US 8,799,447 B2Granted

Notarizing packet traces

AssigneeInternational Business Machines Corporation

InventorsDaniel Horacio Jones, Thomas Girard Lendacky, Emily Jane Ratliff

Life of this patent

Estimating the term…

Loading patent…

Abstract

A system and method for capturing non-forgeable packet traces. Upon start-up of a sniffer, a first quote of Platform Configuration Register (PCR) values in a Trusted Platform Module (TPM) utilized by the sniffer is obtained, wherein the first quote comprises a list of starting values in the PCRs and is signed by the TPM and stored in a packet log. When a packet of interest is intercepted by the sniffer, the sniffer obtains a hash of the packet and instructs the TPM to extend a PCR with the hash value. The packet of interest is then stored in the packet log. When the sniffer is shutdown, a second quote of values in the PCRs is obtained, wherein the second quote comprises a list of current values in the PCRs, and wherein the second quote is signed by the TPM and stored in the packet log.

Claims27

Dependent claims

A method implemented by a computer for capturing non-forgeable packet traces, the method comprising:

the computer, responsive to a start-up of a sniffer, obtaining a first quote of values in one or more platform configuration registers in a trusted platform module utilized by the sniffer, wherein the first quote comprises a list of starting values in the one or more platform configuration registers, and wherein the first quote is signed by the trusted platform module and stored in a packet log;
the computer, responsive to intercepting a packet of interest at the sniffer, obtaining a hash of the packet of interest;
the computer instructing the trusted platform module to extend a platform configuration register with the hash of the packet of interest by appending the hash of the packet of interest with the hash of the current value of the platform configuration register;
the extended value then rehashed to form a composite hash value for the platform configuration register;
the computer storing the packet of interest in the packet log;
and
the computer, responsive to a shutdown of the sniffer, obtaining a second quote of values in the platform configuration registers, wherein the second quote comprises a list of current values in the platform configuration registers, and wherein the second quote is signed by the trusted platform module and stored in the packet log.

4 more elements

A data processing system for capturing non-forgeable packet traces, the data processing system comprising:

a bus;
a storage device connected to the bus, wherein the storage device contains computer usable code;
at least one managed device connected to the bus;
a communications unit connected to the bus;
and
a processing unit connected to the bus, wherein the processing unit executes the computer usable code to obtain a first quote of values in one or more platform configuration registers in a trusted platform module utilized by a sniffer in response to a start-up of the sniffer, wherein the first quote comprises a list of starting values in the one or more platform configuration registers, and wherein the first quote is signed by the trusted platform module and stored in a packet log, obtain a hash of a packet of interest in response to intercepting the packet of interest at the sniffer, instruct the trusted platform module to extend a platform configuration register with the hash of the packet of interest by appending the hash of the packet of interest with the hash of the current value of the platform configuration register, the extended value then rehashed to form a composite hash value for the platform configuration register, store the packet of interest in the packet log, and obtain a second quote of values in the platform configuration registers in response to a shutdown of the sniffer, wherein the second quote comprises a list of current values in the platform configuration registers, and wherein the second quote is signed by the trusted platform module and stored in the packet log.

3 more elements

A computer program product for capturing non-forgeable packet traces, the computer program product comprising:

a non-transitory computer usable storage medium having computer usable program code tangibly stored thereon, the computer usable program code comprising:
computer usable program code for obtaining a first quote of values in one or more platform configuration registers in a trusted platform module utilized by a sniffer in response to a start-up of the sniffer, wherein the first quote comprises a list of starting values in the one or more platform configuration registers, and wherein the first quote is signed by the trusted platform module and stored in a packet log;
computer usable program code for obtaining a hash of a packet of interest in response to intercepting the packet of interest at the sniffer;
computer usable program code for instructing the trusted platform module to extend a platform configuration register with the hash of the packet of interest by appending the hash of the packet of interest with the hash of the current value of the platform configuration register, the extended value then rehashed to form a composite hash value for the platform configuration register;
and
computer usable program code for storing the packet of interest in the packet log;
and
computer usable program code for obtaining a second quote of values in the platform configuration registers in response to a shutdown of the sniffer, wherein the second quote comprises a list of current values in the platform configuration registers, and wherein the second quote is signed by the trusted platform module and stored in the packet log.

5 more elements

Dependencies are inferred from the claim text.