A Canonical Event Log Structure for IMA - David Safford & Monty Wiseman, GE
Channel: The Linux Foundation
Date: 2018-09-01

A Canonical Event Log Structure for IMA - David Safford & Monty Wiseman, GE

IMA (Integrity Measurement Architecture) provides Linux systems with attestation of runtime components. This presentation will review work in progress to convey attestation information to a verifier in the form of a Canonical Event Log structure. This format will provide cryptographic algorithm agility and sequence numbers. Sequence numbering will enable Event Log list truncation and de-duplication which will optimize storage and transmission. This will allow IMA to bound the size of its internal data structures, including the measurement list and the hash table. This new format will support existing IMA templates while enabling extensible features such as attestation of file metadata. It will also support existing firmware Event Log such as those from UEFI systems. This presentation will demonstrate the current prototype, and discuss integration with an open source verifier.

About David Safford
David Safford is a Senior Principal Engineer at GE's Global Research Center, where he leads research on industrial control system security, across power generation, power distribution, aviation, and health care devices. His current focus is in delivering hardware rooted measurement, appraisal, and attestation to the industrial embedded controller product lines. He has presented at LSS four times in the past on various linux integrity and embedded security topics.

About Monty Wiseman
Monty Wiseman is a Principal Engineer at GE's Global Research Center, where he leads research on industrial control system security, across power generation, power distribution, aviation, and health care devices. His current focus is in TCG Standards in general, and particularly in platform certificates for secure supply chains for industrial controllers.