Property Based TPM Virtualization

Transcription

1 Property Based Virtualization Marcel Winandy Joint work with: Ahmad Reza Sadeghi, Christian Stüble Horst Görtz Institute for IT Security Chair for System Security Ruhr University Bochum, Germany Sirrix AG security technologies Bochum, Germany Marcel Winandy Property Based Virtualization 1

2 Introduction: Virtualization Features Commodity operating systems on various hardware platforms Virtual machines: suspend & resume, migration Security: isolation of virtual machines Application scenario: corporate/private computing Isolated work loads for private and corporate working Isolated work loads for different security levels Linux Linux Windows Linux Windows Hypervisor Hardware Hypervisor Hardware Marcel Winandy Property Based Virtualization 2

3 Introduction: Trusted Computing () : cheap, tamper evident hardware security module Cryptographic functions (RSA, SHA 1, key generation, RNG) Protected storage for small data (e.g. keys) Special keys: Endorsement Key (EK) and Storage Root Key (SRK) Authenticated Boot (recording integrity measurements) Measurements stored in Platform Configuration Registers (PCRs) Each component measures next component (chain of trust) hash hash hash hash Apps OS Boot Loader BIOS CRTM store hash store hash store hash store hash PCRs SRK EK Attestation and Sealing Attestation Identity Key (AIK) signs PCRs for (remote) attestation Binding key is used to encrypt data to the current PCR values (decrypting only possible with same PCR states) Marcel Winandy Property Based Virtualization 3

4 Introduction: Virtual () Each should be able to use Providing protected storage and crypto coprocessor Assurance about the booted hypervisor and virtual machines Support for migration Private Working Unclassified Corporate Classified Corporate Hypervisor Hardware Marcel Winandy Property Based Virtualization 4

5 Introduction: Virtual () Each should be able to use Providing protected storage and crypto coprocessor Assurance about the booted hypervisor and virtual machines Support for migration Virtualization of the Emulation in software, but binding to and hardware Berger et al. (USENIX 2006), Scarlata et al. (2007) Private Working Unclassified Corporate Classified Corporate Driver Driver Driver Hypervisor Hardware Marcel Winandy Property Based Virtualization 5

6 Shortcomings of Existing Solutions Migration Protected data bound to binary representation of hypervisor 's data may be unavailable after migration to another platform Keys Differentiated strategies for key generation missing some IT environments demand hardware protected keys wheras others would benefit from flexibility of software keys Privacy Revealing information about system configuration (v) reveals information during remote attestation of PCR values Profiling (security risk) and discrimination possible Marcel Winandy Property Based Virtualization 6

7 New Design Adding new components to internal design: Property Management Representation of virtual PCRs Different mechanisms to store and read values Realizing property based attestation and sealing Key Management Creating and loading cryptographic keys Supports software keys or keys of physical Policy User defined policy of the instance Marcel Winandy Property Based Virtualization 7

8 Flexible Architecture Driver Key Management _CreateWrapKey() _Extend(i, m) Interface CreateKey() Extend(i, m) Property Management PCRRead(i) _PCRRead(i) crypto Cryptographic Functions Management Interface migrate() Migration Controller Software Key Hardware Key PropertyProvider 1 PropertyProvider 2 PropertyProvider N PropertyFilter Policy Hypervisor Key Novel components for Marcel Winandy Property Based Virtualization 8

9 Property Providers Each property provider has its own PCR vector How to store values is up to each implementation This results in a matrix of vpcrs Policy decides which vector to use on which operation Instance vpcr[0] vpcr[1] PropertyProvider 1 PropertyProvider j PropertyProvider N Mapping vpcr[n] Initialization Applying all property providers to build the vpcr matrix Each Property Provider can implement a different mapping PCRs Marcel Winandy Property Based Virtualization 9

10 Changing the Measurement Function PCR extension function of the : Extend(i, m): PCR i SHA1(PCR m) i Generalizing this for each Provider j : Provider j.extend(i,m): vpcr i,j translate (vpcr,m) j i,j Examples: translate hash () is hashing like in hardware translate cert () looks for a certificate and stores the public key Marcel Winandy Property Based Virtualization 10

11 PCR Extension: Example OS measures a file and wants to extend the measurement in PCR 10 of the _Extend(10, f572d396fae fb2ce00f72e94f2258f) Property Management of instance calls each Property Provider vpcr 10,hash of Provider hash 09d2af8dd22201dd8d48e5dcfcaed281ff9422c7 vpcr 10,hash := SHA1(vPCR 10,hash f572d396fae fb2ce00f72e94f2258f) vpcr 10,cert of Provider cert PK certa Look for cert for hash f572d. If found one (e.g., certb), add its PK vpcr 10,hash : vpcr 10,cert : 3a2fdfb2e10d4286a c508b173c PK certa, PK certb Marcel Winandy Property Based Virtualization 11

12 Property Based Attestation with Provider cert is one example to use property certificates Certificates describe the properties for a particular measurement Issued by a Trusted Third Party 1. attest(nonce,i,,j) 6. (pcrdata, nonce) Verifier 2. quote(vaik ID,nonce,i,,j) 5. (pcrdata, nonce) 3. prov = policy.askforprovider(i,,j) 4. sign[vaik ID ](nonce,vpcr i,prov,,vpcr j,prov ) Marcel Winandy Property Based Virtualization 12

13 Migration of and Secure migration needed (confidentiality, integrity, authenticity) Example: move private working environment to home PC Private Working Classified Corporate Online Gaming Hypervisor (Xen 3.1) Hypervisor (Xen 3.2) Hardware (Office PC) Hardware (Home PC) Marcel Winandy Property Based Virtualization 13

14 Trusted Channel based Migration Source platform requests trusted channel to destination Creates secret encryption key bound to and configuration of destination platform (assurance about integrity of end points) Configuration can also be property based Re usable for several migrations Private Working Classified Corporate Online Gaming Hypervisor (Xen 3.1) Hypervisor (Xen 3.2) Hardware (Office PC) Trusted Channel Hardware (Home PC) Marcel Winandy Property Based Virtualization 14

15 Trusted Channel based Migration Source platform requests trusted channel to destination Creates secret encryption key bound to and configuration of destination platform (assurance about integrity of end points) Configuration can also be property based Re usable for several migrations Private Working Classified Corporate Online Gaming Hypervisor (Xen 3.1) Hypervisor (Xen 3.2) Hardware (Office PC) Trusted Channel Hardware (Home PC) Transfer encrypted state via Trusted Channel No re mapping of PCRs necessary (because of property providers) Marcel Winandy Property Based Virtualization 15

16 Trusted Channel based Migration Source platform requests trusted channel to destination Creates secret encryption key bound to and configuration of destination platform (assurance about integrity of end points) Configuration can also be property based Re usable for several migrations Classified Corporate Private Working Online Gaming Hypervisor (Xen 3.1) Hypervisor (Xen 3.2) Hardware (Office PC) Trusted Channel Hardware (Home PC) Transfer encrypted state via Trusted Channel No re mapping of PCRs necessary (because of property providers) Marcel Winandy Property Based Virtualization 16

17 Summary Key Management Software Key Hardware Key Key Driver _CreateWrapKey() _Extend(i, m) Interface CreateKey() Extend(i, m) Property Management PropertyProvider 1 PropertyProvider 2 PropertyProvider N PropertyFilter Policy PCRRead(i) _PCRRead(i) crypto Cryptographic Functions Management Interface Migration Controller migrate() Novel components for New Design Property Providers Key Management Policy Allows to link hypervisor to based on properties Availability of sealed data after migration or software updates Trusted Migration protocol ensures binding to trustworthy platform More flexibility in key usage Key Management can delegate key requests to hardware User defined policy decides which information to reveal Policy defines which Property Provider to use on attestation Marcel Winandy Property Based Virtualization 17

18 Thank you for your attention! Questions? Contact: Marcel Winandy Horst Görtz Institute for IT Security Ruhr University Bochum, Germany Marcel Winandy Property Based Virtualization 18

19 BACKUP Marcel Winandy Property Based Virtualization 19

20 Property Based Sealing Marcel Winandy Property Based Virtualization 20

21 Migration Protocol Source platform Destination platform Migration Controlling Process Migration Controlling Process ' migrate() initiatemigration() requesttrustedchannel() create() ' verify(pk Bind, cert Bind ) (PK Bind, cert Bind ) sk := createkey() esk := bind[pk Bind ](sk) s := getstate() es := encrypt[sk](s) deletekey(sk), deletestate() transfer(es,esk) X destroy() sk := unbind[pk Bind ](esk) s := decrypt[sk](es) setstate(s) Marcel Winandy Property Based Virtualization 21