Integrity manifest certificate
Examples disclosed herein relate to using an integrity manifest certificate to verify the state of a platform. A device identity of a device that has the device identity provisioned and stored in a security co-processor to retrieve an integrity proof from the security co-processor. The device includes at least one processing element, at least one memory device, and a bus including at least one bus device, and wherein the device identity is associated with a device identity certificate signed by a first authority. The integrity proof includes a representation of each of a plurality of hardware components including the at least one processing element, the at least one memory device, the at least one bus device, and a system board and a representation of plurality of firmware components included in the device. The integrity proof is provided to a certification station. The certification station determines that the integrity proof is an expected value based on an expected provisioning state of the device and the device identity. The certification station signs, using a second authority, an integrity manifest certificate, based on the integrity proof and the device identity. The integrity manifest certificate is stored.
1. A method comprising:
receiving, by a verification station, a device identity provided by a device;
receiving, by the verification station, an integrity proof of the device, wherein the integrity proof is stored in a security co-processor of the device, and the integrity proof comprises a representation of a hardware component of the device and a representation of a firmware component of the device;
determining, by the verification station, whether the integrity proof is an expected value based on an expected provisioning state of the device and the device identity; and
responsive to the determination of whether the integrity proof is the expected value, signing, by the verification station, an integrity manifest certificate based on the integrity proof and the device identity to provide a signed integrity manifest certificate.
2. The method of claim 1 , further comprising:
requesting, by the verification station, the device identity from the device;
verifying, by the verification station, the device identity; and
responsive to the verification of the device identity, requesting, by the verification station, the integrity proof from the device.
3. The method of claim 1 , wherein determining that the integrity proof is the expected value comprises comparing, by the verification station, the integrity proof to an initial integrity manifest corresponding to the device.
4. The method of claim 3 , further comprising:
receiving, by the verification station, an integrity manifest certificate corresponding to the initial integrity manifest from a stored location associated with the security co-processor.
5. The method of claim 1 , wherein the integrity proof represents event logs of the device, and the method further comprises:
determining the expected provisioning state of the device based on an initial integrity manifest corresponding to the device and the event logs.
6. The method of claim 1 , further comprising determining the expected provisioning state of the device based on a number of times the device has been booted between verifications of the device.
7. The method of claim 1 , further comprising:
performing a security action in response to the determination that the integrity proof is not the expected value.
8. The method of claim 1 , further comprising:
verifying, by the verification station, a device identity certificate corresponding to the device identity; and
performing a security action in response to the verifying determining that the device identity certificate is not valid.
9. The method of claim 1 , wherein the integrity proof further comprises a representation of at least one processing element of the device and a representation of a software to execute on the at least one processing element.
10. A system comprising:
a hardware processor; and
a memory to store instructions that, when executed by the hardware processor cause the hardware processor to:
receive a device identity provided by a device;
receive an integrity proof of the device, wherein the integrity proof is stored in a security co-processor of the device, and the integrity proof comprises a representation of a hardware component of the device and a representation of a firmware component of the device;
determine whether the integrity proof is an expected value based on an expected provisioning state of the device and the device identity; and
responsive to the determination of whether the integrity proof is the expected value, sign an integrity manifest certificate based on the integrity proof and the device identity to provide a signed integrity manifest certificate.
11. The system of claim 10 , wherein the instructions, when executed by the hardware processor, further cause the hardware processor to:
request, by the verification station, the device identity from the device;
verify, by the verification station, the device identity and
responsive to the verification of the device identity, request, by the verification station, the integrity proof from the device.
12. The system of claim 10 , wherein the instructions, when executed by the hardware processor, further cause the hardware processor to:
compare the integrity proof to an initial integrity manifest corresponding to the device.
13. The system of claim 10 , wherein the instructions, when executed by the hardware processor, further cause the hardware processor to:
receive an integrity manifest certificate corresponding to the initial integrity manifest from a stored location associated with the security co-processor.
14. The system of claim 10 , wherein the integrity proof represents event logs of the device, and the instructions, when executed by the hardware processor, further cause the hardware processor to:
determine the expected provisioning state of the device based on an initial integrity manifest corresponding to the device and the event logs.
15. The system of claim 10 , wherein the instructions, when executed by the hardware processor, further cause the hardware processor to:
perform a security action in response to a determination that the integrity proof is not the expected value.
16. The system of claim 10 , wherein the instructions, when executed by the hardware processor, further cause the hardware processor to:
verify a device identity certificate corresponding to the device identity; and
perform a security action in response to the verification of determining that the device identity certificate is not valid.
17. A non-transitory machine-readable storage medium storing instructions that, when executed by a physical processing element of a system, cause the system to:
receive a device identity provided by a device;
receive an integrity proof of the device, wherein the integrity proof is stored in a security co-processor of the device, and the integrity proof comprises a representation of a hardware component of the device and a representation of a firmware component of the device;
determine whether the integrity proof is an expected value based on an expected provisioning state of the device and the device identity; and
responsive to the determination of whether the integrity proof is the expected value, sign an integrity manifest certificate based on the integrity proof and the device identity to provide a signed integrity manifest certificate.
18. The medium of claim 17 , wherein the instructions, when executed by the physical processing element, further cause the system to:
request the device identity from the device;
verify the device identity; and
responsive to the verification of the device identity, request the integrity proof from the device.
19. The medium of claim 17 , wherein the instructions, when executed by the physical processing element, further cause the system to:
compare the integrity proof to an initial integrity manifest corresponding to the device.
20. The medium of claim 17 , wherein the integrity proof represents event logs of the device, and the instructions, when executed by the processing element, further cause the system to:
determine the expected provisioning state of the device based on an initial integrity manifest corresponding to the device and the event logs.