Abstract
Credential platforms implemented on top of Trusted Execution Environments (TrEEs) allow users to store and use their credentials, e.g., cryptographic keys or user passwords, securely. One important requirement for a TrEE-based credential platform is the ability to attest that a credential has been created and is kept within the TrEE. Credential properties, such as usage permissions, should be also attested. Existing attestation mechanisms are limited to attesting which applications outside the TrEE are authorized to use the credential. In this paper we describe a novel key attestation mechanism that allows attestation of both TrEE internal and external key usage permissions. We have implemented this attestation mechanism for mobile phones with M-Shield TrEE.
This is a preview of subscription content, log in via an institution to check access.
Access this chapter
Tax calculation will be finalised at checkout
Purchases are for personal use only
Preview
Unable to display preview. Download preview PDF.
Similar content being viewed by others
References
ARM. Trustzone technology overview (2009), http://www.arm.com/products/security/trustzone/index.html
Baiardi, F., Cilea, D., Sgandurra, D., Ceccarelli, F.: Measuring semantic integrity for remote attestation. In: Chen, L., Mitchell, C.J., Martin, A. (eds.) Trust 2009. LNCS, vol. 5471, pp. 81–100. Springer, Heidelberg (2009)
Costan, V., Sarmenta, L.F.G., van Dijk, M., Devadas, S.: The trusted execution module: Commodity general-purpose trusted computing. In: Grimaud, G., Standaert, F.-X. (eds.) CARDIS 2008. LNCS, vol. 5189, pp. 133–148. Springer, Heidelberg (2008), http://people.csail.mit.edu/devadas/pubs/cardis08tem.pdf
Internet Crime Complaint Center. Internet crime report (2008), http://www.ic3.gov/media/annualreport/2008_IC3Report.pdf
Itoi, N., Arbaugh, W.A., Pollack, S.J., Reeves, D.M.: Personal secure booting. In: Varadharajan, V., Mu, Y. (eds.) ACISP 2001. LNCS, vol. 2119, pp. 130–144. Springer, Heidelberg (2001)
JavaCard Technology, http://java.sun.com/products/javacard/
Kostiainen, K., Ekberg, J.-E., Asokan, N., Rantala, A.: On-board credentials with open provisioning. In: Proc. of ACM Symposium on Information, Computer & Communications Security, ASIACCS 2009 (2009)
The Programming Language Lua, http://www.lua.org/
Petroni Jr., N.L., Fraser, T., Molina, J., Arbaugh, W.A.: Copilot - a coprocessor-based kernel runtime integrity monitor. In: Proceedings of the 13th USENIX Security Symposium, August 2004, pp. 179–194. USENIX (2004)
Nokia. Symbian OS platform security, http://www.forum.nokia.com/Technology_Topics/Device_Platforms/S60/Platform_Security/
Rundgren, A.: Subject key attestation in keygen2 (2009), http://webpki.org/papers/keygen2/keygen2-key-attestation-1.pdf
SANS Institute. SANS Top-20 2007 Security Risks (November 2008), http://www.sans.org/top20/2007/top20.pdf
Smith, S.W.: Outbound authentication for programmable secure coprocessors. International Journal of Information Security 3, 28–41 (2004)
Srage, J., Azema, J.: M-Shield mobile security technology, TI White paper (2005), http://focus.ti.com/pdfs/wtbu/ti_mshield_whitepaper.pdf
Trusted Computing Group, https://www.trustedcomputinggroup.org/home
TCG Infrastructure Workgroup. Subject Key Attestation Evidence Extension Specification Version 1.0 Revision 7 (June 2005), https://www.trustedcomputinggroup.org/specs/IWG/
Trusted Platform Module (TPM) Specifications, https://www.trustedcomputinggroup.org/specs/TPM/
Author information
Authors and Affiliations
Editor information
Editors and Affiliations
Rights and permissions
Copyright information
© 2010 Springer-Verlag Berlin Heidelberg
About this paper
Cite this paper
Kostiainen, K., Dmitrienko, A., Ekberg, JE., Sadeghi, AR., Asokan, N. (2010). Key Attestation from Trusted Execution Environments. In: Acquisti, A., Smith, S.W., Sadeghi, AR. (eds) Trust and Trustworthy Computing. Trust 2010. Lecture Notes in Computer Science, vol 6101. Springer, Berlin, Heidelberg. https://doi.org/10.1007/978-3-642-13869-0_3
Download citation
DOI: https://doi.org/10.1007/978-3-642-13869-0_3
Publisher Name: Springer, Berlin, Heidelberg
Print ISBN: 978-3-642-13868-3
Online ISBN: 978-3-642-13869-0
eBook Packages: Computer ScienceComputer Science (R0)