Coprocessor-based hierarchical trust management for software integrity and digital identity protection

Issue title: The Third IEEE International Symposium on Security in Networks and Distributed Systems

Article type: Research Article

Authors: Wang, Lifu | Dasgupta, Partha

Affiliations: Department of Computer Science and Engineering, Arizona State University, Tempe, AZ 85287, USA. E-mails: [email protected], [email protected]; Tel.: +480 965 5583; Fax: +480 965 2751

Abstract: Malware and rootkits are serious security threats. They can be designed to be resistant to anti-virus and security software and even remain totally undetectable. This paper describes a hierarchical trust management scheme, where the root of trust is in a non-tamperable hardware co-processor on a PCI bus. The security device checks a part of the OS kernel for integrity, which in turn checks other parts until we ensure the entire system is free of rootkits. The checker can be extended to encompass all applications and anti-virus software. Our system can detect any illegal modifications to kernel, loadable kernel modules and user applications. It also provides a secure communication line for user interaction to manage legal software updates. Moreover, this device can securely perform user authentication and protect digital identity against identity theft. Our tests show that we can correctly detect different real-world and synthetic rootkits even though the host kernel is compromised.

Keywords: Computer security, software integrity, digital identity

DOI: 10.3233/JCS-2008-16304

Journal: Journal of Computer Security, vol. 16, no. 3, pp. 311-339, 2008