Abstract
This paper analyzes the problem of checking the integrity of files stored on remote servers. Since servers are prone to successful attacks by malicious hackers, the result of simple integrity checks run on the servers cannot be trusted. Conversely, downloading the files from the server to the verifying host is impractical. Two solutions are proposed, based on challenge-response protocols.
Chapter PDF
References
CERT Advisory CA-2002-24, Trojan Horse OpenSSH Distribution, August 1, 2002.
W. Diffie and M.E. Hellman, “New Directions in Cryptography”, IEEE Transactions in Information Theory, 22(1976), pp. 644–654.
T. Fraser, L. Badger and M. Feldman, “Hardening COTS Software With Generic Software Wrappers”, Proc. of IEEE Symposium on Security and Privacy, 1999, pp. 2–16.
John Green, David Marchette, Stephen Northcutt, Bill Ralph, “Analysis Techniques for Detecting Coordinated Attacks and Probes”, in Proc. 1st USENIX Workshop on Intrusion Detection and Network Monitoring, Santa Clara, California, USA, April 9–12, 1999, available at: <http://www.usenix.org/publications/library/proceedings/detection99/full_papers/green/green_html/>
Y. Huang, C. Kintala, N. Kolettis, N.D. Fulton, “Software Rejuvenation: Analysis, Module and Applications”, in Proc. 25th IEEE Symposium on Fault Tolerant Computing Conference (FTCS-25), Pasadena, CA, USA, June 1995, pp. 381–390.
M. Jones, “Interposition Agents: Transparently Interposing User Code at the System Interface”, Proc. 14th ACM Symp. on Operating Systems Principles, Operating Systems Review, 27[5], December 1993, pp. 80–93.
G.H. Kim and E.H. Spafford, The Design and Implementation of Tripwire: a File System Integrity Checker, Technical Report CSD-TR-93-071, Computer Science Dept, Purdue University, 1993.
Leslie Lamport, “Password Authentication with Insecure Communication”, Comunications of the ACM, 24(11), pp. 770–772, November 1981.
Vinícius da Silveira Serafim and Raul Fernando Weber, The SOFFIC Project, < http://www.inf.ufrgs.br/~gseg/projetos/the_soffic_project.pdf >.
A. Valdes, M. Almgren, S. Cheung, Y. Deswarte, B. Dutertre, J. Levy, H. Saïdi, V. Stavridou and T. Uribe, “An Adaptative Intrusion-Tolerant Server Architecture”, in Proc. 10th International Workshop on Security Protocols, Cambridge (UK), April 2002, to appear in Springer LNCS Series.
Author information
Authors and Affiliations
Editor information
Editors and Affiliations
Rights and permissions
Copyright information
© 2004 Kluwer Academic Publishers
About this chapter
Cite this chapter
Deswarte, Y., Quisquater, JJ., Saïdane, A. (2004). Remote Integrity Checking. In: Jajodia, S., Strous, L. (eds) Integrity and Internal Control in Information Systems VI. IICIS 2003. IFIP International Federation for Information Processing, vol 140. Springer, Boston, MA. https://doi.org/10.1007/1-4020-7901-X_1
Download citation
DOI: https://doi.org/10.1007/1-4020-7901-X_1
Publisher Name: Springer, Boston, MA
Print ISBN: 978-1-4020-7900-9
Online ISBN: 978-1-4020-7901-6
eBook Packages: Springer Book Archive