Skip to main content
Springer Nature Link
Log in

ICITPM: Integrity Validation of Software in Iterative Continuous Integration Through the Use of Trusted Platform Module (TPM)

  • Conference paper
  • First Online:
Computer Security (ESORICS 2020)

Part of the book series: Lecture Notes in Computer Science ((LNSC,volume 12580))

Included in the following conference series:

Abstract

Software development has passed from being rigid and not very flexible, to be automated with constant changes. This happens due to the creation of continuous integration and delivery environments. Nevertheless, developers often rely on such environments due to the large number of amenities they offer. They focus on authentication only, without taking into consideration other aspects of security such as the integrity of the source code and of the compiled binaries. The source code of a software project must not be maliciously modified. Notwithstanding, there is no safe method to verify that its integrity has not been violated. Trusted computing technology, in particular, the Trusted Platform Module (TPM) can be used to implement that secure method.

This is a preview of subscription content, log in via an institution to check access.

Access this chapter

Log in via an institution

Subscribe and save

Springer+ Basic
$34.99 /Month
  • Get 10 units per month
  • Download Article/Chapter or eBook
  • 1 Unit = 1 Article or 1 Chapter
  • Cancel anytime
Subscribe now

Buy Now

Chapter
USD 29.95
Price excludes VAT (USA)
  • Available as PDF
  • Read on any device
  • Instant download
  • Own it forever

Tax calculation will be finalised at checkout

Purchases are for personal use only

Institutional subscriptions

Similar content being viewed by others

Notes

  1. 1.

    https://jenkins.io/.

  2. 2.

    https://circleci.com/.

  3. 3.

    https://aws.amazon.com/es/codebuild/.

  4. 4.

    https://docs.microsoft.com/en-us/azure/devops/?view=azure-devops.

  5. 5.

    https://www.atlassian.com/software/bamboo.

  6. 6.

    https://travis-ci.com/.

  7. 7.

    https://github.com/.

  8. 8.

    https://about.gitlab.com/.

  9. 9.

    https://wiki.jenkins.io/pages/viewpage.action?pageId=58001258.

  10. 10.

    https://kde.org/.

  11. 11.

    https://www.apache.org/.

  12. 12.

    https://angularjs.org/.

  13. 13.

    https://ubuntu.com/.

  14. 14.

    https://www.amazon.com/914-4136-105-Module-Infineon-Chip-9665/dp/B075FBGTG9/ref=sr_1_2?dchild=1&keywords=TPM+Chip+infineon&qid=1592740968&sr=8-2.

References

  1. Black duck. https://www.blackducksoftware.com/. Accessed 3 July 2020

  2. IBM’s TPM 2.0 TSS. https://sourceforge.net/projects/ibmtpm20tss/. Accessed 19 June 2020

  3. Jfrog. https://jfrog.com/. Accessed 3 July 2020

  4. The secure shell (SSH) public key file format. https://tools.ietf.org/html/rfc4716

  5. Security monkey. https://securitymonkey.readthedocs.io/en/latest/quickstart.html/. Accessed 3 July 2020

  6. Servico Antibotnet. https://www.osi.es/es/servicio-antibotnet/info/mirai. Accessed 19 June 2020

  7. Snyk. https://snyk.io/. Accessed 3 July 2020

  8. Harpaz, O., Goldberg, D.: The Nanshou Campaign - Hackers Arsenal Grows Stronger (2013). https://www.guardicore.com/2019/05/nansh0u-campaign-hackers-arsenal-grows-stronger/. Accessed 19 June 2020

  9. Arthur, W., Challener, D., Goldman, K.: Platform security technologies that use TPM 2.0. A Practical Guide to TPM 2.0, pp. 331–348. Apress, Berkeley, CA (2015). https://doi.org/10.1007/978-1-4302-6584-9_22

    Chapter  Google Scholar 

  10. Bass, L., Holz, R., Rimba, P., Tran, A.B., Zhu, L.: Securing a deployment pipeline. In: 2015 IEEE/ACM 3rd International Workshop on Release Engineering, pp. 4–7. IEEE (2015)

    Google Scholar 

  11. Bass, L., Weber, I., Zhu, L.: DevOps: a software architect’s perspective. sei series in software engineering. Addison-Wesley, New York (2015). http://my.safaribooksonline.com/9780134049847

  12. Bennetts, S.: Owasp zed attack proxy. AppSec USA (2013)

    Google Scholar 

  13. Bird, J.: DevOpsSec: Securing Software Through Continuous Delivery. O’Reilly Media, Sebastopol (2016)

    Google Scholar 

  14. Chacon, S., Straub, B.: Pro Git. Springer Nature, Switzerland (2014)

    Book  Google Scholar 

  15. Deepa, G., Thilagam, P.S.: Securing web applications from injection and logic vulnerabilities: approaches and challenges. Inf. Softw. Technol. 74, 160–180 (2016)

    Article  Google Scholar 

  16. Dheerendra, M., Sourav, M., Saru, K., Khurram, K.M., Ankita, C.: Security enhancement of a biometric based authentication scheme for telecare medicine information systems with nonce. J. Med. Syst. 38(5), 41 (2014)

    Article  Google Scholar 

  17. Felten, E: The Linux Backdoor Attempt of 2003. https://freedom-to-tinker.com/2013/10/09/the-linux-backdoor-attempt-of-2003/

  18. Guan, H., Chen, W.R., Li, H., Wang, J.: Stride-based risk assessment for web application. In: Applied Mechanics and Materials, vol. 58, pp. 1323–1328. Trans Tech Publ (2011)

    Google Scholar 

  19. Huang, Y.W., Yu, F., Hang, C., Tsai, C.H., Lee, D.T., Kuo, S.Y.: Securing web application code by static analysis and runtime protection. In: Proceedings of the 13th International Conference on World Wide Web, pp. 40–52 (2004)

    Google Scholar 

  20. Humble, J., Farley, D.G.: Continuous Delivery: Reliable Software Releases through Build, Test, and Deployment Automation. Addison-Wesley, Upper Saddle River (2010). http://my.safaribooksonline.com/9780321601919

  21. Ellingwood, J.: An Introduction to CI/CD Best Practices (2013). https://www.digitalocean.com/community/tutorials/an-introduction-to-ci-cd-best-practices. Accessed 19 June 2020

  22. Krusche, S., Lichter, H., Riehle, D., Steffens, A.: Report of the 2nd workshop on continuous software engineering. In: CSE@ SE, pp. 1–6 (2017)

    Google Scholar 

  23. Kuusela, J., et al.: Security testing in continuous integration processes (2017)

    Google Scholar 

  24. Lee, T., Won, G., Cho, S., Park, N., Won, D.: Detection and mitigation of web application vulnerabilities based on security testing. In: Park, J.J., Zomaya, A., Yeo, S.-S., Sahni, S. (eds.) NPC 2012. LNCS, vol. 7513, pp. 138–144. Springer, Heidelberg (2012). https://doi.org/10.1007/978-3-642-35606-3_16

    Chapter  Google Scholar 

  25. Lipke, S.: Building a secure software supply chain (2017)

    Google Scholar 

  26. Microsoft: BitLocker most frequenly asked questions. https://docs.microsoft.com/es-es/windows/security/information-protection/bitlocker/bitlocker-overview-and-requirements-faq. Accessed 19 June 2020

  27. Milka, G.: Anatomy of account takeover. In: Enigma 2018 (Enigma 2018) (2018)

    Google Scholar 

  28. Mohan, V., Othmane, L.B.: Secdevops: is it a marketing buzzword?-mapping research on security in devops. In: 2016 11th International Conference on Availability, Reliability and Security (ARES), pp. 542–547. IEEE (2016)

    Google Scholar 

  29. OWASP: pen web application security project (OWASP) howpublished = https://www.owasp.org/. Accessed 2 July 2020

  30. Rahman, A.A.U., Williams, L.: Software security in devops: synthesizing practitioners’ perceptions and practices. In: 2016 IEEE/ACM International Workshop on Continuous Software Evolution and Delivery (CSED), pp. 70–76. IEEE (2016)

    Google Scholar 

  31. Rimba, P., Zhu, L., Bass, L., Kuz, I., Reeves, S.: Composing patterns to construct secure systems. In: 2015 11th European Dependable Computing Conference (EDCC), pp. 213–224. IEEE (2015)

    Google Scholar 

  32. Kumari, S., Das, A.K., Li, X., Wu, F., Khan, M.K., Jiang, Q., Hafizul Islam, S.K.: A provably secure biometrics-based authenticated key agreement scheme for multi-server environments. Multimed. Tools Appl. 77(2), 2359–2389 (2017). https://doi.org/10.1007/s11042-017-4390-x

    Article  Google Scholar 

  33. Sathyanarayanan, N., Nanda, M.N.: Two layer cloud security set architecture on hypervisor. In: 2018 Second International Conference on Advances in Electronics, Computers and Communications (ICAECC), pp. 1–5. IEEE (2018)

    Google Scholar 

  34. Schneider, C.: Security devops-staying secure in agile projects. OWASP AppSec Europe (2015)

    Google Scholar 

  35. Stevens, M., Bursztein, E., Karpman, P., Albertini, A., Markov, Y.: The first collision for full SHA-1. In: Katz, J., Shacham, H. (eds.) CRYPTO 2017. LNCS, vol. 10401, pp. 570–596. Springer, Cham (2017). https://doi.org/10.1007/978-3-319-63688-7_19

    Chapter  Google Scholar 

  36. Tichy, M., Goedicke, M., Bosch, J., Fitzgerald, B.: Rapid continuous software engineering. J. Syst. Softw. 133, 159 (2017)

    Article  Google Scholar 

  37. Ullah, F., Raft, A.J., Shahin, M., Zahedi, M., Babar, M.A.: Security support in continuous deployment pipeline. arXiv preprint arXiv:1703.04277 (2017)

  38. XebiaLabs: Behaviour driven development security. https://xebialabs.com/technology/bdd-security/. Accessed 3 July 2020

Download references

Acknowledgment

This research has been funded by the Marie Skłodowska-Curie SealedGRID grant agreement No. 777996 and the H2020-SC1-FA-DTS-2018-1 CUREX under grant agreement No. 826404.

Author information

Authors and Affiliations

  1. Computer Science Department, University of Malaga Campus de Teatinos s/n, 29071, Malaga, Spain

    Antonio Muñoz & Jordy Ryan Casas Correia

  2. Neurosoft S.A., Athens, Greece

    Aristeidis Farao

  3. Department of Digital Systems, University of Piraeus, Piraeus, Greece

    Christos Xenakis

Authors
  1. Antonio Muñoz
    View author publications

    You can also search for this author in PubMed Google Scholar

  2. Aristeidis Farao
    View author publications

    You can also search for this author in PubMed Google Scholar

  3. Jordy Ryan Casas Correia
    View author publications

    You can also search for this author in PubMed Google Scholar

  4. Christos Xenakis
    View author publications

    You can also search for this author in PubMed Google Scholar

Corresponding author

Correspondence to Antonio Muñoz .

Editor information

Editors and Affiliations

  1. University of Surrey, Guildford, UK

    Ioana Boureanu

  2. University of Surrey, Guildford, UK

    Constantin Cătălin Drăgan

  3. University of Surrey, Guildford, UK

    Mark Manulis

  4. Technical University of Denmark, Kongens Lyngby, Denmark

    Thanassis Giannetsos

  5. Ionian University, Kerkira, Greece

    Christoforos Dadoyan

  6. UBITECH Ltd., Chalandri, Greece

    Panagiotis Gouvas

  7. Dartmouth College and Naval Information Warfare Center, Hanover, NH, USA

    Roger A. Hallman

  8. University of Kent, Canterbury, Kent, UK

    Shujun Li

  9. Teessside University, Middlesbrough, UK

    Victor Chang

  10. Technical University of Berlin, Berlin, Germany

    Frank Pallas

  11. Alexander von Humboldt Institute for Internet and Society, Berlin, Germany

    Jörg Pohle

  12. Ruhr University Bochum, Bochum, Germany

    Angela Sasse

Rights and permissions

Reprints and permissions

Copyright information

© 2020 Springer Nature Switzerland AG

About this paper

Check for updates. Verify currency and authenticity via CrossMark

Cite this paper

Muñoz, A., Farao, A., Correia, J.R.C., Xenakis, C. (2020). ICITPM: Integrity Validation of Software in Iterative Continuous Integration Through the Use of Trusted Platform Module (TPM). In: Boureanu, I., et al. Computer Security. ESORICS 2020. Lecture Notes in Computer Science(), vol 12580. Springer, Cham. https://doi.org/10.1007/978-3-030-66504-3_9

Download citation

  • DOI: https://doi.org/10.1007/978-3-030-66504-3_9

  • Published:

  • Publisher Name: Springer, Cham

  • Print ISBN: 978-3-030-66503-6

  • Online ISBN: 978-3-030-66504-3

  • eBook Packages: Computer ScienceComputer Science (R0)

Publish with us

Policies and ethics