Architecture Support for Dynamic Integrity Checking

Abstract

A trusted platform module (TPM) enhances the security of general purpose computer systems by authenticating the platform at boot time. Security can often be compromised due to the presence of vulnerabilities in the trusted software that is executed on the system. Existing TPM architectures do not support runtime integrity checking and this allows attackers to exploit these vulnerabilities to modify the program after it has been verified (at time of check or TOC) but before the time of its use (at time of use or TOU) to trigger unintended program behavior, such as the execution of malicious code or the leaking of sensitive data. In this paper, we present a dynamic integrity checker (DIC) to improve security by thwarting TOCTOU attacks. The paper makes four contributions. First, we show how to integrate the integrity checker module with a superscalar pipeline. Second, we present an architecture for dynamic integrity checking by monitoring the dynamic execution traces of the program. Third, we present several optimizations to reduce performance impact without compromising the security of the system. Finally, we evaluate the proposed scheme using a cycle-accurate simulator. Results indicate that the proposed technique enhances security against the TOCTOU attacks with 8% performance overhead and 2.52% area overhead over a baseline processor.Index Terms-Computers and information processing, computer architecture, computer security.

Reconfigurable Dynamic Trusted Platform Module for Control Flow Checking

“…Table I shows the memory requirement for different benchmarks. The results show that our method has relatively lower memory overhead than REM [12] and DIC techniques [17], while they were performing integrity checking. The largest benchmark 403.gcc requires around 209 KB for storing BBs.…”

Ensuring Software Integrity in IoT Devices

“…The TPM is the root of trust for a computing system. It manages the three roots of trust that lie at the core of a trusted platform: (i) A root of trust for measurement (RTM) to measure the platform integrity; (ii) a root of trust for storage (RTS) to securely store different integrity measurements, secrets, and keys; and (iii) a root of trust for reporting (RTR) that reliably and securely reports the platform information stored in the RTS [4]. The TPM stores secret keys, passwords, and digital certificates in its secure internal storage protecting them from software and physical attacks.…”

“…A cryptographic hash value of the platform configuration is calculated and compared against the precomputed hash value of the platform. Access to the platform is denied if the integrity check fails [4]. This is the beginning of the "chain-of-trust" for software modules that are subsequently initiated.…”

“…For example, existing TPM architectures do not support runtime integrity checking and this allows attackers to exploit vulnerabilities to modify the program after it has been verified (at time of check or TOC) but before the time of its use (at time of use or TOU) to trigger unintended program behavior, such as the execution of malicious code or the leaking of sensitive data [4]. Since Iot devices are designed to run continuously, barring power outages or other unpredictable events, code may be compromised at run time through a vulnerability and never be discovered.…”

Controlling your control flow graph

“…These include software-based control flow integrity techniques such as [4], [5], [6], [7], [8], and hardware-based techniques such as [2], [9], [10], [11], [12], [13], [14]. However, these approaches either do not protect against CRAs or suffer from high performance overheads.…”