Huanguo Zhang

A Model-Based Fuzz Framework to the Security Testing of TCG Software Stack Implementations

Fuzz testing is an effective technique for finding security vulnerabilities in software. Traditionally fuzz testing tools use random inputs and watch the resulting values. In this paper, we present a model-based fuzz framework for systematic automated testing of a TCG Trusted Software Stack implementation. This framework is based on blackbox fuzz testing methods, integrated with target profiling, data modeling and test algorithm etc. With the generation of smart, semantic-aware test cases, a more complete and deep testing can be provided. We also demonstrate the use of our model-based fuzz framework which can identity several vulnerabilities in some form of TSS implementation.

Dynamic Trustiness Authentication Framework Based on Software's Behavior Integrity

A dynamic trustiness authentication framework based on the integrity of softwarepsilas behavior is proposed in this paper. The method to extract SIBDS (Software Intended Behaviors Describing Sets) and SBAC (Software Behavior Authentication Code) from the binary executable is introduced. In the framework, when the software begin to run, it should be monitored by SBMC (Software Behavior Monitoring Center), then the real API function invoking sequence will be acquired. The framework uses the software behavior comparison algorithm to verify whether the API invoking sequence gotten from the actual behavior is in accordance with SBAC; thereby the softwarepsilas dynamic trustiness can be detected and guaranteed. The experiment results demonstrate the efficacy of the dynamic trustiness authentication framework.

Research and Security Analysis of Anonymous Identity Authentication in Trusted Computing

This paper introduces two anonymous identity authentication solution adopted by the Trusted Computing Group, i.e. privacy certification authority (Privacy CA) and direct anonymous attestation scheme (DAA). Both of the two solutions provide a means for remotely authenticating a trusted platform whilst preserving the user’s privacy. In this paper we give high level overview of DAA and focus on the analysis of security properties, such as pseudonymous authentication, random oracles and rogue tagging etc. We summarize the security and anonymity issues discovered recently and discuss a possible privacy flaw in the scheme that a colluding issuer and verifier can break anonymity to identify the real TPM. We also suggest possible way of fixing this weakness.

Design and Implementation of an Integrity Measurement System Based on Windows Trusted Computing Platform

This paper presents the design and implementation of an integrity measurement system based on Windows trusted computing platform. The trust chain is established from the BIOS up to the application layer, where the executable codes are taken the load-time measurements before execution. And the measurement system can generate an integrity proof for TPM-based remote attestation. In order to accurately reflect runtime integrity of critical applications, a light weight Clark-Wilson model is introduced for verify information flow integrity guarantee. Our experimental system strengthens the security posture of the platform. With the analysis of the tradeoff between performance and security, our system gives great consideration to the impact which the measurements cause to system performance.

A Fuzzing Framework Based on Symbolic Execution and Combinatorial Testing

In order to simulate the attacks at multi input points for the fuzzing, in this paper, we present a white-box combinatorial fuzzing framework based on symbolic execution and combinatorial testing. According to the attack attributes plug-in gained by means of static analysis in advance, our fuzzing framework exploits symbolic execution to collect constraint conditions of attack points where the program may contain an error and to identify the input vector that influence attack points and the constraint interval of every input in input vector, uses constraint solving or interval computation to identify the feasibility of attack points, applies combinatorial coverage strategies to searching interval combination of input vector for the feasible attack points, chooses corresponding strategies of test case generation to generate test case from the interval combination of input vector, and finally injects the combinatorial test case vector to find security vulnerabilities in programs according to the attack strategies in the attack attributes plug-in. Our experimental results indicate that our fuzzing framework can not only effectively expose errors located deep within large applications, but also can avoid the combination explosion to a certain extent.

A Test Method of Trusted Computing Supporting Software

With the rapid development of trusted computing technology, the security of computing environment for multifarious platforms has been enhanced by implementing both dedicated hardware and software. There is an increasing application of trusted computing platform with trusted computing supporting software (TCSS) providing support for the trusted platform module. Although many TCSS vendors claim that their products are compliant to trusted computing group (TCG) specifications version 1.1 or 1.2, it is difficult to find a feasible way to testify whether it is TCG compliant or not. In order to ensure the quality of TCSS, there is a need to test it according to the specification of TCG. This paper presents a test method of TCSS-firstly making security function division of TCSS based on the common criteria, then giving a model of testing TCSS, describing the concrete implementation of the testing prototype system, and finally testing a concrete TCSS product.