System and Method for mitigating TOC/TOU attacks in a cloud computing enviroment

Patent metadata

Field	Value
Publication number	US-9654499-B2
Application number	US-201514743774-A
Country	US
Kind code	B2
Filing date	Jun 18, 2015
Priority date	Jun 20, 2014
Publication date	May 16, 2017
Grant date	May 16, 2017

Abstract

A computer system, method, and computer program product for mitigating TOCTOU attacks, which includes: as processor requesting measurements representing operation of a first process on a host that is untrusted and based on the requesting, obtaining the measurements, which include a checksum that is a result of a second process executing checksum code to verify at least one last branch record on the host. A processor also determined, based on the measurements, whether the first process was compromised.

First claim

The invention claimed is:

1. A method for mitigating TOCTOU attacks comprising:
performing, by a processor of a trusted host communicatively coupled to an untrusted host via a communications connection, a run-time integrity verification of a first process executed by the processor of the untrusted host to determine that a first process executed on the untrusted host was launched from a pre-defined location and executed from beginning to end, wherein the untrusted host comprises multiple processors, the performing comprising:
requesting, by the processor of the trusted host, from a first processor of the multiple processors of the untrusted host, measurements representing operation of a first process on an untrusted host;
based on the requesting, obtaining, by the processor of the trusted host, the measurements, wherein the measurements comprise a checksum that is a result of a second process executing checksum code on the untrusted host to verify, during run-time of the first process, at least one pseudo-randomly chosen last branch record on the untrusted host; and
determining, by the processor, based on the measurements, whether the first process was compromised by utilizing the pseudo-randomly chosen last branch record to verify that the first process was launched from a pre-defined location and executed from beginning to end by the untrusted host.

2. The method of claim 1 , further comprising:
determining, by the processor, at least one of: whether the requesting was intercepted before the measurements were conducted, or whether the second process was compromised.

3. The method of claim 1 , further comprising:
halting, by the processor of the trusted environment, execution of instructions by a portion of the multiple processors, wherein the portion does not include the first processor; and
based on determining that the first process was not compromised, resuming, by the processor of the trusted environment, the halted processors.

4. The method of claim 3 , further comprising
instructing, by the processor of the trusted environment, the halted processors to remain halted when instructed by another host to re-start during the determining whether the first process was compromised.

5. The method of claim 1 , wherein the requesting comprises sending a random number to the second process and wherein the checksum is a self checksum of the random number and the measurements further comprise a secure hash algorithm hash of a hypervisor running on the untrusted host, wherein the self checksum and the secure hash algorithm hash were computed by the second process.

6. The method of claim 1 , wherein the at least one last branch record comprises an LBR From IP pointer.

7. The method of claim 1 , the determining further comprises determining that the checksum is invalid, and based on the invalid checksum, determining that the first process was compromised.

8. The method of claim 7 , wherein executing checksum code to verify at least one last branch record comprises obtaining an invalid jump in a last branch record table on the untrusted host.

9. The method of claim 7 , wherein executing checksum code to verify at least one last branch record comprises obtaining a last branch record without a respective block jump.

10. The method of claim 7 , wherein the checksum is invalid based on an increase in verification time.

11. The method of claim 1 , further comprising:
halting, by the processor, an activity on a second host until completing the determining.

12. A computer system for mitigating TOCTOU attacks, the computer system comprising:
a memory; and
a processor in communication with the memory, wherein the computer system is configured to perform a method, the method comprising:
performing, by a processor of a trusted host communicatively coupled to an untrusted host via a communications connection, a run-time integrity verification of a first process executed by the processor of the untrusted host to determine that a first process executed on the untrusted host was launched from a pre-defined location and executed from beginning to end, wherein the untrusted host comprises multiple processors, the performing comprising:
requesting, by the processor of the trusted host, from a first processor of the multiple processors of the untrusted host, measurements representing operation of a first process on an untrusted host;
based on the requesting, obtaining, by the processor of the trusted host, the measurements, wherein the measurements comprise a checksum that is a result of a second process executing checksum code on the untrusted host to verify, during run-time of the first process, at least one pseudo-randomly chosen last branch record on the untrusted host; and
determining, by the processor, based on the measurements, whether the first process was compromised by utilizing the pseudo-randomly chosen last branch record to verify that the first process was launched from a pre-defined location and executed from beginning to end by the untrusted host.

13. The computer system of claim 12 , further comprising:
determining, by the processor, at least one of: whether the requesting was intercepted before the measurements were conducted, or whether the second process was compromised.

14. The computer system of claim 12 , further comprising:
halting, by the processor of the trusted environment, execution of instructions by a portion of the multiple processors, wherein the portion does not include the first processor; and
based on determining that the first process was not compromised, resuming, by the processor of the trusted environment, the halted processors.

15. The computer system of claim 14 , further comprising
instructing, by the processor of the trusted environment, the halted processors to remain halted when instructed by another host to re-start during the determining whether the first process was compromised.

16. The computer system of claim 12 , wherein the requesting comprises sending a random number to the second process and wherein the checksum is a self checksum of the random number and the measurements further comprise a secure hash algorithm hash of a hypervisor running on the host, wherein the self checksum and the secure hash algorithm hash were computed by the second process.

17. The computer system of claim 12 , wherein the at least one last branch record comprises an LBR From IP pointer.

18. The computer system of claim 12 , the determining further comprises determining that the checksum is invalid, and based on the invalid checksum, determining that the first process was compromised.

19. The computer system of claim 12 , wherein executing checksum code to verify at least one last verify at least one last branch record comprises at least one of: obtaining an invalid jump in a last brand record table on the host, obtaining a last branch record without a block jump, or recording an increase in verification time.

20. A non-transitory computer readable storage medium readable by one or more processors and storing instructions for execution by the one or more processors for performing a method of mitigating TOCTOU attacks comprising:
performing, by a processor of a trusted host communicatively coupled to an untrusted host via a communications connection, a run-time integrity verification of a first process executed by the processor of the untrusted host to determine that a first process executed on the untrusted host was launched from a pre-defined location and executed from beginning to end, wherein

Assignees

• Vencore Labs Inc
• Kddi Corp

Inventors

• Sapello Angelo
• Ghosh Abhrajit
• Poylisher Alexander
• Chiang C Jason
• Kubota Ayumu
• Matsunaka Takashi

Classifications

• H04L63/145 Primary

  the attack involving the propagation of malware through the network, e.g. viruses, trojans or worms · CPC title

• G06F21/575

  Secure boot · CPC title

• G06F21/577

  Assessing vulnerabilities and evaluating computer system security · CPC title

• H04L63/1433

  Vulnerability analysis · CPC title