# Secure and Privacy-Respecting Documentation for Interactive Manufacturing and Quality Assurance
## 4 Privacy-Preserving System Design
### Integrity Verification
By utilizing this TPM-based remote attestation technique in 4 Crypt, we give workers the opportunity to verify if the documentation system is trustworthy before stepping in front of the video cameras. For this we add a TPM to the 4 Crypt machine and conduct a measured boot sequence that includes measurements of the 4 Crypt software and its configuration. The measurements are performed on a Linux machine with TrustedGRUB [25] and the Integrity Measurement Architecture (IMA) developed by [PERSON] et al. [26], which since has been integrated in the Linux kernel. As a result, each 4 Crypt system can prove that it has not been maliciously modified by presenting its measurement log and a corresponding quote. These measurements can then be compared to valid fingerprints of an unmodified 4 Crypt software stack that have been deposited at a _trusted third party_ (TTP) during the deployment of the documentation system. To facilitate the verification process of 4 Crypt systems, we designed and implemented a remote attestation protocol that can be executed over NFC. This allows workers to install an Android application on their personal smartphones and use it to attest the integrity of any 4 Crypt system by simply holding their phone near the provided NFC-reader. We execute our attestation protocol in conjunction with the smartphone-based authentication of the worker that takes place before each recorded work step. That way the remote attestation seamlessly integrates into the normal operation of the video documentation system. Figure 7 shows how our NFC-capable remote attestation protocol works on a high level. We implemented this protocol in accordance with the Trusted Attestation Protocol (TAP) that has recently been standardized by the Trusted Computing Group [27]. For the attestation service on the documentation system, we use JavaScriptCard and Google's gRPC framework [28]. For the Android application we implemented a custom-built NFC service handler. Whenever a worker holds his smartphone near the NFC-reader at the assembly station, a fresh nonce is randomly drawn and transmitted over NFC to the attestation service running on the 4 Crypt system. The attestation service then uses the TPM to create a signed quote that includes the current fingerprints stored in the PCRs as well as the received nonce. The quote and its signature are then transmitted back to the smartphone and verified. This verification process consists of three steps. First, the verifier checks if the previously selected nonce is in fact contained in the quote. This prevents the prover from reusing old quotes in a replay attack. Then the verifier checks the validity of the quote signature under the known AIK public key. If this is successful as well, the verifier finally must evaluate whether the attested fingerprints match the unmodified 4 Crypt system. For this the verifier retrieves a set of valid fingerprints from the trusted third party and compares them to the fingerprints contained in the quote. If all verification steps are successful, the Android application shows that the worker can trust the video documentation system. If instead the  
Figure 7: NFC-capable remote attestation protocol integrated into 4 Crypt. attestation process reveals that the documentation system has been modified, the Android application stores the signed quote as proof of the illegitimate system modification. Then the worker can safely refuse to operate under video surveillance without having to fear negative repercussions by the employer.