METHOD OF ATTESTING A SOFTWARE PROGRAM

Abstract

METHOD FOR ATTESTING A SOFTWARE PROGRAM The invention relates to a method for attesting a software program.The invention is characterized in that an execution environment of the software program is provided, comprising a measurement agent, a verifier is provided, the operating system loads into volatile memory executable pages of the software program, a content of which constitutes a fingerprint of the software program, the fingerprint of the software program loaded into the volatile memory is modified at the initiative of the verifier, the measurement agent or the operating system, the measurement agent executes a measurement function, the measurement of the modified fingerprint of the software program is transferred to the verifier, the verifier obtains a reference measurement deemed correct of the modified fingerprint of the software program, the verifier compares the measurement of the modified fingerprint of the software program in the volatile memory which has been transferred to it with the reference measurement of the modified fingerprint. Abstract figure: Fig. 1.

Description

Title of the invention: METHOD FOR CERTIFYING A SOFTWARE PROGRAM FIELD OF THE INVENTION

[0001] The present invention relates to a method for attesting a software program, the method verifying equality between a measured state of the program and a known reference state thereof, this reference state being deemed correct, and conventionally representing its original state. The measurement of the program consists for example in producing a hash function from the contents of the pages loaded by the operating system into memory for the execution of the program by the processor. The content of these memory pages is designated by the term memory footprint in the following. The hash function makes it possible to detect any modification made to the footprint and results in a measurement. PREVIOUS ART

[0002] The attestation of a software program is a pillar of computer security, based on the principle of verifying, by measurement, that an object is what it should be, by comparison with a reference of its original state deemed correct. An object, for example a piece of data or a software program, is identified by its signature produced by a mathematical hash function, resulting in a non-invertible digital value, calculated from the data characterizing the object stored in memory. It is theoretically impossible to construct a memory fingerprint from a digital hash value and theoretically impossible to have the same hash result for two different fingerprints. The content of the file may result from a prior collection operation of the different parts of its content. This collection may be produced sequentially and in parts or all at once for the entirety.

[0003] Thus, in the case of an attestation of a program at execution, it is verified that the program loaded into RAM, in particular a DRAM type memory, is identical to the imprint of the memory pages during its initial loading by the operating system or that it can also be compared with a signature of the software program delivered by the supplier.

[0004] For example, a file is produced by aggregating all the 4-kilobyte memory pages of RAM used when placing the program in RAM for execution by the processor, before producing the hash.

[0005] State of the art on local or remote certification

[0006] Attestation is a widely used method, which relates to objects of different types such as data, an operating system software program, an embedded software program, a low-layer software program (i.e., BIOS) or an application software program, namely a software application.

[0007] As a result, certification has given rise to many types of local or remote implementations.

[0008] The level of trust attributed to the local or remote attestation is based on the robustness of the software carrying out the measurement, namely the carrying out of the hashing, on the security of the transfer of the latter and, finally, on the security of the verification of authenticity of this measurement.

[0009] The security of the measurement is characterized, on the one hand, by the solidity of its access points to the measured data, that is to say the access points to the memory zone containing the object and, on the other hand, by the solidity of the routine producing the hash against modification.

[0010] The state of the art classifies three types of implementations for carrying out the measurement, with and without hardware device, of two different types. We then refer to hardware, hybrid or purely software attestation.

[0011] Hardware attestation provides a higher level of trust. The standard scheme proposes the use of a dedicated chip of the Trusted Platform Module (TPM) type and meeting a standard. TPMs produce measurements in dedicated chips that are impervious to analysis and modification, and which thus provide total assurances of confidentiality and integrity on its measurements. TPMs have the private key of an asymmetric encryption key pair allowing them to sign the measurements before sending. This private key is neither accessible for reading nor exportable outside the TPM.

[0012] The signed measurements are sent to the remote verifier.

[0013] The latter TPM can then validate its origin by referring to the public key delivered with the measurement, identifying the TPM and can also validate the integrity of the software state by comparison with a reference value. Furthermore, for TPMs, when the measurement relates to memory pages of an application or a system module of the kernel or the operating system of the execution platform, these TPMs access these pages in a completely secure manner, without it being possible for the attacker to intercept and corrupt these readings. Designed for this mission and standardized, TPMs are likely to provide, with respect to the attestation measurement, optimal security. However, so-called side attacks on the latest version of TPM 2.0, correlating by brute force the execution times of operations with a content, made it possible to reconstruct the private key and thus to produce fictitious and arbitrary measurements that the verifier will attribute to the TPM. These attacks led to a response from the TPM manufacturers, who . produced a patch to the embedded software, repositioning the TPMs to the highest level of trust.

[0014] For software applications and excluding system software (i.e. BIOS, operating system), an alternative to the use of TPMs is provided by Trusted Execution Environments (TEEs). TEEs are materialized by an outgrowth of the processor and, therefore, by a device that can be activated by programming, which provides the same high guarantees of confidentiality and integrity for their content (i.e. the application software and the data) arbitrarily defined by the user. Unlike TPMs, whose software is fixed by the manufacturer and invariant, TEEs are loaded by the users' software. TEEs do not allow system software to be housed or accessed, thus not constituting an alternative to TPMs for the attestation of system software.

[0015] In a TEE, the system software and its data are generally intended for one or more security functions of different types and need to be secured. Once embedded in the TEE, this software and its data constitute the Trusted Computing Basis (TCB). In the particular case where the TCB is an attestation routine with the attestation data, we then have an attestation measurement carried out by a TEE with the same security guarantees as with a TPM. As a corollary, and by construction of the security guarantees provided by the TEEs, and, in particular, the integrity guarantee, a measurement agent embedded in a TEE cannot modify itself or be modified from the outside during its execution. Similarly, the software embedded in a TPM is immutable. Hardware attestation implementations exploit a static and immutable trust base.These implementations also fully secure the private keys used to create signatures for the measurements taken before they are sent to the verifier. Just as TPMs have been subject to side-on attacks, many such attacks have targeted TEEs (e.g., Intel™ SGX, AMD™ SEV, arm™ Trustzone), which have also generated patches addressing these attacks in the form of microcode.

[0016] These hardware implementations provide, since they are based on up-to-date software, in particular up-to-date microcode, an unrivaled level of confidence for the measurements they provide to the verifier. They de facto create a deployment constraint requiring the presence of the TPM or the TEE where the attestation measurement is carried out.

[0017] Hybrid attestation has been designed for constrained execution environments for which hardware devices (TPM and TEE) are not present. For common execution environments in the Internet of Things loT domain ("Internet of Things" in English), the size, the general footprint of the device and its resources exclude these devices. Different hybrid attestation schemes exploiting basic functions of the processor such as the clock counter or a memory accessible only in read (ROM) are used by the software attestation routine to achieve a level of security deemed optimal for these devices, without offering the same level of confidence as the hardware configurations on the confidentiality and integrity of the software carrying out the measurement and on the key used for the signature of this measurement.

[0018] Software attestation does not use hardware devices used by hardware or hybrid attestations. There are two types of implementations depending on whether the verifier is remote or local. They are generally used more to carry out the attestation of application software.

[0019] If the verifier is located in the same execution environment as the software being measured, the attestation is local. A special case of local attestation is when the software incorporates within it the measurement and verification functions. The attestation is then referred to as self-attestation. Conversely, the measurement and verification functions can be integrated into the operating system or into an agent separate from the software program. Just like hybrid attestations, they then do not provide full but relative confidentiality and integrity guarantees. The measurement routines of software attestations are particularly exposed to analysis and modification by a local attacker. Software obfuscation techniques consisting of making the software opaque and self-verification techniques may be deployed to reduce this risk, without however canceling it out.A known fact is the impossibility of guaranteeing confidentiality and integrity assurances when the attacker is in a situation to produce a dynamic analysis and to write on the memory pages of the software program. Obfuscation techniques offer a relative level of security, defined according to performance and security requirements of the parts of the software program. Concerning attestation, to be effective and to avoid an attack carried out by prior analysis of an instance of a deployed obfuscated agent, the ideal obfuscation, applied to the agent carrying out a measurement, should present sufficient variability from one deployment of an agent to another deployment of this same agent, thus creating a multiplicity of iso-functional attestation agents whose analysis is difficult.For large numbers of instantiations of a single attestation agent deployed across many applications or embedded in the kernel, this variability creates impractical operational instability, particularly because it can lead to operational hazards and variable performance impacts and would require unit testing of all deployments. While ideal obfuscation produces very high complexity in analysis, it necessarily results in very significant software outgrowth in . generating a related CPU calculation time consumption. Obfuscation must therefore be pushed to a level that remains acceptable from this point of view. For solutions generating a specific operation of the attestation agent such as a pseudo-random hash at each deployment, obfuscation can be used in order to sufficiently delay the specific analysis required by the attacker, generating efforts that cannot be reduced over a minimum period. The implementation of a time counter by the verifier upon receipt of the measurements makes it possible to identify late responses generated by an attack.

[0020] This principle of detection by the time of realization of the measurement has been developed in the following publications, deploying different techniques (obfuscation, encryption, self-modifying code) on the attestation routine intended to delay the analysis by the attacker of the memory zones targeted and used by them:

[0021] SWATT: SoftWare-based ATTestation for Embedded Devices, A. Seshadri et al., IEEE Symposium on Security and Privacy, 2004

[0022] PIONEER: Verifying code integrity and enforcing untampered code execution on legacy code, A. Seshadi et al., ACM SIGOPS Operating Systems Review, Volume 39, Issue 5, December 2005, pp 1-16,

[0023] Remote Software Based Attestation for Wireless Sensors, M Shanek et al., lecture Notes in Computer Science, 2005

[0024] Soft Tamper-Proofing via Program integrity Vérification in Wireless Sensor Networks, T. Park et al., EEE Transactions on Mobile Computing 4(3):297- 309, Juin 2005

[0025] In the document Tamper resistant software: an implementation, D. Aucsmith, Hiding, May 30, 1996, a combination of techniques is presented exploiting encryption, obfuscation and spontaneous modification of the measurement routine in order to generate the maximum effort in each attack, reducing the acquisition of knowledge resulting in a single bypass.

[0026] However, the techniques proposed in the aforementioned publications have never been implemented industrially. Whatever the promises of the authors of these techniques, obfuscation and self-produced modification schemes offer a level of security that decreases rapidly over time when the attacker can have several instances in his field of analysis. Separately and in addition, methods exploiting the time taken for the processor to perform the measurement generate false attack detections, if the processor is heavily loaded by other software loads or if the network involved in the transmission is itself congested.

[0027] In all the software attestation techniques described above, none depart from the scheme in which the variability only applies to the function or measuring agent, never to the measured footprint itself. In all prior art techniques, including when the reading routine is embedded in the program itself, the measurement is produced on sections or on the entirety of the program footprint, starting from an assumption of the invariance of the latter.

[0028] In the field of remote attestation, those skilled in the art may question the security target used in which the attacker would locally produce an analysis of the measurement function or the attestation agent. Indeed, this security target does not correspond to reality which brings into play two preferred attack modes. The two attack modes of the ToCToU (“Time-of-Check to Time-of-Use” type described below are predominant and consist of restoring the memory before the measurement is produced, without it being necessary for the attacker to analyze the type of operations and the memory areas targeted by the measurement. State of the art on ToC / ToU type attacks Page reconstruction attacks

[0029] Unlike hardware implementations and some hybrid implementations, software implementations all share the weakness of being possibly modified at the level of the memory addresses read for the measurement. With software implementations, the attack consists of modifying the measurement production routine by bypassing memory reads. A classic modification uses a memory area previously loaded with data reflecting a previous state recovered by the attacker of the object and on which memory reads relating to the measured program are systematically diverted. This attack requires a modification of the measurement agent to divert memory read operations targeting the address range of the fingerprint.This attack, called page reconstruction, bypasses the agent's readings of the program pages loaded by the processor by reading the previously produced buffer zone. The implementation of this attack is based on the supposed invariant nature of the measured software program, offering the possibility of recovering its memory footprint at startup or at any time during its execution and using it for future measurements during its execution. The attestation schemes generating a different measurement such as those previously cited do not modify this postulate, that is to say the invariance of the memory footprint on which these measurements are carried out, such that the authors exclude page reconstruction attacks from the security target.

[0030] To counter page reconstruction attacks, two countermeasures have been developed. The first distinguishes the type of memory used, namely the pages containing the ins instructions that are highly requested by the processor and accessed quickly by the processor and pages containing data whose access is slower, in particular, but not only, because these pages are not loaded into cache memory by the processor. By analyzing the measurement completion times, we identify whether the measurement was produced from the program's memory pages or by using the contents of a data memory "image" buffer previously mounted by the attacker. This method is described in particular in the document Secure Remote Attestation, M. Jackobsson, 2018.

[0031] Like all methods based on access times varying with a large amplitude, it generates its false detections in particular because variations in processor load can considerably slow down the execution of routines, without there being an attack carried out.

[0032] The other method consists of breaking the condition for carrying out the attack, that is to say the invariance of the software program, by changing instructions during execution. This other method is described in the document: Strengthening software self-checksumming via self-modifying code. In ACSAC, pages 23-32. IEEE Computer Society, 2005, JT Giffin, M. Christodorescu, and L. Kruger.

[0033] The method described in this document allows the identification, by the program itself embedding a specific detection routine, of an attack by reconstruction of memory pages. This is a theoretical method of detection by the program itself of the architecture and the type of memory used (i.e., Van Neumann, Harvard). The publication sets out a principle of invariance of the fingerprint without allowing the implementation of an attestation system. The modification of the fingerprint by the program itself being asynchronous with a remote verifier, de facto causes a malfunction of the attestation by the desynchronization between the spontaneous modification of the software and a reference measurement held by the verifier. The publication does not allow and has not given rise to an industrial implementation. Finally, in its implementation, the detection test, located in the program, is directly exposed to the bypassing of this test by the attacker.Blind Zone Attacks.

[0034] A second type of attack exploits the desynchronization between measurement and current state of the software. This attack consists of modifying the software between two measurements and restoring the processor memory before the next measurement, without requiring page reconstruction as explained previously. This second type of attack, carried out in the blind zone between two measurements, can be implemented for all types of hardware, hybrid and software attestations. Indeed, in all cases, the measurement only reflects the state of the software at the precise moment when the measurement was produced. These attacks modifying the fingerprint between two measurements avoid detection at the next measurement by identifying when it was triggered, preferably in an automated manner.

[0035] Different techniques have been developed to counter these attacks.

[0036] A first technique consists of producing partial measurements, potentially consecutive and accumulative, during the execution of the software. These measurements (i.e., self-measurements) are carried out by the software during its execution and provide partial but continuous detection over time and therefore without blind zones. The measurements carried out can make it possible to cover the entire footprint of the software program by successive accumulation of partial measurements or be restricted to only a part of it, in particular by targeting more exposed parts. To reduce their impact on the performance of the software, these measurements carried out continuously each concern a reduced memory area, before their deferred aggregation. The pseudo-random strategy for selecting the sequentially measured areas reduces the attacker's ability to predict where and when the next measurement will be carried out, resulting in a probabilistic approach to detecting the attack..

[0037] Patent document US9654499B2, entitled System and Method for Mitigating TOC / TOU attacks in a cloud computing environment, proposes another detection method, based on the modification caused by the attack of the control flow of the measurement routine by the extraction of a pseudo-random value from the processor register LBR containing the addresses of the executed instruction blocks. This method claims to ensure that the measurement routine has been executed from start to finish without deviation to a breakpoint or a routine restoring the memory to the original state.

[0038] In I. De Oiveira Nunes et al, On the TOCTOU Problem in Remote Attestation (Nov 2021), the authors present two techniques intended for constrained environments, targeting hybrid implementations. They are based on the write locking of memory pages opened in execution and assigned to application software restricting the scope of modifications of these pages by the system administrator and potentially an attacker with equivalent privileges. Two embodiments make it possible to trace the creation-modification dates of these pages by using or not the clock counter.

[0039] State of the art relating to partial measurements by the program (i.e. “self measurements

[0040] The state of the art presents techniques for self-verification of the integrity of the program itself, used to perform a program attestation or to verify the integrity of certain parts of the program, particularly those most exposed to modifications. These measures access the content of the loaded pages of the software program and relate to its entire footprint or a restricted part.

[0041] Continuous attestation techniques are intended to reduce the impact of the measurement on the operating state of the program (A.Brahim et al, 2017 SeED secure non intrusive attestation for embedded devices, X.Carpent et al, 2018 ERASMUS, efficient remote attestation via self measurements for unattended settings) intended to reduce the risk of denial of service attacks by saturating the execution environment of the software program. These attacks result from the general scheme in which the verifier initiates attestation requests to the measurement agent which must execute, regardless of the execution state of the program and the load on its execution environment. These solutions reverse the scheme by positioning the agent to initiate the attestation, carry out its measurement without weighing on the execution environment and deliver it when it is ready.This scheme follows the best-effort security assumption by prioritizing system availability but without guaranteeing the freshness of the attestation measurement spontaneously performed by the agent. This scheme of recovering successive and contained measurements does not reduce the risk of the page reconstruction attack, each measurement being performed on the previously reconstructed pages.

[0042] The state of the art also includes the technique of self-verification of integrity by the program on a restricted part without agglomeration of the total footprint. These measurements only provide proof of integrity on this single perimeter. These measurements provide a guarantee in one direction only. In the event of detection of a discrepancy between the measurement and what it is supposed to be, one can conclude with certainty that the software program has been modified but the converse is false. Without a discrepancy observed on the partial measurement, one cannot conclude with certainty that the software program is intact. By targeting parts of the program more exposed to modification, such as a usage right verification routine, a software program mining strategy is implemented that optimizes the detection of the modification with acceptable performance degradation.The field of DRM (Digital Rights Management) has exploited this technique to protect the rights management routine in a non-predictive manner. In practice, we see that each of these traps can be circumvented as soon as it is identified. The state of the art also generates an instantaneous reaction to the detection of a deviation. For DRM systems using this technique, partial accesses to the memory pages of the software program are directly useful to the software program itself and used in the software program in such a way that a modification of the values ​​read generates a modification of the behavior of the software program during its execution, instantly and without knowing in advance the change in behavior of the software program. An attacker with the means to trace the execution of the software, in particular by using a debugger, can go back sequentially, . step by step, to the cause, identify the generating reading and modify its value by the expected value, corresponding to the original program, before modification, to return to normal behavior. Thus, as soon as the cause of the reaction can be identified, the attacker can bypass the trap deliberately placed in the program.

[0043] The techniques described above, based on comparison with an immutable reference of the fingerprint, remain permeable to page reconstruction attacks.

[0044] State of the art on secure exchanges between verifier and measurement agent

[0045] When the verifications are produced remotely, the transfer security uses asymmetric encryption such as the RSA protocol for the creation of signatures by the agent and the verification of the origin of the signature by the verifier. The trust attributed to the signatures is conditioned by the impossibility for the attacker to have the private key used by the transmitter. To avoid replay attacks made possible by an interception of the communication link between the verifier and the measurement agent, the verification requests integrate a challenge based on a random number held by the verifier and modifying the response expected by the agent but without modifying the measurement carried out by the agent as such. The challenge consists of adding a layer of security on the transmission and not on the verified measurement, by comparison with a fixed reference held by the verifier, and therefore by definition which cannot change with the random number of the challenge..

[0046] State of the art on securing verification

[0047] Securing the verification function is crucial. In all cases, the verifier must have the state of the expected attestation measure serving as a reference. In the state of the art, this condition is achieved by the provision by a third-party entity during the attestation process, by the storage of this reference in the verifier's execution environment or by the verifier's ability to produce the signature by itself.

[0048] As stated previously and, with the exception of the attempts of JT Giffin et al. described in the aforementioned document, the static nature of this unique reference for a software program is an asset for the attacker. Challenge mechanisms to counter this uniqueness and avoid attacks by interception of the transmission and sending the generated result to a valid node or by replay are produced by the verifier and must obviously remain secret.

[0049] The invariant nature of the measured program fingerprint and the signature expose the verifier to confidentiality attacks to extract the reference signature that it will use for its comparison test. Finally, at the end of the attestation cycle, the verification routine generates a single-bit test result (positive or negative test). The result of this test can be forced by the attacker if the verification routine comparison is identified and exposed to modification. Thus, the entire attestation process is short-circuited by directly attacking the result.

[0050] Ultimately, the state of the art provides different schemes for securing verification, either by its location in a secure place or its integration into a trusted execution environment (i.e., TEE). The risks of denial of service associated with the concentration of the function in a single location has also given rise to numerous experiments in the distribution of the verification function and, in particular, to mutual attestation schemes in which the verification and measurement functions are present in all nodes.

[0051] State of the art on the certification of software with a varying footprint

[0052] Varying the footprint of a software program can be part of a defense against certain attacks, breaking the conditions for carrying out the attack. Emblematically, the Address Space Layout Randomization (ASLR) method, used in recent operating systems, produces a distinct memory allocation each time an application is loaded by the processor, remedying buffer overflow attacks and control flow bypass attacks. This memory rearrangement contravenes the attestation principle by rendering a reference measurement of the software program obsolete. However, the memory allocation device produces an ordering of the software program functions without touching them. The instructions are therefore translated in blocks by modifying the memory addresses of the same increment. In A. Cabutto et al.2015 Software Protection with Code Mobility, the authors reconcile the mobility of functions in memory and the possibility of establishing an attestation measure by reducing the measured scope to functions taken separately. The reference measurements are restricted to the functions. The attestation routine has the means necessary to locate them for the production of the corresponding measurements. It should be noted that the reference measurements correspond to a scope invariant by the attestation. The attestation concerns the functions taken separately and whose footprints have not varied, thus remaining in the classic scheme of invariance of the measured footprint.

[0053] The ASLR aims to counter attacks of a different type than TOCTOU type attacks targeting attestation.

[0054] The page reconstruction attack can be carried out as soon as the reallocated pages of the software program are loaded into memory. These pages, which no longer vary after their loading, will be recovered and copied into memory by the attacker.

[0055] To our knowledge, whatever the type of attestation implementation, including those integrating the agents into the operating system, none modify the fingerprint before the measurement, in a controlled and anticipated manner, and carried out at the very moment when the measurement is produced. Summary of the invention

[0056] The method according to the invention addresses the problem of page reconstruction attacks for software attestation implementations. Its scope covers complete or partial measurements of the program fingerprint by a measurement agent or by the software program itself (i.e., "self measurements"). To do this, the method proposes to break with the general scheme based on the constancy of the program fingerprint once loaded by the processor by making modifications to it when carrying out the measurement and in such a way that the modified fingerprint makes it possible to carry out the measurement as expected by the verifier, i.e. the reference measurement. On the other hand, any recovery of the program fingerprint recovered prior to the measurement does not correspond to the expected measurement.

[0057] In practice, a critical element of attestation solutions is the provision and securing of reference measurements to the verifier. As discussed previously, modification of the fingerprint requires that it correspond to the modified state of the fingerprint. The invention provides various technical responses to this subject, in particular, by allowing the verifier to produce the reference measurement of this modified state by itself. In a particular embodiment of the invention, static measurements from outside are used. This mode proposes to modify the fingerprint of the program as soon as it is loaded into memory and to produce an inverse modification before the measurement.

[0058] In view of the above, the subject of the invention is a method of attesting a software program, comprising steps according to which:

[0059] an execution environment of the software program is provided comprising

[0060] a processor,

[0061] a volatile memory,

[0062] an operating system, and

[0063] a measuring agent,

[0064] a verifier is provided,

[0065] for execution of the software program by the processor, the operating system loads into volatile memory executable pages of the software program, the content of which constitutes a fingerprint of the software program,

[0066] the imprint of the software program loaded into the volatile memory is modified at the initiative of the verifier, the measurement agent or the operating system,

[0067] the measurement agent performs a measurement function to obtain a measurement of the modified footprint of the software program,

[0068] the measurement of the modified footprint of the software program is transferred to the verifier,

[0069] the verifier obtains a reference measurement of the modified fingerprint of the software program, this reference measurement being deemed correct,

[0070] the verifier compares the measurement of the modified fingerprint of the software program in the volatile memory transferred to it with the reference measurement of the modified fingerprint, to obtain a comparison result, and

[0071] an integrity of the software program is attested if the comparison result shows that the two measurements are identical.

[0072] Advantageously, the execution environment of the software program is carried by a platform of the software program and according to which the verifier is contained in a remote platform, located outside the platform of the software program; - the fingerprint of the software program is returned upon completion of the measurement to its state before the production of the measurement; - the measurement agent is contained in the software program, the verifier generates the measurement function, the verifier sends the measurement function to the measurement agent, and the measurement agent is modified by the insertion of the measurement function; - the method is applied to a plurality of attestations, and according to which the measurement function differs for each attestation;- the measurement agent is provided with a memory buffer accessible in write and execution, the memory buffer allowing direct insertion or construction of instructions of the measurement function, then a transfer of execution from the measurement agent to the buffer to execute instructions either directly or by reconstruction of the instructions during the execution of the measurement agent; - the memory buffer is returned to its initial state, after the measurement has been carried out; - the memory buffer is loaded with a content predefined by the verifier and different from the measurement function, once the measurement has been carried out; - the measurement only concerns a restricted part of the software program; - the agent or the verifier integrate and are functionalities of the operating system of the execution environment of the software program;- at the initiative of the verifier or the measuring agent, the imprint of the software program in the volatile memory is modified at the launch or from a first phase of execution of the software program and according to which the imprint of the program is modified a second time and so as to recover the imprint of the software program.; BRIEF DESCRIPTION OF THE FIGURES

[0073] The invention will be better understood on reading the following non-limiting description, drawn up with reference to the appended drawings, in which:

[0074] [Fig.l] [Fig.l] schematizes a particular embodiment of the invention according to which the modification of the program footprint is based on the modifications generated on the buffer, namely a memory area open for writing and reading accessible to the measurement agent which loads the measurement function of the verifier. These modi fications can come from the recovery of the measurement function produced by the verifier or the creation of this function by the agent upon receipt of data produced by the verifier. This figure finally presents the perimeter of the memory footprint measured by the measurement function and which corresponds to the entirety of the software program, therefore integrating the agent and its buffer.

[0075] [Fig.2] [Fig.2] shows the sequencing of the different operations carried out by the verifier and the agent, in the particular embodiment of [Fig. 1]. The sequence covers the operations of a complete attestation cycle.

[0076] [Fig.3] [Fig.3] schematizes a particular embodiment in which the modifications on the program footprint overflow from the agent and when the agent is located outside the program to be measured. The diagram presents a sequence of typical operations carried out by the agent upon receipt of synchronization data and / or selection of the measurement to be carried out. The agent can integrate the operating system of the execution environment of the software program.

[0077] [Fig.4] [Fig.4] shows a diagram of the verifier and its interfaces with the measurement agent and a remote supply service. The figure shows the verifier's ability to produce the modified reference measurement, using the elements available locally or by exchange with the remote service.

[0078] [Fig.5] [Fig.5] shows schematically the scope of the measurement when it only concerns a sub-part of the software program and in particular the scope of this measurement to understand the modification of the measured footprint.

[0079] [Fig.6] [Fig.6] shows schematically the embodiment consisting of the double modification of the imprint allowing a measurement to be carried out on the original imprint. DETAILED DESCRIPTION OF THE INVENTION

[0080] The method according to the invention proposes to transiently, possibly ephemerally, generate a modification of the program footprint during the measurement.

[0081] The invention relates to a local or remote attestation of a software program, a security service making it possible to verify the conformity of the latter with a reference measurement relating to its memory footprint. The invention proposes a modification of the footprint with the objective of countering attacks by reconstruction of pages using the content of the footprint recovered prior to the measurement. It applies to all implementations of software attestation, whether or not they use a hardware device, whether it is carried out remotely or locally.

[0082] Transitional and modifying certificate of the imprint during measurement

[0083] To counter page reconstruction attacks, the invention modifies prior schemes by breaking the principle of program measurement invariance. The invention modifies the program imprint temporarily, possibly ephemerally, during the measurement itself. Once the measurement has been carried out on the imprint thus modified, it can advantageously be returned to the state prior to the measurement.

[0084] The measurements carried out according to the method of the invention may relate to a partial imprint of the software program.

[0085] Different embodiments are possible and differ in the location(s) of the software for modifying the imprint and measuring, located in a grouped manner or conversely separately inside the software being measured or outside of it. In all cases, the operations of measuring and modifying the imprint are synchronized so that the measurement relates to the imprint in its modified state. If the invention allows all the aforementioned embodiments, the embodiments grouping the two operations of measuring and modifying the imprint in a single software program designed for synchronizing them are to be favored for ease of implementation. A description of this preferred embodiment is given below.

[0086] It should be noted that the verification of the measured footprint is done by comparison with a reference deemed to be correct and which must correspond to the modified footprint. In the case where the measured footprint and the type of measurement vary over time, it is appropriate to provide the verifier in a synchronized manner with the means of having reference measurements corresponding to the variations on the footprint and the type of measurement.

[0087] In practice, the preferred embodiment is that in which the verifier initiates the measurement, knowing the measurement function that it will send or that it will command to the measurement agent. By knowing the measured program, it can have its reconstructed fingerprint, that is to say a representation of it including the addresses and the content of the memory pages of the software program as they are loaded by the processor. This reference fingerprint can be provided to it by an external supply service or have it available within its own resources.

[0088] Having the reconstructed fingerprint and the measurement function, the verifier can produce the reference measurement that it will use for its comparison. An alternative is to have or retrieve, by an external supply service, reference measurements. Different centralized or distributed structures, such as a blockchain, make it possible to ensure the external supply service for these elements. In another embodiment, the measurement agent, or the operating system, spontaneously initiate the measurement process including prior modification of the fingerprint. The verifier can be informed in different ways about the type of measurement and the prior modification of the fingerprint, in particular by the transmission from the agent or the operating system to the verifier simultaneously with the measurement of elements characterizing the type of measurement and the modification made before the measure.

[0089] As mentioned above, another mode of use of the invention proposes to produce a modification of the imprint of the program when it is loaded into memory and an inverse modification of the imprint during the measurement resulting in the measurement being carried out on the original imprint. Preferred methods of implementation

[0090] The preferred embodiments address the problem of synchronization between the modification of the fingerprint and the performance of the measurement, favoring the embodiment where the verifier initiates the attestation process.

[0091] The method according to the invention then proposes to integrate a measurement agent into the measured program. The measurement agent is loaded when the measurement of a measurement function is carried out. The modification of the footprint occurs when the measurement function, integrating the perimeter of the measurement, is inserted into the measurement agent. In addition, it is advantageous to restore the initial footprint by erasing the measurement function or replacing it with data after the measurement, leaving no trace on the measurement function and therefore the footprint measured after the measurement has been carried out. This first embodiment thus proposes an insertion, into the measurement agent, of a memory buffer open for writing and execution, loaded during a request for certification by the verifier by the measurement function.This may contain a sequence of instructions or, alternatively, data necessary and used by the agent to construct this sequence of instructions by itself.

[0092] In the first embodiment, the generation of the measurement function can be produced by the verifier. It can result from a pseudo-random construction of the sequence of instructions, initiated by a random number generated by the verifier and resulting in a sequence of instructions and data constituting the measurement function. These instructions produce a collection of the pages of the program fingerprint, then a hash of these pages of the program, potentially taken in a random order and modified by logical operations of all types (e.g. an addition or an exclusive or). The sequences of instructions used can also be selected from a set of iso-functional instruction combinations, as provided by the obfuscation solutions.

[0093] In a second embodiment, the measurement function may result from a dynamic construction by the measurement agent, using data transmitted during the measurement by the verifier. The measurement agent may directly execute the measurement function once it has been constructed and loaded into the buffer.

[0094] These two embodiments ensure, by construction, the consistency and synchronization of the operations of modification of the imprint and measurement on this footprint, it being observed that, in both cases, the measurements are produced by the measurement function where it has already modified the footprint by its presence, that is to say in the buffer integrating the perimeter of the agent, itself integrating the measured perimeter.

[0095] A third embodiment proposes to place a measurement agent located outside the software program, which coordinates the operations of carrying out total or partial modification of the footprint and then measurement. The agent can possibly integrate the operating system of the execution environment.

[0096] The modifications of the footprint may include an isofunctional replacement of instruction sequences, a rearrangement of the memory addresses of the different functions of the program. This embodiment requires controlling the control flow of the program, interrupting it, recovering the execution context of the program (i.e., the processor registers), inserting the modifications of the program and then restarting the program with its execution context recovered at the breakpoint. Once the modification has been made, the agent can then produce and send its measurement. As explained above, it will be necessary to ensure synchronicity between the total or partial modification of the footprint and the provision or calculation by the verifier of the reference measurement corresponding to the modifications of the footprint.

[0097] Attestation process resulting in a modification of the footprint before measurement

[0098] The invention provides a purely software-based response, in principle, to TOCTOU attacks by page reconstruction, for software implementations of local or remote attestation of a software program.

[0099] To do this, it implements the principle of the transient, possibly ephemeral, modification of the program footprint during the performance of the attestation measurement, breaking with the invariant nature of the memory footprint of the program to be measured. It therefore generates the need for synchronization of the operations of modification of the footprint, measurement of the footprint and verification on the correct reference of the footprint.

[0100] A first embodiment is described in [Fig. 1]. The agent is an integral part of the software program, modified for this purpose, in particular and, in particular, by automatic modification operations of the executable file of the program in order to insert this agent. The agent comprises a memory area open for writing and execution (i.e., the memory buffer), receptacle of the measurement function sent to it by the verifier. This function is a sequence of instructions whose execution carries out the measurement. This sequence of instructions can either be directly produced and transferred by the verifier or result from a construction from data previously loaded into the agent's buffer and by using data provided by the verifier when requesting certification from the agent. This data may be a cryptographic element allowing the data already present in the agent to be decoded and transformed in encrypted form to result in the desired sequence of instructions. The construction of the sequence of instructions of the load always results from the execution of the agent. The measurement of the agent will cover the entire software program, thus integrating the instructions of the agent itself and therefore those produced specifically for the measurement function. The measurement is executed as soon as it is placed or carried out in the buffer. Any recovery by the attacker of the program fingerprint prior to the execution of the measurement by the measurement function, not including the instructions of the measurement function, cannot be used.After the measurement is performed, the memory buffer can be reset to its initial state or loaded with a predefined value known to the verifier, before the measurement was produced, removing any trace for later analysis of the software by the attacker. [Fig.l] presents the case where the verifier is located in an execution environment other than that of the software program, giving rise to a remote attestation. The integration of the verifier in the execution environment of the software program gives rise to a local attestation. The integration of the verifier in the software program gives rise to a self-attestation.

[0101] [Fig.2] describes the sequencing of operations and the collaboration between the verifier and the measuring agent.

[0102] A second embodiment is presented in [Fig.3], with an agent external to the measured program but which has intrusive means of control over the execution of the program and its memory pages. In this extreme case and representing a theoretical case, the agent will be able to intercept the control flow, block the execution, recover the execution context, modify pages of the program, produce the measurement on the entire program (including the pages thus modified) and launch the modified program with the modified execution context. The agent can integrate the perimeter of the operating system, the measured program or be located outside of these.

[0103] [Fig.4] shows schematically the operation of the verifier. The verifier includes ins software instructions, a storage space in which software program fingerprints, reference measurements and measurement functions are potentially located. The verifier is potentially interfaced to an external provisioning service delivering reference measurements, fingerprints and measurement functions. The verifier is also interfaced to the measurement agents. In the preferred embodiment, the verifier initiates the attestation request. For the production of the measurement function, it can refer to its storage space or establish a request to the external provisioning service. It transmits the measurement function itself to the agent or an element allowing the agent to construct this measurement function before loading it. The verifier can retrieve the reference measurement from its storage space or by establishing an exchange with the external supply service, or calculate it using the program footprint and the measurement function applied. When the measurement agent initiates the attestation, the verifier can retrieve, in particular when receiving measurements, the additional elements transmitted by the agent and characterizing the measurement function and / or the modification of the footprint made.

[0104] [Fig. 5] shows schematically the method of carrying out partial measurements. The different embodiments described, when the measurement concerns the entire footprint of the program, are possible, while respecting the principle of modifying the measured footprint before measuring it. The measured footprint must therefore include the part that has been modified by the measurement. This may be the modified restricted part or alternatively the agent. In the first case, the measured footprint is only the sub-part of the software program. In the second case, the measured footprint corresponds to the meeting of restricted parts of the software program and the measurement agent. The figure shows the measurement agent in the software program. The latter may be external and possibly integrate the operating system.

[0105] [Fig.6] shows the flow of operations implemented to enable the exploitation of the invention by carrying out a measurement on the original footprint of the software program, through a double modification of the footprint, the second modification being the opposite of the first. The first modification is carried out during the loading phase or at the launch of the software program. The second modification is carried out just before the measurement.

Claims

Claims

1. A method for attesting a software program, comprising steps according to which: an execution environment of the software program is provided, comprising a processor, a volatile memory, an operating system, and a measurement agent, a verifier is provided, for an execution of the software program by the processor, the operating system loads into volatile memory executable pages of the software program, a content of which constitutes a fingerprint of the software program, the fingerprint of the software program loaded into the volatile memory is modified at the initiative of the verifier, the measurement agent or the operating system, the measurement agent executes a measurement function to obtain a measurement of the modified fingerprint of the software program, the measurement of the modified fingerprint of the software program is transferred to the verifier, the verifier obtains a reference measurement of the modified fingerprint of the software program,this reference measurement being deemed correct, the verifier compares the measurement of the modified fingerprint of the software program in the volatile memory which has been transferred to it with the reference measurement of the modified fingerprint, to obtain a comparison result, and an integrity of the software program is attested if the comparison result shows that the two measurements are identical.,

2. The method of claim 1, wherein the execution environment of the software program is carried by a platform of the software program and wherein the verifier is contained in a remote platform, located outside the platform of the software program.

3. The method according to one of claims 1 or 2, according to which the imprint of the software program is returned upon carrying out the measurement to its state before the production of the measurement.

4. The method according to one of the preceding claims, wherein the measurement agent is contained in the software program, the verifier generates the measurement function, the verifier sends the measurement function to the measurement agent, and the measurement agent is modified by inserting the measurement function.

5. The method according to one of the preceding claims, applied to a plurality of attestations, and according to which the measurement function differs for each attestation.

6. The method according to one of the preceding claims, characterized in that the measurement agent is provided with a memory buffer accessible in writing and execution, the memory buffer allowing direct insertion or construction of instructions of the measurement function, then a transfer of execution from the measurement agent to the buffer to execute instructions either directly or by reconstruction of the instructions during the execution of the measurement agent.

7. The method of claim 6, wherein the memory buffer is reset to its initial state, after the measurement has been performed.

8. The method according to claim 6, according to which the memory buffer is loaded with a content predefined by the verifier and different from the measurement function, once the measurement has been carried out.

9. The method according to one of the preceding claims, according to which the measurement only relates to a restricted part of the software program.

10. The method according to one of the preceding claims, according to which the agent or the verifier integrate and are functionalities of the operating system of the execution environment of the software program.

11. The method according to one of the preceding claims, according to which, at the initiative of the verifier or the measuring agent, the imprint of the software program in the volatile memory is modified at the launch or from a first phase of execution of the software program and according to which the imprint of the program is modified a second time and so as to recover the imprint of the software program.

Images