Bachelors Thesis: A Certification Service for future Home Networks - - PowerPoint PPT Presentation

▶

Feb 28, 2023 210 likes •557 views

Lehrstuhl Netzarchitekturen und Netzdienste Institut fr Informatik TU Mnchen Bachelors Thesis: A Certification Service for future Home Networks based on Trusted Computing Technology Announcement: Prof. Georg Carle Advisor: Holger

SLIDE 1

Lehrstuhl Netzarchitekturen und Netzdienste Institut für Informatik TU München

Bachelor‘s Thesis: A Certification Service for future Home Networks based on Trusted Computing Technology

Announcement: Prof. Georg Carle Advisor: Holger Kinkelin Student: Simon Mittelberger Lehrstuhl für Netzarchitekturen und Netzdienste TU München

SLIDE 2

Bachelor Thesis SS 2009 2

Agenda

 Existing Approach  Security Analysis / Motivation  Key Requirements  Approach  Evaluation  Related Work  Conclusion & Future Work

SLIDE 3

Bachelor Thesis SS 2009 3

AutHoNe’s PKI

SLIDE 4

Bachelor Thesis SS 2009 4

Trust Relationship

SLIDE 5

Bachelor Thesis SS 2009 5

Trust Relationship

SLIDE 6

Bachelor Thesis SS 2009 6

Security Analysis / Motivation

Home Key and Device Key are in Danger

 Identity Theft  Treacherous Home  Treacherous Device

SLIDE 7

Bachelor Thesis SS 2009 7

Trust Relationship

SLIDE 8

Bachelor Thesis SS 2009 8

Identity Theft

SLIDE 9

Bachelor Thesis SS 2009 9

Identity Theft

SLIDE 10

Bachelor Thesis SS 2009 10

Identity Theft

SLIDE 11

Bachelor Thesis SS 2009 11

Identity Theft

SLIDE 12

Bachelor Thesis SS 2009 12

Treacherous Device

SLIDE 13

Bachelor Thesis SS 2009 13

Treacherous Device

SLIDE 14

Bachelor Thesis SS 2009 14

 R1 Protection of the Private Key

Home Key
Device Key

 R2 Prove Protection to other Entities  R3 Backup of the Home Key

Key Requirements

SLIDE 15

Bachelor Thesis SS 2009 15

 Private part of a Key managed through a TPM is never readable from

the outside => R1 (Protection)

 Protection and type of protection is provable => R2 (Proof)  Certain Migration Schemes allow a Migration of a Key to another TPM

=> R3 (Backup)

Approach

Use a Trusted Platform Module (TPM) for Management of the Key

SLIDE 16

Bachelor Thesis SS 2009 16

Important Keys in a TPM

 Endorsement Key (EK): unique for every TPM, can only sign internal

data, not migratable

 Attestation Identity Key (AIK): derives from EK, can only sign internal

data, not migratable

 Signing Key (SK): only signing operations of internal and external data,

migratable/not migratable

 Legacy Key (LK): signing and encryption operations of internal and

external data, migratable/not migratable

SLIDE 17

Bachelor Thesis SS 2009 17

Current AutHoNe PKI

SLIDE 18

Bachelor Thesis SS 2009 18

AutHoNe TPM Integration

SLIDE 19

Bachelor Thesis SS 2009 19

TPM Credentials

SLIDE 20

Bachelor Thesis SS 2009 20

TPM Credentials - Migratability

SLIDE 21

Bachelor Thesis SS 2009 21

Evaluation

No TPM Protection Migratable Key Non Migratable Key Usability - Backup of Key Possible Attacks

Identity Theft
Treacherous Device
Treacherous Home

SLIDE 22

Bachelor Thesis SS 2009 22

Evaluation

No TPM Protection Migratable Key Non Migratable Key Usability - Backup of Key

Backup of Key

Possible Attacks

Identity Theft
Treacherous Device
Treacherous Home
Treacherous Device
Treacherous Home

SLIDE 23

Bachelor Thesis SS 2009 23

Evaluation

No TPM Protection Migratable Key Non Migratable Key Usability - Backup of Key

Backup of Key
No Backup of Key

Possible Attacks

Identity Theft
Treacherous Device
Treacherous Home
Treacherous Device
Treacherous Home
Treacherous Home

SLIDE 24

Bachelor Thesis SS 2009 24

Treacherous Home

SLIDE 25

Bachelor Thesis SS 2009 25

Evaluation

 Trade off between usability and security caused by migratability

Migratable Key = weak security, strong usability
Non Migratable Key = strong security, weak usability

No TPM Protection Migratable Key Non Migratable Key Usability - Backup of Key

Backup of Key
No Backup of Key

Possible Attacks

Identity Theft
Treacherous Device
Treacherous Home
Treacherous Device
Treacherous Home
Treacherous Home

SLIDE 26

Bachelor Thesis SS 2009 26

Performance

 Performance of the Device Registration Process

SLIDE 27

Bachelor Thesis SS 2009 27

Performance

 Performance of the Device Registration Process

Device Device with TPM Create CSR 0.697s 1.169s Process CSR through HCS 1.261s 1.427s Process CSR through Device 0.555s 0.815s

*Times without loading time and network transmissions

SLIDE 28

Bachelor Thesis SS 2009 28

Technical Limitations

 Infrastructure is not completed

PCA does not exist yet (only proof of concept)
Not all TPM Manufacturers ship the EK Certificates
Other Certificates unavailable
Migration Infrastructure is incomplete

SLIDE 29

Bachelor Thesis SS 2009 29

Related Work: SKAE

SLIDE 30

Bachelor Thesis SS 2009 30

SKAE vs. this Approach

 AIK signs Key directly

=> no migratability

 No outstanding

benefit, reached through SKAE

 CA PCA: central entities involved in the process

=> overhead

SLIDE 31

Bachelor Thesis SS 2009 31

Conclusion

 Main Goal achieved:

Private Home Key is protected through a TPM

 Design is dynamic and applicable also on a Device  Trade off:

usability vs. security <=> migratability vs. non migratability

 Trade off at users side

SLIDE 32

Bachelor Thesis SS 2009 32

Future Work

 Infrastructure has to be completed  Exploit advantages of provable TPM protection

Trust Level leads to Access Level

SLIDE 33

Bachelor Thesis SS 2009 33

Questions?

SLIDE 34

Bachelor Thesis SS 2009 34

Literature

 Thomas Müller – Trusted Computing Systeme  Trusted Computing Group – TPM Specification Part 1, Part 2, Part 3

http://www.trustedcomputinggroup.org/resources/ tpm_specification_version_12_revision_103_part_1__3/

 TCG Infrastructure Workgroup – Subject Key Attestation Evidence

http://www.trustedcomputinggroup.org/files/resource_files/ 876A7F79-1D09-3519-AD321B21144AE93C/ IWG_SKAE_Extension_1-00.pdf

 IAIK TU Graz - Trusted Computing for the JAVA Platform

http://trustedjava.sourceforge.net/

 Simon Mittelberger – A Certification Service for future Home Networks