Bootstrapping Trust in Modern Computers
Total Page：16
File Type：pdf, Size：1020Kb
Bryan Parno • Jonathan M. McCune • Adrian Perrig Bootstrapping Trust in Modern Computers Permission granted by the authors to review this work; do not distribute. Bryan Parno Jonathan M. McCune Microsoft Research CyLab Redmond, WA Carnegie Mellon University USA Pittsburgh, PA [email protected] USA [email protected] Adrian Perrig CyLab Carnegie Mellon University Pittsburgh, PA USA [email protected] ISSN 2191-5768 e-ISSN 2191-5776 ISBN 978-1-4614-1459-9 e-ISBN 978-1-4614-1460-5 DOI 10.1007/978-1-4614-1460-5 Springer New York Dordrecht Heidelberg London Library of Congress Control Number: 2011936127 © The Author(s) 2011 All rights reserved. This work may not be translated or copied in whole or in part without the written permission of the publisher (Springer Science+Business Media, LLC, 233 Spring Street, New York, NY 10013, USA), except for brief excerpts in connection with reviews or scholarly analysis. Use in connection with any form of information storage and retrieval, electronic adaptation, computer software, or by similar or dissimilar methodology now known or hereafter developed is forbidden. The use in this publication of trade names, trademarks, service marks, and similar terms, even if they are not identified as such, is not to be taken as an expression of opinion as to whether or not they are subject to proprietary rights. Printed on acid-free paper Springer is part of Springer Science+Business Media (www.springer.com) Permission granted by the authors to review this work; do not distribute. For Diana, Kathleen, and Andrea Permission granted by the authors to review this work; do not distribute. Acknowledgements In May of 2010, we presented a paper entitled Bootstrapping trust in commodity computers at the IEEE Symposium on Security and Privacy [152]. There, we were pleased to hear from a number of people that our review paper had taught them a great deal about the area as a whole, or that they planned to distribute it to their stu- dents. Their gracious comments inspired us to expand our review into the form you see here. We hope that it will be of service to the security and privacy community. The authors are especially grateful to our collaborators, Virgil Gligor, Mike Re- iter, Arvind Seshadri, Leendert van Doorn, and Amit Vasudevan, whose insights and enthusiasm greatly enriched our work. The authors are also grateful to David Chal- lener, Ron Perez, Reiner Sailer, and Josh Schiffman for their insightful comments, which greatly improved the present work. This research was supported in part by CyLab at Carnegie Mellon under grants DAAD19-02-1-0389, MURI W 911 NF 0710287, and W911NF-09-1-0273 from the Army Research Office, and grants CNS-0831440 and CCF-0424422 from the National Science Foundation. The views and conclusions contained here are those of the authors and should not be interpreted as necessarily representing the offi- cial policies or endorsements, either express or implied, of ARO, CMU, CyLab, Microsoft, NSF, or the U.S. Government or any of its agencies. vii Permission granted by the authors to review this work; do not distribute. Contents 1 Introduction...............................................1 2 What Do We Need to Know? Techniques for Recording Platform State.......................3 2.1 Recording Code Identity..............................3 2.2 Recording Dynamic Properties.........................9 2.3 Which Property is Necessary?......................... 10 3 Can We Use Platform Information Locally?.................... 13 3.1 Secure Boot......................................... 13 3.2 Storage Access Control Based on Code Identity........... 14 4 Can We Use Platform Information Remotely?................... 19 4.1 Prerequisites........................................ 19 4.2 Conveying Code Measurement Chains.................. 19 4.3 Privacy Concerns.................................... 22 5 How Do We Make Sense of Platform State?.................... 25 5.1 Coping With Information Overload..................... 25 5.2 Focusing on Security-Relevant Code.................... 25 5.3 Conveying Higher-Level Information................... 32 6 Roots of Trust............................................. 35 6.1 General-Purpose Tamper-Resistant and Tamper- Responding Devices.................................. 35 6.2 General-Purpose Devices Without Physical Defenses...... 37 6.3 Special-Purpose Minimal Devices...................... 38 6.4 Research Solutions Without Hardware Support........... 39 7 Challenges in Bootstrapping Trust in Secure Hardware........... 41 7.1 Problem Definition................................... 42 7.2 Potential Solutions................................... 45 7.3 Preferred Solutions................................... 50 8 Validating the Process....................................... 51 9 Applications............................................... 53 9.1 Real World......................................... 53 9.2 Research Proposals................................... 55 10 Implementing Trust Bootstrapping: Open Source Tools........... 59 10.1 Component Packages................................. 59 10.2 Complete Distributions or LiveCDs..................... 60 ix Permission granted by the authors to review this work; do not distribute. x Contents 11 Human Factors & Usability.................................. 61 11.1 Trustworthy Verifier Devices.......................... 61 11.2 Using Your Brain to Check a Computer.................. 71 11.3 Pairing Two Trustworthy Devices....................... 71 12 Limitations................................................ 73 12.1 Load-Time Versus Run-Time Guarantees................ 73 12.2 Hardware Attacks.................................... 73 13 Additional Reading......................................... 75 13.1 Books.............................................. 75 13.2 Conference and Workshop Proceedings.................. 76 14 Summary................................................. 77 References ......................................................... 79 Index ............................................................. 97 Permission granted by the authors to review this work; do not distribute. Acronyms AES Advanced Encryption Standard AIK Attestation Identity Key AMT Active Management Technology API Application Programming Interface BBRAM Battery-Backed RAM BGP Border Gateway Protocol BIND Binding Instructions aNd Data BIOS Basic Input/Output System CA Certificate Authority CFI Control-Flow Integrity CLR Common Language Runtime CRTM Core Root of Trust for Measurement DAA Direct Anonymous Attestation DDoS Distributed Denial-of-Service DEV Device Exclusion Vector DMA Direct Memory Access DRAM Dynamic RAM DRM Digital Rights Management DRTM Dynamic Root of Trust for Measurement EK Endorsement Key FPGA Fully-Programmable Gate Array GPIO General-Purpose Input/Output IMA Integrity Measurement Architecture IPMI Intelligent Platform Management Interface ISP Internet Service Provider LED Light-Emitting Diode LPC Low-Pin Count LS2 Logic of Secure Systems LT LaGrande Technology MAC Mandatory Access Control MLE Measured Launched Environment MLTM Mobile Local-owner Trusted Module MPT Memory Protection Table MPWG Mobile Phone Working Group xi Permission granted by the authors to review this work; do not distribute. xii Bootstrapping Trust in Modern Computers MRTM Mobile Remote-owner Trusted Module MTM Mobile Trusted Module NAT Network Address Translation NGSCB Next-Generation Secure Computing Base NTP Network Time Protocol NVRAM Non-Volatile RAM OAEP Optimal Asymmetric Encryption Padding OIAP Object Independent Authorization Protocol OS Operation System OSLO Open Secure LOader PC Personal Computer PCI Peripheral Component Interconnect PCI-X PCI Express PCR Platform Configuration Register PIN Personal Identification Number PKCS Public-Key Cryptography Standards PKI Public-Key Infrastructure PRIMA Policy-Reduced Integrity Measurement Architecture PUF Physical Unclonable Function PXE Preboot eXecution Environment RAM Random-Access Memory ReDAS Remote Dynamic Attestation System ROM Read-Only Memory ROTI Root of Trust Installation SELinux Security-Enhanced Linux SIM Subscriber Identity Module SLB Secure Loader Block SMI System-Management Interrupt SMM System-Management Mode SMX Safer-Mode Extensions SP Secret Protected SSH Secure Shell SSL Secure Socket Layer SVM Secure Virtual Machine TCB Trusted Computing Base TCPA Trusted Computing Platform Alliance TCG Trusted Computing Group TNC Trusted Network Connect TOCTOU Time Of Check, Time Of Use TOFU Trust On First Use TPM Trusted Platform Module TSS TCG Software Stack TVD Trusted Virtual Domain TVEM Trusted Virtual Environment Module TXT Trusted eXecution Technology Permission granted by the authors to review this work; do not distribute. Bootstrapping Trust in Modern Computers xiii USB Universal Serial Bus VM Virtual Machine VMM Virtual Machine Monitor VT Virtualization Technology VT-d Virtualization Technology for Directed IO vTPM virtual Trusted Platform Module WebALPS Web Applications with Lots of Privacy and Security XOM eXecute-Only Memory ZTIC Zurich Trusted Information Channel Permission granted by the authors to review this work; do not distribute. Permission granted by the authors to review this work; do not distribute. 1 Introduction Suppose you are presented with two physically identical computers. One is running a highly-certified, formally-proven, time-tested software stack, while the other is running a commodity software stack that provides similar features, but is infested with sophisticated malware.