# Trusted GNSS-Based Time Synchronization for Industry 4.0 Applications
## 4 Trusted Computing
### Integrity Measurement Architecture (IMA)  
Integrity Measurement Architecture (IMA) [50; 51] is a security subsystem of the Linux kernel. When enabled, it measures all files that match a given policy (see Appendix A.1) that are loaded and possibly executed. All measurement records are kept in memory in the so-called IMA log and an overall integrity checksum is retained using the TPM PCR10. This is an excerpt of an IMA log for the Linux kernel v.4.19 we used:  
```
1 pfliadata-hash
103 ab3b13f687 cd2h630e257b4810f8 ac711 fbdcim 9797 af8f8d80 eed36b1 cf92547816051c8 af464 eeboot,aggregate
111098d41 fd1 cf70c76f90053612c3 fa0568f66 dim 33 bc9d8d1041 cf25731 fd36d30b80e173a58456c



Each measurement record includes:

IMA-record = PCR-index || template-hash || tpl || filedata-hash || file-pathname, where:

* PCR-index is the index of the used PCR, with default value equal to 10, i.e., the PCR extended, one-by-one, by template-hash;
* tpl is the template name;
* template-hash = sha1 ( filedata-hash length, filedata-hash,...  file-pathname length, file-pathname );
* filedata-hash = sha1 ( filedata ). IMA also includes the function Appraisal that together with the Linux Extended Validation Module (EVM) implements a fine grained Secure Boot process. In our prototype, to implement the Secure Boot, we selected the approach based on an encrypted partition and the encryption/decryption key sealed to the TPM and a set of PCR values. ### Remote Attestation

The Trust Decision can also occur when the authenticated bootstrap is completed; with this option, a remote node, i.e., the Attestor, is responsible for challenging and verifying the trustworthiness of target nodes with a given periodicity, as depicted in Figure 4.

The Attestor performs a Remote Attestation by asking the TCB to be attested to send information about the loaded components for the cryptographic verification. In this work, the Remote Attestation is implemented in its easiest form. The Attestor opens a standard secure channel with mutual authentication by means of TLS [52] with the target TCB to protect the communication. Then, the Attestor challenges the TCB and verifies its trustworthiness. To avoid attacks where a malicious node can fool the Attestor by acting as MITM and acquire the attestation data from a trusted node, the node implements a soft binding between the TPM identity and the Secure Channel identity. This is implemented by binding the Attestation Key (AK) used to perform the TPM_Quote operation over the selected PCRs values and the key used for authentication during secure channel handshake. More practically, this is done by using the Public Key Certificate of the key used for authentication to extend one PCR of the TPM. The TPM_Quote is substantially a digital signature over a set of relevant PCR values and the nonce sent by the Attestor for freshness purposes to avoid replay attacks. Once the TLS channel is established between the two parties that successfully identified each other, the Remote Attestation takes place over it according to the following sequence of actions:

1. The Attestor sends the nonce to the TCB,
2. The TCB executes the TPM_Quote, i.e., it signs the PCRs from 0 to 10 and the nonce using the Attestation Key (AK), and prepares the IMA log for delivery,

Figure 4: Illustration of Remote Attestation on the synchronization distribution network. 3. The Platform sends back to the Attestor the Quote (i.e., the signature over the values of the PCR from 0 to 10 and the nonce) and the AK certificate, the PCR values, the IMA log, and the list of files measured by the bootloader with their digest; then,
4. The Attestor performs all checks to verify the TCB integrity: 1. It verifies the validity of the Quote using the public key embedded in the AK certificate (previously set as trusted), also including the nonce; 2. It verifies that the values of \"soft PCRs\" calculated from the list of files (and their digest) measured by the bootloader correspond to the values of PCR 0 to 8 extended as well by the bootloader; 3.