ELASTIC D4.3: Security of Wasm, eBPF, and TEEs on edge and far-edge

This deliverable presents the security analysis and strengthening of WebAssembly (Wasm), extended Berkeley Packet Filter (eBPF), and Trusted Execution Environments (TEEs) for edge and far-edge IoT nodes within the ELASTIC architecture. It establishes a threat model and security architecture for constrained devices, examines runtime-level security mechanisms for Wasm workloads including privacy-preserving deployment patterns and secure module distribution, evaluates eBPF maturity on non-x86 embedded platforms with experimental XDP performance results, and explores TEEs, Secure Elements, and Hardware Security Modules (HSMs) for trusted execution at the far-edge, including transparent data-at-rest encryption in RISC-V Keystone enclaves via WASI interception. Authentication, authorisation, and secure communication protocols for constrained devices are analysed, and remote attestation flows based on IETF RATS are integrated into the Propeller orchestrator to gate workload execution on verified targets. The findings provide the security foundation for trusted Wasm workload deployment across heterogeneous edge and far-edge devices, directly feeding into the WP5 demonstrators.