"Secure Endpoints, Secure Network" is my presentation from the NYU-Poly THREADS conference on November 14, 2013, summarizing the work that JW Secure has done since our DARPA Cyber Fast Track project, "BIOS Integrity Measurements Heuristics Tool." The focus is on the techniques and commercialization potential for TPM remote platform attestation.

1. Secure Endpoints, Secure
Network
BIOS Integrity Measurements
Heuristics Tool for CFT
Dan Griffin
JW Secure, Inc.

2. WWNSAD?
• NSA and NIST have been public about:
– Inevitability of mobile computing
– Need to support cloud-based services
– Even for use with secret data in the field
• What works for them can work for you

8. Introduction
• What is a TPM?
• What is “measured boot”?
• What is “remote attestation”?

9. Measured Boot + Remote
Attestation

10. What is measured boot?
BIOS
Boot
Loader
Kernel
Hash of next item(s)
TPM
[PCR data]
[AIK pub]
[Signature]
Boot Log
Early
Drivers

11. What is remote attestation?
Client Device
Signed
Boot
Log
TPM
some token…
Attestation
Server

12. Weaknesses
• Provisioning
– Secure supply chain?
– TPM EK database
– Patching delay & whitelist maintenance
• Integrity of the TPM hardware
– Capping; electron microscopes
– Trend of migration from hardware to firmware
• Hibernate file is unprotected

13. Post-CFT
• Measurement-Bound Keys
– “Trusted Tamperproof Time on Mobile
Devices”
– See http://www.jwsecure.com/dan
• Commercialization
– JW Secure StrongNet
– RSA 2013

15. Questions?
dan@jwsecure.com
206-683-6551
@JWSdan
JW Secure provides custom security
software development services.