We think you have liked this presentation. If you wish to download it, please recommend it to your friends in any social system. Share buttons are a little bit lower. Thank you!
Presentation is loading. Please wait.
Published byKayla Preston
Modified over 3 years ago
Confidential 1 Phoenix Security Architecture and DevID July 2005 Karen Zelenko Phoenix Technologies
© Copyright 2004 Phoenix Technologies Ltd 2 Objectives for DevID Provide strong means to identify and authenticate the identity of devices in a network – including during initial provisioning (possibly remotely) Identity is permanently bound to device Each identity is unique Centralized infrastructure not required for DevID to be usable
© Copyright 2004 Phoenix Technologies Ltd 3 Phoenix Security Architecture Security Architecture provides secure cryptographic operations and the ability to bind applications and data to a specific device Operations done in Secure SMI Environment Caller Validation provides extra protection Binding to device via Secure Storage
© Copyright 2004 Phoenix Technologies Ltd 4 Phoenix Security Framework Core System Software Power-on Application OS Kernel Application Ring 3 Application privilege Ring 0 OS privilege System Management Mode (Highest privilege on the CPU) Security Driver SMM CSS privilege Caller Validation Device Key in Secure Silicon
© Copyright 2004 Phoenix Technologies Ltd 5 Secure Storage Nonvolatile memory Hardware-Based OAR-Locking (Open at Reset) Offline storage of Device Key (DK) 20 Bytes = 16 byte DK + 4 byte status Retrieved at BIOS reset Contents transferred to SMRAM Locked until next reset Examples – CMOS, FWH, EC, …
© Copyright 2004 Phoenix Technologies Ltd 6 Device Key (DK) 128-bit Advanced Encryption Standard (AES) Systems typically ship with no DK DK randomly generated on first use of a cME Security application DK unique to that specific device (motherboard) Never exposed outside of SMI for StrongROM
© Copyright 2004 Phoenix Technologies Ltd 7 Device Key Handling
© Copyright 2004 Phoenix Technologies Ltd 8 StrongROM Embedded Crypto Engine StrongROM provides: Secure Storage and DK access General Crypto Caller Validation Runs in SMM (System Management Mode) SMRAM (Locked, Paged in by hardware) Time-slicing for compute-intensive operations
© Copyright 2004 Phoenix Technologies Ltd 9 StrongROM Algorithms SHA-1 160-bit AES 128-bit HMAC-SHA RSA 1024-2048-bit PRNG SHA-1 Based NIST Approved
© Copyright 2004 Phoenix Technologies Ltd 10 Caller Validation Inter-module communication involves checking caller against a signature driver-to-StrongROM application-to-driver Requires that calling applications are Signed Authorized Undamaged Protects against debug attacks
© Copyright 2004 Phoenix Technologies Ltd 11 Caller Validation (cont.) Portion of executables in-memory image is hashed into an Owners Code Digest (OCD) OCD is signed by Phoenix Phoenix maintains hierarchy of keys in a secure location with root key protected by Verisign Caller validation compares in-memory image of calling application against signature
© Copyright 2004 Phoenix Technologies Ltd 12 Caller Validation
© Copyright 2004 Phoenix Technologies Ltd 13 Security Services Data Protection and Binding to Device Seal / Unseal AppContainer using Device Key Data accessed by authorized application on authorized platform RSA Key Protection and Binding to Device Special AppContainer storing keys Private Keys are not exposed outside of SMM Platform Identifier Platform ID = HMAC (DK, OCD || Usage Flags)
© Copyright 2004 Phoenix Technologies Ltd 14 Phoenix Security Strengths Unique DK – limits class attacks DK Handled in a secure environment Secure Storage variety (as opposed to homogenous storage) Caller validation Privacy – Limited exposure of the DK Basic building blocks for applications (ex. Client-server application)
© Copyright 2004 Phoenix Technologies Ltd 15 DevID with Phoenix Framework Use the Platform ID as a DevID Statistically unique credential bound to the device Derive a new credential unique to DevID, unrelated to the Device Key except by platform association presumably stored as a protected BLOB outside of StrongROM
© Copyright 2004 Phoenix Technologies Ltd 16 Summary Phoenix Security Framework provides the necessary components to implement DevID strong asymmetric crypto secure hashing integrated secure storage Platform ID by itself meets the needs of DevID Phoenix Security Framework could be optimized for variety device classes
Solutions for Secure and Trustworthy Authentication Ramesh Kesanupalli
Securing Applications With Firmware (Going Beyond TCPA Platform Security) Dr. Robert W. Baldwin Chief Scientist.
Copyright © Clifford Neuman - UNIVERSITY OF SOUTHERN CALIFORNIA - INFORMATION SCIENCES INSTITUTE USC CSci599 Trusted Computing Lecture Three.
1 Information Security – Theory vs. Reality , Winter Lecture 12: Trusted computing architecture (cont.), Eran Tromer Slides credit:
Trusted Computing and the Trusted Platform Module Bruce Maggs (with some slides from Bryan Parno)
Trusted Infrastructure Xiaolong Wang, Xinming Ou Based on Dr. Andrew Martin’s slides from TIW 2013.
Trusted Computing Platform Alliance
© Copyright 2009 SSLPost 01. © Copyright 2009 SSLPost 02 a recipient is sent an encrypted that contains data specific to that recipient the data.
Key Management Workshop November 1-2, Cryptographic Algorithms, Keys, and other Keying Material Approved cryptographic algorithms Security.
Security. is one of the most widely used and regarded network services currently message contents are not secure may be inspected either.
Edward Tsai – CS 239 – Spring 2003 Strong Security for Active Networks CS 239 – Network Security Edward Tsai Tuesday, May 13, 2003.
Cryptography Chapter 7 Part 4 Pages 833 to 874. PKI Public Key Infrastructure Framework for Public Key Cryptography and for Secret key exchange.
Electronic Mail Security
Architecture for Protecting Critical Secrets in Microprocessors Ruby Lee Peter Kwan Patrick McGregor Jeffrey Dwoskin Zhenghong Wang Princeton Architecture.
Cosc 4765 Trusted Platform Module. What is TPM The TPM hardware along with its supporting software and firmware provides the platform root of trust. –It.
© 2006 Cisco Systems, Inc. All rights reserved. Network Security 2 Module 3: VPN and Encryption Technology.
Technical Presentation AIAC Group 11. System Rationale System Architecture Secure Channel Establishment Username/Password Cartão Cidadão Digital.
© 2017 SlidePlayer.com Inc. All rights reserved.