## 8 Scalability
### Constraints of the Proposed Solution  
To implement an end-to-end ML attestation solution, the selected platform must fulfill specific hardware and software requirements.  
The proposed implementation follows the PSA Certified guidelines, which define well-established security boundaries rooted in fundamental security engineering principles. Table 7 presents the list of software and hardware requirements necessary to establish trust in the attestation solution. The two most crucial features a platform must have are an immutable RoT and isolation using TrustZone technology, while for the remaining requirements, there are various open-source or vendor-specific software alternatives available.  
Not all SoC vendors offer an immutable RoT. Some rely on hardware-software-based security solutions, where secure boot and software protections replace a dedicated, immutable hardware RoT. Additionally, lower-end microcontrollers (e.g., NXP LPC800, Microchip PIC32, Atmel SAM D) lack an immutable RoT that supports secure boot, offering only basic security features like read-out protection or memory write protection.  
Similarly, not all microcontrollers and SoCs feature TrustZone technology. While higher-end platforms like ARM Cortex-A and Cortex-M33 cores typically support TrustZone for secure isolation, lower-end microcontrollers (e.g., Cortex-M0, Cortex-M3) do not. These devices lack the advanced isolation and secure execution environments provided by TrustZone, which limits their ability to protect sensitive operations from less secure processes.  
Memory requirements for TFLM can vary significantly depending on the type of ML model in use. TFLM's memory usage encompasses the code size for components such as the interpreter, memory allocator, and memory planner, along with any operators needed by the specific model. For instance, platforms running convolutional neural networks (CNNs) or recurrent neural networks (RNNs) typically require higher specifications, including a minimum of 1 MB of flash memory, 512 kB of SRAM, and a high-performance clock operating above 200 MHz [42].  
On the other hand, classical ML algorithms like Support Vector Machines (SVMs), Random Forests (RFs), or lightweight Multi-Layer Perceptron (MLP) networks demand significantly less memory. According to [38], lightweight MLP models can run on low-end  
\begin{table}
\begin{tabular}{l l l} \hline \hline
**Platform Requirements** & **Utilized** & **Alternatives** \\ \hline \multirow{3}{*}{iRoT} & \multirow{3}{*}{STiROT (STM Microelectronics)} & iMX RoT (NXP) Sitara RoT \\  & & (Texas Instruments) ESP32-S3 \\  & & RoT (Expressif) SAMaSD \\  & & RoT (Microchip) \\ \hline Isolation & TrustZone (ARM) & PMP (RISC-V) \\ \hline \multirow{3}{*}{Secure Environment} & Secure Manager (STM Microelectronics) & TF-M/A (Open Source) OP-TEE \\  & & (Open Source) SME (Silicon Labs) \\ \hline \multirow{3}{*}{Secure Storage} & \multirow{3}{*}{Internal Encrypted Flash} & External Flash OTP Fuses \\  & & EEPROM Secure Element \\ \hline \multirow{3}{*}{Secure Boot} & \multirow{3}{*}{STuROT (STM Microelectronics)} & \multirow{3}{*}{Meuboot (Open Source) Wolfboot (Open Source) HAB (NXP)} \\ \cline{3-3}  & & HW Accelerated (STM & _HW Cryptographic Engines_: NXP, \\ \cline{1-1} \cline{3-3}  & Microelectronics) SW & Microchip, Reness _SW Solutions:_ \\ \cline{1-1} \cline{3-3}  & & \multicolumn{1}{c}{} \\ \end{tabular}
\end{table}
Table 7: Comparison of platform requirements. Solutions utilized in the current evaluation and alternatives.  
platforms with just 8 kB of SRAM and 256 kB of flash memory. In these cases, the only constraints are the specifications outlined in Table 7 and the availability of such resources on low-end platforms.