A Model-Based Fuzz Framework to the Security Testing of TCG Software Stack Implementations
Yang Yang, Huanguo Zhang, Pan Mi, Jian Sheng Yang, Fan He, Li Zhide · 2009
Fuzz testing is an effective technique for finding security vulnerabilities in software. Traditionally fuzz testing tools use random inputs and watch the resulting values. In this paper, we present a model-based fuzz framework for systematic automated testing of a TCG trusted software stack implementation. This framework is based on blackbox fuzz testing methods, integrated with target profiling, data modeling and test algorithm etc. With the generation of smart, semantic-aware test cases, a more complete and deep testing can be provided. We also demonstrate the use of our model-based fuzz framework which can identity several vulnerabilities in some form of TSS implementation.