1. Copyright © 1995-2006 Clifford Neuman - UNIVERSITY OF SOUTHERN CALIFORNIA - INFORMATION SCIENCES INSTITUTE USC CSci599 Trusted Computing Lecture Ten – Protecting the Platform March 28, 2007 Dr. Clifford Neuman University of Southern California Information Sciences Institute

2. Copyright © 1995-2006 Clifford Neuman - UNIVERSITY OF SOUTHERN CALIFORNIA - INFORMATION SCIENCES INSTITUTE Friday’s Lecture Friday’s lecture will be used for discussion of student projects. I will provide feedback on all of your proposals by this evening. For Friday’s lecture, each of you should prepare to speak for 8 minutes describing your projects. The class will provide feedback. If you wish to use slides (not required) please send them to me by Noon Friday.

3. Copyright © 1995-2006 Clifford Neuman - UNIVERSITY OF SOUTHERN CALIFORNIA - INFORMATION SCIENCES INSTITUTE Today’s lecture Intended to promote discussion. Think about what other issues are relevant to protecting the platform. We can discuss these questions during lecture – when we discuss related issues, or we can discuss other questions / issues at the end of lecture.

4. Copyright © 1995-2006 Clifford Neuman - UNIVERSITY OF SOUTHERN CALIFORNIA - INFORMATION SCIENCES INSTITUTE What is Platform Protection Attesting to the code that runs Mitigating effect of malicious code Preventing modification of system code Providing a sandboxed environment Containing effects of even “trusted” code

5. Copyright © 1995-2006 Clifford Neuman - UNIVERSITY OF SOUTHERN CALIFORNIA - INFORMATION SCIENCES INSTITUTE Code Attestation How to ensure that the code that is running has not been maliciously modified. –Problem: What is legitimate code. –Easy, but problematic solution: Check the PCR’s against a list of valid code.

6. Copyright © 1995-2006 Clifford Neuman - UNIVERSITY OF SOUTHERN CALIFORNIA - INFORMATION SCIENCES INSTITUTE A Policy Problem The base TC policies work: –i.e. making sure that the PCR’s reflect the real code that runs. The higher level policy is more difficult. –Which code can we run –Which versions. –What if customizations present.

7. Copyright © 1995-2006 Clifford Neuman - UNIVERSITY OF SOUTHERN CALIFORNIA - INFORMATION SCIENCES INSTITUTE Solutions Exhaustive list of valid PCR values. –Impractical or limits flexibility. Solve the Halting Problem –Then determine if the code that is present is safe (uncomputable) List valid modifications –Provide list that is present and calculate if PCR’s match

8. Copyright © 1995-2006 Clifford Neuman - UNIVERSITY OF SOUTHERN CALIFORNIA - INFORMATION SCIENCES INSTITUTE Limits on Unknown Modifications Still need to know what each of the modifications does, and how it affects security. Question: Can we allow legitimate mods, yet with sufficient constraints that certain unknown mods are still sandboxed in terms of which properties they may violate.

9. Copyright © 1995-2006 Clifford Neuman - UNIVERSITY OF SOUTHERN CALIFORNIA - INFORMATION SCIENCES INSTITUTE Examples Browser plug-ins –These are often used by malicious code. –Perhaps limit effect of installed plug-ins to specific virtual systems. –How does this relate to securing today’s systems/browsers.

10. Copyright © 1995-2006 Clifford Neuman - UNIVERSITY OF SOUTHERN CALIFORNIA - INFORMATION SCIENCES INSTITUTE Mitigating Effect of Malicious Code Limiting parts of the system that can be modified. –E.g. plug-ins to browsers only effect: ▪Current session ▪Current Virtual System ▪Current user ▪Vs. whole system

11. Copyright © 1995-2006 Clifford Neuman - UNIVERSITY OF SOUTHERN CALIFORNIA - INFORMATION SCIENCES INSTITUTE Preventing Modification Limiting parts of the system that can be modified. –Constraints on file access ▪Write as well as read –Copy on write for new sandboxed virtual system ▪Question is when to discard ▪How to tag objects that move out of sandboxed system. Detecting Modification through PCRs –But what about changes to code already running

12. Copyright © 1995-2006 Clifford Neuman - UNIVERSITY OF SOUTHERN CALIFORNIA - INFORMATION SCIENCES INSTITUTE Sandboxed Environments Limits on reads and writes Limits on ability to communicate –But might be needed by application –Might want to list which communication is acceptable Limits on resource consumption Clear user interface deliniation

13. Copyright © 1995-2006 Clifford Neuman - UNIVERSITY OF SOUTHERN CALIFORNIA - INFORMATION SCIENCES INSTITUTE Containing Trusted Code Explicit authorization vs explicit denial of access. –Sandboxes –E.g. use virtual systems to limit the resources which can be accessed, not just the processes that can access protected resources. Firewalls and other defenses