Rapid Trust Establishment for Pervasive Personal Computing

SECURITY & PRIVACY Rapid Trust Establishment for Pervasive Personal Computing Trust-Sniffer’s staged approach to establishing confidence in untrusted machines balances security and ease-of-use, facilitating rapid use of transient hardware. n the emerging Internet Suspend/Resume hardware use to become commonplace, users must mobile computing model,1–3 users exploit be able to quickly establish a similar confidence pervasive deployments of inexpensive, mass- level in hardware that they don’t own or manage. market PC hardware rather than carrying To address this problem, we’ve created Trust- portable hardware. ISR’s driving vision is Sniffer, a tool that helps users incrementally gain Ithat plummeting hardware costs will someday elim- confidence in an initially untrusted machine. inate the need to carry computing environments in Trust-Sniffer focuses on software attacks but portable computers. Instead, ISR will deliver an doesn’t guard against hardware attacks, such as exact replica of the last checkpointed state of a user’s modifying the basic I/O system. Potential defenses entire computing environment (including the oper- against hardware attacks include physical sur- ating system, applications, files, and customiza- veillance or the use of tamper-proof or tamper- tions), on demand over the Internet to hardware evident hardware. Although Trust-Sniffer is de- located nearby. So, ISR cuts the tight binding signed to safeguard mobile users, you can couple between PC state and PC hard- it with system operators’ security technologies, Ajay Surie, Adrian Perrig, ware. ISR is implemented by lay- such as full disk encryption, direct memory-access Mahadev Satyanarayanan, ering a virtual machine on dis- monitoring, and remote attestation. and David J. Farber tributed storage. The virtual Trust-Sniffer’s staged approach to establishing Carnegie Mellon University machine encapsulates execution confidence in an untrusted machine balances the and user customization; the dis- needs for security, usability, and speed (for a com- tributed storage transports that parison of Trust-Sniffer and other approaches, state across space and time. see the sidebar). In this new computing model, establishing trust in unmanaged hardware for transient use becomes Design overview a major issue. Today, when a user sits down at a Trust-Sniffer aims to enhance security with computer in the office or home, he or she implic- modest user effort. A key design principle, moti- itly assumes that the machine hasn’t been tampered vated by ISR’s unique characteristics, is to vali- with and that it doesn’t contain malware, such as date only the software a user needs for a task. a keystroke logger. This assumption is reasonable Specifically, most of a user’s execution environ- because unauthorized physical access to the ment is fetched from a trusted server over an machine is restricted. The same assumption applies authenticated, encrypted channel. This includes to a portable computer that the user physically the guest operating system and applications that safeguards at all times. For ISR’s vision of transient execute inside the user’s virtual machine. Cached 24 PERVASIVEcomputing Published by the IEEE Computer Society ■ 1536-1268/07/$25.00 © 2007 IEEE Figure 1. Trust-Sniffer’s staged approach to trust establishment. Initially, all Untrusted code Trusted application software is untrusted. (a) The trust Trusted code 1 initiator’s boot uses a minimal trusted operating system to validate the on-disk Minimal trusted OS Trusted host OS Trusted host OS OS. (b) Next, the trusted host OS is (from trust initiator) (from disk) (from disk) booted from disk, which validates Validate OS Validate application 1 applications as required. (c) The host OS only permits trusted applications to execute. Application 2 Application 2 Application 2 Application 1 Application 1 Application 1 virtual-machine state on disk is always encrypted, and ISR verifies its integrity OS OS OS before a virtual machine uses it. So, it’s only necessary to verify the integrity of a Host hardware Host hardware Host hardware small core of local ISR and Linux soft- (a) (b) (c) ware. Other compromised state isn’t a threat if it’s never used when a machine Time is functioning as an ISR client. This min- imalist approach speeds trust establishment and makes ISR more ubiquitous. A reboot from disk, which is now known robust than en-masse validation with second important design principle is to to be safe. This ensures that a full suite respect to ISR software evolution. If a prevent the execution of untrusted soft- of drivers for the local hardware (such new release of ISR client software uses a ware. This is in contrast to attestation as graphics accelerators) as well as cor- local software component that previous techniques, which facilitate the detection rect local environment settings (such as releases didn’t use, Trust-Sniffer will dis- of untrusted software but don’t prevent those for printers, networks, and time) cover its use, even if a software devel- its execution. is obtained. During this boot process, oper fails to list it. Trust-Sniffer dynamically loads the trust Staged approach extender module into the kernel, which Example use Figure 1 shows Trust-Sniffer’s staged extends the zone of trust as execution The following example illustrates our approach to trust establishment. proceeds. On the first attempt to execute system’s use. Bob boots up a PC at his any code that lies outside the current hotel’s business center using his USB key. Establishing a root of trust. First, the user zone of trust (including dynamically Trust-Sniffer’s initial scan quickly vali- performs a minimal boot of the untrusted linked libraries), the kernel triggers a dates the on-disk operating system, which machine from a small, lightweight device trust fault. The trust extender handles a is subsequently booted. Bob then initiates such as a USB memory stick that the user trust fault by verifying the suspect mod- the resume step of ISR. Once Trust-Snif- owns and carries at all times. This trust ule’s integrity and stops execution if the fer verifies the ISR client software’s initiator device serves as the root of trust module’s integrity cannot be established. integrity, ISR fetches Bob’s personal exe- in Trust-Sniffer. Relying on a trusted cution environment over a trusted com- physical possession is convenient and Validating other local software on trust munication channel. The locally installed easy for the user to understand. This faults. As each component of ISR client Web browser is riddled with malware, but stage involves a minimal boot, because software is accessed for the first time, the this doesn’t affect Bob’s task because he its sole purpose is for Trust-Sniffer to kernel generates trust faults and Trust- works only within his trusted personal ex- examine the local disk and verify that it’s Sniffer validates the component’s inte- ecution environment. safe to perform a normal boot using the grity. Once the user gains confidence in on-disk operating system and its associ- the machine and its ISR software, he or Threat model and assumptions ated boot software. The minimal boot she can perform the resume step of ISR. Machines used as ISR clients are vul- ignores the network and any devices On the other hand, if Trust-Sniffer can’t nerable to attacks such as modifications other than the disk. validate any component of ISR client to client or system software and installa- software, it alerts the user and terminates tion of malware such as key-logging or Booting the on-disk operating system. the ISR resume sequence. screen-capture software. Trust-Sniffer’s Next, Trust-Sniffer performs a normal On-demand validation is much more goal is to avoid potential loss or disclosure OCTOBER–DECEMBER 2007 PERVASIVEcomputing 25 SECURITY & PRIVACY Applications Trust alerter • Minimal OS Trust-fault Mismatched data USB User space • Measurement utilities • Reference measurements Kernel space Trust extender Kernel modules Linux kernel Trust initiator Untrusted machine Figure 2. The Trust-Sniffer architecture. The trust initiator plugs into an untrusted machine, validates its operating system, and equips it with a list of trusted applications’ SHA-1 hashes (reference measurements). Applications that haven’t been validated cause a trust fault, which the trust extender handles. If an application can’t be validated, the user-space trust alerter notifies the user. of user data by validating software on an mentation of Integrity Measurement Validating applications ISR client machine before a user accesses Architecture for Linux.5 IMA checks Trust-Sniffer validates an application his or her personal execution environment. the system software stack’s integrity by comparing its sample measurement, We assume that, to use our system, the by computing a SHA-1 hash over an obtained when the application is loaded, user may reboot the untrusted machine executable’s contents when it’s loaded. to a known list of reference measure- and that the BIOS allows booting from a This SHA-1 hash is called a measurements generated from trusted applica- USB memory stick. We also assume that ment. IMA is built into the kernel and tions. A mismatch is an inequality be- modifying the BIOS is difficult. So, we is invoked whenever executable code tween a sample measurement and every don’t guard against virtual-machine- is loaded, accounting for user-level bi- reference measurement in the list. In based attacks, such as SubVirt,4 where a naries, dynamically loadable libraries, contrast to attestation, where measure- compromised BIOS could boot directly kernel modules, and scripts. IMA mea- ments detect untrusted software after it into a malicious virtual-machine monitor. sures each loaded executable and has been loaded, validation refers to In addition, Trust-Sniffer is based on stores its measurement in a list in the detection of untrusted software before load-time binary validation, so it doesn’t kernel.

Load more