Design of an Integrity
Measurement Architecture

Our integrity Measurement architecture consists of three major components:

• The Measurement Mechanism on the attested system determines what parts of the run-time environment to measure, when to measure, and how to securely maintain the measurements.
• An Integrity Challenge Mechanism that allows authorized challengers to retrieve measurement lists of a computing platform and verify their freshness and completeness.
• An Integrity Validation Mechanism, validating that the measurement list is complete, non-tampered, and fresh as well as validating that all individual measurement entries of runtime components describe trustworthy code or configuration files.

Figure 2 shows how these mechanisms interact to enable remote attestation. Measurements are initiated by so-called measurement agents, which induce a measurement of a file, (a) store the measurement in an ordered list in the kernel, and (b) report the extension of the measurement list to the TPM.

Figure 2: TPM-based Integrity Measurement

The integrity challenge mechanism allows remote challenger to request the measurement list together with the TPM-signed aggregate of the measurement list (step 1 in Fig 2). Receiving such a challenge, the attesting system first retrieves the signed aggregate from the TPM (steps 2 and 3 in Fig 2) and afterwards the measurement list from the kernel (step 4 in Fig 2). Both are then returned to the attesting party in step 5. Finally, the attesting party can validate the information and reason about the trustworthiness of the attesting system's run-time integrity in step 6.