ODLV: On-Demand Lightweight Virtualization Based Trusted Network Connect Endpoint

We present ODLV: an on-demand lightweight virtualization mechanism to solve the "lying endpoint problem" in TCG-TNC. ODLV utilizes dynamic root of trust and virtualization technologies of new commodity processors from Intel and AMD to dynamically establish a chain of trust and to insert a Lightweight Virtual Machine Manager (LVMM) under commodity Operating System (OS). The LVMM protects itself and some Trusted Network Connect (TNC) components from the influence of the OS environment. Compared with the existing architectures, ODLV measures the endpoint with very small overhead and no modification to guest OS. In addition, ODLV has a very small Trusted Computing Base (TCB) and provides run-time measurement rather than the load-time measurement. We implement ODLV in Linux and our analysis and evaluation demonstrate that ODLV is effective and practical.