Abstract: Dynamic trusted measurement is a hot and difficult research topic in trusted computing. Concerning the measurement difficulty invoked by the dynamic nature of operating system kernel, a Dynamic Trusted Kernel Measurement (DTKM) model was proposed. Dynamic Measurement Variable (DMV) was presented to describe and construct dynamic data objects and their relations, and the method of semantic constraint was proposed to measure the dynamic integrity of kernel components. In DTKM, the collection of memory data was implemented in real-time, and the dynamic integrity was verified by checking whether the constructed DMV was consistent with semantic constraints which were defined based on the security semantics. The nature analysis and application examples show that DTKM can effectively implement dynamic measurement of the kernel and detect the illegal modification of the kernel dynamic data.

Key words: trusted computing, trusted measurement, dynamic measurement, operating system kernel, remote attestation

摘要： 动态可信度量是可信计算的研究热点和难点，针对由操作系统内核动态性所引起的可信度量困难问题，提出一种操作系统内核的动态可信度量模型，使用动态度量变量描述和构建系统动态数据对象及其关系，对内核内存进行实时数据采集，采用语义约束描述内核动态数据的动态完整性，通过语义约束检查验证内核动态数据是否维持其动态完整性。给出了模型的动态度量性质分析与证明，模型能够有效地对操作系统内核的动态数据进行可信度量，识别对内核动态数据的非法篡改。

关键词: 可信计算, 可信度量, 动态度量, 操作系统内核, 远程证明