METHOD FOR CERTIFYING A SOFTWARE PROGRAM

Abstract

METHOD FOR ATTESTATING A SOFTWARE PROGRAM The invention relates to a method for attesting a software program.The invention is characterized in that a software program execution environment is provided, including a measurement agent; a verifier is provided; the operating system loads executable pages of the software program into volatile memory, some of whose content constitutes a fingerprint of the software program; the fingerprint of the software program loaded into volatile memory is modified at the initiative of the verifier, the measurement agent, or the operating system; the measurement agent executes a measurement function; the measurement of the modified fingerprint of the software program is transferred to the verifier; the verifier obtains a reference measurement deemed correct of the modified fingerprint of the software program; the verifier compares the measurement of the modified fingerprint of the software program in the volatile memory transferred to it with the reference measurement of the modified fingerprint. Abstract figure: Fig. 1.

Description

Title of the invention: METHOD FOR ATTESTATING A SOFTWARE PROGRAM FIELD OF INVENTION

[0001] The present invention relates to a method for verifying the conformity of a software program. The method verifies the equality between a measured state of the program and a known reference state of the program, this reference state being deemed correct and conventionally representing its original state. The program measurement consists, for example, of generating a hash function from the contents of the pages loaded into memory by the operating system for program execution by the processor. The contents of these memory pages are referred to as the memory footprint in what follows. The hash function detects any modification made to the footprint and results in a measurement. EARLIER ART

[0002] Software program attestation is a cornerstone of computer security, based on the principle of verifying, through measurement, that an object is indeed what it should be, by comparison with a reference to its original state deemed correct. An object, for example, data or a software program, is identified by its signature produced by a mathematical hash function, resulting in a non-invertible numerical value, calculated from the data characterizing the object stored in memory. It is theoretically impossible to construct a memory fingerprint from a numerical hash value and theoretically impossible to obtain the same hash result for two different fingerprints. The file's content may result from a prior collection operation of the different parts of its content. This collection may be performed sequentially and in parts or all at once.

[0003] Thus, in the case of a program execution attestation, it is verified that the program loaded into RAM, in particular a DRAM type memory, is identical to the footprint of the memory pages when it was initially loaded by the operating system or that it can also be compared with a signature of the software program issued by the supplier.

[0004] For example, a file is produced by aggregating all the 4 Kilobyte memory pages of RAM used when placing the program into RAM for execution by the processor, before producing the hash.

[0005] State of the art on local or remote attestation

[0006] Attestation is a widely used method, which relates to objects of different types such as data, an operating system software program, an embedded software program, a low-layer software program (i.e., BIOS) or an application software program, namely a software application.

[0007] As a result, the attestation has given rise to many different types of local or remote implementations.

[0008] The level of confidence attributed to the local or remote attestation is based on the robustness of the software performing the measurement, namely the hashing, on the security of the transfer thereof and, finally, on the security of the verification of the authenticity of this measurement.

[0009] The security of the measurement is characterized, on the one hand, by the robustness of its access points to the measured data, i.e. access points to the memory area containing the object and, on the other hand, by the robustness of the routine producing the hash against a modification.

[0010] The state of the art classifies three types of implementations for carrying out the measurement, with and without a hardware device, of two different types. These are referred to as hardware, hybrid, or purely software attestation.

[0011] The physical attestation provides a higher level of trust. The standard scheme proposes the use of a dedicated chip of the Trusted Platform Module (TPM) type, conforming to a standard. TPMs produce measurements on dedicated chips that are impervious to analysis and modification, thus providing complete assurance of confidentiality and integrity for their measurements. TPMs possess the private key of an asymmetric encryption key pair, enabling them to sign the measurements before transmission. This private key is neither readable nor exportable outside the TPM.

[0012] The signed measurements are sent to the remote verifier.

[0013] The last TPM can then validate its origin by referring to the public key delivered with the measurement, identifying the TPM, and can also validate the integrity of the software state by comparison with a reference value. Furthermore, for TPMs, when the measurement relates to memory pages of an application or a system module of the kernel or the operating system of the execution platform, these TPMs access these pages in a completely secure manner, without it being possible for an attacker to intercept and corrupt these reads. Designed for this purpose and standardized, TPMs are likely to provide optimal security for the attestation measurement. However, so-called "side attacks" on the latest version of TPM 2.0, which brute-force correlations of operation execution times with content, have made it possible to reconstruct the key. private and therefore able to produce fictitious and arbitrary measurements that the verifier will attribute to the TPM. These attacks prompted a response from TPM manufacturers, who produced a patch for the embedded software, restoring the TPMs to the highest level of confidence.

[0014] For software applications, excluding system software (i.e., BIOS, operating system), Trusted Execution Environments (TEEs) offer an alternative to the use of TPMs. TEEs are implemented as an extension of the processor and are therefore programmatically activated, providing the same high guarantees of confidentiality and integrity for their content (i.e., application software and data) arbitrarily defined by the user. Unlike TPMs, whose software is fixed by the manufacturer and invariant, TEEs are loaded by user software. TEEs do not allow the storage or access of system software and thus do not constitute an alternative to TPMs for system software attestation.

[0015] In a TEE, system software and its data are generally intended for one or more security functions of various types and require security. Once embedded in the TEE, this software and its data constitute the Trusted Computing Basis (TCB). In the specific case where the TCB is an attestation routine with attestation data, we then have an attestation measure performed by a TEE with the same security guarantees as with a TPM. Consequently, and by design, due to the security guarantees provided by TEEs, and in particular the integrity guarantee, a measurement agent embedded in a TEE cannot modify itself or be modified externally during its execution. Similarly, the software embedded in a TPM is immutable. Hardware attestation implementations use a static and immutable trust base.These implementations also fully secure the private keys used to create signatures for measurements taken before they are sent to the verifier. Just as TPMs have been subject to side attacks, numerous attacks of this type have targeted TEEs (e.g., Intel™ SGX, AMD™ SEV, arm™ Trustzone), which have also led to patches addressing these attacks in the form of microcode.

[0016] These hardware implementations, provided they rely on up-to-date software, particularly up-to-date microcode, offer an unparalleled level of confidence for the measurements they provide to the verifier. They de facto create a deployment constraint requiring the presence of the TPM or TEE at the location where the attestation measurement is performed.

[0017] Hybrid attestation was designed for constrained execution environments where hardware devices (TPM and TEE) are not present. For common execution environments in the Internet of Things (IoT) field, the size, overall footprint of the device, and its resources preclude these devices. Various hybrid attestation schemes exploiting basic processor functions such as the clock counter or read-only memory (ROM) are used by the software attestation routine to achieve a level of security deemed optimal for these devices, without offering the same level of confidence as hardware configurations regarding the confidentiality and integrity of the software performing the measurement and the key used to sign it.

[0018] Software attestation does not use hardware devices employed by hardware or hybrid attestations. Two types of implementations are distinguished depending on whether the verifier is remote or local. These are generally more commonly used for application software attestation.

[0019] If the verifier is located in the same execution environment as the software being measured, the attestation is local. A special case of local attestation is when the software incorporates the measurement and verification functions within itself. The attestation is then referred to as self-attestation. Conversely, the measurement and verification functions can be integrated into the operating system or into an agent separate from the software program. Like hybrid attestations, they then provide only relative guarantees of confidentiality and integrity, not full ones. The measurement routines of software attestations are particularly vulnerable to analysis and modification by a local attacker. Software obfuscation techniques, which make the software opaque, and self-verification techniques can be deployed to reduce this risk, but not to eliminate it.It is a well-known fact that assurances of confidentiality and integrity cannot be guaranteed when an attacker is able to perform dynamic analysis and write to the software program's memory pages. Obfuscation techniques offer a relative level of security, defined according to the performance and security requirements of the software program components. Regarding attestation, to be effective and to prevent an attack carried out by prior analysis of an instance of a deployed obfuscated agent, the ideal obfuscation, applied to the agent performing a measurement, should exhibit sufficient variability from one agent deployment to another, thus creating a multitude of functionally identical attestation agents that are difficult to analyze.For large quantities of instantiations of a single attestation agent deployed for many applications or integrating the kernel, this variability creates impractical operational instability, particularly because it can lead to . Variable operational uncertainties and performance impacts would necessitate unit testing of all deployments. While ideal obfuscation results in very high analysis complexity, it inevitably leads to significant software bloat, resulting in a corresponding increase in CPU processing time. Therefore, obfuscation must be pushed to a level that remains acceptable from this perspective. For solutions involving specific operation of the attestation agent, such as pseudo-random hashing with each deployment, obfuscation can be used to sufficiently delay the specific analysis required by the attacker, thus minimizing the effort required over a limited timeframe. Implementing a time counter by the verifier upon receiving the measurements allows for the identification of delayed responses generated by an attack.

[0020] This principle of detection by the time of measurement execution has been developed in the following publications, deploying different techniques (obfuscation, encryption, self-modifying code) on the attestation routine intended to delay the analysis by the attacker of the targeted memory areas and those used by them:

[0021] SWATT: SoftWare-based ATTestation for Embedded Devices, A. Seshadri et al., IEEE Symposium on Security and Privacy, 2004

[0022] PIONEER: Verifying code integrity and enforcing untampered code execution on legacy code, A. Seshadi et al., ACM SIGOPS Operating Systems Review, Volume 39, Issue 5, December 2005, pp 1-16,

[0023] Remote Software Based Attestation for Wireless Sensors, M Shanek et al., reading Notes in Computer Science, 2005

[0024] Soft Tamper-Proofing via Program integrity Verification in Wireless Sensor Networks, T. Park et al., EEE Transactions on Mobile Computing 4(3):297-309, June 2005

[0025] In the document Tamper resistant software: an implementation, D. Aucsmith, Hiding, May 30, 1996, a combination of techniques exploiting encryption, obfuscation and spontaneous modification of the measurement routine is presented in order to generate maximum effort at each attack, reducing knowledge acquisition resulting in a single bypass.

[0026] However, the techniques proposed in the aforementioned publications have never been implemented industrially. Regardless of the promises made by the authors of these techniques, obfuscation and self-generated modification schemes offer a level of security that decreases rapidly over time when the attacker can have multiple instances within their analysis scope. Separately and in addition, methods exploiting the time it takes the processor to perform the measurement generate false attack detections if the processor is highly loaded by other software loads or if the network involved in the transmission is itself congested.

[0027] In all the software attestation techniques described above, none deviates from the pattern in which variability applies only to the measuring function or agent, never to the measured footprint itself. In all prior art techniques, including when the reading routine is embedded in the program itself, the measurement is performed on sections or on the entire program footprint, based on an assumption of its invariance.

[0028] In the field of remote attestation, a person skilled in the art may question the security target used, in which the attacker would locally perform an analysis of the measurement function or the attestation agent. Indeed, this security target does not correspond to reality, which presents two preferred attack modes. The two Time-of-Check to Time-of-Use (ToCToU) attack modes described below are predominant and consist of restoring memory before the measurement is performed, without the attacker needing to analyze the type of operations and the memory areas targeted by the measurement. State of the art on ToC / ToU attacks: Page Reconstruction Attacks

[0029] Unlike hardware implementations and some hybrid implementations, software implementations all share the weakness of potentially being modified at the memory addresses read for measurement. With software implementations, the attack consists of modifying the measurement production routine by bypassing memory reads. A classic modification uses a memory area pre-loaded with data reflecting a previous state of the object, retrieved by the attacker, and to which memory reads for the measured program are systematically diverted. This attack requires a modification of the measurement agent to divert memory read operations targeting the fingerprint address range.This attack, known as page reconstruction, bypasses the agent's reads of program pages loaded by the processor by reading from a previously created buffer. The execution of this attack relies on the assumed invariant nature of the measured software program, allowing its memory footprint to be retrieved at startup or at any point during its execution and used for subsequent measurements. The attestation schemes that generate different measurements, such as those mentioned previously, do not alter this assumption—that is, the invariance of the memory footprint on which these measurements are performed. are carried out in such a way that the authors exclude attacks by rebuilding pages of the security target.

[0030] To counter page reconstruction attacks, two defenses have been developed. The first distinguishes between the type of memory used, namely pages containing instructions heavily accessed by the processor and quickly retrieved, and pages containing data that are accessed more slowly, particularly, but not exclusively, because these pages are not loaded into the processor's cache. By analyzing the measurement execution times, it is identified whether the measurement was generated from the program's memory pages or using the contents of a data memory "image" buffer previously mounted by the attacker. This method is described in particular in the document Secure Remote Attestation, M. Jackobsson, 2018.

[0031] Like all methods based on access times varying with a large amplitude, it generates its false detections in particular because variations in processor load can considerably slow down the execution of routines, without any attack being carried out.

[0032] The other method consists of breaking the condition for the success of the attack, that is, the invariance of the software program, by changing instructions during execution. This other method is described in the document: Strengthening software self-checksumming via self-modifying code. In ACSAC, pages 23-32. IEEE Computer Society, 2005, JT Giffin, M. Christodorescu, and L. Kruger.

[0033] The method described in this document allows the program itself, which incorporates a specific detection routine, to identify a memory page reconstruction attack. It is a theoretical method for detecting the architecture and type of memory used (i.e., Van Neumann, Harvard) by the program itself. The publication presents a hash invariance principle without enabling the implementation of an attestation system. Since the hash modification by the program itself is asynchronous with a remote verifier, it de facto causes a malfunction in the attestation due to the desynchronization between the spontaneous modification of the software and a reference measurement held by the verifier. The publication does not allow for, and has not led to, industrial implementation. Finally, in its implementation, the detection test, located within the program, is directly exposed to bypass by the attacker.Blind zone attacks.

[0034] A second type of attack exploits the desynchronization between measurement and the current state of the software. This attack consists of modifying the software between two measurements and restoring the processor's memory before the next measurement, without requiring page reconstruction as explained previously. This second type of attack, Performed in the blind spot between two measurements, this attack can be implemented for all types of hardware, hybrid, and software attestations. Indeed, in all cases, the measurement only reflects the state of the software at the precise moment it was generated. These attacks, which modify the fingerprint between two measurements, evade detection at the next measurement by identifying its triggering, preferably in an automated manner.

[0035] Various techniques have been developed to counter these attacks.

[0036] A first technique consists of producing partial, potentially consecutive and cumulative, measurements during software execution. These measurements (i.e., self-measurements) are performed by the software during its execution and provide partial but continuous detection over time, thus eliminating blind spots. The measurements taken can cover the entire footprint of the software program through successive accumulation of partial measurements or be restricted to only a portion of it, particularly by targeting more exposed areas. To reduce their impact on software performance, these continuously performed measurements each cover a small memory area before their delayed aggregation. The pseudo-random strategy of selecting sequentially measured areas reduces the attacker's ability to predict where and when the next measurement will be performed, resulting in a probabilistic approach to attack detection..

[0037] US patent document US9654499B2, entitled System and Method for Mitigating TOC / TOU attacks in a cloud computing environment, proposes an alternative detection method based on the modification caused by the attack to the control flow of the measurement routine by extracting a pseudo-random value from the processor LBR register containing the addresses of the executed instruction blocks. This method claims to ensure that the measurement routine has been executed from end to end without deviation to a breakpoint or a routine that resets the memory to its original state.

[0038] In I. De Oiveira Nunes et al., On the TOCTOU Problem in Remote Attestation (Nov 2021), the authors present two techniques for constrained environments, targeting hybrid implementations. They rely on write-locking open memory pages assigned to application software, thus restricting modifications to these pages by the system administrator and potentially an attacker with equivalent privileges. Two embodiments allow tracking the creation and modification times of these pages, either by using a clock counter or not.

[0039] State of the art relating to partial measurements by the program (i.e. “self measurements”)

[0040] The prior art presents techniques for self-verification of program integrity, used for issuing a program attestation or for verifying the integrity of certain parts of the program, particularly those most susceptible to modification. These measures access the content of the loaded pages of the software program and cover its entire footprint or a limited portion thereof.

[0041] Continuous attestation techniques are designed to reduce the impact of measurement on the program's operating state (A. Brahim et al., 2017, SeED secure non-intrusive attestation for embedded devices; X. Carpent et al., 2018, ERASMUS, efficient remote attestation via self measurements for unattended settings) in order to reduce the risk of denial-of-service attacks by saturating the software program's execution environment. These attacks result from the general pattern in which the verifier initiates attestation requests to the measurement agent, which must execute regardless of the program's execution state and the load on its execution environment. These solutions reverse this pattern by positioning the agent to initiate attestation, perform its measurement without impacting the execution environment, and deliver it when it is ready.This scheme follows the best-effort security principle, prioritizing system availability but without guaranteeing the "freshness" of the attestation measurement spontaneously performed by the agent. This scheme of retrieving successive and contained measurements does not reduce the risk of page reconstruction attacks, as each measurement is performed on previously reconstructed pages.

[0042] The prior art also includes the technique of self-checking integrity by the program on a limited portion without agglomerating the entire footprint. These measures only provide proof of integrity for this single area. These measures provide a guarantee in only one direction. If a discrepancy is detected between the measurement and what it is supposed to be, it can be concluded with certainty that the software program has been modified, but the converse is not true. If no discrepancy is detected in the partial measurement, it cannot be concluded with certainty that the software program is intact. By targeting parts of the program more exposed to modification, such as a usage rights verification routine, a software program mining strategy is implemented that optimizes modification detection with an acceptable performance degradation.The field of Digital Rights Management (DRM) has exploited this technique to protect the rights management routine in a non-predictive manner. In practice, each of these pitfalls can be circumvented once identified. State-of-the-art technology also enables an instantaneous response to the detection of a deviation. For DRM systems employing this technique, partial access to program memory pages... These software reads are directly useful to the software program itself and are used within the program in such a way that a change in the read values ​​triggers a change in the program's behavior during its execution, instantaneously and without prior knowledge of the change. An attacker with the means to trace the software's execution, particularly through the use of a debugger, can sequentially, step by step, trace the behavior back to its source, identify the triggering read, and modify its value to the expected value corresponding to the original program before the modification, thus restoring normal behavior. Therefore, once the cause of the reaction can be identified, the attacker can circumvent the trap deliberately placed within the program.

[0043] The techniques described above, based on comparison with an immutable reference of the fingerprint, remain permeable to page reconstruction attacks.

[0044] State of the art on secure exchanges between verifier and measurement agent

[0045] When verifications are performed remotely, the transfer is secured using asymmetric encryption such as that provided by the RSA protocol for the agent to generate signatures and for the verifier to verify the signature's origin. The trust placed in the signatures is contingent upon the attacker's inability to obtain the private key used by the sender. To prevent replay attacks made possible by intercepting the communication link between the verifier and the measurement agent, the verification requests incorporate a challenge based on a random variable held by the verifier. This random variable modifies the agent's expected response but does not alter the measurement itself. The challenge adds a layer of security to the transmission, not to the verified measurement, by comparison to a fixed reference value held by the verifier, which, by definition, cannot change with the random variable of the challenge..

[0046] State of the art on securing verification

[0047] Securing the verification function is crucial. In all cases, the verifier must have access to the state of the expected attestation measure, which serves as a reference. In the prior art, this condition is met by the provision of this reference by a third party during the attestation process, by storing it in the verifier's execution environment, or by the verifier's ability to generate the signature itself.

[0048] As stated previously, and with the exception of the attempts by JT Giffin et al. described in the aforementioned document, the static nature of this unique reference for a software program is an advantage for the attacker. Challenge mechanisms exist to counter this uniqueness and prevent attacks by intercepting the transmission and The sending of the generated result to a valid node or by replay is produced by the verifier and must obviously remain secret.

[0049] The invariant nature of the measured program's hash and signature exposes the verifier to confidentiality attacks aimed at extracting the reference signature it will use for its comparison test. Finally, at the end of the attestation cycle, the verification routine generates a single-bit test result (positive or negative). The result of this test can be manipulated by the attacker if the comparison routine is identified and exposed to modification. Thus, the entire attestation process is bypassed by directly attacking the result.

[0050] In conclusion, the state of the art provides various schemes for securing verification, either by locating it in a secure location or by integrating it into a trusted execution environment (i.e., TEE). The denial-of-service risks associated with concentrating the function in a single location have also led to numerous experiments in distributing the verification function and, in particular, in mutual attestation schemes in which the verification and measurement functions are present in all nodes.

[0051] State of the art on the certification of software whose fingerprint varies

[0052] Varying the footprint of a software program can be part of a defense against certain attacks, breaking the conditions for the attack to succeed. Emblematically, the Address Space Layout Randomization (ASLR) process, used in recent operating systems, produces a separate memory allocation each time an application is loaded by the processor, remedying buffer overflow attacks and control flow bypass attacks. This memory rearrangement violates the principle of attestation by rendering a reference measurement of the software program obsolete. However, the memory allocation mechanism produces a sequencing of the software program's functions without altering them. The instructions are therefore translated as a whole by modifying the memory addresses by the same increment. In A. Cabutto et al.In their 2015 work, Software Protection with Code Mobility, the authors reconcile the mobility of functions in memory with the possibility of establishing an attestation measure by reducing the measured scope to functions considered individually. Reference measures are restricted to functions. The attestation routine has the necessary means to locate them for the production of the corresponding measures. It should be noted that the reference measures correspond to a scope that remains unchanged by the attestation. The attestation focuses on functions considered individually whose fingerprints have not changed, thus remaining within the classic framework of invariance of the measured fingerprint.

[0053] The ASLR aims to counter attacks of a different type than TOCTOU type attacks targeting the attestation.

[0054] The page reconstruction attack can be carried out as soon as the reallocated pages of the software program are loaded into memory. Since these pages no longer change after being loaded, they will be retrieved and copied into memory by the attacker.

[0055] To our knowledge, whatever the type of attestation implementation, including those integrating agents into the operating system, none of them modify the fingerprint before the measurement, in a controlled and anticipated manner, and carried out at the very moment the measurement is produced. Summary of the invention

[0056] The method according to the invention addresses the problem of page reconstruction attacks for software attestation implementations. Its scope covers complete or partial measurements of the program's fingerprint by a measurement agent or by the software program itself (i.e., "self measurements"). To this end, the method proposes to break with the general approach based on the constancy of the program's fingerprint once loaded by the processor, by modifying it during the measurement process in such a way that the modified fingerprint allows the measurement to be performed as expected by the verifier, that is, the reference measurement. Conversely, any program fingerprint retrieved prior to the measurement does not correspond to the expected measurement.

[0057] In practice, a critical element of attestation solutions is the provision and securing of reference measurements for the verifier. As discussed previously, modifying the fingerprint requires that the modified fingerprint correspond to the modified state. The invention provides various technical solutions to this problem, notably by allowing the verifier to generate the reference measurement of this modified state independently. In a particular embodiment of the invention, static measurements from an external source are used. This embodiment proposes modifying the program's fingerprint as soon as it is loaded into memory and producing a reverse modification before the measurement.

[0058] In light of the foregoing, the invention relates to a method for attesting a software program, comprising steps according to which:

[0059] a software program execution environment is provided comprising

[0060] a processor,

[0061] volatile memory,

[0062] an operating system, and

[0063] a measuring agent,

[0064] a checker is provided,

[0065] For execution of the software program by the processor, the operating system loads executable pages of the software program into volatile memory, the content of which constitutes a fingerprint of the software program,

[0066] The fingerprint of the software program loaded into volatile memory is modified at the initiative of the verifier, the measuring agent, or the operating system.

[0067] The measurement agent executes a measurement function to obtain a measurement of the modified footprint of the software program,

[0068] the measurement of the modified footprint of the software program is transferred to the verifier,

[0069] the verifier obtains a reference measurement of the modified footprint of the software program, this reference measurement being deemed correct,

[0070] The verifier compares the measurement of the modified footprint of the software program in the volatile memory transferred to it with the reference measurement of the modified footprint, to obtain a comparison result, and

[0071] Integrity of the software program is attested if the comparison result shows that the two measurements are identical.

[0072] Advantageously, the execution environment of the software program is supported by a software program platform and according to which the verifier is contained in a remote platform, located outside the software program platform; - the footprint of the software program is returned as soon as the measurement is performed to its state before the production of the measurement; - the measurement agent is contained in the software program, the verifier generates the measurement function, the verifier sends the measurement function to the measurement agent, and the measurement agent is modified by the insertion of the measurement function; - the method is applied to a plurality of attestations, and according to which the measurement function differs for each attestation;- The measurement agent has a writable and executable memory buffer. This memory buffer allows for the direct insertion or construction of instructions from the measurement function, followed by a transfer of execution from the measurement agent to the buffer to execute instructions either directly or by reconstructing the instructions during the execution of the measurement agent; - The memory buffer is returned to its initial state after the measurement is performed; - The memory buffer is loaded with content predefined by the verifier and different from the measurement function after the measurement is performed; - The measurement only covers a limited part of the software program; - The agent or the verifier is integrated into and functions of the operating system within the software program's execution environment;- at the initiative of the verifier or the measurement agent, the software program's fingerprint in volatile memory is modified at launch or during a first phase of software program execution, and according to which the program's fingerprint is modified a second time in order to recover the software program's fingerprint. ; BRIEF DESCRIPTION OF THE FIGURES

[0073] The invention will be better understood upon reading the following non-limiting description, drawn up with reference to the accompanying drawings, in which:

[0074] [Fig. 1] Fig. 1 schematically illustrates a particular embodiment of the invention in which the modification of the program's footprint is based on modifications made to the buffer, namely a memory area open for writing and reading accessible to the measurement agent, which loads the verifier's measurement function. These modifications can result from retrieving the measurement function produced by the verifier or from creating it by the agent upon receiving data produced by the verifier. This figure ultimately shows the perimeter of the memory footprint measured by the measurement function, which corresponds to the entire software program, thus including the agent and its buffer.

[0075] [Fig.2] [Fig.2] shows the sequence of the different operations performed by the verifier and agent, in the particular embodiment of [Fig.1]. The sequence covers the operations of a complete certification cycle.

[0076] [Fig.3] Fig.3 schematically illustrates a particular embodiment in which the Modifications to the program's footprint extend beyond the agent's control, and this occurs when the agent is located outside the program being measured. The diagram illustrates a typical sequence of operations performed by the agent upon receiving synchronization data and / or selecting the measurement to be taken. The agent can integrate with the operating system of the software program's execution environment.

[0077] [Fig.4] [Fig.4] schematically illustrates the verifier and its interfaces with the measuring agent, and a remote provisioning service. The figure shows the verifier's ability to produce the modified reference measurement, either by using the elements available locally or by exchanging them with the remote service.

[0078] [Fig. 5] [Fig. 5] schematically represents the perimeter of the measurement when it only relates to a sub-part of the software program and in particular the scope of this measure to understand the modification of the measured footprint.

[0079] [Fig.6] [Fig.6] schematically illustrates the embodiment consisting of the double modification of the imprint allowing a measurement to be taken on the original imprint. DETAILED DESCRIPTION OF THE INVENTION

[0080] The method according to the invention proposes to generate, in a transient, possibly ephemeral way, a modification of the program's footprint during measurement.

[0081] The invention relates to a local or remote attestation of a software program, a security service enabling verification of its conformity with a measure of The invention proposes a modification of the fingerprint to counter page reconstruction attacks using the content of the fingerprint retrieved prior to the measurement. It applies to all software attestation implementations, whether or not they use a hardware device, and whether they are performed remotely or locally.

[0082] Transitional certificate and modification of the imprint during measurement

[0083] To counter page reconstruction attacks, the invention modifies previous schemes by breaking the principle of program measurement invariance. The invention transiently, and possibly ephemerally, modifies the program footprint during the measurement itself. Once the measurement has been performed on the modified footprint, it can advantageously be restored to its state prior to the measurement.

[0084] The measurements carried out according to the method of the invention may relate to a partial footprint of the software program.

[0085] Different embodiments are possible and differ in the location(s) of the software for modifying the imprint and for measurement, whether grouped together or separated within the software being measured or outside of it. In all cases, the measurement and imprint modification operations are synchronized so that the measurement is performed on the imprint in its modified state. While the invention allows for all the aforementioned embodiments, those embodiments combining the two operations of measuring and modifying the imprint in a single software program designed for their synchronization are preferred for ease of implementation. A description of this preferred embodiment is given below.

[0086] It should be noted that the verification of the measured indentation is carried out by comparison with a reference deemed correct and which must correspond to the modified indentation. In the event that the measured indentation and the type of measurement vary over time, the verifier must be provided, in a synchronized manner, with the means of obtaining reference measurements corresponding to the variations in the indentation and the type of measurement.

[0087] In practice, the preferred embodiment is one in which the verifier initiates the measurement, knowing the measurement function that it will send or command to the measurement agent. By knowing the program being measured, it can have its reconstructed fingerprint, that is, a representation of it including the addresses and contents of the memory pages of the software program as loaded by the processor. This reference fingerprint can be provided by an external supply service or held internally.

[0088] With the reconstructed footprint and the measurement function, the verifier can produce the reference measurement that he will use for comparison. An alternative is to obtain or retrieve measurements from an external supply service. reference data. Various centralized or distributed structures, such as a blockchain, enable the external provisioning of these elements. In another embodiment, the measurement agent, or the operating system, spontaneously initiates the measurement process, which includes prior modification of the hash. The verifier can be informed in various ways about the type of measurement and the prior hash modification, notably by the agent or operating system simultaneously transmitting to the verifier, during the measurement, elements characterizing the type of measurement and the modification made before the measurement.

[0089] As mentioned above, another mode of use of the invention proposes to produce a modification of the program footprint when it is loaded into memory and an inverse modification of the footprint when the measurement results in the measurement being carried out on the original footprint. Preferred methods of implementation

[0090] The preferred embodiments address the problem of synchronization between the modification of the imprint and the performance of the measurement, favoring the embodiment where the verifier initiates the attestation process.

[0091] The method according to the invention proposes integrating a measurement agent into the program being measured. During the measurement process, the measurement agent is loaded with a measurement function. The modification of the measurement footprint occurs when the measurement function, incorporating the measurement scope, is inserted into the measurement agent. Additionally, the initial footprint can advantageously be restored by erasing the measurement function or replacing it with data after the measurement, leaving no trace on the measurement function and therefore on the measured footprint after the measurement has been performed. This first embodiment thus proposes inserting, into the measurement agent, a memory buffer that is open for both writing and execution, and which is loaded by the measurement function when the verifier requests confirmation.This can contain a sequence of instructions or, alternatively, data necessary and used by the agent to construct this sequence of instructions itself.

[0092] In the first embodiment, the generation of the measurement function can be performed by the verifier. It can result from a pseudo-random construction of the instruction sequence, initiated by a random number generated by the verifier and resulting in a sequence of instructions and data constituting the measurement function. These instructions produce a collection of pages from the program's footprint, then a hash of these program pages, potentially taken in a random order and modified by logical operations of all types (e.g., addition or exclusive OR). The instruction sequences used can also be selected from a set of combinations of iso-functional instructions, such as those provided by obfuscation solutions.

[0093] In a second embodiment, the measurement function can result from a dynamic construction by the measurement agent, using data transmitted during the measurement by the verifier. The measurement agent can directly execute the measurement function once it has been constructed and loaded into the buffer.

[0094] These two embodiments ensure, by construction, the consistency and synchronization of the operations of modifying the footprint and measuring on this footprint, it being noted that, in both cases, the measurements are produced by the measurement function where it has already modified the footprint by its presence, that is to say in the buffer integrating the perimeter of the agent, itself integrating the measured perimeter.

[0095] A third embodiment proposes placing a measurement agent located outside the software program, which coordinates the operations of performing a total or partial modification of the footprint and then measurement. The agent may optionally be integrated into the operating system of the execution environment.

[0096] The fingerprint modifications may include an isofunctional replacement of instruction sequences, or a rearrangement of the memory addresses of the various program functions. This embodiment requires controlling the program's control flow, interrupting it, retrieving the program's execution context (i.e., the processor registers), inserting the program modifications, and then restarting the program with its execution context retrieved from the breakpoint. Once the modification is made, the agent can then produce and send its measurement. As explained above, it will be necessary to ensure synchronicity between the total or partial modification of the fingerprint and the provision or calculation by the verifier of the reference measurement corresponding to the fingerprint modifications.

[0097] Certification process resulting in a modification of the fingerprint before measurement

[0098] The invention provides a purely software-based and principled response to TOCTOU page reconstruction attacks, for software implementations of local or remote attestation of a software program.

[0099] To achieve this, it implements the principle of a transient, possibly ephemeral, modification of the program's footprint during the attestation measurement, thus breaking with the invariant nature of the memory footprint of the program being measured. This consequently creates the need for synchronization of the footprint modification, footprint measurement, and verification operations, ensuring the footprint is correctly referenced.

[0100] A first embodiment is described in [Fig. 1]. The agent is an integral part of the software program, which is modified for this purpose, notably and in particular, by automatic modification operations of the program's executable file to insert this agent. The agent includes a memory area open for writing and execution (i.e., the memory buffer), which receives the measurement function sent to it by the verifier. This function is a sequence of instructions whose execution performs the measurement. This sequence of instructions can either be directly generated and transferred by the verifier or result from a construction based on data previously loaded into the agent's buffer and using data provided by the verifier when requesting certification from the agent.This data can be a cryptographic element used to decode and transform the data already present in the agent into encrypted form, resulting in the desired sequence of instructions. The construction of the payload's instruction sequence always results from the execution of the agent. The agent's measurement will cover the entire software program, including the agent's own instructions and those specifically generated for the measurement function. The measurement is executed as soon as it is placed or completed in the buffer. Any program hash recovered by the attacker prior to the measurement function's execution, and not containing the measurement function's instructions, cannot be used.After the measurement is performed, the memory buffer can be reset to its initial state or loaded with a predefined value known to the verifier before the measurement was taken, thus eliminating any trace for subsequent analysis of the software by the attacker. Figure 1 shows the case where the verifier is located in a different execution environment than that of the software program, resulting in remote attestation. Integrating the verifier into the software program's execution environment results in local attestation. Integrating the verifier into the software program results in self-attestation.

[0101] Fig. 2 describes the sequence of operations and the collaboration between the verifier and the measuring agent.

[0102] A second embodiment is shown in [Fig. 3], with an agent external to the program being measured but possessing intrusive means of controlling the program's execution and its memory pages. In this extreme and theoretical case, the agent can intercept the control flow, block execution, retrieve the execution context, modify program pages, perform the measurement on the entire program (including the modified pages), and launch the modified program with the modified execution context. The agent can be integrated into the operating system's perimeter, the program being measured, or be located outside of them.

[0103] Figure 4 illustrates the operation of the verifier. The verifier comprises software instructions, a storage space potentially containing software program fingerprints, reference measurements, and measurement functions. The verifier is potentially interfaced with an external provisioning service that delivers reference measurements, fingerprints, and measurement functions. The verifier is also interfaced with measurement agents. In the preferred embodiment, the verifier initiates the attestation request. To generate the measurement function, it can refer to its storage space or submit a request to the external provisioning service. It transmits the measurement function itself, or an element enabling the agent to construct this measurement function, to the agent before it is loaded.The verifier can retrieve the reference measurement from its storage space or by establishing an exchange with the external supply service, or calculate it using the program's fingerprint and the applied measurement function. When the measurement agent initiates the attestation, the verifier can retrieve, particularly upon receipt of measurements, the additional information transmitted by the agent that characterizes the measurement function and / or the modification of the fingerprint performed.

[0104] Figure 5 schematically illustrates the implementation of partial measurements. The various embodiments described, when the measurement covers the entire footprint of the program, are possible, while respecting the principle of modifying the measured footprint before it is measured. The measured footprint must therefore include the part modified by the measurement. This can be the modified restricted portion or, alternatively, the agent. In the first case, the measured footprint is only the sub-part of the software program. In the second case, the measured footprint corresponds to the combination of restricted portions of the software program and the measurement agent. The figure shows the measurement agent within the software program. The latter may be external and possibly integrated into the operating system.

[0105] Figure 6 shows the flow of operations implemented to enable the exploitation of the invention by performing a measurement on the original footprint of the software program, through a double modification of the footprint, the second modification being the inverse of the first. The first modification is performed during the loading phase or at the launch of the software program. The second modification is performed just before the measurement.

Claims

Demands

1. A method for attesting to a software program, comprising steps in which: a software program execution environment is provided, including a processor, volatile memory, an operating system, and a measurement agent; a verifier is provided; for execution of the software program by the processor, the operating system loads executable pages of the software program into volatile memory, some of whose contents constitute a fingerprint of the software program; the fingerprint of the software program loaded into volatile memory is modified at the initiative of the verifier, the measurement agent, or the operating system; the measurement agent executes a measurement function to obtain a measurement of the modified fingerprint of the software program; the measurement of the modified fingerprint of the software program is transferred to the verifier; the verifier obtains a reference measurement of the modified fingerprint of the software program.Assuming this reference measurement is correct, the verifier compares the measurement of the modified software program's footprint in the volatile memory transferred to it with the reference measurement of the modified footprint, to obtain a comparison result, and the integrity of the software program is attested if the comparison result shows that the two measurements are identical, the measurement only covering a limited part of the software program.

2. The method according to claim 1, wherein the execution environment of the software program is carried by a software program platform and wherein the verifier is contained in a remote platform, located outside the software program platform.

3. The method according to either of claims 1 or 2, wherein the software program footprint is restored to its state before the measurement is produced as soon as the measurement is carried out.

4. The method according to any one of the preceding claims, wherein the measuring agent is contained in the software program, the verifier generates the measuring function, the verifier sends the measuring function to the measuring agent, and the measuring agent is modified by the insertion of the measuring function.

5. The method according to any one of the preceding claims, applied to a plurality of attestations, and according to which the measurement function differs for each attestation.

6. The method according to any one of the preceding claims, characterized in that the measuring agent is provided with a writable and executeable memory buffer, the memory buffer allowing direct insertion or construction of instructions of the measuring function, and then a transfer of execution from the measuring agent to the buffer to execute instructions either directly or by reconstructing the instructions during the execution of the measuring agent.

7. The method according to claim 6, wherein the memory buffer is returned to its initial state, after the measurement has been carried out.

8. The method according to claim 6, wherein the memory buffer is loaded with a predefined content by the verifier and different from the measurement function, once the measurement has been carried out.

9. The method according to any one of the preceding claims, whereby the agent or the checker are integrated and are functionalities of the operating system of the software program execution environment.

10. The method according to any one of the preceding claims, wherein, at the initiative of the verifier or the measuring agent, the fingerprint of the software program in volatile memory is modified at launch or from a first phase of execution of the software program and wherein the fingerprint of the program is modified a second time and so as to recover the fingerprint of the software program.

Images