BoF: Simple Remote Attestation with Secure & Attested Communication Channels
Talkat Linux Security Summit Europe 2019 · on Thursday, 2019-10-31· at 15:40· Terreaux Reception Hall·
summary
Proposes a small demonstrator: a network management system and router that only establish a secure session when the router’s TPM reports an allowed state. Uses TPM-signed measurements and adds those measurements into certificate extensions so the management server checks them with an IBM verification module. Shows concrete failures: modifying config files or binaries flips TPM state, prevents the policy-gated TLS channel, and blocks device management operations, demonstrating detection of offline tampering and enforcement of integrity policies.
AI-written summary · about
chapters (7)
- 0:00Remote attestation approach
- 3:14Attestation solution components
- 7:28TPM policy enforcement demo
- 10:43Offline attack protection
- 13:23Runtime verification checks
- 15:48Secure communication setup
- 17:15Conclusion
related talks
29mRemote Attestation of IoT devices using a discrete TPM 2.0
42mTPM based attestation - how can we use it for good?
29mA Simple Protocol for Remote Attestation of System Integrity
36mRoots of Trust and Attestation
15mRemote Attestation in AMD SEV-SNP Confidential VMs
40mUsing TPMs to Cryptographically Verify Devices at Scale
59mLayered Attestation of a Cross-Domain System
25mEstablishing Trusted and Secure Foundation for Device Management Using Open Source Software