SEDAT:Security Enhanced Device Attestation
with TPM2.0

Traditional computing and Embedded devices are proliferating into numerous and diverse aspects of everyday life. These devices are utilizing in different domains ranging from tiny personal gadgets to large industrial systems. the amount of such devices connected to the Internet is growing rapidly and securing these devices and our electronic infrastructure becomes increasingly difficult, in particular because a large fraction of devices cannot be managed by security professional nor can they be protected by firewalls. this devices are most likely to be susceptible to attacks like - hardware modification, or counterfeit can cause serious security challenges as e.g., see Chinese supply chain hardware attack [1]. Malware infestation involves modifying a device’s firmware and software and replacing benign code with a malicious one. Which can destroy physical equipment (e.g., see Stuxnet [2]) or enables a more sophisticated attack threatening the safety of the users (e.g., see Jeep hack [3]). This increasing importance confronts developers with new challenges. One of them is the verification of the identity and integrity of a device by the trusted remote attestation tool called remote verifier.

Fig-1 shows high-level design of trusted remote verifier - Security Enhanced Device Attestation with TPM 2.0 (SEDAT) to attest untrusted devices. As can be seen, the verifier has to attest three components: hardware, firmware, and software to fully attest a device. Device suppliers will provide platform root certificates, endorsement certificates, platform attributes certificate. The device will have firmware and software modules that need to be unchanged and executed in the correct order to ensure integrity. This execution of the firmware and software module will create event records in form of firmware and IMA event logs, which will be explained in detail in the coming section. Fig-1 has Reference Integrity Manifest (RIM) for both firmware and software event logs, which will provide golden measurements based on Trusted Computing Group (TCG) ’s new recommendations. Details of each module and working will be discussed in the following sections.

Remote Verifier (RV) has to validate the integrity and authenticity of hardware, firmware, and software state on the untrusted device against known good state for attesting the device. If any or all of the states fail, then the device attestation result is failed. RV should be able to perform attestation on-demand to ensure the correct state of remote prover. RV can perform a quote check with TPM2.0 to validate Ek and signing keys.

Goals and Contributions:

In this paper, we present SEDAT, the first proof of concept work for remote attestation, to ensure the integrity and authenticity of devices via a security-enhanced communication channel. Designing such a verifier is a challenging task.As there are many possibilities of malfunctions, like, their could be counterfeit hardware, modified software or malicious prover will triggering the attestation process. Therefore, we analyzed the requirements for designing a secure attestation protocol and depict how to address them with minimal features and assumptions. Further, we identified possible use-cases where SEDAT can be applied. Our work brings the following contributions:

• •

  Client provisioning: Provided tool for client provisioning. it is the process that enables the platform owner to register the device with a remote verifier using a security-enhanced Single Packet Authentication (SPA) technique.

• •

  Platform attestation: Provide remote verifier for platform which attests platform root CA certificates, endorsement certificates, platform bindings.

• •

  CEL firmware event logs: Provide tools to convert and verify firmware event logs into canonical event log (CEL) structure. also, validated upstreamed kernel patches for crypto align firmware event logs.

• •

  CEL IMA event logs: Provide tools and kernel patches for getting IMA event logs into userspace and converting it into CEL format.

• •

  Quote check: Provide tools to check the quote at a remote verifier.

• •

  Secure authentication: Provide tools for secure connection and authentication for verifier and protects it from replay and DoS type attacks.

Outline: This is not correct at this time –putting some place-holder flow. Outline, Section 2 reviews related work, adversary models and Replay, DoS attacks on attestation. Section 3 provides required preliminaries and notations, identifies the minimal requirements for secure RV, and describes SEDAT. The prototype implementation of SEDAT has described in Section 4; its application to collective attestation is explained in Section 5. Next, the security of SEDAT has evaluated in Section 7, and the paper concludes in Section 8.

Remote attestation is an interactive process between a trusted remote verifier (denoted as RV) and a potentially untrusted remote device called prover (denoted as RP).It allows a trusted RV to capture the state of a potentially untrusted remote device.Essentially, RV measures and takes hash of the software running on the RP, tranfers it to it self and matches to the golden measurement to attest the device. Remote attestation can be performed by Hardware-only, software-only, or hybrid techniques. Each approach has its merits and demerits. Hardware or hybrid approach provides better security assurance as they use immutable hardware as a root of trust.

One approach to achieve better security is to equip these devices with a root of trust, such as a Trusted Platform Module (TPM), a Trusted Execution Environment (TEE), and Software Guard Extensions (SGX), and then have that root of trust attest the state of the device or computations made. Many devices have a Trusted Platform Module (TPM) that fulfills these tasks.

Remote device attestation (RV) can be used to establish static or dynamic root of trust in cyber-physical and industrial controls systems.It can be used as building block for other security services and primitives, such as device provisioning, firmware updates, kernel software patching.

After understanding theory and design requierments SEDAT is designed in moduler fashion.each module is performing dedicated task as follow.

The framwork of SEDAT works as follow

• •

  Client provisioning: In this step untrusted prover will establish secure communication channel with the remote verifier.

• •

  Get TPM certificate: Using TPM2.0 command get the TPM EK key and create endorsement certificate from the manufacturers root certificate site.

• •

  Get platform certificate: Using TPM2.-0 command to get platform certificate and run paccor to create platform attributes certificate.

• •

  Store certificates in TPM: Using TPM2.0 commands store the platform certificate and endorsement certificate into NV storeage of TPM2.0.

• •

  Take ownership: Using TPM2.0 command take ownership of the platform.

• •

  Get eventlogs for Firmware and IMA in CEL format: Using provided scripts get the firmware and IMA event logs from /sys/kernel/security/tpm0/binary* and /system/kernel/security/ima/binary* respectively and send it to RV.

• •

  Generate quote: Using tpm2_quote command and added freshness nonce generate quote.

• •

  Validate quote at RV: based on received information at the remote verifier regenerate and check the quote. this is implemented using IBM’s software tpm as verifier needs not to have tpm module.

Verifier and tools are implemented in go language and used postgres as backend database. we took insperation from National Security Authorities (NSA)’s tool for platform varification called HIRS. SEDAT verifier uses NSA’s tool called paccor to generate platform certificate and platform attributes. it stores those two certificate along with manufacturer’s root CA certificate into the postgres database as golden template. SEDAT transfers the golden CEL firmware and IMA event logs to the remote verifier using replay protected secure channel. we provide full control to verifier to enable or disable certificates, firmware event logs and IMA logs validation.

SEDAT can be applied to different application areas.here we showcase three usecases.

• •

  Supply Chain Validation:

  In supply chain platform supplier will be located in different geolocation and it transports the devices from the assembly line to warehouse, then it will go to retail location or to the installation facility. In this transport process, there are multiple untrusted anchors involved which can lead to counterfiet, substitute the devices.tpm based attestation provides the hardwae root of trust,signed key, certificate validation will increase security and trust. our verifier helps in tracking with reduced cost and increased trust. it also reduces the in situ installation and replacement cost.it is possible to remote key provisioning. key allows trusted remote configuration, trust channels using keys allows multiplexing connections reducing cabling costs.with SPA the communication is replay and DoS protected.
  

  

  As shown in Fig.7 we need to have one-time trusted channel between platform owner and tpm and platform supplier to transfer securely the platform supplier cert and tpm supplier cert to platform owner and it will be binded and referenced as discussed before. we are using standard https connection for now.

  

  As shown in Fig.8 shows supply chain validation uses case. the connection for now.

• •

  Inventory management:

  In large organization employer will give computers to emplyees which they use for all corporate works so integrity, authenticity and inventory management of those coputer devices are must. SEDAT can be used as remote attestation verifier as most of the computers now a days have TPM chip. SEDAT can also be laverage to list information of mutable and immutable components on computers as it was shown in [4]. this helps in boot time security and inventory management. if some employee has broken display or ethernet port while on vacation or travel and they replaced untrusted replacement part with SEDAT trust anchor installed verifier has golden state of all mutable immutable components on the device with was given to employee on day one. so next time when attestation takes place verifiers platform certs will not match and we can trigger an alert for appropriate action.

• •

  Industrial control systems:

  SEDAT can be used as remote verifier for controllers and embedded devices with hardware or firmware based TPM module. in those environment verifying the integrity and authenticity of the platform is key factor.

We have compared SEDAT with other solutions and found that SEDAT outperforms others by providing one stop solution for Hardware firmware and software remote verification with single packet authentication to protect from replay and DoS attacks.below figure shows the evaluation report.

Remote Verifier (RV) allows a trusted entity to securely measure internal state of the remote unstrusted platform (prover). RV can be used to establish static or dynamic root of trust in cyber-physical and industrial controls systems.It can be used as building block for other security services and primitives, such as provisioning, updates, patches.Current attestation approaches fall into two domains namely collective attestation and single device attestation.

• •

  Collective Attestation:

  Traditional attestation schemes consider only a single prover and verifier. Swarm/collective attestation aims at scaling existing attestation schemes to networks of embedded devices, by leveraging in-network verification [9], and novel cryp- tographic primitives [10]. SEDA [9] investigates the security of swarms of embedded de vices. It presents the first attestation protocol for large swarm, allowing a central verifier to assess the trustworthiness of a million device swarms in order of seconds. It achieves this by distributing the attestation burden across the swarm, allowing neighbors to attest each other, and aggregating the attestation results in a hop- by-hop manner. SANA [10] enables low verification overhead due to the integration of a novel Optimistic Aggregate Signatures (OAS), which is a generalization of aggregate and multi-signatures. Finally, DARPA [11] aims at detecting software compromise and device capture in embedded networks. Since DoS attacks on collective attestation are more significant, as it allows to adversary to disturb a large network by targeting one device, SANA [10] proposes using secure tokens obtained from a trusted third party to prohibt scaling DoS attacks to large networks. However, SANA uses expensive public key cryptography which imposes additional overhead on the Prv, and is vulnerable to DoS attacks based on the digital signature verification procedure.

• •

  Single Device Attestation:

  It has three main categories:Software-based attestation schemes [12, 13, 14, 15, 16, 17]. does not require secure hardware. It enables attestion of legacy and low-end embedded devices with some assumptions. These assumptions are: adversery is not active during the attestation process,the attestation code and implementation are optimal,and presence of an out-of-band authentication channel. Due to this reasons, security of software-based attestation schemes has been challenged by [18, Sankar1, 19] and their applicability and reliability was limited. Hardware-based attestation schemes [20, 21, 22, 23, 24, 25] provide better security guarantees. Software/Hardware Co-design or Hybrid schemes such as [26, 27, 28, Koeberl] provides examples of minimal hardware-based features required for enabling secure remote attestation. Such security features are as simple as a Read Only Memory (ROM), and a simple Memory Protection Unit (MPU).

  SEDAT is the first remote attestation scheme, which performs hardware, firmware and software attestation and it is completely secure against Denial of Service (DoS), replay attacks.

In this paper we have presented proof of concept work for remote verifier to perform end to end attestation of hardware, firware and software of untrusted device with tpm2.0. to the best of our knowledge SEDAT is the first solution to demornstrate one stop solution for all three components varification with INTEL’s /TCG recommended tpm2-tools stack. we are the first one to auther tools for represnting IMA and Firmware eventlogs into CEL format. all codes is open-sourced and available for future research.

The authors would like to thank faculties of University of Maryland Baltimore County (UMBC) and research group at General Electric global research for funding, actively participating and guiding the research work.