  Recent IoT applications gradually adapt more complicated end systems with
commodity software. Ensuring the runtime integrity of these software is a
challenging task for the remote controller or cloud services. Popular
enforcement is the runtime remote attestation which requires the end system
(prover) to generate evidence for its runtime behavior and a remote trusted
verifier to attest the evidence. Control-flow attestation is a kind of runtime
attestation that provides diagnoses towards the remote control-flow hijacking
at the prover. Most of these attestation approaches focus on small or embedded
software. The recent advance to attesting complicated software depends on the
source code and CFG traversing to measure the checkpoint-separated subpaths,
which may be unavailable for commodity software and cause possible context
missing between consecutive subpaths in the measurements. In this work, we
propose a resilient control-flow attestation (ReCFA), which does not need the
offline measurement of all legitimate control-flow paths, thus scalable to be
used on complicated commodity software. Our main contribution is a multi-phase
approach to condensing the runtime control-flow events; as a result, the vast
amount of control-flow events are abstracted into a deliverable size. The
condensing approach consists of filtering skippable call sites, folding
program-structure related control-flow events, and a greedy compression. Our
approach is implemented with binary-level static analysis and instrumentation.
We employ a shadow stack mechanism at the verifier to enforce context-sensitive
control-flow integrity and diagnose the compromised control-flow events
violating the security policy. The experimental results on real-world
benchmarks show both the efficiency of the control-flow condensing and the
effectiveness of security enforcement.
