Security Evaluation of Scenarios Based on the TCG’s TPM Specification
The Trusted Platform Module TPM is a basic but nevertheless very complex security component that can provide the foundations and the root of security for a variety of applications. In contrast to the TPM, other basic security mechanisms like cryptographic algorithms or security protocols have frequently been subject to thorough security analysis and formal verification. This paper presents a first methodic security analysis of a large part of the TPM specification. A formal automata model based on asynchronous product automata APA and a finite state verification tool SHVT are used to emulate a TPM within an executable model. On this basis four different generic scenarios were analysed with respect to security and practicability: secure boot, secure storage, remote attestation and data migration. A variety of security problems and inconsistencies was found. Subsequently, the TPM specification was adapted to overcome the problems identified. In this paper, the analysis of the remote attestation scenario and some of the problems found are explained in more detail.
KeywordsState Component Security Evaluation Attack Model Trust Computing Group Authorization Data
Unable to display preview. Download preview PDF.
- 1.TCG Trusted Computing Group: TPM Main Part 2 TPM Structures Specification Version 1.2 Level 2 Revision 103 (2007), www.trustedcomputing.org
- 2.TCG Trusted Computing Group: TPM Main Part 3 Commands Specification Version 1.2 Level 2 Revision 103 (March 2007), www.trustedcomputing.org
- 3.Trusted Computing Group: TCG TPM Specification 1.2 (2006), http://www.trustedcomputing.org
- 4.Gürgens, S., Ochsenschläger, P., Rudolph, C.: Authenticity and Provability – a Formal Framework. GMD Report 150, GMD – Forschungszentrum Informationstechnik GmbH (2001)Google Scholar
- 5.Gürgens, S., Ochsenschläger, P., Rudolph, C.: Role based specification and security analysis of cryptographic protocols using asynchronous product automata. In: Hameurlain, A., Cicchetti, R., Traunmüller, R. (eds.) DEXA 2002. LNCS, vol. 2453, Springer, Heidelberg (2002)Google Scholar
- 6.Gürgens, S., Rudolph, C.: Security Analysis of (Un-) Fair Non-repudiation Protocols. Formal aspects of computing (2004)Google Scholar
- 9.Ochsenschläger, P., Repp, J., Rieke, R., Nitsche, U.: The SH-Verification Tool – Abstraction-Based Verification of Co-operating Systems. Formal Aspects of Computing, The Int. Journal of Formal Methods 11, 1–24 (1999)Google Scholar
- 11.Sailer, R., Zhang, X., Jaeger, T., van Doorn, L.: Design and implementation of a TCG-based integrity measurement architecture. In: Proceedings of the 13th USENIX Security Symposium. USENIX Association (2004)Google Scholar