Whole-Program Control-Flow Path Attestation

Path attestation is an approach to remotely attest the execution of a program P. In path attestation, a prover platform, which executes P, convinces a remote verifier V of the integrity of P by recording the path that P takes as it executes a particular input. While a number of prior techniques have been developed for path attestation, they have generally been applied to record paths only for parts of P's execution. In this paper, we consider the problem of whole program control-flow path attestation, i.e., to attest the execution of the entire program path in P. We show that prior approaches for path attestation use sub-optimal techniques that fundamentally fail to scale to whole program paths, and impose a large runtime overhead on the execution of P. We then develop Blast, an approach that reduces these overheads using a number of novel approaches inspired by prior work from the program profiling literature. Our experiments show that Blast makes path attestation more practical for use on a wide variety of embedded programs. CCS CONCEPTS • Security and privacy → Embedded systems security.