trustworthy and introduces three core guarantees built on simple hardware primitives: 1. **Execution of an Unaltered Bootloader**: Devices must always reboot into an untampered trusted bootloader (the Cider bootloader). This is achieved using hardware write latches that block write access to the bootloader's flash/eMMC storage blocks before control transfers to untrusted firmware. 2. **Firmware Attestation and Patching**: Bootloader verification ensures only hub-approved firmware runs. To prevent a compromised firmware from stealing the device attestation key, the key is consumed during boot and immediately locked down using a read-write latch that blocks all further reads and writes until the next hardware reset. To minimize the Trusted Computing Base (TCB), the networking stack is isolated into an untrusted recovery module treated like standard firmware. 3. **Unconditional Device Reset via Authenticated Watchdog Timers**: Conventional watchdog timers can be spoofed by malicious software writing expected constants to registers. Cider replaces this with an authenticated watchdog timer requiring nonces signed by the hub (certificates/tickets). If a device is compromised and fails hub verification, the hub stops issuing tickets, causing the timer to expire and triggering an unconditional hardware reset back into Cider's trusted bootloader.

The authors implemented Cider across high-, mid-, and low-end evaluation boards (SolidRun, Raspberry Pi 3, and STM32). The authenticated watchdog timer can be realized either by repurposing existing onboard hardware (such as TrustZone, physical timers, or MPUs) or by attaching an external microcontroller costing under one dollar.

### Takeaways Cider demonstrates that dominance over IoT devices can be enforced with minimal performance overhead—runtime delays are negligible since watchdog check-ins occur only every few hours or days, and boot overhead is minimal unless downloading full patch images. By prioritizing temporal isolation ("isolation in time") over complex runtime hardware isolation mechanisms (which require MMUs, context switching, and multi-threading susceptible to speculative execution and side-channel attacks), Cider provides a practical, low-cost cornerstone for resilient IoT security.