Trusted Integrity Measurement and Reporting for Virtualized Platforms

Trusted Computing (TC) is a technology developed and promoted by the Trusted Computing Group (TCG), and aims to enhance the overall security, privacy and trustworthiness of a variety of computing devices. The core of the trusted computing technologies of TCG is the Trusted Platform Module (TPM), a tamper-resistant module embedded in a platform, which is implemented by a TPM chip and designed to resist software attacks and moderate hardware attacks. TPM includes non-volatile storage, a set of Platform Configuration Registers (PCRs) and an engine for cryptographic operations. Based on TPM and TCG Software Stack (TSS), a suite of mechanisms can be realized, including memory curtaining, protected execution, secure I/O, sealed storage, platform measurement and remote attestation. As a fundamental secure computing module, TPM is the root trust module to establish security and trust in digital computing, communication and networking. Basically, it can support secure booting and trustworthy software installation, private data protection and Digital Rights Management (DRM), as well as remote attestation- based trusted communications and collaboration. There is significant research currently in the field of trusted computing, in both academia and industry. Recent efforts focus on TC module development and extension, trustworthy software assurance, Trusted Execution Environment (TEE), trusted collaboration and trusted storage. The recent advance of Intel Software Guard Extensions (Intel® SGX) offers hardware-assistant TEE, which allows user code execution in a private region of memory, called enclave, in an untrusted third party. This technology attracts special attention and motivates innovations of many applications.

Trusted Platform Module (TPM) is a key component designed to enable computers achieve greater security. Several vulnerabilities discovered in the TPM highlight the necessity of formal analysis. The procedure invoking an API may be regarded as several interactive processes between the TPM and a user. As a result, the current study formalized the API specifications proposed by Trusted Computing Group (TCG) using applied pi calculus. Meanwhile, two authentication properties between them were also described in a formalized way. With the help of the tool ProVerif, the flaw of the command TPM_CertifyKey was discovered. It was also confirmed on the TPM emulator. Subsequently, the modified API was presented and its authentication properties could be satisfied after verifying again. Results show the model is valid. DOI: http://dx.doi.org/10.11591/telkomnika.v11i2.2034

3 - Overview of the TPM Architecture

As the platform mobility increases, it becomes increasingly susceptible to theft. Stolen data is often regarded as being more valuable than the notebook hardware itself. Thus, the need to protect user data and secrets is underscored in a mobile computing environment. The Trusted Platform Module (TPM) is defined as a hardware instantiation which has been proposed by the TCG (Trusted Computing Group) for trust computing. TPM offers facilities for the secure generation of cryptographic keys, and limitations on their use, in addition to a hardware pseudo-random number generator. It also includes capabilities such as remote attestation and sealed storage. A TPM can be used to authenticate hardware devices. Since each TPM chip has a unique and secret RSA key burned in during production, it is capable of performing platform authentication. The TPB (Trusted Platform Board) is an expansion of the TPM for enhancing the efficiency and usability of the TPM chip. In addition to the TPB functions supporting high-standard trust environments within the hardware standard of the system in this paper, we develop the v-TMS (Visual Trustworthy Monitoring System) that provides visualization of real-time monitoring for the behavior of system resources (process, memory, network, users, etc.) with TPB and system software for hardening of OS and applications. Moreover, v-TMS is not only a web-based computing environment for system resources but also a real-time monitoring system for a trust computing environment.

Trusted computing (TC) is considered to be one of the newly developed technologies on improving computer security and creating a trustworthy environment. Although the Trusted Computing Group (TCG) has defined specifications/or TC, including that of trusted platform module (TPM), criteria on compliance testing is still not available. It is important that the design and implementation of TPM and other components follow the specifications, as incompliance may lead to crucial security impacts. In this paper, a test mechanism checking TPM commands is instrumented into TPM application, so that conformance to standards can be examined before TPM's functional execution to validate its compliance with the specifications. Furthermore, this paper also initially puts forward the concept of "chain of compliance", which enhances the trustworthiness of computing platforms by verifying the conformance of their components.

<p>A computer hijacked by a malware may pretend that it is normal as usual and retrieve secrets from storage of itself and other victim computers. By adopting trusted computing technology a computer’s former health status cannot be forged. Computers can thus detect the change of health status of a hijacked computer and prevent the leakage of the secrets. As Trusted Computing Group (TCG) proposed Trusted Platform Module (TPM) specification, IBM implemented software TPM (sTPM) and utilities for engineer who wants to learn the operating principle of TPM. Meanwhile, the blooming of tiny size, but powerful, computers, e.g. Raspberry Pi 2 (Rpi2), attract ones to develop some dedicated applications on the computers. In this article, we report the verified steps for installing new sTPM version on RPi2. After the installation, we also test the functionality and evaluate the performance of the sTPM with some major TPM Commands. The real behaviour of and the traffic between the host computer and the emulated TPM can thus be learned easily.</p>

Cloud computing platforms constructed on Trusted Computing Technology are commonly referred to as trusted cloud computing. The core component of this technology is known as Trusted Platform Module (TPM). Its specifications are given by the consortium known as Trusted Computing Group (TCG). Though TPM is an immovable module and is fixed inside any computer, yet its credentials can be shared with other devices. This paper presents the accessibility model for Virtual Machine (VM) of a distributed trust protocol which is based on TPM, through which consumer's credentials are shared to other trusted devices. These credentials essentially describe the integrity of VM.

This paper describes the direct anonymous attestation scheme (DAA). This scheme was adopted by the Trusted Computing Group (TCG) as the method for remote authentication of a hardware module, called Trusted Platform Module (TPM), while preserving the privacy of the user of the platform that contains the module. DAA can be seen as a group signature without the feature that a signature can be opened, i.e., the anonymity is not revocable. Moreover, DAA allows for pseudonyms, i.e., for each signature a user (in agreement with the recipient of the signature) can decide whether or not the signature should be linkable to another signature. DAA furthermore allows for detection of known keys: if the DAA secret keys are extracted from a TPM and published, a verifier can detect that a signature was produced using these secret keys. The scheme is provably secure in the random oracle model under the strong RSA and the decisional Diffie-Hellman assumption.

: The design of a trusted system based on the Trusted Computing Group's Trusted Platform Module (TPM) was analyzed to understand the role and trust relationships of the TPM, firmware, and software modules involved. The objective was to confirm that the measurements stored and reported by the TPM can successfully discriminate a normal boot sequence, which leaves trusted system software in control, from an insecure one, where some trusted modules might have been replaced by malicious ones. The principal tool used in the analysis was the SMV symbolic model checker.

To prevent unauthorized access to protected trusted platform module (TPM) objects, authorization protocols, such as the object-specific authorization protocol (OSAP), have been introduced by the trusted computing group (TCG). By using OSAP, processes trying to gain access to the protected TPM objects need to prove their knowledge of relevant authorization data before access to the objects can be granted. Chen and Ryan's 2009 analysis has demonstrated OSAP's authentication vulnerability in sessions with shared authorization data. They also proposed the Session Key Authorization Protocol (SKAP) with fewer stages as an alternative to OSAP. Chen and Ryan's analysis of SKAP using ProVerif proves the authentication property. The purpose of this paper was to examine the usefulness of Colored Petri Nets (CPN) and CPN Tools for security analysis. Using OSAP and SKAP as case studies, we construct intruder and authentication property models in CPN. CPN Tools is used to verify the authentication property using a Dolev---Yao-based model. Verification of the authentication property in both models using the state space tool produces results consistent with those of Chen and Ryan.

The Trusted Computing Group (TCG) has proposed the binary attestation mechanism that enables a computing platform with a dedicated security chip, the Trusted Platform Module (TPM), to report its state to remote parties. The concept of property-based attestation (PBA) improves the binary attestation and compensates for some of its main deficiencies. In particular, PBA enhances user privacy by allowing the trusted platform to prove to a remote entity that it has certain properties without revealing its own configuration.The existing PBA solutions, however, require a Trusted Third Party (TTP) to provide a reliable link of configurations to properties, e.g., by means of certificates. We present a new privacy-preserving PBA approach that avoids such a TTP. We define a formal model, propose an efficient protocol based on the ideas of ring signatures, and prove its security. The cryptographic technique deployed in our protocol is of independent interest, as it shows how ring signatures can be used to efficiently prove the knowledge of an element in a list without disclosing it.

An Advanced Trusted Platform for mobile phone devices

Direct Anonymous Attestation (DAA) has been adopted in Trusted Platform Module v 1.2 (TPM v1.2) Specification, described by Trusted Computing Group (TCG). It intends to solve the trusted platform attestation and the platform privacy protection. In DAA, the certificate can be used repeatedly and this will provide the opportunities for rogue TPMs to initiate the replay attacks. For identifying the rogue platform, DAA cannot but use a relatively fixed pseudonym rather than a random pseudonym, which would badly weaken the anonymity of the platform. To tackle this problem, a time-and-times-limited strong DAA (TTLS-DAA) scheme, which extends DAA by adding valid period of time and restriction of times into the certificate, is put forward. Since the pseudonym of the user platform is different for each attestation, TTLS-DAA provides stronger anonymity. Being able to control the use of the certificate, it can be widely used in practice especially in commercial fields.

Efficient zero-knowledge proofs of knowledge (ZK-PoK) are basic building blocks of many practical cryptographic applications such as identification schemes, group signatures, and secure multiparty computation. Currently, first applications that critically rely on ZK-PoKs are being deployed in the real world. The most prominent example is Direct Anonymous Attestation (DAA), which was adopted by the Trusted Computing Group (TCG) and implemented as one of the functionalities of the cryptographic Trusted Platform Module (TPM) chip.Implementing systems using ZK-PoK turns out to be challenging, since ZK-PoK are, loosely speaking, significantly more complex than standard crypto primitives, such as encryption and signature schemes. As a result, implementation cycles of ZK-PoK are time-consuming and error-prone, in particular for developers with minor or no cryptographic skills.In this paper we report on our ongoing and future research vision with the goal to bring ZK-PoK to practice by making them accessible to crypto and security engineers. To this end we are developing compilers and related tools that support and partially automate the design, implementation, verification and secure implementation of ZK-PoK protocols.KeywordsSignature SchemeTrusted Platform ModuleKnowledge PropertyCryptology ePrint ArchiveSecure Multiparty ComputationThese keywords were added by machine and not by the authors. This process is experimental and the keywords may be updated as the learning algorithm improves.

Due to economic benefits of cloud computing, consumers have rushed to adopt Cloud Computing. Apart from rushing into cloud, security concerns are also raised. These security concerns cause trust issue in adopting cloud computing. Enterprises adopting cloud, will have no more control over data, application and other computing resources that are outsourced from cloud computing provider. In this paper we propose a novel technique that will not leave consumer alone in cloud environment. Firstly we present theoretical analysis of selected state of the art technique and identified issues in IaaS cloud computing. Secondly we propose Distributed Trust Protocol for IaaS Cloud Computing in order to mitigate trust issue between cloud consumer and provider. Our protocol is distributed in nature that lets the consumer to check the integrity of cloud computing platform that is in the premises of provider's environment. We follow the rule of security duty separation between the premises of consumer and provider and let the consumer be the actual owner of the platform. In our protocol, user VM hosted at IaaS Cloud Computing uses Trusted Boot process by following specification of Trusted Computing Group (TCG) and by utilizing Trusted Platform Module (TPM) Chip of the consumer. The protocol is for the Infrastructure as a Service IaaS i.e. lowest service delivery model of cloud computing.