The integrity measurement is a task that takes place at different levels. First of all, the boot process up to the start of the VMM has to be measured. For that purpose, we employ the authenticated boot mechanism provided by the TCG, as discussed in Sect. II-A. Moreover, we employ TrustedGRUB to measure the VMM as well. The VMM proceeds with measuring the basic system. Within the basic system, we employ the Integrity Measurement Architecture (IMA), as discussedin Sect. II-A, to take measurements of all programs that are executed. As the manufacturer system is started, basically the same measurement procedure—made up by authenticated boot and IMA—is performed within that system. The main difference for that system is that the hardware TPM PCRs cannot be employed to store the hash values but the vTPM PCRs have to be used instead. When it comes to the start of the bank system, the measurements are performed again. As part of this procedure, the files of the security suite that is executed within the bank system are also measured. However, within the bank system—which will be a Windows system again—the employment of IMA is not possible as it is not available for Windows systems.