# Trusted GNSS-Based Time Synchronization for Industry 4.0 Applications
## 4 Trusted Computing
### Integrity Measurement Architecture (IMA)
An excerpt of the output of the command showing the IMA log is as follows:

pidraspberrypi:-/s sudo cat/sys/kernel/security/ima/ascii_runtime_measurements

10 03 eb317e687 bd21e360e257 bd4810f8 ac71 fbt4c ima 9797 ed8d0 eed36b1 cf92547816051c8 af4e4 eee boot_aggregate

11 110984f14 fc70c87f90053612c37 eea068f6646 ima 339c49d101 df1c25731 df3 df30d0880173e3456 cc/lib/systemd/systemd

10 bc447 bde2e47d6455644 dbcf9187e92418f02 ba ima 369c4027e9b09131e6971 ee963 bf37d41 dc251c/lib/arm-linux-gnuebahf/ld-2.28.so

10 c35b0d4b3a5b64f125 dd46958237a123 eefefe? ima 9e7916b2932f7 db4 cf863a65881e0253c0285/etc/ld.so.preload

10 26 bbf916638 fd64c452484 ddc48d91c32913b53b ima 77a35d26c2817e4c6 df2512f10446 cf1640/usr/local/sbin/ptpd2

10 d5297919 ea0 fe1 cdecec53 bf2546d3b076e95f8 ima b526 bd78d18258929e2 cd26 cd821c47 abc10912/home/pi/PTPd/ptpd2.slave.conf

The last two rows are related to the pptpd executable file and to its configuration file installed in the Slave 4 and Slave 5 nodes, including their full path names. An excerpt of the whitelist file is the following:

b526 bd78d18255929e2c2d2 ccd821c47 abc10912/home/pi/PTPd/ptpd2.slave.conf

77a352d6c2817e46c4672512f10446 cf1d6e0/usr/local/sbin/ptpd2

01a2 eb892b3423e30 ef9b42e23994649073/usr/local/sbin/tpm2-abmd

b559477c2 ee8b999272d026882922 ea8647e/usr/local/bin/ima_boot_aggregate

fabb6 bd28f788395c37e470a51 cf2d6d308f4c/usr/local/bin/ima_measure

a931585873b9f2 becbba68641b5a2d566 ff678f /usr/local/bin/ima_map

20436 ac9 bbf6 eeee35 fbc3 fd08b4c845578 df0/usr/local/bin/ra_build_white_list

Looking at the first two rows of the whitelist, we can appreciate that the digest values for both the configuration file and the pptpd executable are consistent with the corresponding values of the previous IMA log. At this point, we simulate the previous Attack 1 (i.e., an unauthorized SW modification) by stopping the PTP daemon, replacing the pptpd executable with a maliciously modified version, and then running it with the nominal configuration, as follows:

pidraspberrypi:-/sudo killall pptd2 pi@raspberrypi:-/sudo cp -/PTPdm/ptpd/arc/ptpd2 /usr/local/sbin/ptpd2 pi@raspberrypi:-/sudo pptpd2 -/home/pi/PTPd/ptpd2.slave.conf

These commands trigger new IMA measurements, which result in the following records appended to the IMA log:

10 2e8a62501 ac82d1b51f073d019d5e6d41e5995 cf ima e1299122 fc1 dfdb0707a96 bf6b6b79273278c941a /usr/bin/kill

10 c7 fbe7019734 bd0d65 dc0 eb8407923b50d9b03 ima 19e940258 bfba5 cc25e66c73 bb0d793949583a1c /home/pi/PTPd/ptpd/src/ptpd2

10 c57611 efea3a69a0b07a912 dd30778 dfc8 ef725 ima 19e940258 bfba6 cc25e66c73 bb0d793949583a1c /usr/local/sbin/ptpd2

By comparing the IMA log and the whitelist, the attack is immediately detected, as the digest for pptpd in the former is different from the new digest in the latter. At the end of that test, we restore the original pptpd and reboot both the Slave nodes in order to return to the nominal synchronization of all the nodes. Then, we can emulate the Attack 2 (i.e., an unauthorized modification on the configuration file).