vTPM: Virtualizing the Trusted Platform Module Joshua Schiffman - - PowerPoint PPT Presentation

vtpm virtualizing the trusted platform module
SMART_READER_LITE
LIVE PREVIEW

vTPM: Virtualizing the Trusted Platform Module Joshua Schiffman - - PowerPoint PPT Presentation

Systems and Internet Infrastructure Security Network and Security Research Center Department of Computer Science and Engineering Pennsylvania State University, University Park PA vTPM: Virtualizing the Trusted Platform Module Joshua Schiffman


slide-1
SLIDE 1

Systems and Internet Infrastructure Security (SIIS) Laboratory Page 1

Systems and Internet Infrastructure Security

Network and Security Research Center Department of Computer Science and Engineering Pennsylvania State University, University Park PA

vTPM: Virtualizing the Trusted Platform Module

Joshua Schiffman

slide-2
SLIDE 2

Systems and Internet Infrastructure Security (SIIS) Laboratory Page 2

It could happen to you…

  • Computers offer no implicit reason to trust them
  • Key Loggers, root kits, spy ware
  • Do you know of anyone who has fallen victim to one
  • f these?
  • What can we do?
slide-3
SLIDE 3

Systems and Internet Infrastructure Security (SIIS) Laboratory Page 3

Trusted Computing

  • The Trusted Computing Group suggests we:
  • Deploy a Trusted Platform Module (TPM) in all systems
  • And an infrastructure to support their use
  • Shamon?
  • TPMs allow a system to:
  • Gather and attest system state
  • Store and generate cryptographic data
  • Prove platform identity
slide-4
SLIDE 4

Systems and Internet Infrastructure Security (SIIS) Laboratory Page 4

Virtual Trust?

  • Unfortunately, your computer might be an illusion…
  • Advances in hardware virtualization
  • Improve system utilization
  • Saves money
  • Gives the illusion of an independent system
  • A Virtual Machine Monitor

(Hypervisor) could control what data is measured by the TPM

slide-5
SLIDE 5

Systems and Internet Infrastructure Security (SIIS) Laboratory Page 5

Virtualize the TPM

  • Cannot have multiple users per TPM
  • Why don’t we just virtualize the TPM?
  • It would violate its security properties
  • Trust rooted in hardware
  • VMs support unique lifecycles
  • Suspend and Resume on different platforms
  • How do you trust a transient environment?
slide-6
SLIDE 6

Systems and Internet Infrastructure Security (SIIS) Laboratory Page 6

Requirements

  • Authors identify four requirements for vTPMs:
  • Same usage model and command set
  • Strong association between VM and its vTPM instance
  • Strong association between real TPM and vTPM
  • Easy to distinguish between real and virtual TPM
slide-7
SLIDE 7

Systems and Internet Infrastructure Security (SIIS) Laboratory Page 7

The vTPM Model

  • Similar to Xen, Dom-0:
  • Contains access to the

hardware TPM

  • Control of vTPM

instances

  • Can spawn vTPMs
  • Client-side driver

request are routed to the server-side drivers

slide-8
SLIDE 8

Systems and Internet Infrastructure Security (SIIS) Laboratory Page 8

Secure Coprocessor

  • The vTPM design was made to be modular
  • PCI-X Cryptographic Coprocessor
  • Accelerated cryptographic engine
  • Tamper-Responsive
  • Not all TPMs have this support
  • Expensive
slide-9
SLIDE 9

Systems and Internet Infrastructure Security (SIIS) Laboratory Page 9

Xend is your Friend

  • Implementation modified Xen to support the vTPM
  • Xen Management tool parses config file
  • Xend determines where the vTPM manager is located
  • Xenstore, frontend, backend, hotplug scripts
  • A table of VM to vTPMs is also maintained
  • Absence of mapping = create new instance
  • Presence of mapping = resume vTPM
slide-10
SLIDE 10

Systems and Internet Infrastructure Security (SIIS) Laboratory Page 10

Driver Considerations

  • Existing TPM protocol assumes
  • Reliable bus
  • Must ensure a response is given to the last message

before suspending the OS

  • Shared memory (grant tables) is used to

communicate between Front and Backends

  • Concurrent access
slide-11
SLIDE 11

Systems and Internet Infrastructure Security (SIIS) Laboratory Page 11

Interesting Issues

  • VM migration
  • Associating vTPM with underlying system
  • Key management
  • Trust Management
slide-12
SLIDE 12

Systems and Internet Infrastructure Security (SIIS) Laboratory Page 12

VM Migration

  • Created extensions to TPM 1.2 command set
  • vTPM Management / Migration / Utility commands
  • Migration is rather straightforward:
  • Create instance with associated nonce
  • Lock source with nonce and encrypt with key
  • Wrapped with parent TPM instance SRK
  • Serialize and update message digest
  • Migrate data, digest and verify
slide-13
SLIDE 13

Systems and Internet Infrastructure Security (SIIS) Laboratory Page 13

Associating the Real TPM

  • The TPM has security properties that makes it

different from most hardware

  • Virturalized TPMs cannot be totally transparent
  • Must have knowledge of the underlying system
  • Solution: Divide the PCRs into localities
  • Lower set used for system
  • Upper set for the vTPM instance
  • Issues with nested VMs?
slide-14
SLIDE 14

Systems and Internet Infrastructure Security (SIIS) Laboratory Page 14

Key Hierarchy

  • Root keys stored inside the TPM to prevent leakage
  • Endorsement Key (EK) to identify the platform
  • Manufacture certificates not so common as once prescribed
  • Storage Root Key (SRK) to seal (encrypt) data / keys
  • vTPMs are too ephemeral to bind to hardware TPM
  • They are kept independent of the platform
  • Speeds key creation
  • Persistent store emulated with real TPM
slide-15
SLIDE 15

Systems and Internet Infrastructure Security (SIIS) Laboratory Page 15

Trust Management

  • AIKs and SKs follows a chain of keys rooted

hardware

  • Programs rely on these keys (TSS, User PS)
  • Migrating VMs will change their host TPM EK
  • vTPM EKs are freshly generated for each VM
  • How can we identify a vTPM EK?
  • Some VMs may not want to be on certain machines
slide-16
SLIDE 16

Systems and Internet Infrastructure Security (SIIS) Laboratory Page 16

Suggestions

  • Create EK’ for each vTPM
  • Create an AIK’ for all vTPMs
  • Use a local authority to verify the vTPM
  • Use a secure coprocessor
slide-17
SLIDE 17

Systems and Internet Infrastructure Security (SIIS) Laboratory Page 17

Create an EK

slide-18
SLIDE 18

Systems and Internet Infrastructure Security (SIIS) Laboratory Page 18

Create AIK

slide-19
SLIDE 19

Systems and Internet Infrastructure Security (SIIS) Laboratory Page 19

Take Away

  • Virtualizing a TPM is not as easy as normal hardware
  • Security and trust must be addressed
  • It is not clear how to establish trust in a transient

TPM identity

  • We can compromise