Introduction of Trusted Network Connect: Houcheng Lee May 9, 2007

Introduction of Trusted
Network Connect
Houcheng Lee
houchen1@umbc.edu
May 9, 2007
What is Trusted Computing?
Trusted Computing Group
(TCG)
Trusted Computing Group (TCG) Membership
170 Total Members as of January, 2007
Contributors Contributors Adopters
Funk Software, Inc. Seagate Technology ConSentry Networks
Promoters
General Dynamics C4 Systems Siemens AG CPR Tools, Inc.
AMD
Giesecke & Devrient SignaCert, Inc. Credant Technologies
Hewlett-Packard
Hitachi, Ltd. Silicon Integrated Systems Corp. Fiberlink Communications
IBM
Infineon Sinosun Technology Co., Ltd. Foundstone, Inc.
Intel Corporation
InfoExpress, Inc. SMSC GuardianEdge
Microsoft
InterDigital Communications Sony Corporation ICT Economic Impact
Sun Microsystems, Inc.
iPass STMicroelectronics Industrial Technology Research Institute
Lenovo Holdings Limited Symantec Infosec Corporation
Contributors Lexmark International Symbian Ltd Integrated Technology Express Inc.
Adaptec, Inc. Lockheed Martin Synaptics Inc. LANDesk
Agere Systems M-Systems Flash Disk Pioneers Texas Instruments Lockdown Networks
American Megatrends, Inc. Maxtor Corporation Toshiba Corporation Marvell Semiconductor, Inc.
ARM Meetinghouse Data TriCipher, Inc. MCI
Atmel Communications Unisys Meganet Corporation
AuthenTec, Inc. Mirage Networks UPEK, Inc. Roving Planet
AVAYA Motorola Inc. Utimaco Safeware AG SafeBoot
Broadcom Corporation National Semiconductor VeriSign, Inc. Safend
Certicom Corp. nCipher Vernier Networks Sana Security
Check Point Software, Inc. NEC Vodafone Group Services LTD Secure Elements
Citrix Systems, Inc. Nevis Networks, USA Wave Systems Senforce Technologies, Inc
Comodo Nokia Winbond Electronics Corporation SII Network Systems, Inc.
Dell, Inc. NTRU Cryptosystems, Inc. Silicon Storage Technology, Inc.
Endforce, Inc. NVIDIA Adopters Softex, Inc.
Ericsson Mobile Platforms AB OSA Technologies, Inc Advanced Network Technology StillSecure
France Telecom Group Philips Labs Swan Island Networks, Inc.
Freescale Semiconductor Phoenix Apani Networks Symwave
Fujitsu Limited Pointsec Mobile Technologies Apere, Inc. Telemidic Co. Ltd.
Fujitsu Siemens Computers Renesas Technology Corp. ATI Technologies Inc. Toppan Printing Co., Ltd.
Ricoh Company LTD BigFix, Inc. Trusted Network Technologies
RSA Security, Inc. BlueRISC, Inc. ULi Electronics
Copyright© 2007 Trusted Computing Group - Other names and brands are properties of their respective owners. Inc.
Samsung Electronics Co. Bradford Networks Valicore Technologies, Inc.
SanDisk Corporation Caymas Systems Websense
SCM Microsystems, Inc. Cirond
TCG Key Players
Copyright© 2007 Trusted Computing Group - Other names and brands are properties of their respective owners.
Trusted Platform Module
(TPM)
Trusted Platform Module (TPM)
Introduction
 What is a TPM?
 A Hardware
 What it does?
V1.2 functions, including:
•stores OS status information
•generates/stores a private key
•creates digital signatures
•anchors chain of trust for keys,
digital certificates, and other
credentials
TPM – TCG Definition
 Asymmetric Key Module
 Generate, store & backup public/private key pairs
 Generate digital signatures, encrypt/decrypt data
 Trusted Boot Configuration
 Storage of software digests during boot process
 Anonymous Attestation
 Endorsement key used to establish properties of
multiple identity keys
 TPM Management
 Turn it on/off, ownership / configure functions, etc.
TPM – Abstract Definition
 Root of Trust in a PC
 Operations or actions based on the TPM have measurable
trust.
 Flexible usage model permits a wide range of actions to be
defined.
 Doesn’t Control PC (About DRM)
 User still has complete control over platform. It’s OK to turn
the TPM off (it ships disabled).
 User is free to install any software he/she pleases.
Why Not Software?
 Software is hard to secure.
 Ultimately, it is usually based on something stored in a
relatively insecure location (like the hard drive).
 Soft data can be copied.
 Lets an attacker take more time or apply more
equipment to the attack procedure.
 Security can’t be measured.
 Two users running same software operation may see
radically different risks.
TPM Measurement flow
Trusted Network Connection
(TNC)
What is TNC?
 Open Architecture for Network Access

Control
 Suite of Standards
 Developed by Trusted Computing Group
Network Endpoint Problem
 Sophisticated Attacks
 Viruses, Worms, Spyware, Rootkits, Botnets
 Zero-Day Exploits
 Targeted Attacks
 Rapid Infection Speed
 Exponential Growth
 > 40,000,000 Infected Machines
 > 35,000 Malware Varieties
 Motivated Attackers (Bank Crackers)
 Any vulnerable computer is a stepping stone
Key Computing Trends Drive the Need
for TNC
TREND IMPLICATION
 Increasing network span to  Less reliance on physical
mobile workers, customers, access identity verification (i.e.
partners, suppliers guards & badges)
 Network clients moving to  Remote access sequences

wireless access easily monitored, cloned
 Malware increasingly targeting  Clients ‘innocently” infect

network via valid client entire networks
infection
 Client scanning demands
 New malware threats move from once/week to
emerging at an increasing rate once/login
Network Integrity Architectures
 Several Initiatives are pursuing Network Integrity

Architectures
 All provide the ability to check integrity of objects
accessing the network
 [Cisco] Network Admission Control (NAC)
 [Microsoft] Network Access Protocol (NAP)
 [TCG] Trusted Network Connect (TNC)
 Support multi-vendor interoperability
 Leverage existing standards
 Empower enterprises with choice
Trusted Network Connect Advantages
Open standards
 Open standards process
 multi-vendor compatibility
 Enable customer choice
 open technical review
 Integrates with established protocols like EAP,
TLS, 802.1X, and IPsec
Incorporates Trusted Computing Concepts
- guarding the guard
Controlling Integrity of What is on
the Network
 Moving from “who” is allowed on the
network
 User authentication
 To “who” and “what” is allowed on the
network
 Adding Platform Integrity verification
Check at connect time
QuickTime™ and a
TIFF (Uncompressed) decompressor
are needed to see this picture.
Enterprise Net
Can I connect?
- Who are you -

- What is on your computer User DB
+
Integrity DB
Access control dialog
Quarantine and Remediation
Remediation
Server
Quarantine
QuickTime™ and a
TIFF (Uncompressed) decompressor
are needed to see this picture.
Net
Enterprise Net
Can I connect?
No I am quarantining you User DB

+
Try again when you’re fixed up Integrity DB
Access control dialog

data
TNC Architecture
Policy Policy
Access
Enforcement Decision
Requestor
Point Point
(AR)
(PEP) (PDP)
wireless
wired
Network
perimeter
TNC Architecture
Policy Enforcement Policy Decision
Access Requestor
Point Point
t
Integrity Measurement
Collector (IF-M) Integrity Measurement
Collector Verifiers
Verifiers
Collectors (IMC) Peer Relationship Verifiers (IMV)
(IF-IMC) (IF-IMV)
TNC Client (IF-TNCCS) TNC Server

(TNCC) Peer Relationship (TNCS)
(IF-PTS)
(IF-T)
Platform Trust Network Network Access
Service (PTS) Access Policy (IF-PEP) Authority
Requestor Enforcement
TSS Point (PEP)
TPM
Endpoint Integrity Policy
 Machine Health
 Anti-Virus software running and properly
configured
 Recent scan shows no malware
 Personal Firewall running and properly configured
 Patches up-to-date
 No authorized software
 Machine Behavior
 No porting scanning, sending spam, etc.
Examples of Integrity Checks
 Virus scan
 Is virus scanner present/ which version
 Has it run “recently” / what is the result
 Spyware checking
 Is Spyware checker running/ what version
 Have programs been deleted/isolated
 What is your OS patch level
 Is unauthorized software present?
 Other - IDS logs, evidence of port scanning
Network Operator Access Policy
 Define policy for what must be checked

 e.g. Virus, Spyware and OS Patch level
and
results of checks
 e.g. Must run
 VirusC- version 3.2 or higher, clean result
 SPYX- version 1.5 or higher
 Patchchk - version 6.2 or higher, patchlevel-3 or newer
TNC Scenario (Anti-Virus)
AV AV AV
configuration engine definitions 1 2
Baseline
3 Measured Measurements
Policies
Embedded
Anti-Virus Integrity
Services 4 Measurements
AV-IMC AV-IMV
Sequence Other IMCs 5 Other IMVs
1) Harvesting Policy
Decision
2) Policy authoring TNC TNC
3) Collection Client Server
4) Reporting Control 6
Request
5) Evaluation Network Access Network Access
6) Enforcement Requestor Authority
7) Remediation
AR PDP
TNC Model for Exchanging Integrity Data
Anti-virus Anti-virus
Collector Verifier
firewall firewall
Collector Verifier
IF-T
TNC Client TNC Server
Patch mgt Patch mgt
Collector Verifier
Platform trust Platform trust

Collector Verifier
- Messages are batched by TNCC/ TNCS
- Either side can start batched exchange
- IMC/IMV may subscribe to multiple message
types - Exchanges of TNC batches called
handshake
Authorized Access Only
Access Requestor
Point Point
Access
Denied
Hacker_Cindi
LynnP
Authorized Users
Guest JoeK
Access
Denied NoelC
KathyR
LynnP
JoeK
Corporate SW Requirements
Access Requestor Policy Enforcement Policy Decision
Point Point
Non-compliant System R
Windows XP em
SP2 ed
xOSHotFix 2499 ia
t io
xOSHotFix 9288 n
AV - McAfee Virus Scan 8.0 Ne
Firewall tw
or
k
Corporate Network
Client Rules
Windows XP
Compliant System •SP2
Windows XP •OSHotFix 2499
SP2 •OSHotFix 9288
OSHotFix 2499 •AV (one of)
OSHotFix 9288 •Symantec AV 10.1
AV - Symantec AV 10.1 •McAfee Virus Scan 8.0
Firewall •Firewall
Customized Network Access
Point Point
Gu
est
Ne
two
Inte rk
r ne
Guest User tO
nly
R&D
Ne twor
k
Ken – R&D
Finance Network
Access Policies
•Authorized Users
Linda – Finance
•Client Rules
Windows XP
OS Hotfix 9345
OS Hotfix 8834
AV - Symantec AV 10.1
Firewall
Platform Trust Services PTS
 IF-PTS evaluates the integrity of TNC
components and makes integrity reports
available to the TNCC and TNCS
 The PTS establishes the integrity state of the
TNC framework and binds this state to the
platform transitive-trust chain
 PTS IMC collects integrity information about
TNC elements and sends to PTS IMV
 PTS IMV has information (probably from
vendors) on expected values for IMCs and other
TNC and verifies received values
TPM Integrity Check
Point Point
TPM – Trusted Platform Module
• HW module built into most of
today’s PCs
• Enables a HW Root of Trust
• Measures critical components
during trusted boot
• PTS-IMC interface allows
PDP to verify configuration
and remediate as necessary
Corp LAN
Compliant System Client Rules

TPM verified TPM enabled
•BIOS
BIOS •OS
OS •Drivers
•Anti-Virus SW
Drivers
Anti-Virus SW
TNC Architecture – Existing Support
Access Requestor
Point Point
Endpoint Network Device AAA Server, Radius,
Supplicant/VPN Client, etc. FW, Switch, Router, Gateway Diameter, IIS, etc
TPM Use Cases - Government &
Regulatory
 National Security Agency
 Full drive encryption
 TCG for compatibility
 U.S. Army
 Network Enterprise Technology Command now
requires TPM 1.2 on new computers
 F.D.I.C.
 Promotes TPM usage to member banks
TPM Use Cases – Realistic Projects
 Pharmacy Company
 With VPN over public network, put TPMs on all clients
 Access dependent on digital certificate
 Verifies both user and machine
 Hardware and software from Lenovo
 Japanese Health Care Projects
 Obligation to preserve data; METI funded
 Fujitsu’s TNC deployment verifies HW and app config for
session of broadband telemedicine
 Hitachi’s TPM-based system for home health care
 IBM’s Trusted Virtual Domains
 MicroSoft Vista BitLocker
Thank you
Question?
Reference
 Trusted Computing Group (TCG) -

https://www.trustedcomputinggroup.org/home
 Trusted Network Connection (TNC) -
https://www.trustedcomputinggroup.org/group
s/network/

Introduction of Trusted Network Connect: Houcheng Lee May 9, 2007

Uploaded by

Copyright:

Available Formats

You might also like

Introduction of Trusted Network Connect: Houcheng Lee May 9, 2007

Uploaded by

Document Information

Original Title

Copyright

Available Formats

Share this document

Share or Embed Document

Sharing Options

Did you find this document useful?

Is this content inappropriate?

Copyright:

Available Formats

Introduction of Trusted Network Connect: Houcheng Lee May 9, 2007

Uploaded by

Copyright:

Available Formats

Introduction of Trusted

 Open Architecture for Network Access

 Network clients moving to  Remote access sequences

 Malware increasingly targeting  Clients ‘innocently” infect

 Several Initiatives are pursuing Network Integrity

- Who are you -

No I am quarantining you User DB

Access control dialog

TNC Client (IF-TNCCS) TNC Server

 Define policy for what must be checked

Platform trust Platform trust

Compliant System Client Rules

 Trusted Computing Group (TCG) -

You might also like