Improving coherency of runtime integrity measurement

Abstract

Recent work in software integrity verification provides techniques for measuring integrity at runtime, where a measurement agent observes the memory image of a running process and constructs some meaningful description of the process's current state. Unlike in static and load time measurement architectures, the target of a runtime measurement is running and hence able to change its state. In this setting, an accurate measurement must reflect a coherent state of the target. A coherent measurement must satisfy two properties: atomicity ensures that a measurement corresponds to the state of the target at a particular point in time and quiescence ensures that the target data is in a consistent state, i.e. not a critical section. We address the former property, showing that we can obtain an atomic measurement using a memory copy-on-write strategy, which we have implemented in the Xen hypervisor. We show that this approach achieves significant performance gains in the memory and time impact to the target, when compared with naive strategies for enforcing atomicity.

Principles of remote attestation

“…In this paper, measurement is discussed only as necessary to support our architecture for attestation, but cf. [23,37,22,27] for more on measurement strategies.…”

“…Much of this evidence-gathering can be viewed as algorithmically akin to garbage collection [37]. The measurement process needs to traverse pointers repeatedly, starting from pointers that reside in static program variables or on the stack.…”

JMF

“…The integrity policy language of JMF enables a partial solution to the measurement quiescence problem [39]: how to measure a target when it is executing in some critical section (e.g., updating a field). The qualifiers qual allow particular policy constraints to be enabled or disabled for a given set of objects if the specified methods of those objects are currently executing.…”

“…Forking the process utilizes the memory copyon-write (COW) mechanism of Linux, which allows the target process to run while the measurement is performed on the forked process. Copy-on-write has been shown elsewhere to be a useful mechanism to improve target performance while still guaranteeing atomicity of the measurement [39]. It is important to note that this is an OS-level fork of the JVM that is running the Java application; we do not need to implement any new COW functionality, but instead make use of the existing COW implementation within Linux that happens automatically with the fork.…”

Building Efficient Integrity Measurement and Attestation for Mobile Phone Platforms

“…Runtime integrity measurement has been proposed recently with copy-on-write mechanism [28]. However, this is implemented on Xen-like virtualization environment, which is so far not practical for mobile platforms.…”