  Guaranteeing runtime integrity of embedded system software is an open
problem. Trade-offs between security and other priorities (e.g., cost or
performance) are inherent, and resolving them is both challenging and
important. The proliferation of runtime attacks that introduce malicious code
(e.g., by injection) into embedded devices has prompted a range of mitigation
techniques. One popular approach is Remote Attestation (RA), whereby a trusted
entity (verifier) checks the current software state of an untrusted remote
device (prover). RA yields a timely authenticated snapshot of prover state that
verifier uses to decide whether an attack occurred.
  Current RA schemes require verifier to explicitly initiate RA, based on some
unclear criteria. Thus, in case of prover's compromise, verifier only learns
about it late, upon the next RA instance. While sufficient for compromise
detection, some applications would benefit from a more proactive,
prevention-based approach. To this end, we construct CASU: Compromise Avoidance
via Secure Updates. CASU is an inexpensive hardware/software co-design
enforcing: (i) runtime software immutability, thus precluding any illegal
software modification, and (ii) authenticated updates as the sole means of
modifying software. In CASU, a successful RA instance serves as a proof of
successful update, and continuous subsequent software integrity is implicit,
due to the runtime immutability guarantee. This obviates the need for RA in
between software updates and leads to unobtrusive integrity assurance with
guarantees akin to those of prior RA techniques, with better overall
performance.
