A Model-based Fuzz Framework to the Security Testing of TCG Software Stack Implementations

摘要：

Fuzz testing is an effective technique for finding security vulnerabilities in software. Traditionally fuzz testing tools use random inputs and watch the resulting values. In this paper, we present a model-based fuzz framework for systematic automated testing of a TCG Trusted Software Stack implementation. This framework is based on blackbox fuzz testing methods, integrated with target profiling, data modeling and test algorithm etc. With the generation of smart, semanticaware test cases, a more complete and deep testing can be provided. We also demonstrate the use of our model-based fuzz framework which can identity several vulnerabilities in some form of TSS implementation.

关键词： Trusted computing software security testing fuzz framework fault injection syntax model

作者: Yang Yang Huanguo Zhang Mi Pan Jian Yang Fan He Zhide Li

作者单位: 1School of Computer, Wuhan University, Wuhan, China 430072 School of Computer, Wuhan University, Wuhan, China 430072 State Key Lab of Software Engineering, Wuh School of Computer, Wuhan University, Wuhan, China 430072 Guangdong Dongguan Supervision Testing Institute of Quality and Metrology,Dongguan,China 523120

会议类型: 国际会议

会议名称: The First International Conference on Multimedia Information Networking and Security(第一届国际多媒体网络信息安全会议 MINES 2009)

会议地点: 武汉

会议语种:英文

页码: 149-152

在线出版日期: 2009-11-18（万方平台首次上网日期，不代表论文的发表时间）