  Assured Remote Execution on a device is the ability of suitably authorized
parties to construct secure channels with known processes -- i.e. processes
executing known code -- running on it. Assured Remote Execution requires a
hardware basis including cryptographic primitives. In this paper, we show that
a simple hardware-level mechanism called Cryptographically Assured Information
Flow (CAIF) enables Assured Remote Execution. CAIF is akin to some operations
in existing Trusted Execution Environments, but securely implements an ideal
functionality defined in terms of logging and confidential escrow. We show how
to achieve Assured Remote Execution for a wide variety of processes on a CAIF
device. Cryptographic protocol analysis demonstrates our security goals are
achieved even against a strong adversary that may modify our programs and
execute unauthorized programs on the device. Assured Remote Execution enables
useful functionality such as trustworthy remote attestation, and provides some
of the support needed for secure remote reprogramming.
