TY - CONF T1 - BIND: a fine-grained attestation service for secure distributed systems Y1 - 2005 A1 - Elaine Shi A1 - Perrig, A. A1 - Van Doorn, L. KW - BIND KW - binding instructions and data KW - code attestation KW - data integrity KW - digital signatures KW - distributed processing KW - fine-grained attestation service KW - input data integrity KW - program verification KW - sandboxing mechanism KW - secure distributed systems KW - signature KW - time-of-attestation KW - time-of-use KW - transitive integrity verification KW - trusted computing AB - In this paper we propose BIND (binding instructions and data), a fine-grained attestation service for securing distributed systems. Code attestation has recently received considerable attention in trusted computing. However, current code attestation technology is relatively immature. First, due to the great variability in software versions and configurations, verification of the hash is difficult. Second, the time-of-use and time-of-attestation discrepancy remains to be addressed, since the code may be correct at the time of the attestation, but it may be compromised by the time of use. The goal of BIND is to address these issues and make code attestation more usable in securing distributed systems. BIND offers the following properties: (1) BIND performs fine-grained attestation. Instead of attesting to the entire memory content, BIND attests only to the piece of code we are concerned about. This greatly simplifies verification. (2) BIND narrows the gap between time-of-attestation and time-of-use. BIND measures a piece of code immediately before it is executed and uses a sandboxing mechanism to protect the execution of the attested code. (3) BIND ties the code attestation with the data that the code produces, such that we can pinpoint what code has been run to generate that data. In addition, by incorporating the verification of input data integrity into the attestation, BIND offers transitive integrity verification, i.e., through one signature, we can vouch for the entire chain of processes that have performed transformations over a piece of data. BIND offers a general solution toward establishing a trusted environment for distributed system designers. ER -