Trust chain preservation for remote attestation
Disclosed herein are system, method, and computer program product embodiments for verifying the integrity of a boot process without relying on a boot aggregate value. An embodiment operates by cryptographically validating, by a hardware root of trust, a first code module associated with a digital signature. The embodiment determines that the first code module was cryptographically validated and cryptographically measures the first code module thereby generating a first measurement. The embodiment stores a representation of the first measurement in a first platform configuration register (PCR) of a trusted platform module. The embodiment configures a remote attestation agent to instruct a remote attestation server to attest the value stored in the first PCR. The embodiment transmits a TPM attestation quote to the remote attestation server. The embodiment receives an acknowledgment from the remote attestation server indicating a match between the value stored in the first PCR and an allowed cryptographic measurement.
1. A computer implemented method for verifying the integrity of a boot process without using a boot aggregate value computed by a trusted platform module (TPM), comprising:
cryptographically validating, by a hardware root of trust (HWRoT), a first code module associated with a digital signature;
determining, by the HWRoT, that the first code module was cryptographically validated upon a first boot;
based on a determination that the first code module was cryptographically validated upon the first boot, cryptographically measuring the first code module, by the HWRoT, thereby generating a first hash measurement;
storing the first hash measurement in a first platform configuration register (PCR) of the TPM;
cryptographically measuring a second code module, by the first code module, thereby generating a second hash measurement and storing the second hash measurement in a second PCR of the TPM;
configuring a remote attestation agent to instruct a remote attestation server to attest values stored in the first PCR and the second PCR, wherein the remote attestation server is configured to attest the values stored in the first PCR and the second PCR by identifying a match between the values stored in the first PCR and the second PCR and allowed cryptographic measurements in an allowed list of cryptographic measurements stored at the remote attestation server, and wherein the allowed list of cryptographic measurements is an allowed list of cryptographic hash values;
transmitting a TPM attestation quote to the remote attestation server, wherein the TPM attestation quote comprises the values stored in the first PCR and the second PCR; and
receiving an acknowledgment, from the remote attestation server, indicating a match between the values stored in the first PCR and the second PCR and the allowed cryptographic measurements in the allowed list of cryptographic measurements stored at the remote attestation server.
2. The method of claim 1 , wherein the cryptographically validating the first code module further comprises:
verifying the digital signature using a public key corresponding to the digital signature.
3. The method of claim 1 , further comprising:
determining, by the HWRoT, upon a subsequent boot, that the first code module was not cryptographically validated;
based on the determination, upon the subsequent boot, that the first code module was cryptographically not validated, replacing the first code module with an immutable copy of the first code module; and
cryptographically measuring the first code module thereby generating an updated first hash measurement.
4. The method of claim 1 , wherein the cryptographically measuring the first code module further comprises:
computing a cryptographic hash value of the first code module using a secure hash algorithm (SHA).
5. The method of claim 1 , further comprising:
cryptographically measuring a third code module thereby generating a third measurement; and
storing a representation of the third measurement in a third PCR of the TPM, wherein the representation of the third measurement is a hash of a current value stored in the third PCR and the third measurement.
6. The method of claim 1 , wherein the first code module is a firmware used to perform hardware initialization during the boot process.
7. The method of claim 1 , wherein the remote attestation agent is a Keylime agent.
8. A system for verifying the integrity of a boot process without using a boot aggregate value computed based on platform configuration registers (PCR) values stored in a trusted platform module (TPM), comprising:
a memory;
a hardware root of trust (HWRoT);
the TPM; and
at least one processor coupled to the memory, the HWRoT, and the TPM,
wherein the HWROT is configured to:
cryptographically validate a first code module associated with a digital signature;
determine that the first code module was cryptographically validated upon a first boot; and
wherein, based on a determination that the first code module was cryptographically validated upon the first boot, the at least one processor is configured to:
cryptographically measure the first code module, using the HWRoT, thereby generating a first hash measurement;
store the first hash measurement in a first PCR of the TPM;
cryptographically measure a second code module, using the first code module, thereby generating a second hash measurement and storing the second hash measurement in a second PCR of the TPM;
configure a remote attestation agent to instruct a remote attestation server to attest values stored in the first PCR and the second PCR, wherein the remote attestation server is configured to attest the values stored in the first PCR and the second PCR by identifying a match between the values stored in the first PCR and the second PCR and allowed cryptographic measurements in an allowed list of cryptographic measurements stored at the remote attestation server, and wherein the allowed list of cryptographic measurements is an allowed list of cryptographic hash values;
transmit a TPM attestation quote to the remote attestation server, wherein the TPM attestation quote comprises the value stored in the first PCR and the second PCR; and
receive an acknowledgment, from the remote attestation server, indicating a match between the values stored in the first PCR and the second PCR and the allowed cryptographic measurements in the allowed list of cryptographic measurements stored at the remote attestation server.
9. The system of claim 8 , wherein to cryptographically validate the first code module, the HWROT is further configured to:
verify the digital signature using a public key corresponding to the digital signature.
10. The system of claim 8 , wherein the HWROT is further configured to:
determine, upon a subsequent boot, that the first code module was not cryptographically validated;
based on the determination, upon the subsequent boot, that the first code module was cryptographically not validated, replace the first code module with an immutable copy of the first code module; and
cryptographically measure the first code module thereby generating an updated first measurement.
11. The system of claim 8 , wherein to cryptographically measure the first code module, the HWROT is further configured to:
compute a cryptographic hash value of the first code module using a secure hash algorithm (SHA).
12. The system of claim 8 , wherein the at least one processor is further configured to:
cryptographically measure a third code module thereby generating a third measurement; and
store a representation of the third measurement in a third PCR of the TPM wherein the representation of the third measurement is a hash of a current value stored in the third PCR and the third measurement.
13. The system of claim 8 , wherein the first code module is a firmware used to perform hardware initialization during the boot process.
14. The system of claim 8 , wherein the remote attestation agent is a Keylime agent configured to communicate with a Keylime remote attestation server.
15. A non-transitory computer-readable medium (CRM) having instructions stored thereon that, when executed by at least one computing device, causes the at least one computing device to perform operations comprising:
cryptographically validating, using a hardware root of trust (HWRoT), a first code module associated with a digital signature;
determining, using the HWROT, that the first code module was cryptographically validated upon a first boot;
based on a determination that the first code module was cryptographically validated upon the first boot, cryptographically measuring the first code module, by the HWRoT, thereby generating a first hash measurement;
storing the first hash measurement in a first platform configuration register (PCR) of a trusted platform module (TPM);
cryptographically measuring a second code module, by the first code module, thereby generating a second hash measurement and storing the second hash measurement in a second PCR of the TPM;
configuring a remote attestation agent to instruct a remote attestation server to attest values stored in the first PCR and the second PCR, wherein the remote attestation server is configured to attest the values stored in the first PCR and the second PCR by identifying a match between the values stored in the first PCR and the second PCR and allowed cryptographic measurements in an allowed list of cryptographic measurements stored at the remote attestation server, and wherein the allowed list of cryptographic measurements is an allowed list of cryptographic hash values;
transmitting a TPM attestation quote to the remote attestation server, wherein the TPM attestation quote comprises the values stored in the first PCR and the second PCR; and
receiving an acknowledgment, from the remote attestation server, indicating a match between the values stored in the first PCR and the second PCR and the allowed cryptographic measurements in the allowed list of cryptographic measurements stored at the remote attestation server.
16. The non-transitory CRM of claim 15 , wherein the cryptographically validating the first code module comprises:
verifying the digital signature using a public key corresponding to the digital signature.
17. The non-transitory CRM of claim 15 , the operations further comprising:
determining, using the HWRoT, upon a subsequent boot, that the first code module was not cryptographically validated;
based on the determination, upon the subsequent boot, that the first code module was cryptographically not validated, replacing the first code module with an immutable copy of the first code module; and
cryptographically measuring the first code module thereby generating an updated first measurement.
18. The non-transitory CRM of claim 15 , wherein cryptographically measuring the first code module further comprises:
computing a cryptographic hash value of the first code module using a secure hash algorithm (SHA).
19. The non-transitory CRM of claim 15 , the operations further comprising:
cryptographically measuring a third code module thereby generating a third measurement; and
storing a representation of the third measurement in a third PCR of the TPM wherein the representation of the third measurement is a hash of a current value stored in the third PCR and the third measurement.
20. The non-transitory CRM of claim 15 , wherein the first code module is a firmware used to perform hardware initialization during a boot process.