Sinosun Technology Co., Ltd. Class A · SZSE:300333
Sinosun Technology Co., Ltd. Class A — Trusted Computing Group — GovSec 2005
126 slides from Sinosun Technology Co., Ltd. Class A's conference presentation, May 26, 2005
Slide 1: Trusted Computing: How to Make Your Systems and Data Truly Secure
Trusted Computing: How to Make Your Systems and Data Truly Secure Thursday, May 26, 2005 8:30 am – 11:30 am Booth #1743 Copyright© 2005 Trusted Computing Group - Other names and brands are properties of their respective owners. Slide #1
Slide 2: Agenda
Agenda 8:30 am Introduction Brian Berger, Wave Systems 8:35 am Keynote Speaker Roger Kay, IDC 9:05 am TCG Architecture Monty Wiseman, Intel 9:25 am Open Source Solutions Dr. David Safford, IBM 9:45 am Writing and Using Trusted Applications Alexander Koehler, Utimaco Safeware AG; Steven Sprague, Wave
Slide 3: TCG Mission
TCG Mission Develop & promote open, vendor-neutral, industry standard specifications for trusted computing building blocks and software interfaces across multiple platforms. Copyright© 2005 Trusted Computing Group - Other names and brands are properties of their respective owners. Slide #3
Slide 4: Trusted Computing: The BIG Picture
Trusted Computing: The “BIG” Picture Credentials Operating Applications Systems Web Services Mobile Phones PDAs Storage TCG TCG Standards Standards Authentication TP Devices M Servers TPM Input Notebooks Devices Security Desktops Hardware Copyright© 2005 Trusted Computing Group - Other names and bra
Slide 5: TCG Membership Momentum
TCG Membership Momentum 120 100 80 Network Software 60 Client HW 40 Semi 20 0 2003 2004 2005 • 103 Member company’s as of May, 2005 • BOD – AMD, HP, IBM, Intel, Microsoft, Seagate, Sony, Sun, Verisign Copyright© 2005 Trusted Computing Group - Other names and brands are properties of their respective
Slide 6: Agenda: Keynote Speaker Roger Kay, IDC
Agenda 8:35 am Keynote Speaker Roger Kay, IDC Roger L. Kay is IDC's Vice President of Client Computing. He has responsibility for covering technological, market, and competitive developments related to desktop and portable personal computers. In his capacity as leader of the PC client team, Mr. Kay
Slide 7: GovSec 2005 The Future of Trusted Computing
GovSec 2005 The Future of Trusted Computing Roger L. Kay Vice President Client Computing
Slide 8: Agenda
Agenda Philosophy, history, and issues TPM forecast A bit about trusted network access Final notes
Slide 9: A Sea Change in Public Thinking
A Sea Change in Public Thinking Before 9/11, people wanted all the privacy they could get – Only criminals had fingerprints on record Post 9/11, people want to be known as who they are – Identity theft and other heretofore unknown dangers – Increased value of stored data This change creates a
Slide 10: Recap of Efforts Thus Far
Recap of Efforts Thus Far IBM pioneered technology in 1999 Gave to Trusted Computing Platform Alliance October 1999 TPM 1.1b spec released 1Q02 Grand plans for broad usage: PKI Formation of Trusted Computing Group April 2003 TPM 1.2 final spec released February 2005 Focus on client aut
Slide 11: Hardware Security: The Right Answer
Hardware Security: The Right Answer In 2000, nCipher of Cambridge, England proved that software-based security had fatal flaws – Came up with algorithm that searched main memory, looking for a high degree of entropy – Good random numbers have a high degree of entropy – In software security, the ke
Slide 12: Segment Behavior
Segment Behavior Enterprise – Policies can be set by fiat – Perimeter defined – Corporate is trusted 3rd party Consumer – Nobody sets policies for everybody – Credentials could be passed around – There is no trusted 3rd party
Slide 13: Segment Adoption
Segment Adoption Enterprise picks and chooses – Justification is easier, but conservatism leads to slow adoption – However, many will “buy up” in hardware to prepare for arrival of Longhorn Consumers take what’s on the shelf – Uptake could be rapid once integration and trust issues are solved
Slide 14: Client Side Access Control
Client Side Access Control Biometrics, particularly fingerprint, will dominate What you are as opposed to what you know or what you have Multifactor Fingerprint reader paring with TPM lags
Slide 15: Integrated vs. Discrete
Integrated vs. Discrete Integration beats discrete on cost Discrete could have 10-20% of the market over time, sold as being more resistant to hacking – Having a FIPS-4 part will be required in some cases, desirable in others Must solve flash in South Bridge issue for complete integration in c
Slide 16: TPM Forecast Assumptions
TPM Forecast Assumptions Big boosts to hardware security solution: – Dell entry in 2005 – Most OEMs commit strongly in 2005 with 1.2 spec – Longhorn (N.G.S.C.B.) incorporation in 2006 – Intel integration in South Bridge by 2008 – Saturation of client space by 2010
Slide 17: TPM Module Forecast
TPM Module Forecast (In millions of units shipped) 300 250 200 150 100 50 0 1999 2000 2001 2002 2003 2004 2005 2006 2007 2008 2009 2010 Source: IDC
Slide 18: Notebook vs. Desktop
Notebook vs. Desktop TPMs in Desktops TPMs in Portables (In millions of units shipped) 160 140 120 100 80 60 40 20 0 1999 2000 2001 2002 2003 2004 2005 2006 2007 2008 2009 2010 Source: IDC
Slide 19: TPM Attach: Portables
TPM Attach: Portables (In millions of units shipped) Total Portables TPMs in Portables 120 100 80 60 40 20 0 1999 2000 2001 2002 2003 2004 2005 2006 2007 2008 2009 2010 Source: IDC
Slide 20: TPM Attach: Desktops
TPM Attach: Desktops (In millions of units shipped) Total Desktops TPMs in Desktops 160 140 120 100 80 60 40 20 0 1999 2000 2001 2002 2003 2004 2005 2006 2007 2008 2009 2010 Source: IDC
Slide 21: Network Security: A Perimeter Problem
Network Security: A Perimeter Problem Maginot Line Security is only as strong as the weakest link The client has been neglected in the past Mobility is a special case
Slide 22: Trusted Network Connect
Trusted Network Connect What is TNC? – Represents a significant, high profile development directly applicable to today’s network operations – Introduced in April 2005, an open standard that allows network operators to establish policies for client access – Presents a roadmap for technology develop
Slide 23: Final Notes
Final Notes Other specs are in the works: – Server – Mobile phone – Peripherals • Storage • Keyboard and mouse – Infrastructure – PC – Software The exciting news: TCG is applying the trust specification developed for PCs to a broader — potentially universal — set of devices
Slide 24: Contact Info
Contact Info Please email me at Rkay@idc.com
Slide 25: Agenda: TCG Architecture, Monty Wiseman
Agenda 9:05 am TCG Architecture Monty Wiseman, Intel Monty Wiseman is currently a Security Architect for Intel's Desktop Architecture Lab. His areas of specialty include high performance mass storage systems, filesystems, directory services, and authentication mechanisms. His current projects includ
Slide 26: TCG Architecture: The Trusted Platform Module
TCG Architecture: The Trusted Platform Module Monty Wiseman monty.wiseman@intel.com Security Architect Intel, Corp. Copyright© 2005 Trusted Computing Group - Other names and brands are properties of their respective owners. Slide #26
Slide 27: TPM Abstract Architecture
TPM Abstract Architecture • Core component is a Trusted Platform Module (TPM) – Protected storage – Protected operations – Platform authentication under user control • User control to handle the uniqueness appropriately • Platform Specific Specifications – Defines how a TPM is implemented on specifi
Slide 28: TPM Key Features for Platforms
TPM Key Features for Platforms • Indicates platform as “valid” – Platform is the one issued by IT • Indicates platform is in a “valid” or authorized state – Platform configuration • Are Pre-OS, OS & Apps what IT has authorized • Protected storage – Uses isolated environment to protect keys Copyright
Slide 29: TPM Overview
TPM Overview • Module on the motherboard – Can’t be moved or swapped – Secrets in TPM can’t be read by HW or SW attackers • Uses asymmetric cryptography – Private key operations occur inside TPM – Default keys are 2048-bit RSA • Holds Platform Measurements – PC measures software, TPM is repository o
Slide 30: Platform Authentication
Platform Authentication • Applications tend to focus on “user authentication” • But how does the IT infrastructure know which platform is being used? – Is it authorized to be attached to the network? Copyright© 2005 Trusted Computing Group - Other names and brands are properties of their respective
Slide 31: Platform Attestation
Platform Attestation • Applications tend to assume they have not been attacked – Especially true of “monitoring” or “defensive” apps • But how does the IT infrastructure know if the platform is executing the application as authorized? Copyright© 2005 Trusted Computing Group - Other names and brands
Slide 32: Protecting Secrets
Protecting Secrets • OS and Applications use software to protect keys and secrets – They lack a standardized and isolated place to create, store and use them • All software can be attacked – Offline attacks are not difficult Copyright© 2005 Trusted Computing Group - Other names and brands are proper
Slide 33: Purview of Specifications
Purview of Specifications • TPM Specification defines only the protected capabilities of the TPM – Functionality not specific to any type of platform – Bus protocol and type not defined • Platform Specific Specifications define attachment of TPM to platform – Bus – H/W protocol – Specific integrity
Slide 34: Ongoing Work In The TCG
Ongoing Work In The TCG • Platforms – PC Client – Server – Mobile – Peripherals and Storage • Infrastructure – TNC – Credential formats • Work is progressing – If you or your company are interested please join TCG and participate Copyright© 2005 Trusted Computing Group - Other names and brands are p
Slide 35: Implementation Status
Implementation Status • PCs with TPMs available; millions deployed – Dell – IBM* ThinkPad notebooks and NetVista desktops – HP* D530 Desktops and nc4010, nc6000, nc8000, and nw8000 Notebooks – Intel* D945GNTLKR, D945GTPLKR, D945GCZLKR motherboards – Fujitsu* LifebookS notebook PC series – Toshiba, A
Slide 36: Dispelling Common Misconceptions
Dispelling Common Misconceptions • The TPM does not measure, monitor or control anything – Software measurements are made by the PC and sent to the TPM – The TPM has no way of knowing what was measured – The TPM is unable to reset the PC or prevent access to memory • The platform owner controls the
Slide 37: Thank You
Thank You Copyright© 2005 Trusted Computing Group - Other names and brands are properties of their respective owners. Slide #37
Slide 38: Agenda: Open Source Solutions, Dr. David Safford
Agenda 9:25 am Open Source Solutions Dr. David Safford, IBM Dr. Dave Safford manages the Global Security Analysis Lab in IBM's T.J Watson Research Center in Hawthorne, New York, where he directs research in security analysis tools, data forensics, security hardware, secure Linux, security engineerin
Slide 39: Open Source Solutions
Open Source Solutions Dave Safford, IBM Research Copyright© 2005 Trusted Computing Group - Other names and brands are properties of their respective owners. Slide #39
Slide 40: Outline
Outline • Threat Trends • Trusted Computing • Open Source Projects • What's Missing • The Future Copyright© 2005 Trusted Computing Group - Other names and brands are properties of their respective owners. Slide #40
Slide 41: Client Risk is Rising
Client Risk is Rising Discovery of Vulnerabilties * 10000 • The number of attacks in the wild, and their lifetimes and impact are growing fast 1000 100 • 450% increase in Windows viruses over last year 1995 1996 1997 1998 1999 2000 2001 2002 2003 • 1500% growth in BotNets Jan to Jun 2004 Days to Bro
Slide 42: A Trusted Platform Module (TPM) Can Help
A Trusted Platform Module (TPM) Can Help RSA crypto key generation, signature, encrypt, decrypt Secure storage private keys master keys (eg loopback) Integrity measurement Platform Configuration Registers (PCR) compromise detection Tie key use to uncompromised environment Attestation host ba
Slide 43: Understanding The TPM
Understanding The TPM: Main Specification: Trusted Computing Group (TCG) home page: http://www.trustedcomputinggroup.org Tutorial/Introduction paper: (4 pages) Linux Journal, August 2003 White papers, open source code http://www.research.ibm.com/gsal/tcpa device driver/access library/example a
Slide 44: Programming view of the TPM
Programming view of the TPM Functional Units Non-volatile memory Volatile memory RNG Endorsement Key (2048b) RSA Key Slot-0 ... Hash Storage Root Key (2048b) RSA Key Slot-9 HMAC Owner Auth Secret (160b) PCR-0 ... RSA Key Generation PCR-15 RSA Encrypt/Decrypt Key Handles Auth Session Handles Copyrigh
Slide 45: Open Source TPM projects
Open Source TPM projects IBM Research Linux Device Driver/library/applications http://www.research.ibm.com/gsal/tcpa Trusted Linux Client IBM Linux Technology Center http://sourceforge.net/projects/tpmdd http://sourceforge.net/projects/trousers Rick Wash (umich) BSD port of IBM driver/library/
Slide 46: IBM Linux Technology Center
IBM Linux Technology Center Official Device Driver included in 2.6.12 kernel http://sourceforge.net/projects/tpmdd Open source TCG Software Stack (TSS) http://sourceforge.net/projects/trousers Full software stack, including synchronization resource control (loaded keys) example applications test
Slide 47: IBM Research: Trusted Linux Client
IBM Research: Trusted Linux Client Goals: protect integrity of system from current attacks be transparent to user let user get job done block only malicious activity Foundations: TPM LSM (Linux Security Modules) Functionality TPM based “Trusted Boot” Authenticated file metadata for storing has
Slide 48: Trusted Linux Client Modules
Trusted Linux Client Modules: TPM: driver measures integrity of kernel and initrd, and releases kernel key EVM: Extended Verification Module – authenticates extended attributes, data SLIM: Simple Linux Integrity Module – Mandatory Access Control Sandbox Implemented as stacked LSM module: mea
Slide 49: TLC Extended Attributes
TLC Extended Attributes EVM Extended Attributes: security.evm.hash - hash of file data (from signed rpm) security.evm.hmac - hmac-sha1 of security.* attributes security.evm.packager – signer of package security.evm.version - version of package SLIM Extended Attributes security.slim.level – six class
Slide 50: Open Source TPM projects – What's Missing?
Open Source TPM projects – What's Missing? OpenSSL support Example applications already use OpenSSL key formats Need way to use TPM for client side SSL authentication hooks for openSSL to call TPM library Copyright© 2005 Trusted Computing Group - Other names and brands are properties of their resp
Slide 51: Open Source Trusted Computing
Open Source Trusted Computing Future Work – Integration with virtualization (Xen) – Integration with Selinux – Integration with encrypted filesystems Summary – drivers, libraries, trusted boot available now – many more applications in work Copyright© 2005 Trusted Computing Group - Other names an
Slide 52: Agenda: Writing and Using Trusted Applications, Alexander Koehler
Agenda 9:45 am Writing and Using Trusted Applications Alexander Koehler, Utimaco Safeware AG; Steven Sprague, Wave Systems Alexander Koehler completed his studies in mathematics and computer science at Karlsruhe University, Germany. After working as software development engineer on ground transporta
Slide 53: Writing and Using Trusted Applications: Security Solutions in Operation
Writing and Using Trusted Applications: Security Solutions in Operation Alexander W. Koehler Business Intelligence Utimaco Safeware Inc. Copyright© 2005 Trusted Computing Group - Other names and brands are properties of their respective owners. Slide #53
Slide 54: Agenda
Agenda • Improvements of security at all three states of a mobile PC: – Power-Off – Boot – Operational • From TCG to TCO (Total Cost of Ownership) • Testimonials: It is not just theory, it works Copyright© 2005 Trusted Computing Group - Other names and brands are properties of their respective owner
Slide 55: Risks in IT - Types of Attacks and Misuse
Risks in IT - Types of Attacks and Misuse Laptop theft Sabotage Financal faud Theft of proprietary info Unauthorized Access Net abuse Denial of Service Virus 0 50 100 150 200 250 300 Number of respondents Source: CSI/FBI: Computer Crime and Security Survey 2003 http://www.gocsi.com/db_area/pdfs/fbi/
Slide 56: The Base Protection Issue on Notebooks
The Base Protection Issue on Notebooks • In Windows® XP the SAM database stores passwords • Microsoft® recommends to encrypt the SAM database with „syskey“ (*). – It requests either an additional password entry every time the notebook is booted or a floppy has to be carried around – It is not conven
Slide 57: Power-Off Protection
Power-Off Protection ® • Bulk Encryption with SafeGuard Easy – If an attacker steals the hard drive or the notebook, all data is protected. The SAM, system files, temporary files, page files, Microsoft Office® files, the hibernation file, a.s.o., everything is encrypted. – Encryption is compatible w
Slide 58: Authentication
Authentication • Pre-Boot Authentication in combination with a TPM offers authentication in a compact and protected environment. • Security – Vulnerabilites of a large system like an OS cannot be exploited – Credentials are protected through hardware – Mutual authentication „server-client“ through T
Slide 59: Authentication – Boot – Authorization
- Authentication – Boot – Authorization • Security – Boot: Machine Binding – SSO: The TPM is the „Root of Trust“ for the SSO process • Credentials are protected through hardware • Convenience – SSO • Highly complex passwords • Certificates (X.509) – Deployment – Revocation – PKI Copyright© 2005 Trus
Slide 60: Operational
Operational • Protecting data through Virtual Disk – A Virtual Disk is a „vault“ for data – Virtual Disks can be mounted / dismounted as operating environments change (online, offline) – Neither content nor structure is visible – Protected through passwords or certificates – Virtual Disks on harddri
Slide 61: Operational
Operational • Secure Media Exchange – Protection reaches beyond the PC platform – Virtual Disks can be exchanged between PC platforms and Converged Mobile Devices (phones, PDAs) – Content secured by secrets, which are protected through TPMs Copyright© 2005 Trusted Computing Group - Other names and b
Slide 62: The Trusted Platform Module Today
The Trusted Platform Module Today • The TPM provides a variety of solid improvements in security of system and application software • Products are available already today for the benefit of the customer Copyright© 2005 Trusted Computing Group - Other names and brands are properties of their respecti
Slide 63: From TCG to TCO
From TCG to TCO • TCO (Total Cost of Ownership) – The TPM is a low-cost, built-in hardware unit – No additional costs for purchase of e.g. tokens – No additional costs for lifecycle management – Gains in productivity • No extra deployment • No install • No downtime due to lefts – Gains in administra
Slide 64: Bulk Encryption and TCG in Operation
Bulk Encryption and TCG in Operation • LBS Nord, Hannover, Germany • Building society, 1 million customers • The application: – Agents provide their consulting services inside the customers‘ premises • customers‘ workplace • customers‘ home – LBS proprietary consulting software and company data are
Slide 65: Bulk Encryption and TCG in Operation
Bulk Encryption and TCG in Operation • The solution: • IBM® T40 Thinkpads®, equipped with TPMs (Trusted Platform Module) • IBM® ThinkVantage® Technology: Embedded Security Subsystem: Streamlined client management in conjunction with improved security • Utimaco SafeGuard® Easy: Bulk Encryption of all
Slide 66: Bulk Encryption and TCG in Operation
Bulk Encryption and TCG in Operation • SWIFT is the financial industry-owned mutual organization, supplying secure, standardized messaging services and interface software to 7,600 financial institutions in 200 countries. HQ: La Hulpe, Belgium • Business Need: To cope with the consequences of theft o
Slide 67: Bulk Encryption and TCG in Operation
Bulk Encryption and TCG in Operation • The Solution: • IBM Thinkvantage ESS • Platform binding • data to the platform • platform to the network • High quality key generation by TPM • All data protection by all harddisk encryption • Notebook or HDD disposal at very low cost • TPM built-in at no extra
Slide 68: Summary
Summary • TCG technology leverages existing security technology for the benefit of the customer – Increased level of security – Decreased costs – Improved manageability – Standardization • Utimaco is committed to continue integration of TCG technology to provide also in the future leading edge secur
Slide 69: Alexander W. Koehler, Utimaco Safeware Inc.
Alexander W. Koehler Utimaco Safeware Inc. 10 Lincoln Road, Suite 102 Foxboro, MA 02035 Phone:(508) 543-1008 Fax:(508) 543-1009 Email: sales.us@utimaco.com www.utimaco.us Copyright© 2005 Trusted Computing Group - Other names and brands are properties of their respective owners. Slide #69
Slide 70: Agenda: Steven Sprague, Wave Systems
Agenda 9:45 am Writing and Using Trusted Applications Alexander Koehler, Utimaco Safeware AG; Steven Sprague, Wave Systems Steven Sprague is president and CEO of Wave Systems Corp. Wave is a leader in delivering trusted computing applications and services with advanced products, infrastructure and s
Slide 71: Writing and Using Trusted Applications: Security Solutions Using TCG Technology
Writing and Using Trusted Applications: Security Solutions Using TCG Technology Steven Sprague Wave Systems Corp. May 26, 2005 Copyright© 2005 Trusted Computing Group - Other names and brands are properties of their respective owners. Slide #71
Slide 72: Solution Opportunities
Solution Opportunities Current Problems Need Trusted Solutions Insecure Insecure Distribution Distribution Identity Identity Theft 1. Stronger Network Authentication of Theft ofData Data 2. Data Protection Worms, Worms, 3. Strong Authentication to VPNs Laptop Viruses Viruses Laptop Theft 4. Password
Slide 73: Getting started
Getting started 1. Make sure all procured PCs contain TPM’s • Dell, Fujitsu, HP, IBM/Lenovo, Intel, Toshiba….. 2. Solutions • Client applications • Data protection • Password Protection • Network applications • Asset management • Network access control • Digital Signing Copyright© 2005 Trusted Compu
Slide 74: What do I need
What do I need • Trusted computer with TPM and client Software – TPM 1.1b or TPM 1.2 – Client software with CSP – Management utilities – Key Transfer Management tools Client Copyright© 2005 Trusted Computing Group - Other names and brands are properties of their respective owners. Slide #74
Slide 75: How’s it Work
How’s it Work The 2 minute guide Copyright© 2005 Trusted Computing Group - Other names and brands are properties of their respective owners. Slide #75
Slide 76: TPM Security Programming Model
TPM Security Programming Model Application 3 Software Application Layer Application 1 Application 2 Software MSCAPI Infrastructure Software HDW TCG Enabled TCG Enabled Layer CSP CSP CSP Middleware HDW - Driver TSS Hardware Layer Smartcard or token TPM Copyright© 2005 Trusted Computing Group - Other
Slide 77: Client Applications
Client Applications Data protection Password Protection Windows Logon Data Signing Copyright© 2005 Trusted Computing Group - Other names and brands are properties of their respective owners. Slide #77
Slide 78: Data protection
Data protection • Several Methodologies – not a 1 size fits all solution… – File and Folder Encryption – Work Group file and Folder encryption • Key Sharing – Drive Locking – Whole Disk encryption – Data signing Copyright© 2005 Trusted Computing Group - Other names and brands are properties of their
Slide 79: Wave’s Document Manager
Wave’s Document Manager – Document and data Vault encryption View – TPM Hardware protected keys – Workgroup capability – Integrated support for backup Accessible Accessiblein inExplorer Explorer &&My Computer My Computer – Data protected against unauthorized access, theft of PC. Copyright© 2005 Trus
Slide 80: Password Management & Security
Password Management & Security • Wave’s Private Information Manager – TPM Secured storage of Web and Application usernames/passwords Web Weband andPC PCApplication Application Credential CredentialStorage Storage • Intelligent retrieval – automated • Auto capture of new login data – Multiple Profile
Slide 81: TPM Management & Authentication
TPM Management & Authentication • Wave’s EMBASSY Security Center – TPM Management – Multifactor Authentication with Biometric, Smart Card, TPM/PKI • Secure Windows Logon • TPM Key Authentication – TPM Key Password Management Copyright© 2005 Trusted Computing Group - Other names and brands are proper
Slide 82: Data Signing
Data Signing • Random document authentication • PDF signing tools • Paperless contracts Copyright© 2005 Trusted Computing Group - Other names and brands are properties of their respective owners. Slide #82
Slide 83: Server Tools
Server Tools • Backup and recovery • Access Control • Web Authentication Copyright© 2005 Trusted Computing Group - Other names and brands are properties of their respective owners. Slide #83
Slide 84: TPM Key Archive/Restore
TPM Key Archive/Restore • Wave’s Key Transfer Manager – Automatic or scheduled archive of client keys & certificates – Restore to same or different TPM PC – One button restore for platform failure – Active Directory Integration – Client and Server modes Copyright© 2005 Trusted Computing Group - Othe
Slide 85: Network Authentication
Network Authentication • Hardware Based Network Authentication – Integration with Microsoft VPN – Integration with VPN concentrators – Support any MS CSP compatible Networking equipment. – Both Simple PKI and full PKI support. • Trusted Network Connect (TNC) Copyright© 2005 Trusted Computing Group -
Slide 86: Web Authentication
Web Authentication • Business to Business capabilities – Supports active directory – Can be overlaid on existing user ID and Password systems • Many examples being explored by business’s today for token authentication – Can eliminate passwords or increase security of access – All Web projects should
Slide 87: Government Need
Government Need Agencies like DHS can benefit today from this technology. Solutions such as strong authentication can ensure that the PCs on the DHS network actually belong to DHS. We can use hardware security to report client platform status and configuration to the network during initial authentic
Slide 88: Conclusion
Conclusion • Trusted computing is available today. – Make sure all task orders ask for it. • Trusted Computing Client only applications can make each computer more secure and automate compliance • The server infrastructure can use Trusted Computing Platforms today and all future systems should reque
Slide 89: Thank you
Thank you Questions Contact Wave: Steven Sprague, CEO 413-243-7011 Marty Wargon, VP Gov’t Sales 561-752-4464 Providing the Software and experience to deploy trusted computing today Copyright© 2005 Trusted Computing Group - Other names and brands are properties of their respective owners. Slide #89
Slide 90: Agenda: Trusted Storage and Applications, Michael Willett
Agenda 10:30 am Trusted Storage and Applications Michael Willett, Seagate Technology, Inc. Dr. Michael Willett received his bachelor's degree from the US Air Force Academy and his Masters and Ph.D. degrees in mathematics from NC State University. After a career as a university professor of mathemati
Slide 91: Trusted Storage and Applications: Trusted Drive
Trusted Storage and Applications: TM Trusted Drive Michael Willett, Seagate and TCG Copyright© 2005 Trusted Computing Group - Other names and brands are properties of their respective owners. Slide #91
Slide 92: TCG Trusted Platform Module
TCG Trusted Platform Module TPM v1.2 functions include: • Store platform status information • Generates and stores a private key (+ derivative keys) • Hashes files using SHA-1 • Creates digital signatures • Anchors chain of trust for keys, digital certificates and other credentials Copyright© 2005 T
Slide 93: Extending Trust to Platform Peripherals
Extending Trust to Platform Peripherals Ability to interact with the Platform Authentication/Attestation LOW HIGH Capability Level Copyright© 2005 Trusted Computing Group - Other names and brands are properties of their respective owners. Slide #93
Slide 94: General Risk Model of a Peripheral
General Risk Model of a Peripheral Peripheral Controller Electronics Primary Host Loadable Data Sink / Source Interface Firmware Firmware Power Functions Special Hardware Functions Diagnostic Ports Probe Points Trust = systems operate as intended Objective: Exercise control over operations that migh
Slide 95: Joint Work with ISO T10 and T13
Joint Work with ISO T10 (SCSI) and T13 (ATA) TRUSTED SEND (Protocol ID = xxxx …..) TRUSTED RECEIVE T10/T13 defining the “container commands” TCG/Storage/Peripherals defining the “TCG payload” Protocol IDs assigned to TCG, T10/T13, or reserved Copyright© 2005 Trusted Computing Group - Other names and
Slide 96: Protocol ID = 0 and Credential
Protocol ID = 0 and Credential TRUSTED SEND (Protocol ID = 0 …..) TRUSTED RECEIVE (Device Credential, ….) Status: Container Commands (IN/OUT) and Device Credential Submitted to T10/SCSI (under review) Copyright© 2005 Trusted Computing Group - Other names and brands are properties of their respective
Slide 97: Device Credential
DEVICE CREDENTIAL Field name Description Credential Serial Number The unique serial number of the credential Credential Validity Period The time for which the credential is valid as determined by the issuer of the credential Credential Issuer The issuer of the credential Credentialed Entity Identifi
Slide 98: Scope: Payload Commands w/ Protocol ID = TCG
Scope: Payload Commands w/ Protocol ID = “TCG” - Establishing/managing communications: Secure Messaging, RPC - Parameter management: table entries with Access Control - Security management: Secure Partitions, Authority, ACLs - Cryptography: random numbers, key generation, encrypt/decrypt, hash - Adm
Slide 99: Trusted Send/Receive w/Access Control
Trusted Send/Receive w/Access Control Versatile Access Control per Command TRUSTED SEND (Protocol ID = TCG …..) TRUSTED RECEIVE -Authentication and Access Control -Protecting Hidden Storage and Password Trusted Drive security features Biometrics -Join TCG and see!! RSA Authentication MAC Challenge/R
Slide 100: Trusted Drive and TPM: TCG Use Case
Trusted Drive and TPM: TCG Use Case Wave Systems Booth Trusted Platform Configuration •Enroll Drive with Platform Host •Drive will not Read/Write unless attached to the Platform Host Wave EMBASSY Trust Suite •Prevents re-purposing (theft) Trusted Drive by Seagate of drives or attachment of drives on
Slide 101: Demonstration: Technical Details
Demonstration: Technical Details Wave EMBASSY Software SEAGATE TPM TPM Trusted Drive KEYS Created During Enrollment Both TPM and Trusted Drive Provide Strong Key Protection • Uses MAC Authentication and Secure Messaging • 3DES symmetric keys –secure messaging between drive and host (3DES encrypt the
Slide 102: Contrast: Password-Only Drive Locking
Contrast: Password-Only Drive Locking Corporate user knows the password (user has to type it in!) so user can re-purpose the drive compared to Wave EMBASSY Software SEAGATE T PM TPM Trusted Drive User plugs the drive into the USB port: –First time only, give the TPM password (not the drive password)
Slide 103: Thank You! Questions?
www.trustedcomputinggroup.org THANK YOU! QUESTIONS? Copyright© 2005 Trusted Computing Group - Other names and brands are properties of their respective owners. Slide #103
Slide 104: Agenda: Trusted Network Connect Overview, Jon Brody
Agenda 10:50 am Trusted Network Connect Overview Jon Brody, Sygate Technologies Jon Brody, Vice President of Marketing Communications, brings to Sygate nearly twenty years of expertise in building and marketing software solutions to global enterprises for secure collaboration and business integratio
Slide 105: Trusted Network Connect Overview: Why, What, When
Trusted Network Connect Overview: Why, What, When Jon Brody VP Marketing, Sygate Technologies TCG/TNC Member Copyright© 2005 Trusted Computing Group - Other names and brands are properties of their respective owners. Slide #105
Slide 106: Open networks: boon and bane
Open networks: boon and bane • Security approaches have always failed – but open networks have amplified the consequences of failure. • Open networks are better – Open networks enabling new business models. • NYT 2/24/05 – even biotech jobs are moving overseas. • The Washington Times, 3/21/05 “Telew
Slide 107: Technology Advantage
One business problem at a time. Problem 2 Problem 3 Problem 1 Put your employees Permit any device Put your business on the web on the web on your on the web network Get global market access Enable telework on corporate Enable outsourcing, Advantage laptops consultants Set up a perimeter VPN Clientl
Slide 108: Root Cause - Open Networks Promiscuous and Permissive
Root Cause - Open Networks Promiscuous and Permissive 1. Any device y Corporate, Employee, Guest, Consultant, Outsourcer 2. Anywhere y Home, Hotel, Kiosks y DSL, Wireless, Dial-up 3. Anything goes y Any application – p2p y Any configuration – missing patches y Any protection – turned off, old, out o
Slide 109: Effort and Value misaligned
Effort and Value misaligned Mission disruption • Business Models Outsourcing • New Markets Internet Point of Presence Value • Cost and Productivity Telework, B2E Automation Compliance violation • Regulations Regulatory fines • Auditors Civil penalties Effort • Security Admin Audit findings Operation
Slide 110: Pragmatic view
Pragmatic view Misconfiguration, Misuse, and Malicious Access Misconfiguration Old Patch Recent Patch IPS New Vulnerability 0 Day Source: Gartner Copyright© 2005 Trusted Computing Group - Other names and brands are properties of their respective owners. Slide #110
Slide 111: Without An Infrastructure & Framework: Can We Keep Up?
Without An Infrastructure & tac Framework: Can We Keep Up? At ks ks 9 Each an Individual Process tac AV At 9 Keep Turning on Same SIMS Cranks 9 Continues to Produce VM Same Results 9 Each One Has Unique F/W Metric ks 9 Neither Efficient or Attac IDS At Effective tac 9 No Integrated Solution ks s Att
Slide 112: TNC Solution Creates a Virtual Airlock
TNC Solution Creates a “Virtual Airlock” for Network Access & Protection PR OT REMEDIATION NE EC TW TE OR D K INTEGRITY CHECK login IDENTITY CHECK Copyright© 2005 Trusted Computing Group - Other names and brands are properties of their respective owners. Slide #112
Slide 113: Policy Enforcement
New Framework to Marshal Assets AV PFW OS Phishing Endpoint Remediation Integrity Behavior Spyware Buffer DRM Encryption Overflow hIPS Address Cisco NAC Services - DHCP Policy Enforcement Points Identity Services LAN Switching & Remote Access Wireless Endpoint - PFW Inline Gateway - RADIUS SSL & IPs
Slide 114: TNC Architecture
TNC Architecture Policy Policy Decision Integrity Measurement Layer Access Requestor Enforcement Point Point t Integrity Measurement Collector Peer Relationship Integrity Measurement Verifiers Collector Verifiers Collectors Verifiers TNC Peer Relationship TNC Client Server Platform Trust Network Pol
Slide 115: NAP alignment
NAP alignment Policy Policy Decision Access Requestor Enforcement Point Point t NAP System NAP System Integrity Measurement Collector Peer Relationship Health Agents Collector Integrity Measurement Verifiers Verifiers Health Collectors Verifiers Verifiers Quarantine Agent TNC Peer Relationship TNC Q
Slide 116: NAC Alignment
NAC Alignment Policy Policy Decision Access Requestor Enforcement Point Point t NAC AV NAC AV Clients Integrity Measurement Collector Peer Relationship Collector Integrity Measurement Verifiers Verifiers Servers Collectors Verifiers Cisco Trust TNC Peer Relationship TNC Cisco ACS Agent Client Server
Slide 117: What’s New Today
What’s New Today • Client-Integrity Measurement Collector Spec (APIs) • Server- Integrity Measurement Verifier Spec (APIs) AR PEP PDP IMV API Features Measurement IMC API Features •Integrity Check Integrity Integrity Measurement Integrity Measurement Handshake Layer •Integrity Check Collector Verifi
Slide 118: What Can Vendors Do With Today’s APIs?
What Can Vendors Do With Today’s APIs? • Develop interoperable products based on an open specification developed by the industry • Spec designed so that vendors can upgrade existing products rather than re-engineer them, decreasing time to market for solutions • Based on existing standards and proto
Slide 119: Example: Integrated Corporate & Guest Compliance & Enforcement
Example: Integrated Corporate & Guest Compliance & Enforcement Corporate Devices Sygate Sygate Management • Authenticate using 802.1X/EAP (optional) Funk LAN Server RADIUS • Norton Anti-Virus, Sygate Security Agent, Enforcer Remediation Patches Enforced using LAN Enforcer + 802.1x/EAP • Dynamically
Slide 120: Large Federal Agency enforce policy on guests
Large Federal Agency enforce policy on guests Requirements: y Eliminate or control access by non corporate devices y Ensure government devices on LAN and VPN are compliant with policy. y Juniper SSL, Cisco Switches, any AV y No forklift upgrades y Integrate with existing incident response systems. S
Slide 121: Global Oil Services Company, enforce employee data privacy policy
Global Oil Services Company, enforce employee data privacy policy Requirements: y Protect sensitive HR, business data on SAP system from being compromised at endpoint y Stop malicious code from entering the network via mobile users & contractors y Juniper SSL, Cisco Switches, any AV Solution: y Secu
Slide 122: International Financial Services policy to protect anydevice access
International Financial Services policy to protect “anydevice” access Requirements: y Secure “anytime, anydevice, anyplace” computing y React to internal events in near real-time y Flag unauthorized applications (e.g. Kazaa) when installed y Juniper, Nortel, Cisco Infrastructure y any AV, Alteris Co
Slide 123: ATM Manufacturer enforces remote access policy
ATM Manufacturer enforces remote access policy Requirements: y Protect 5,000 mobile & remote users y Enforce security policy & patching y Control consultant & employee external access to internal resources Solution: y Ensure compliance before permitting network access y Nortel VPN integration Benefi
Slide 124: Trusted Computing Group Booth
Trusted Computing Group Booth • The TCG will be showcasing a number of available member platforms running trusted applications at booth #1743 • Complete the Trusted Computing Group Seminar Survey Copyright© 2005 Trusted Computing Group - Other names and brands are properties of their respective owne
Slide 125: Questions & Answers
Questions & Answers Copyright© 2005 Trusted Computing Group - Other names and brands are properties of their respective owners. Slide #125
Slide 126: Thank You
Thank You Copyright© 2005 Trusted Computing Group - Other names and brands are properties of their respective owners. Slide #126