As edge devices continue to improve in performance, their role is expanding in real-world environments such as smart factories and smart homes, where executing server-provided code on edge devices is essential for real-time processing and operational flexibility. However, edge code deployment introduces several security challenges, including the exposure of sensitive data and operations to runtime attacks, the absence of remote attestation mechanisms to validate code integrity and execution correctness, and insufficient access control for sensitive peripherals. Existing solutions address only a subset of these challenges and therefore fail to provide comprehensive security guarantees for edge devices. In this article, we present TzPy , a Python runtime designed for secure edge code deployment on ARM TrustZone. TzPy enables the execution of Python code entirely within the secure world. In addition, we design a remote attestation mechanism that verifies both the static integrity of deployed Python code and its runtime control flow through control-flow tracing. Furthermore, TzPy enforces a manifest-driven, fine-grained peripheral access control mechanism to prevent unauthorised or unintended access to sensitive devices. We evaluate TzPy on a Raspberry Pi 3B+ using a smart farm workload and a blinky application, and the results show an end-to-end overhead of 13.4%.

Stack memory errors, such as buffer overflows and over-reads, remain a critical attack vector in embedded systems, which rely heavily on stack memory due to their constrained resources and real-time requirements. Although conventional stack canary techniques have been widely adopted as a lightweight solution, they suffer from several limitations, including limited detection coverage, delayed error reporting, and inability to detect illegal reads. In this paper, we present SMORE, a practical stack memory error detection mechanism designed for ARMv8-M-based embedded systems. SMORE leverages the Memory Protection Unit to implement a hardware-assisted redzone, enabling immediate detection of both read and write violations at runtime. SMORE manages redzones efficiently at function boundaries using the Test Target instructions, minimizing performance impact. We evaluate SMORE on a real embedded platform, the Nucleo-L552ZE-Q running RIOT-OS, and show that it provides significantly improved detection coverage over stack canary while maintaining low performance overhead. These results demonstrate that SMORE provides a practical and effective solution for improving stack memory error detection in embedded software.

Numerous embedded systems utilize firmware written in memory-unsafe C/C++. So, the firmware may exhibit spatial memory vulnerabilities, such as buffer overflows, which, if exploited by an attacker, can lead to various software attacks. While several studies have proposed defenses against these memory vulnerabilities, they often introduce significant performance and memory overhead or are impractical for application in embedded systems. In this paper, we introduce micro-fat pointer, a novel solution for heap memory safety for embedded systems. Notably, micro-fat pointer leverages TT instructions newly introduced in ARMv8-M to implement an efficient bounds-checking mechanism. Our evaluation results demonstrate that micro-fat pointer exhibits a 41% performance improvement compared to the existing state-of-the-art heap memory safety solution.