$\mu$RNG: A Framework for Assessing Randomness in Intermittent Computing Devices

Ultra-low Size, Weight, and Power (UlSWaP) devices, capable of energy harvesting and intermittent computation, are enabling the deployment of vast networks of self-powered sensors that integrate seamlessly into our everyday environments. These technologies bring us closer to the horizon of the Fourth Industrial Revolution: a hyper-connected and automated world of smart dust. The combination of pervasive connectivity and physical proximity to sensitive data raises new security challenges. Although lightweight cryptographic protocols exist for resource-constrained systems, their behavior under intermittent power remains poorly understood. While researchers have made significant progress toward realizing practical intermittent computing systems, securing these devices and their communications remains an open problem. We lay the groundwork for securing intermittent computing systems by addressing the foundation of all cryptographic protocols: random number generation. Security protocols rely on random values for key material and nonces, yet the impact of intermittent operation on Random Number Generators (RNGs) is unclear. We survey real-world UlSWaP devices suitable for intermittent computation and observe a wide range of RNG implementations. We show that applying traditional statistical analyses, designed for continuously powered systems with limited attacker access, can yield a false sense of security in intermittent environments. To address this gap, we introduce a systematic framework for assessing and qualifying RNGs under intermittent operation. Using this framework, we evaluate nine UlSWaP device families representative of academic and commercial platforms, spanning 189 devices across manufacturers, cores, operating conditions, and security capabilities. Our analysis finds that 132 devices lack on-chip RNGs, 27 employ RNGs that are insecure under intermittency and environmental influence, and only 23 provide trustworthy entropy sources. We conclude with recommendations for selecting devices to serve as the base for future security-enabled intermittent computing systems.