An Approach for Sensitive Binary File Protection

When a host computer is attacked, files in the host computer are more or less unauthorizedly modified so as to achieve attacker's goal. Based on trusted computing technology, we present a trusted computer based approach for sensitive binary files protection. Different from traditional methods, our approach does not based on "condition-code", "intrusion-rule" and so on. It is checksum-based: each time before a sensitive binary filepsilas running, the kernel captures its running request first. And then the kernel calculates and compares its current hash, for example, SHA-1, against the expected one stored in the trusted platform module (TPM) in advance. If the comparison passes, the running request granted. Otherwise denied and the maliciously tampered file will be automatically recovered.