A Simple Protocol for Remote Attestation of System Integrity
summary
Proposes implicit remote attestation by using TLS endpoints plus a TPM-sealed key certified via the TCG X.509 extension Subject Key Attestation Evidence (SKAE) so successful handshake proves a sealed-to-good-state key. Implements an IMA Digest Lists kernel whitelist that preloads vendor digests and reports only unknown file accesses, making IMA PCRs largely predictable. Combines TPM 2.0 sealing, modified sealing policies, and SELinux process-interaction analysis (only ~2.5% of policy seen) into a prototype with GitHub code and packages that demonstrably detects prior integrity violations and enables server-less attestation.
AI-written summary · about
chapters (20)
- 0:00Intro
- 0:53Remote Attestation - Problem
- 2:17Background - Explicit RA
- 4:53Simple RA Protocol with Implicit RA
- 6:59Mutable Files in the IMA Measurement List
- 7:17Alternative Solution for Evaluation of Mutable Fles
- 7:38Unknown Impact of Process Actions without MAC
- 8:17Protect Mutable Files with Mandatory Access Control
- 9:32Integrity Models - Biba vs Clark-Wison
- 10:08PRIMA Overview and Drawbacks
- 11:18Our Proposal to Simplify and Complete PRIMA
- 12:14Reduce TCB size
- 13:25Detect Malicious Updates of Mutable Fles
- 15:25Exclude Mutable Files from Measurement
- 16:03Chained Integrity Verification across Reboots
- 19:52Implicit RA-Verification Options
- 21:19Infollow LSM Implementation - Setup Phase
- 22:33Infoflow LSM Implementation - Deployment Phase
- 24:42Source Code
- 25:05Conclusions
related talks
59mLayered Attestation of a Cross-Domain System
42mTPM based attestation - how can we use it for good?
29mRemote Attestation of IoT devices using a discrete TPM 2.0
15mRemote Attestation in AMD SEV-SNP Confidential VMs
25mDemystifying remote attestation
43mKeylime - An Open Source TPM Project for Remote Trust.
41mKeylime - An Open Source TPM Project for Remote Trust of IoT
49mKeylime: Bootstrapping and Maintaining Trust