RunPBA -- Runtime attestation for microcontrollers with PACBTI

Technical Summary: RunPBA - Runtime Attestation for Microcontrollers with PACBTI

Problem Statement
Embedded systems are increasingly deployed in critical infrastructure, yet their security is often compromised by intrinsic constraints such as limited computational resources and strict energy budgets. While attestation mechanisms are essential for establishing device trust, traditional solutions face significant challenges. Software-based runtime attestation often introduces prohibitive performance overhead and energy consumption, rendering them unsuitable for real-time operations. Conversely, hardware-based solutions frequently rely on custom Intellectual Property (IP) cores or specialized hardware modifications, which increase manufacturing costs and complexity, hindering widespread adoption. Furthermore, many existing attestation schemes suffer from the Time-Of-Check Time-Of-Use (TOCTOU) problem, where an attacker can compromise a device between the measurement of its state and the verification of that state.

Methodology
The authors propose RunPBA (Runtime PACBTI Attestation), a hardware-based runtime attestation system designed specifically for ARM Cortex-M microcontrollers. RunPBA leverages the Pointer Authentication and Branch Target Identification (PACBTI) extension, a native feature available in newer processors like the Cortex-M85 and Cortex-M52, rather than requiring custom hardware.

The system architecture is built upon Trusted Firmware-M (TF-M), utilizing the ARM TrustZone technology to create a Trusted Execution Environment (TEE). The core design principles include:

• Control-Flow Integrity (CFI) Enforcement: RunPBA uses PACBTI to verify the integrity of the execution flow. Pointer Authentication (PA) protects return addresses (backward edges), while Branch Target Identification (BTI) ensures indirect branches land on valid instructions (forward edges).
• Fault Handling and Traceability: When a PACBTI violation occurs in the Non-Secure Processing Environment (NSPE), the system escalates the fault to a Hard Fault in the Secure Processing Environment (SPE). The RunPBA application, acting as an Application Root of Trust (RoT), intercepts this fault, logs critical debug information (such as the Program Counter and fault type) into the Internal Trusted Storage (ITS), and halts the NSPE execution to prevent further exploitation.
• Attestation Integration: RunPBA extends the standard TF-M attestation service. It modifies the attestation token to include a "security lifecycle claim" that reflects the current status of the PACBTI features and any detected runtime faults. This allows a remote verifier to determine if the device has been compromised since the last attestation.
• Lifecycle Management: The system introduces a new device lifecycle state, "NSPE Compromised," which is triggered upon a PACBTI fault, preventing the device from returning to a secure state until the fault is analyzed and resolved.

Key Contributions

1. Attack Analysis: The paper provides a classification of potential attacks against PACBTI, including brute-force, malicious PAC generation, reuse attacks, and side-channel attacks. It also analyzes the vulnerability of BTI to Function Oriented Programming (FOP) attacks, noting that while FOP is theoretically possible, it requires specific gadget chains and privileged access that are difficult to achieve in practice.
2. System Design: The design of RunPBA, which integrates PACBTI monitoring with TF-M to enforce CFI and provide runtime attestation without custom hardware.
3. Implementation: A proof-of-concept implementation of RunPBA as an Application RoT within TF-M, including modifications to the TF-M core to handle PACBTI-specific exceptions and the generation of extended attestation tokens.
4. Evaluation: A comprehensive evaluation of the system's performance and security using the CoreMark-Pro and BEEBS benchmark suites on the Cortex-M85 architecture.

Results
The evaluation demonstrates that RunPBA achieves its goal of low overhead while maintaining robust security:

• Performance Overhead: The system imposes a geometric mean performance overhead of 1.1% on the CoreMark-Pro benchmark and 4.7% on the BEEBS benchmark. The overhead is primarily driven by the additional instructions required for Pointer Authentication (PAC), while Branch Target Identification (BTI) incurs minimal impact as it is handled by hardware.
• Energy Consumption: Power consumption increased by approximately 1% (CoreMark-Pro) and 4.7% (BEEBS), correlating with the execution time overhead. The results indicate that the hardware implementation of PACBTI does not introduce significant additional energy demands despite its cryptographic nature.
• Code Size: The firmware size increase was minimal, ranging from 0.05% to 0.06%, as the primary cost is the addition of PAC and BTI instructions to function prologues and epilogues.
• Security Efficacy: Functional tests confirmed that RunPBA successfully detects and halts execution when PAC or BTI violations occur (e.g., buffer overflow attacks attempting to hijack control flow), preventing the extraction of secrets and forcing a device reset.

Significance and Claims
The paper claims that RunPBA represents a significant step forward in securing embedded systems by bridging the gap between software-based and custom-hardware-based attestation. By utilizing existing processor extensions (PACBTI) rather than requiring new IP cores, RunPBA offers a commodity hardware solution that is cost-effective and easier to adopt.

The authors emphasize that RunPBA effectively mitigates the TOCTOU problem by continuously monitoring the control flow and providing immediate evidence of compromise in the attestation token. While the system inherits certain limitations of PACBTI (such as susceptibility to FOP attacks under specific conditions), the authors argue that the combination of PACBTI with other security measures (like ASLR and NX) and the difficulty of constructing the necessary exploit chains makes the solution robust for real-world deployment. The work positions PACBTI as a viable mechanism for bringing low-overhead Control-Flow Integrity to low-end microcontrollers, a domain previously underserved by advanced security mechanisms.