Abstract
Virtualization technologies have been explored to mitigate the vulnerabilities in the current TCG architecture. But only a small number of efforts address the handling of the detected TCG TOCTOU attacks. This paper aims to defeat TCG TOCTOU attacks occurring in Xen hardware virtual machines. We propose an efficient response approach (ERA) in the environment of the Xen virtual machine monitor and the virtual TPM facility shipped with the Xen. ERA has the following features: (1) Effective in defeating the TCG TOCTOU attacks; (2) Impose less overhead on the system during normal execution; and (3) Transparent to guest virtual machines. We describe the ERA implementation in detail and evaluate its ability via experiments.