HPCCFA: Leveraging Hardware Performance Counters for Control Flow Attestation

2026-03-31

AI Summary

Existing trusted execution environments (TEEs) rely on static attestation, which is insufficient to defend against runtime control-flow hijacking attacks. This work proposes HPCCFA, the first approach to leverage ubiquitous hardware performance counters (HPCs) in general-purpose CPUs for lightweight, hardware-assisted runtime control-flow attestation (CFA). HPCCFA enables generation of execution traces and detection of anomalies without requiring specialized hardware. A prototype implemented on the RISC-V Keystone TEE demonstrates that the method effectively identifies control-flow violations with acceptable performance overhead, while also revealing a fundamental trade-off between measurement-point density and attestation reliability.

Abstract

Trusted Execution Environments (TEEs) allow the secure execution of code on remote systems without the need to trust their operators. They use static attestation as a central mechanism for establishing trust, allowing remote parties to verify that their code is executed unmodified in an isolated environment. However, this form of attestation does not cover runtime attacks, where an attacker exploits vulnerabilities in the software inside the TEE. Control Flow Attestation (CFA), a form of runtime attestation, is designed to detect such attacks. In this work, we present a method to extend TEEs with CFA and discuss how it can prevent exploitation in the event of detected control flow violations. Furthermore, we introduce HPCCFA, a mechanism that uses HPCs for CFA purposes, enabling hardware-backed trace generation on commodity CPUs. We demonstrate the feasibility of HPCCFA on a proof-of-concept implementation for Keystone on RISC-V. Our evaluation investigates the interplay of the number of measurement points and runtime protection, and reveals a trade-off between detection reliability and performance overhead.

Problem

• Trusted Execution Environments
• Control Flow Attestation
• Runtime Attacks
• Hardware Performance Counters
• Static Attestation

Innovation

• Control Flow Attestation
• Hardware Performance Counters
• Trusted Execution Environments
• Runtime Attestation
• RISC-V