Advertisement

ws-Attestation: Enabling Trusted Computing on Web Services

Chapter

Abstract

This chapter proposes ws-Attestation, an attestation architecture based upon a Web Services framework. The increasing prevalence of security breaches caused by malicious software shows that the conventional identity-based trust model is insufficient as a protection mechanism. It is unfortunately common for a computing platform in the care of a trustworthy owner to behave maliciously. Zombie computers used to send spam being a common example.

Specifications created by the Trusted Computing Group TCG [27, 26] introduced the concept of platform integrity attestation, by which a computing platform can prove its current configuration state to a remote verifier in a reliable manner. ws-Attestation allows Web Services providers and consumers to leverage this technology in order to make better informed business decisions based on the security of the other party.

Current TCG specifications define only a primitive attestation mechanism that has several shortcomings for use in real-world scenarios: attestation information is coarse grained; dynamic system states are not captured; integrity metrics are difficult to validate; platform state as of an attestation is not well bound to the platform state as of interaction and platform configuration information is not protected from attackers. We aim to provide a software-oriented, dynamic, and fine-grained attestation mechanism which leverages TCG and ws-Security technologies to increase trust and confidence in integrity reporting. In addition, the architecture allows binding of attestation with application context, privacy protection, and infrastructural support for attestation validation.

Keywords

Shared Secret Trust Platform Module Platform Integrity Trust Computing Group Direct Anonymous Attestation 
These keywords were added by machine and not by the authors. This process is experimental and the keywords may be updated as the learning algorithm improves.

Preview

Unable to display preview. Download preview PDF.

Unable to display preview. Download preview PDF.

References

  1. 1.
    W.A. Arbaugh, J. Farber, and J.M. Smith. A secure and reliable bootstrap architecture. In IEEE Computer Society Conference on Security and Privacy, pp. 65–71, 1997.Google Scholar
  2. 2.
    BM, BEA Systems, Microsoft, SAP AG, Sonic Software, and VeriSign. Web services policy framework (ws-policy), Sep 2004.Google Scholar
  3. 3.
    Cert/cc statistics 1988-2005. Accessed 2005. http://www.cert.org/stats/cert_stats.html.Google Scholar
  4. 4.
    IBM et al. Web services secure conversation language (ws-secureconversation), Feb 2005.Google Scholar
  5. 5.
    IBM et al. Web services trust language (ws-trust), Feb 2005.Google Scholar
  6. 6.
    T. Garfinkel, B. Pfaff, J. Chow, M. Rosenblum, and D. Boneh. Terra: A virtual machine-based platform for trusted computing. In 19th ACM Symposium on Operating Systems Principles, 2003.Google Scholar
  7. 7.
    John L. Griffin, Trent Jaeger, Ronald Perez, Reiner Sailer, Leendert van Doorn, and Ramon Caceres. Trusted virtual domains: Toward secure distributed services. In Workshop on Hot Topics in System Dependability, 2005.Google Scholar
  8. 8.
    V. Haldar, D. Chandra, and M. Franz. Semantic remote attestation — a virtual machine directed approach to trusted computing. In 3rd Virtual Machine Research and Technology Symposium, May 2004.Google Scholar
  9. 9.
    IBM. Web services federation language (ws-federation), Jul 2003.Google Scholar
  10. 10.
    IBM, Microsoft, RSA Security, and VeriSign. Web services security policy language (ws-securitypolicy).Google Scholar
  11. 11.
    IBM, BEA Systems, Microsoft, SAP AG, Computer Associates, Sun Microsystems, and webMethods. Web services metadata exchange (ws-metadataexchange), Sep 2004. http://www-128.ibm.com/developerworks/library/specification/ws-mex/.Google Scholar
  12. 12.
    IBM, BEA Systems, Microsoft, Arjuna, and Hitachi. Web services transactions specifications, Nov 2004.Google Scholar
  13. 13.
    Microsoft IBM. Security in a web services world: A proposed architecture and roadmap, Apr 2002. http://www-128.ibm.com/developerworks/library/specification/ws-secmap/.Google Scholar
  14. 14.
    Ibm service management framework. http://www-306.ibm.com/software/wireless/smf/.Google Scholar
  15. 15.
    Java cryptography extension (jce). http://java.sun.com/products/jce/.Google Scholar
  16. 16.
    Linux intrusion detection system (lids). http://www.lids.org/.Google Scholar
  17. 17.
    Open vulnerability and assessment language. http://oval.mitre.org/.Google Scholar
  18. 18.
    OSGi alliance. http://www.osgi.org/.Google Scholar
  19. 19.
    W3C Recommendation. Soap version 1.2, Jun 2004. http://www.w3.org/TR/soap/.Google Scholar
  20. 20.
    W3C Candidate Recommendation. Web services description language (wsdl) version 2.0 part 0: Primer, Mar 2006. http://www.w3.org/TR/2006/CR-wsdl20-primer-20060327/.Google Scholar
  21. 21.
    Redhat enterprise linux. http://www.redhat.com/.Google Scholar
  22. 22.
    A. Sadeghi and C. Stüble. Property-based attestation for computing platforms: Caring about properties, not mechanisms. In 2004 Workshop on New Security Paradigms (NSPW 2004), pages 67–77, 2004.Google Scholar
  23. 23.
    R. Sailer, T. Jaeger, X. Zhang, and L. Van Doorn. Attestation-based policy enforcement for remote access. In 11th ACM Conference on Computer and Communications Security, pages 308–317, Oct 2004.Google Scholar
  24. 24.
    R. Sailer, X. Zhang, T. Jaeger, and L. van Doorn. Design and implementation of a tcg-based integrity measurement architecture. In 13th USENIX Security Symposium, pages 223–238, Aug 2004.Google Scholar
  25. 25.
    Tcg software stack specification version 1.2. http://www.trustedcomputing.org/specs/TSS.Google Scholar
  26. 26.
    Tcg specification architecture overview, revision 1.2. Trusted Computing Group, Apr 2004. Available at https://www.trustedcomputinggroup.org/groups/TCG_1_0_Architecture_Overview.pdf.Google Scholar
  27. 27.
    Trusted computing platform alliance main specification, version 1.1b. Trusted Computing Group, Feb 2002. https://www.trustedcomputinggroup.org/specs/TPM.Google Scholar
  28. 28.
    Uddi spec technical committee draft, version 3.02, Oct 2004. http://www.oasis-open.org/.Google Scholar
  29. 29.
    Yuji Watanabe, Sachiko Yoshihama, Takuya Mishina, Michiharu Kudo, , and Hiroshi Maruyama. Bridging the gap between inter-communication boundary and inside trusted components. In 11th European Symposium on Research in Computer Security(ESORICS 2006), LNCS. Springer, 2006.Google Scholar
  30. 30.
    Web service security: Soap messaging security 1.0 (ws-security 2004). OASIS Standard 200401, Mar 2004.Google Scholar

Copyright information

© Springer-Verlag Berlin Heidelberg 2007

Authors and Affiliations

  1. 1.IBM Tokyo Research LaboratoryYamato-shiJapan
  2. 2.CA LabsRichmondAustralia

Personalised recommendations