解决度量-验证时间差的一种差值证明方法  

Differential attestation approach for TOCTOU

作　　者：张谦[1,2] 贺也平[1] 孟策[1,2] 

机构地区：[1]中国科学院软件研究所,北京100190 [2]中国科学院研究生院,北京100049

出　　处：《通信学报》2009年第S1期43-50,共8页Journal on Communications

基　　金：国家自然科学基金资助项目(90818012);中国科学院重大方向性项目(KGCX2-YW-125);北京科学技术委员会基金资助项目(Z08000102000801)~~

摘　　要：度量-验证时间差问题是现有远程证明方法中的一个重要问题。它是因为现有方法中的加载时度量机制缺乏对系统状态变化的察觉和表达能力导致其无法表达当前状态。针对可信虚拟域中的虚拟环境证明提出一种方法在原有的加载时度量的基础上补充了卸载时度量,使得更改后的度量机制可以察觉并表达系统中对象的存活状态,即使用加载度量和卸载度量的差值来表达系统的当前状态,进而解决度量-验证时间差问题。As a key problem in remote attestation, TOCTOU(time-of-check time-of-use) was caused by measure-on-load approach's shortcomings that it couldn't trace the variation of computing environment to reflect system's living status exactly.This problem, could be reduced with a differential attestation approach for TVD which extended existed methods by introducing the thought of measure-on-unload, and the approach was able to describe the real-time status of system by examining the difference between the records of measure-on-load and measure-on-unload.Consequently, the TOCTOU problem in TVD can be effectively mitigated with help of this approach.

关 键 词：度量-验证时间差问题 卸载时度量 Merkle散列树 可信虚拟域 差值证明方法 

分 类 号：TP309[自动化与计算机技术—计算机系统结构]