TCG Guidance for Securing Network Equipment

Preview Synopsis
Version 1.0
Revision 7
Aug 23, 2017

Contact: admin@trustedcomputinggroup.org

TCG Preview
Copyright © TCG 2017TCG

Copyright ©2017 TCG
Preview Synopsis

TCG Guidance for Securing Network Equipment
Version 1.0

1

Table of Contents

2

1. Executive Summary .......................................................................................................................................... 23

1.1

Network Equipment Reference Model .................................................................................................. 24

1.2

Key Differences between Network Equipment and PC Applications .................................................... 35

2. Use Cases ........................................................................................................................................................ 4

62.1

Device Identity ....................................................................................................................................... 472.2Securing Secrets ................................................................................................................................... 582.3

Protection of Configuration Data ........................................................................................................... 592.4

Software Inventory ................................................................................................................................ 5102.5

Attestation of Integrity for Network Devices (“Health Check”) .............................................................. 511

2.6

Inventory of Composite Devices ........................................................................................................... 612

2.7

Integrity-Protected Logs ........................................................................................................................ 613

2.8

Entropy Generation ............................................................................................................................... 614

2.9

Deprovisioning....................................................................................................................................... 615

3. Conclusion ........................................................................................................................................................ 616

1. Executive Summary

171819The world is interconnected by networks, and those networks have become critical to theoperation of a broad range of devices and services, ranging from the World Wide Web toindustrial robots and the electric power grid.

20212223242526

Preserving the integrity and security of equipment such as routers, switches, and firewalls
used to create the network infrastructure is essential to network reliability, as well as
maintaining integrity and privacy of the many kinds of data that transit networks. As
increasingly sophisticated attacks are launched on network equipment, strong protection
mechanisms for network equipment, both on the device and service level, is required. Trusted
Computing is a key security technology to keep networking services free of disruption and toallow for improvements in maintenance processes.

272829303132

Yet little information is available on how Trusted Computing should be used to secure
network equipment and thus the networks that depend on this equipment. TCG’s mission isthe creation of security specifications and the promotion of best practices for various
application domains. The TCG Network Equipment working group has the expertise to provide
good advice in the area of communication devices and the application of Trusted Computingin infrastructure scenarios.

333435The Reference document TCG Guidance for Securing Network Equipment provides details ofuse-cases and implementation approaches to solve these problems, designed to help systemdesigners and network architects get the best security possible from this powerful technology.

361.1

3738

Figure 1 shows a simplified reference model for Network Equipment depicting the stakeholderinteractions common in communication networks. Special attention to the interconnections

Network Equipment Reference Model

Revision 72
TCG Preview

Aug 23, 2017

3940

between administrative domains and the protection of end user equipment is important insecuring networking equipment.

4142434445Customer Premise Equipment (CPE) or Residential Gateways are often positioned between
administrative domains, and may require special attention for management of access andidentity. CPE devices are often under the direct physical access of the respective customers,
so secure identities and authentic software are essential security features offered by Trusted
Computing.
Network Service
ProviderAdministrative
DomainEnterprise
Administrative
DomainCPE
Router /FirewallEnterprise
Router /SwitchNetworkConnected
Endpoints

RouterConsumer /Home Network
Residential
Gateway

Endpoints

Devices withShared
Administration
46
Figure 1: Simplified Network Reference Model

4748
4950
51
5253

Traffic transiting from one endpoint to another through networks will often pass throughmany administrative domains, resulting in a complex trust model. Mechanisms developed by
TCG for secure handoff of ownership from one domain to another provide novel security
enhancements for the communication industry enhancing the overall robustness of theinfrastructure against attackers, and also enabling the detection of common administrativeissues.

54
55
56
57
58

Further, network administrators normally will not have direct physical connectivity to thedevice, resulting in a need for authenticated remote access to carry out the management
functions. Trusted Computing allows for hardware protected device identities whose security
is rooted in a certified design, allowing confident use of these identities in remote access andinventory applications.

59

1.2

60
61
62

Networking Equipment almost always contains a general-purpose computing environment toconfigure and manage the device. But there are distinct differences between Networking
Equipment and the common PC client and server applications:

Key Differences between Network Equipment and PC Applications

Copyright ©2017 TCGPreview Synopsis

TCG Guidance for Securing Network Equipment
Version 1.06364

While Network Equipment may be highly modular, it is often shipped as a closed
embedded system, integrating hardware and software.

65
66



The chain of security typically does not stop when the OS boots; what matters issecurity of the networking function that’s provided by the unit as a whole67

Network Equipment typically must boot and operate without manual intervention.

68
69



While Network Equipment has an important role in protecting user privacy, theequipment itself typically should not have an ability to hide or mask its own identity.

70
71

Network Equipment often has a long life cycle, and must stay operational in thenetwork for many years.

72

2. Use Cases

73
74
75

TCG technology has a number of applications in Networking Equipment, some of which arecommon to all computing devices, but others of which are unique to the networkingapplication.

76
77

The TCG Guidance for Securing Network Equipment document examines each of these usecases and provides non-normative advice on how existing TCG technology can be put to use.

78

2.179
80

Providing strong remotely-accessible device identity for each piece of network equipment is aprerequisite for most use cases related to securing network equipment.

81
82
83

Following the IEEE Standard for Local and Metropolitan Networks – Secure Device Identity,
IEEE Std 802.1AR, the TCG Guidance for Securing Network Equipment defines Manufacturer
device identity and Owner device identity.

84
85
86
87

Manufacturer identity is generally unique across all products from that manufacturer (e.g., amodel number plus a serial number), and is cryptographically signed by the Manufacturer,
while Owner identity will be unique within the Administrator’s facility (e.g., an asset number),and is signed by the Owner of the device.

88
89

The TCG Network Equipment device identity guidance is aligned with Initial and Local Device
ID, as specified in IEEE 802.1AR.

90

Cryptographic device identity has several applications in Networking Equipment

Device Identity

91
92
93
94
95

Identity for Network Access - Telecommunications companies, cloud and data center
operators, hospitals, chemical plants, manufacturing facilities are all examples wherethe network needs to be tightly controlled, and mechanisms used to ensure that only
authorized equipment can be connected. This can be achieved by using cryptographic
device identification, with keys stored in tamper-resistant TPMs.

9697
98
99
100
101

OEM Device Identity and Counterfeit Protection - Both network equipment owners
and device manufacturers (OEM’s) need to verify the authenticity of network
equipment, determining whether it is “counterfeit” (made by an unauthorized party orin an unauthorized manner) or “authentic” (made by authorized parties in anauthorized manner). Certificates signed by the manufacturer and rooted in a TPM canprovide such assurance.

102
103

Secure Zero Touch Configuration - There are many cases where a networking device
may be shipped with no unique configuration, but must be configured before it can beRevision 7

4TCG Preview

Aug 23, 2017

104
105
106
107
108

used with a network. Zero Touch Configuration (also known as Autoconfiguration) is
an increasingly popular mechanism where the device can identify itself reliably, andcommunicate through the network, to obtain the configuration information that would
specify policy for operational use. As an example, downloaded configuration mightenable access to a corporate VPN, by loading a set of private keys.

109110111
112
113
114

Remote Device Management - Network Equipment Owners with a large number ofdevices often want to manage those devices remotely, including the ability to monitor
devices and reconfigure them dynamically. Remote management and reconfiguration
is especially important in modern, flexible computing environments that implement
Software-Defined Networking (SDN) or Network Function Virtualization (NFV). Reliable
identification of each device is critical to remote management.

1152.2116
117
118
119120121122123Network equipment often contains secrets such as traffic logs or cryptographic keys (e.g.,shared secrets, passwords, VPN keys, SSL keys, and stored data encryption keys). Disclosureof these secrets could result in disclosure of confidential network traffic and privacy-sensitive
information or even enable malicious tampering with the network. Network operators(especially Service Providers and Enterprises) must protect these secrets against disclosure
to keep their networks secure and reliable and also to meet regulatory or customer
requirements for confidentiality and privacy, and can use a variety of TPM mechanisms toensure that private information stays that way.

124

2.3

125
126
127
128
129
130

Network Equipment usually requires configuration, often involving many parameters stored
in a variety of files. The equipment Owner may wish to retain control over changes toconfiguration files on the equipment, with the goal of ensuring that unauthorized
configuration changes don’t compromise their network. TCG technology can enable anequipment owner to ensure that configuration data can only be applied to the device it’smeant for, and can’t be snooped along the way.

131

2.4

132
133
134
135
136

Most Network devices rely on complex embedded software to enable basic features as well as
to enforce security policies. This software is often updated on devices already in the field,
using releases and patches usually supplied by the device manufacturer, leaving Network
Administrators with the task of keeping track of which devices have been updated to whatrevision level, sometimes tracking many independent components on a single complex device.

137
138

Mechanisms can be implemented to allow the Administrator to query devices to find whichrevision level of what components are installed on each network device in their network.

139

2.5

140
141
142
143
144

One extension to remote device management enabled by TCG technology allows themanagement station to monitor the authenticity of software versions and configurations
running on each device, through a process called Attestation. This allows owners and auditors
to detect deviation from approved software and firmware versions and configurations,potentially identifying infected devices.

Securing Secrets

Protection of Configuration Data

Software Inventory

Attestation of Integrity for Network Devices (“Health Check”)

Copyright ©2017 TCG
Preview Synopsis

TCG Guidance for Securing Network Equipment
Version 1.0

145

2.6

146
147
148
149
150
151
152

Many network devices are composed of one or more control or management units plus
optional components like line processing units, feature processing units and other kinds ofField Replaceable Units (FRUs), each of which might contain its own autonomous computingenvironment. The interaction and tasks of the components are vendor specific, but thebehavior of the network device is based upon the composite behavior of individualcomponents. The security posture of the network device is therefore only accuratelyrepresented by a composite measure that includes the posture of sub-components.

153
154
155
156
157

Many network devices allow FRUs to be replaced without triggering a complete system restart(often called ‘hot swap’); for these devices, system-level reboots may be very rare, and thesystem’s security posture must be re-evaluated every time an individual unit is inserted orremoved from the system. The TCG Guidance for Securing Network Equipment outlines
procedures for determining the security posture of these complex machines.

158

2.7

159
160
161
162
163
164

Various processes in the day-to-day operation of network equipment are based on information
gathered from the system status of servers, routers and sensors. SACM, SIEM or even legal
interception are based on state information of various components. Tampering with thisinformation, mostly existent as log files, can impact the security protection (e.g. by
suppressing intrusion-detection (IDS) data) or impact the integrity of information deliveredby the legal interception interface.

165
166

Integrity-protected log files can be used by the management or external entities by providing
information proving the authenticity and integrity of the file.

167

2.8

168
169

Many networking protocols such as SSH and IPsec have a need for cryptographic-quality
random numbers, to avoid the generation of predictable ephemeral session keys.

170
171
172

In addition, the TCP stack for Network Equipment should use good-quality randomness for
the TCP window starting point as well as in the selection of ephemeral ports. These help tomitigate SYN and RST attacks against the device.

173
174

Most TPMs contain a source of cryptographic entropy, which can be used to improve thesecurity of the many mechanisms that depend on random numbers.

175

2.9

176
177
178

Networking Devices often contain information that’s considered sensitive by theAdministrator, such as customer configurations or routing policies. Once the device is takenout of service, this information must be reliably destroyed.

179
180
181

Confidential information can include TPM keys themselves, or information encrypted by TPM
keys. The TPM mechanisms for deleting keys can ensure that the confidential information
will become inaccessible.

182

3. Conclusion

183
184

Attacks on network equipment are becoming more frequent and more sophisticated. With thegrowing importance of networking in our lives, especially as IoT becomes commonplace, theInventory of Composite Devices

Integrity-Protected Logs

Entropy Generation

Deprovisioning

Revision 7

6TCG Preview

Aug 23, 2017

185
186
187

security of network equipment is paramount. While securing network equipment is a complex
problem, it is clear that Trusted Computing is essential to provide a firm foundation on whichhigher-layer security mechanisms can be built.

188
189
190
191

The complete TCG Guidance for Securing Network Equipment provides detailed
implementation suggestions for all of these use cases, plus related background material. The
document is currently available for review.

192
193

Readers interested in this topic (especially network equipment providers
telecommunications carriers) are encouraged to join TCG to help shape this guidance.

194

TCG Guidance for Securing Network Equipment can be found on the TCG public web site:

195
196

(https://trustedcomputinggroup.org/wpcontent/uploads/TCG_Guidance_for_Securing_NetEq_1_0r26b_Public-Review.pdf ).

197
198

Please contact admin@trustedcomputinggroup.org formembership, or the Working Group, or to offer comments.

more

information

onandTCG