MicroOS Remote Attestation with TPM and Keylime
Channel: SUSE Labs
Date: 02/11/2021

Thanks to our conference sponsor, arm : https://arm.com
Hosting provided by BigBlueButton (https://twitter.com/bigbluebutton) and Blindside Networks(https://twitter.com/blindsidenetwks)

The Trusted Computing Group (TCG)[1] is defining via specifications the different technology pieces that compose what is named Trusted Computing (TC)[2], that in an effort to guarantee that the computers behave under certain restrictions, and protect the system against unauthorized changes.

This is achieved via the Trusted Platform Module (TPM) co-processor, that can be used as an independent agent that can certify its internal state and that it can only be changed in very specific ways.

With a TPM we can now do measurements in our computer, and change the internal state of the TPM accordingly. An external service can request the current state of the TPM and validate that the measurements done previously were not tampered in any way.

This remote agent can compare those measurements with some expected values and validate the status of the system at this point. This full process is known as remote attestation.

Keylime[3] is an open source project designed to do remote boot attestation and runtime integrity (via IMA measurements done by the kernel) that has been recently integrated in MicroOS[4].

This presentation will present concepts like TPM, measure boot and remote attestation in the context of Keylime and MicroOS. If the starts are favorable there will be a demonstration that will show how a change in the system will be detected remotely, and an action will be triggered designed to isolate the tampered system.

-- [1] https://trustedcomputinggroup.org/about [2] https://trustedcomputinggroup.org/trusted-computing/ [3] https://keylime.dev/ [4] https://en.opensuse.org/Portal:MicroOS/RemoteAttestation

Speaker: Alberto Planas Dominguez