Response Method For TOCTOU Attack In Trusted Computing Platform

With the rapid development of the information technology,the architectures and frameworks,which enhance the security at the kernel level by relying on the correctness of some kernel portion,can not avoid the attacks from kernel rootkits.Trusted Computing,which uses the Trusted Platform Module(TPM) as the roots of trust for storage and measurement,aims to use hardware enforcement mechanisms to provide an adequate foundation for building a high-assurance trusted platform.However,the current TCG architecture suffers from the TOCTOU (Time-of-Check-To-Time-of-Use) attacks in commodity PC operating systems,in which kernel rootkits can unrestrictedly access OS resources.An attack defense system consists of two components:attack detection and attack response.VMM-based approaches running at a privilege level higher than that of kernel rootkits can effectively detect dynamic or static data attacks.Many current efforts have explored VMM-based approaches to protect the target system,while a smaller number of efforts are for TCG TOCTOU attacks and exhibit limitations in the capability of responding to the attacks.This thesis focuses on designing a response method,which is more effective in defeating the TCG TOCTOU attacks without sacrificing the system performance. Different from the existing mechanism,our response mechanism can work in the situation of more than one run-time VMs.We describe the design idea and the implementation by using the Xen virtual machine monitor and the virtual TPM facility shipped with the Xen.Finally,this thesis introduces the test experimentation and conclusion,and also the further work.