Keylime - An Open Source TPM Project for Remote Trust of IoT
Talkat Open Source Summit Europe + Embedded Linux Conference Europe 2019 · on Monday, 2019-10-28· at 14:25· Forum 6·
summary
Keylime is an open source remote attestation system (originating MIT Lincoln Laboratory) that measures hardware TPM state and Linux IMA hashes, verifies TPM-signed TPM quotes and enforces policies. A verifier polls devices (default every two seconds) and one verifier scaled to 2,000 devices in benchmarks. It implements a bootstrap flow that delivers secrets via an encrypted payload split key (V and U halves), a revocation framework that can revoke certificates and push local scripts, VTpm aggregation via a Merkle tree, and an agent being ported to Rust. CI runs on Travis.
AI-written summary · about
chapters (27)
- 0:00Introduction
- 0:17Lukes background
- 1:09The problem
- 1:19Remote IoT trust
- 2:07Physical protections
- 3:15Physical protection schemes
- 3:42Mandatory access control
- 4:22Software trust
- 4:47Remote device trust
- 5:29Hardware root of trust
- 7:40TPM usage
- 8:20What is Keylime
- 8:53Measured boot
- 11:56Architecture
- 15:22Use Cases
- 15:38Keylime Agent
- 16:43Bootstrap Key
- 18:58Continuous Remote attestation
- 19:57IMA
- 22:48Verification Revocation
- 24:03Revocation Framework
- 25:21Organic Growth
- 27:03Continuous Integration
- 29:01Weekly Meetings
- 30:10Virtual TPM
- 31:45Porting Agent to Rust
- 32:23Get Involved
related talks
43mKeylime - An Open Source TPM Project for Remote Trust.
49mKeylime: Bootstrapping and Maintaining Trust
38mKeylime, Securing your Slice of the Cloud.
37mKeylime: Pushing the Boundaries of Remote Attestation on the Edge
46mToward Usable Open-Source Remote Attestation for Cloud and Edge
20mCloud-native security in Rust with Keylime
29mRemote Attestation of IoT devices using a discrete TPM 2.0
29mA Simple Protocol for Remote Attestation of System Integrity