Incremental Multiset Hash Functions and Their Application to Memory Integrity Checking

Abstract

Abstract. We introduce a new cryptographic tool: multiset hash functions. Unlike standard hash functions which take strings as input, multiset hash functions operate on multisets (or sets). They map multisets of arbitrary finite size to strings (hashes) of fixed length. They are incremental in that, when new members are added to the multiset, the hash can be updated in time proportional to the change. The functions may be multiset-collision resistant in that it is difficult to find two multisets which produce the same hash, or just set-collision resistant in that it is difficult to find a set and a multiset which produce the same hash. We demonstrate how set-collision resistant multiset hash functions make an existing offline memory integrity checker secure against active adversaries. We improve on this checker such that it can use smaller time stamps without increasing the frequency of checks. The improved checker uses multiset-collision resistant multiset hash functions.

Efficient memory integrity verification and encryption for secure processors

“…At runtime, the processor updates logs with minimal overhead so that it can verify the integrity of a sequence of operations at a later time. To maintain the logs in a small fixed amount of trusted on-chip storage, the processor uses incremental multiset hash functions [6]. When the processor needs to check its operations, it performs a separate integrity-check operation using the logs.…”

“…MSet-Add-Hash requires one MD5 operation using a secret key in the processor, and one addition operation over a fixed number of bits to update the multiset hash incrementally. The details and formal proofs of the security of MSet-Add-Hash and the loghash memory integrity checking scheme are in [6]. In this paper, we extend the scheme to work with trusted caches and on-demand memory allocation, give a brief overview of why it works, and evaluate the scheme's performance.…”

Transparent, Distributed, and Replicated Dynamic Provable Data Possession

“…If the average number of blocks in a file for each version is n, and there are v versions, their VCS requires O(log n + log v) time and space for proofs, whereas our proposal requires only O(1+log n), which is independent of the number of versions (see [19,9,27,18,12] for optimality discussion). Furthermore, we show how to combine this VCS with our DR-DPDP to obtain distributed VCS with the same complexity.…”

Optimal parameter selection for efficient memory integrity verification using merkle hash trees

“…A fractal-based approach [9] has been proposed to minimize the traversal of a Merkle hash tree; this work also takes the Merkle hash tree as a given and does not examine the selection of blocksize for the hash tree. Incremental multiset hash functions [3] have been proposed as a means to improve memory integrity verification performance by the ability to quickly update read and write logs in trusted storage, to be verified at a later time. This work focuses on sequences of reads and writes, and outperforms a hash tree only in the case of infrequent memory verification.…”