CN101488176B

CN101488176B - A TOCTOU Attack Response Method for TPM Trusted Computing

Info

Publication number: CN101488176B
Application number: CN2009100782012A
Authority: CN
Inventors: 常晓林; 刘吉强; 韩臻; 刘博�; 何帆; 邢彬
Original assignee: Beijing Jiaotong University
Current assignee: Beijing Jiaotong University
Priority date: 2009-02-20
Filing date: 2009-02-20
Publication date: 2010-06-02
Anticipated expiration: 2029-02-20
Also published as: CN101488176A

Abstract

The invention relates to a method for responding TOCTOU attack aiming at a TPM credible computer. The components of the method comprise a virtual TPM device program and a privileged domain proxy module which both have more powerful functions. Just as the prior methods, the method of the invention adopts a method of PCR register information updating, but the methods for enabling and executing event update is different from the prior methods so that a TPM command in the following two conditions can correctly indicate the current state of a client virtual domain platform: the first TPM command condition is that a TPM command processing result is not sent out of the virtual TPM device program when the TOCTOU attack is detected, and the second TPM command condition is that the TPM command is not received by the virtual TPM device program when the TOCTOU attack is detected. While considering the security, the invention also takes the system performance into full consideration and ensures the utilization effectiveness and the expandability of system resources by adopting event drive and avoiding process scheduling of an extra user space.

Description

A kind of TOCTOU attack-response method at the TPM Trusted Computing

Technical field

The present invention relates to computer information safe Trusted Computing field, be meant a kind of TOCTOU attack-response method especially at the TPM Trusted Computing.Response method of the present invention utilizes the Xen virtual machine technique, defends to attack at the TOCTOU of TPM Trusted Computing by the platform information that upgrades the credible platform module storage.

Background technology

The safety problem of computerized information is difficult to depend merely on software and solves.In order to solve the existing structural unsafe problems of PC, the TCPA of credible calculating platform alliance (renaming TCG afterwards as) proposes to guarantee by the security that strengthens existing terminal architecture the safety of total system, and main thought is to introduce credible platform module (the being called credible chip again) TPM with safe storage and encryption function on various terminal hardware platforms; The process that starts the operating system is divided into several relatively independent layers, with the root of trust of TPM as credible calculating platform, lower floor carries out integrity measurement to the upper strata earlier, and will measure among the platform registers PCR that the result deposits the TPM chip in, the operation control of transmission system then, iteration makes up a trust chain layer by layer.Data among the PCR can only be carried out the expansion of digest value behind computer starting, can not reset and distort, so the user can judge whether current running environment is credible, and whether some link safety problem occurs according to the numerical value of corresponding PCR.

Present most of commercial operation system is designed to have superuser right with kernel program (comprising load-on module), and kernel program uses shared linear internal memory so that for improving system effectiveness, this has caused only providing the TCG architecture of software loading checking to suffer the attack of TOCTOU (time of check vstime of use) easily, particularly, the mistiming that the assailant utilizes program tolerance and program to use these two time points, internal memory to program is distorted, and the platform information that causes TPM to provide can't reflect the ruuning situation of actual platform.

Defence is attacked and need be solved two problems at the TOCTOU of TPM Trusted Computing: how (1) detects TOCTOU is attacked; (2) attack response how.The scheme that a kind of TOCTOU of detection attacks is by modification memory management unit (MMU), and it is monitored in real time to memory refreshing, however the poor expandability of this hardware based solution.Meanwhile, utilize open source code virtualization product Xen virtual machine technique can realize a pure software solution with function of above-mentioned detection scheme.The Xen virtual machine comprises a monitor of virtual machine, a virtual computational fields of privilege and a plurality of client virtual computational fields, sees Fig. 1.Operating system of each computational fields operation, monitor of virtual machine is between system hardware platform and virtual computational fields operating system software, be responsible for monitoring lower floor hardware, but and become the entity of management and dispatching to keep supplying layer computational fields hardware abstraction to use, all memory refreshings all will be through the affirmation of monitor of virtual machine; An Xen virtual machine will move monitor of virtual machine and privileged domain at least, and promptly behind the Xen virtual machine activation, privileged domain is the operating system that must and at first enter, and then creates as the case may be and start client virtual domain; The privilege computational fields has the highest authority, and privileged domain is utilized virtual Domain management tool control client computational fields, comprises establishment, deletion, visit physical equipment etc.Fig. 2 is a kind of terminal platform security solution with Intel Virtualization Technology and reliable computing technology combination, and by providing a pure software TPM equipment in privileged domain for client virtual domain, client virtual domain can realize carrying out Trusted Computing.

At how responding detected TOCTOU attack, author (Sergey Bratus, NihalD ' Cunha, Evan Sparks, Sean Smith, TOCTOU, Traps, and Trusted Computing, TRUST 2008) the attack information that has proposed to catch is reflected to the TPM equipment PCR register of client virtual domain rapidly by escape way.Flow process is as shown in Figure 3: the application program memory address that (1) virtual Domain kernel module will be monitored to the monitor of virtual machine report, (2) monitor of virtual machine receives behind the address that virtual Domain transmits, will monitor any modification to them, in case monitoring internal memory distorts, monitor of virtual machine can send a virtual interruption to privileged domain, (3) kernel of privileged domain is had no progeny in receiving, the vTPM rear end drives can forge a TPM instruction bag from client virtual domain, pass to the vTPM device program by the vTPM management tool, this command content is that one group of random number is expanded the PCR content of registers of appointment.

Because the uncertainty of CPU scheduling, there is safety defect in above-mentioned response method under following situation: suppose that a client will be to just carrying out remote validation in detected virtual Domain in the network, then virtual Domain drives one of transmission by the vTPM front-end driven to the vTPM rear end and reads PCR value request package, and this request is placed into the vTPM rear end and drives and vTPM equipment management tool communication pipe; And meanwhile, monitor of virtual machine monitors this virtual Domain internal memory and is distorted, and notifies the driving of vTPM rear end can produce a request of upgrading PCR immediately, and this request also is placed into request queue, might be placed in and before read after the PCR request package; Will occur a problem like this, return to the PCR information that virtual Domain is used for remote validation and can not reflect that internal memory has been distorted, promptly can not reflect the current safe state of client virtual domain platform.

Summary of the invention

A kind of TOCTOU attack-response method at the TPM Trusted Computing for avoiding above-mentioned deficiency of the prior art to provide is provided.Propose a kind of method of upgrading the platform information of TPM storage, response method of the present invention is made up of two parts: the vTPM device program of (1) increased functionality, (2) privileged domain proxy module.

Purpose of the present invention can reach by following measure:

A kind of TOCTOU attack-response method at the TPM Trusted Computing, the method assembly comprises virtual TPM (vTPM) device program and the privileged domain proxy module of increased functionality, the concrete steps of response method are as follows:

Step 1 after the privileged domain proxy module receives the TOCTOU attack message that monitor of virtual machine sends, can be immediately created a special sign file, and content is set to 1 under/proc catalogue, expression virtual Domain internal memory is distorted;

Step 2, when the vTPM device program of increased functionality receives from the TPM of client virtual domain instruction, do not handle earlier the TPM instruction, but check/whether have specific file under the proc catalogue, if do not have or file exists but content is 0, then normal process TPM instruction; Otherwise utilize current system time to be seed, produce a random number, and with this random number the PCR content of registers of appointment is expanded, the content of specific file is set to 0 under the general/proc catalogue simultaneously, and then handles the TPM instruction;

Step 3, the result that the vTPM device program of increased functionality instructs TPM spreads out of before the vTPM device program, also look over earlier/whether have specific file under the proc catalogue, this is to prevent to exist in the client virtual domain virtual Domain to be tampered after sending the TPM instruction; If do not have or file exists but content is 0, then normally spread out of; Otherwise utilize current system time to be seed, produce a random number, and the PCR content of registers of appointment is expanded with this random number, simultaneously/content of that file under the proc catalogue is set to 0, again handle the TPM instruction that received just now for a time then, again the result is passed.

The present invention has following advantage compared to existing technology:

1. defend the attack at the TOCTOU of Trusted Computing more effectively, when monitoring the TOCTOU attack, all TPM requests of also not handled by the vTPM device program all can correctly reflect client virtual domain platform current state.

2. adopt event driven mode of operation, compare the process scheduling that does not have extra user's space with original system, therefore method of the present invention has kept the original system effective utilization rate of resource.

3. this method extendability is strong, can be seamlessly and various surveillance collaborative works based on the Xen virtual machine, and defend the TOCTOU in the TCG system to attack.

Description of drawings

Fig. 1. be the Xen virtual machine component framework synoptic diagram that uses among the present invention.

Fig. 2. carry out the component framework synoptic diagram of the method for Trusted Computing based on virtual TPM for a kind of client virtual domain.

Fig. 3. be the synoptic diagram of the existing defence TOCTOU that mentions among the present invention method of attacking.

Fig. 4. be the assembly synoptic diagram of the TOCTOU attack-response method that designs of the present invention.

Fig. 5. be the workflow diagram of the vTPM device program of the increased functionality that designs of the present invention.

Embodiment

The present invention supposes that the detection system of Fig. 2 system and Fig. 3 disposes, and provides subordinate's step of response method of the present invention below:

Step 1 is replaced the vTPM device program that Fig. 2 method provides with the vTPM device program of increased functionality.

Step 2 loads the privileged domain proxy module in privileged domain.

Below in conjunction with Fig. 4 and Fig. 5 the workflow that the present invention designs TOCTOU attack-response method is described further:

(1) after the privileged domain proxy module receives the TOCTOU attack message that monitor of virtual machine sends, can be immediately under/proc catalogue, to create a special sign file, and content is set to 1, expression virtual Domain internal memory is distorted.

When (2) the vTPM device program of increased functionality receives from the TPM of client virtual domain instruction, do not handle earlier the TPM instruction, but check/whether have specific file under the proc catalogue, if do not have or file exists but content is 0, then normal process TPM instruction; Otherwise utilize current system time to be seed, produce a random number, and with this random number the PCR content of registers of appointment is expanded, the content of specific file is set to 0 under the general/proc catalogue simultaneously, and then handles the TPM instruction.

(3) the vTPM device program of increased functionality spreads out of the result of TPM instruction before the vTPM device program, also look over earlier/whether have specific file under the proc catalogue, this is to prevent to exist in the client virtual domain virtual Domain to be tampered after sending the TPM instruction; If do not have or file exists but content is 0, then normally spread out of; Otherwise utilize current system time to be seed, produce a random number, and the PCR content of registers of appointment is expanded with this random number, simultaneously/content of that file under the proc catalogue is set to 0, again handle the TPM instruction that received just now for a time then, again the result is passed.

Pass through said method, the TPM instruction that belongs to following situation all can correctly reflect client virtual domain platform current state: (1) TPM instruction process result when monitoring the TOCTOU attack also is not sent the TPM instruction of virtual TPM device program, (2) TPM instruction that the vTPM device program does not also receive when monitoring the TOCTOU attack.

Claims

1. A TOCTOU attack response method for TPM trusted computing is characterized in that: the method component includes a virtual TPM device program and a privileged domain agent module with enhanced functions, and the concrete steps of the response method are as follows:

Step 1, when the privileged domain agent module receives the TOCTOU attack message sent by the virtual machine monitor, it will immediately create a specific file in the /proc directory, and set the content of the specific file to 1, indicating that the virtual domain memory has been blocked. tamper;

Step 2: When the function-enhanced virtual TPM device program receives the TPM command from the customer's virtual domain, it does not process the TPM command first, but checks whether the specific file created in step 1 exists in the /proc directory. If the specific file does not exist or If the file exists but the content of the file is 0, the TPM command is processed normally; otherwise, the current system time is used as the seed to generate a random number, and the random number is used to expand the contents of the specified PCR register, and at the same time, the specific file under the /proc directory Set the content of 0 to 0, and then process the TPM command;

Step 3, before the virtual TPM device program with enhanced functions transmits the processing result of the TPM command to the virtual TPM device program, it must first check whether the specific file created in step 1 exists in the /proc directory; if the specific file does not exist or the specific file exists but If the file content is 0, the virtual TPM device program with enhanced functions will send the processing result of the TPM command to the virtual TPM device program; otherwise, the virtual TPM device program with enhanced functions will first use the current system time as a seed to generate a random number and use the random The number expands the content of the specified PCR register, and at the same time sets the content of the specific file under the /proc directory to 0, then reprocesses the TPM command received just now, and then passes the result out.