Logo
ScienceStack
Table of Contents
Fetching ...
Sign In

ENOLA: Efficient Control-Flow Attestation for Embedded Systems

Md Armanuzzaman, Engin Kirda, Ziming Zhao

TL;DR

ENOLA introduces a novel authenticator that achieves linear space complexity, and capitalizes on the latest hardware-assisted message authentication code computation capabilities found in commercially-available devices for measurement computation.

Abstract

Microcontroller-based embedded systems are vital in daily life, but are especially vulnerable to control-flow hijacking attacks due to hardware and software constraints. Control-Flow Attestation (CFA) aims to precisely attest the execution path of a program to a remote verifier. However, existing CFA solutions face challenges with large measurement and/or trace data, limiting these solutions to small programs. In addition, slow software-based measurement calculations limit their feasibility for microcontroller systems. In this paper, we present ENOLA, an efficient control-flow attestation solution for low-end embedded systems. ENOLA introduces a novel authenticator that achieves linear space complexity. Moreover, ENOLA capitalizes on the latest hardware-assisted message authentication code computation capabilities found in commercially-available devices for measurement computation. ENOLA employs a trusted execution environment, and allocates general-purpose registers to thwart memory corruption attacks. We have developed the ENOLA compiler through LLVM passes and attestation engine on the ARMv8.1-M architecture. Our evaluations demonstrate ENOLA's effectiveness in minimizing data transmission, while achieving lower or comparable performance to the existing works.

ENOLA: Efficient Control-Flow Attestation for Embedded Systems

TL;DR

ENOLA introduces a novel authenticator that achieves linear space complexity, and capitalizes on the latest hardware-assisted message authentication code computation capabilities found in commercially-available devices for measurement computation.

Abstract

Microcontroller-based embedded systems are vital in daily life, but are especially vulnerable to control-flow hijacking attacks due to hardware and software constraints. Control-Flow Attestation (CFA) aims to precisely attest the execution path of a program to a remote verifier. However, existing CFA solutions face challenges with large measurement and/or trace data, limiting these solutions to small programs. In addition, slow software-based measurement calculations limit their feasibility for microcontroller systems. In this paper, we present ENOLA, an efficient control-flow attestation solution for low-end embedded systems. ENOLA introduces a novel authenticator that achieves linear space complexity. Moreover, ENOLA capitalizes on the latest hardware-assisted message authentication code computation capabilities found in commercially-available devices for measurement computation. ENOLA employs a trusted execution environment, and allocates general-purpose registers to thwart memory corruption attacks. We have developed the ENOLA compiler through LLVM passes and attestation engine on the ARMv8.1-M architecture. Our evaluations demonstrate ENOLA's effectiveness in minimizing data transmission, while achieving lower or comparable performance to the existing works.
Paper Structure (29 sections, 2 equations, 14 figures, 11 tables, 1 algorithm)

This paper contains 29 sections, 2 equations, 14 figures, 11 tables, 1 algorithm.

Table of Contents

  1. Introduction
  2. Formalizing the Complexity of CFA
  3. Hardware Primitives on MCU
  4. Enola
  5. System and Threat Model
  6. Enola Trace and Measurement Schemes
  7. Enola Components and Workflow
  8. Secure Generation of $T_{\mathcal{O}}$
  9. Secure and Efficient Calculation of Measurements
  10. Backtracking Algorithm for Verification
  11. Security Analysis
  12. Implementation
  13. Evaluation
  14. Evaluation Environment
  15. Micro-level Performance Evaluations
  16. ...and 14 more sections

Figures (14)

  • Figure 1: The workflow of Enola
  • Figure 2: Enola passes in the LLVM pass pipeline
  • Figure 3: Execution time comparison: a single execution of the pacg instruction versus single runs of software-implemented hashing functions on a 25MHz Cortex-M85
  • Figure 4: Code size, $Auth$, and execution time overhead comparison between Enola and Blast
  • Figure 5: Execution overhead and $Auth$ size comparison on syringe pump application
  • ...and 9 more figures