EXIA: Trusted Transitions for Enclaves via External-Input Attestation

EXIA: Trusted Transitions for Enclaves via External-Input Attestation

Speakers: Zhen Huang

Conference: NDSS Symposium

YouTube: https://www.youtube.com/watch?v=qdT1KzrdIkY

Overview

This talk presents EXIA (External-Input Attestation), a lightweight framework that extends trusted execution environment (TEE) security guarantees from launch-time to runtime by measuring all external inputs to an enclave. Rather than attempting to track complex internal control flows or data flows -- which requires massive pre-computed evidence databases -- EXIA focuses exclusively on monitoring all writes to the enclave from external sources. By cryptographically chaining every input measurement, the system converts runtime integrity attacks (memory corruption, control-flow hijacking, data-only attacks) from silent exploitation into detectable verification failures.

EXIA was implemented on two architectures: AMD SEV-SNP (using VMPL isolation) and RISC-V Penglai (using architectural extensions). Performance evaluation shows overhead peaking at just 2.4% for macro benchmarks including ML training, database workloads, and key management, with per-page measurement costs as low as 0.17 milliseconds.

Background

▶ Watch: TEE background: remote attestation only covers launch-time (0:00)

Cloud computing relies heavily on trusted execution environments (TEEs) to protect workloads on untrusted infrastructure. Leading TEE technologies include Intel SGX, Intel TDX, AMD SEV-SNP, ARM CCA, and open-source RISC-V solutions like Penglai and Keystone. Trust is established through remote attestation: the user sends a challenge, the TEE generates a cryptographic quote, and an attestation service verifies it.

However, standard remote attestation primarily focuses on launch-time guarantees -- verifying the initial enclave state and hardware platform. During runtime, enclaves remain vulnerable to memory corruption (out-of-bounds access, dangling pointers), hardware fault injection, and Iago attacks (where a malicious OS provides corrupted system call responses). These attacks can inject malicious code, hijack control flow, or corrupt data -- all while the initial attestation remains valid.

Previous solutions proposed control-flow attestation and data-flow attestation, which compare runtime behavior against pre-computed evidence databases. These approaches suffer from significant overhead: the evidence database must be collected before program execution, and real-time verification against massive databases is computationally expensive.

Key Findings

▶ Watch: Key insight: measure external inputs instead of internal control flows (3:30)

External inputs are sufficient for runtime integrity: By measuring all external inputs to the enclave rather than tracking internal execution flows, EXIA provides equivalent security guarantees with dramatically lower overhead. If any malicious input attempts to violate enclave integrity, it is captured by the EIM (External Input Measurement) recorder.

Security vulnerabilities become reliability issues: EXIA converts silent exploitation (data leakage, integrity compromise) into explicit verification failures or verifiable crashes. An attacker cannot complete a successful attack without altering the input measurement sequence, which the user detects.

Minimal performance overhead: Macro benchmark overhead peaks at just 2.4%. Micro-level measurement cost is 0.17 ms per 4KB page on RISC-V Penglai and 1.51 ms on AMD SEV-SNP. For ML workloads, increasing batch size from 1 to 128 reduces overhead from ~16% to below 1%.

Formal security guarantees: The framework provides a provable theorem: if the initial state and final EIM sequence match the locally-computed reference value, all intermediate execution steps are cryptographically guaranteed to be valid.

Cross-architecture applicability: EXIA works on both AMD SEV-SNP (using VMPL for isolation) and RISC-V Penglai (using architectural extensions), demonstrating portability across commercial and open-source TEE platforms.

Technical Deep Dive

▶ Watch: Trusted input gateway: dual page transfer and replay prevention (6:00)

EXIA consists of three core components:

Privileged Attestation Environment: Operates at a higher privilege level than the user application inside the TEE, ensuring the measurement logic cannot be tampered with. All external inputs must pass through this layer before reaching the application. Implementation options include:

• Off-the-shelf privilege leveling: SVSM in AMD SEV-SNP, L1 VMM in Intel TDX
• Software-based isolation: Plantiér (NDSS 2025)
• Architectural extensions: RISC-V specific extensions

Trusted Input Gateway: Prevents the enclave from directly fetching data from host memory, defending against time-of-check to time-of-use (TOCTOU) vulnerabilities and replay attacks. Two mechanisms:

• Dual Page Transfer: Two separate buffers -- one for host-to-gateway communication, another for gateway-to-application communication. The host never directly shares memory with the application.
• Shared Page Permission Flipping: A memory page can only be accessed by either the host or the enclave at any given time, with the gateway controlling access permissions.

Freshness verification ensures every piece of data is used only once, preventing replay.

Trusted Input Interrupt Handling: Interrupts are categorized into:

• Transparent exit events (e.g., hardware timers): Handled entirely by the hypervisor, do not alter enclave state, no measurement needed
• Non-transparent exit events: Affect enclave state. Further divided into events without host input (e.g., divide-by-zero -- authenticity checked in custom interrupt handler) and events with host input (e.g., system calls -- host inputs synchronized with user and integrated into request-response protocols)

Execution Flow: The host passes input to the privileged attestation environment, where the EIM recorder intercepts and sequentially hashes inputs. Each new input is cryptographically chained with the previous state (EIMI = hash(EIM_{i-1} || input_i)). After measurement, data passes to the enclave application which performs freshness verification. The user simultaneously computes a local reference measurement and compares it against the enclave's EIM sequence.

Demo / Proof of Concept

▶ Watch: EXIA architecture: EIM recorder and cryptographic chaining (8:00)

The researchers implemented EXIA on two platforms:

EXIA-SEV (AMD SEV-SNP): Uses VMPL for privilege isolation, dual page transfer for TOCTOU prevention, and freshness verification against replay attacks. Built upon the existing SEV Protected Services framework.

EXIA-Penglai (RISC-V): Integrated into the Penglai enclave ecosystem, extending its secure monitor. Uses shared page permission flipping. Current hardware constraints prevent external interrupt support.

Security evaluation confirmed EXIA effectively detects memory corruption exploits including buffer overflows and dangling pointer misuse. Performance evaluation across ML training/inference, database workloads, and key management showed overhead peaking at 2.4%, with batch-size-dependent amortization reducing ML workload overhead below 1% at batch size 128.

Defensive Implications

▶ Watch: Performance results: 2.4% peak overhead, sub-1% for batched ML (12:00)

EXIA represents a practical approach to extending TEE security from launch-time to runtime without the complexity and overhead of control-flow or data-flow attestation. For organizations deploying confidential computing:

Runtime attestation becomes practical: Previous approaches required maintaining massive evidence databases collected through pre-execution analysis. EXIA eliminates this requirement by relying solely on user-side input knowledge, making deployment significantly simpler.

Threat model transformation: By converting silent exploitation into detectable failures, EXIA changes the economics of TEE attacks. Attackers can still cause denial of service (crashing the enclave), but they cannot silently extract secrets or corrupt results -- a significant improvement for workloads where availability failures are preferable to integrity violations.

Confidential computing deployment guidance: Organizations running sensitive workloads (ML training on proprietary data, key management, database processing) in cloud TEEs should evaluate EXIA-style protections, especially when the threat model includes a malicious cloud provider or compromised hypervisor.

Limitation: EXIA does not fix memory safety vulnerabilities -- it detects their exploitation through input verification. For prevention, memory-safe languages or compile-time safety mechanisms remain necessary.

Key Takeaways

• EXIA provides runtime integrity attestation for TEEs by measuring all external inputs rather than tracking internal control flows
• The framework converts silent exploitation attacks into detectable verification failures with provable security guarantees
• Performance overhead peaks at just 2.4% for macro benchmarks, with ML workloads below 1% at larger batch sizes
• Implemented on both AMD SEV-SNP (VMPL isolation) and RISC-V Penglai (architectural extensions)
• Eliminates the need for pre-computed evidence databases required by prior control-flow and data-flow attestation approaches
• Defends against memory corruption, Iago attacks, and hardware fault injection through external input measurement

About the Speaker(s)

Zhen Huang from USC presented this paper on behalf of the original authors from Shanghai University and Auburn University, who could not attend due to visa issues. The research bridges confidential computing, formal verification, and practical systems security across both commercial (AMD SEV-SNP) and open-source (RISC-V Penglai) TEE platforms.