Introduction of Trusted
Network Connect
Houcheng Lee
May 9, 2007
What is Trusted Computing?
Trusted Computing Group
(TCG)
Copyright© 2007 Trusted Computing Group - Other names and brands are properties of their respective owners.
Promoters
AMD
Hewlett-Packard
IBM
Intel Corporation
Microsoft
Sun Microsystems, Inc.
Contributors
Adaptec, Inc.
Agere Systems
American Megatrends, Inc.
ARM
Atmel
AuthenTec, Inc.
AVAYA
Broadcom Corporation
Certicom Corp.
Check Point Software, Inc.
Citrix Systems, Inc.
Comodo
Dell, Inc.
Endforce, Inc.
Ericsson Mobile Platforms AB
France Telecom Group
Freescale Semiconductor
Fujitsu Limited
Fujitsu Siemens Computers
Trusted Computing Group (TCG) Membership
170 Total Members as of January, 2007
Contributors
Funk Software, Inc.
General Dynamics C4 Systems
Giesecke & Devrient
Hitachi, Ltd.
Infineon
InfoExpress, Inc.
InterDigital Communications
iPass
Lenovo Holdings Limited
Lexmark International
Lockheed Martin
M-Systems Flash Disk Pioneers
Maxtor Corporation
Meetinghouse Data
Communications
Mirage Networks
Motorola Inc.
National Semiconductor
nCipher
NEC
Nevis Networks, USA
Nokia
NTRU Cryptosystems, Inc.
NVIDIA
OSA Technologies, Inc
Philips
Phoenix
Pointsec Mobile Technologies
Renesas Technology Corp.
Ricoh Company LTD
RSA Security, Inc.
Samsung Electronics Co.
SanDisk Corporation
SCM Microsystems, Inc.
Adopters
ConSentry Networks
CPR Tools, Inc.
Credant Technologies
Fiberlink Communications
Foundstone, Inc.
GuardianEdge
ICT Economic Impact
Industrial Technology Research Institute
Infosec Corporation
Integrated Technology Express Inc.
LANDesk
Lockdown Networks
Marvell Semiconductor, Inc.
MCI
Meganet Corporation
Roving Planet
SafeBoot
Safend
Sana Security
Secure Elements
Senforce Technologies, Inc
SII Network Systems, Inc.
Silicon Storage Technology, Inc.
Softex, Inc.
StillSecure
Swan Island Networks, Inc.
Symwave
Telemidic Co. Ltd.
Toppan Printing Co., Ltd.
Trusted Network Technologies
ULi Electronics Inc.
Valicore Technologies, Inc.
Websense
Contributors
Seagate Technology
Siemens AG
SignaCert, Inc.
Silicon Integrated Systems Corp.
Sinosun Technology Co., Ltd.
SMSC
Sony Corporation
STMicroelectronics
Symantec
Symbian Ltd
Synaptics Inc.
Texas Instruments
Toshiba Corporation
TriCipher, Inc.
Unisys
UPEK, Inc.
Utimaco Safeware AG
VeriSign, Inc.
Vernier Networks
Vodafone Group Services LTD
Wave Systems
Winbond Electronics Corporation
Adopters
Advanced Network Technology
Labs
Apani Networks
Apere, Inc.
ATI Technologies Inc.
BigFix, Inc.
BlueRISC, Inc.
Bradford Networks
Caymas Systems
Cirond
Copyright© 2007 Trusted Computing Group - Other names and brands are properties of their respective owners.
TCG Key Players
Trusted Platform Module
(TPM)
Copyright© 2007 Trusted Computing Group - Other names and brands are properties of their respective owners.
Trusted Platform Module (TPM)
Introduction
What is a TPM?
A Hardware
What it does?
V1.2 functions, including:
•
stores OS status information
•
generates/stores a private key
•
creates digital signatures
•
anchors chain of trust for keys,
digital certificates, and other
credentials
Copyright© 2007 Trusted Computing Group - Other names and brands are properties of their respective owners.
TPM – TCG Definition
Asymmetric Key Module
Generate, store & backup public/private key pairs
Generate digital signatures, encrypt/decrypt data
Trusted Boot Configuration
Storage of software digests during boot process
Anonymous Attestation
Endorsement key used to establish properties of
multiple identity keys
TPM Management
Turn it on/off, ownership / configure functions, etc.
Copyright© 2007 Trusted Computing Group - Other names and brands are properties of their respective owners.
TPM – Abstract Definition
Root of Trust in a PC
Operations or actions based on the TPM have measurable
trust.
Flexible usage model permits a wide range of actions to be
defined.
Doesn’t Control PC (About DRM)
User still has complete control over platform. It’s OK to turn
the TPM off (it ships disabled).
User is free to install any software he/she pleases.
Copyright© 2007 Trusted Computing Group - Other names and brands are properties of their respective owners.
Why Not Software?
Software is hard to secure.
Ultimately, it is usually based on something stored in a
relatively insecure location (like the hard drive).
Soft data can be copied.
Lets an attacker take more time or apply more
equipment to the attack procedure.
Security can’t be measured.
Two users running same software operation may see
radically different risks.
Copyright© 2007 Trusted Computing Group - Other names and brands are properties of their respective owners.
TPM Measurement flow
Trusted Network Connection
(TNC)
Copyright© 2007 Trusted Computing Group - Other names and brands are properties of their respective owners.
What is TNC?
Open Architecture for Network Access Control
Suite of Standards
Developed by Trusted Computing Group
Copyright© 2007 Trusted Computing Group - Other names and brands are properties of their respective owners.
Network Endpoint Problem
Sophisticated Attacks
Viruses, Worms, Spyware, Rootkits, Botnets
Zero-Day Exploits
Targeted Attacks
Rapid Infection Speed
Exponential Growth
> 40,000,000 Infected Machines
> 35,000 Malware Varieties
Motivated Attackers (Bank Crackers)
Any vulnerable computer is a stepping stone
Copyright© 2007 Trusted Computing Group - Other names and brands are properties of their respective owners.
Key Computing Trends Drive the Need
for TNC
TREND
Increasing network span to
mobile workers, customers,
partners, suppliers
Network clients moving to
wireless access
Malware increasingly targeting
network via valid client
infection
New malware threats
emerging at an increasing rate
IMPLICATION
Less reliance on physical
access identity verification (i.e.
guards & badges)
Remote access sequences
easily monitored, cloned
Clients ‘innocently” infect
entire networks
Client scanning demands
move from once/week to
once/login
Copyright© 2007 Trusted Computing Group - Other names and brands are properties of their respective owners.
Network Integrity Architectures
Several Initiatives are pursuing Network Integrity
Architectures
All provide the ability to check integrity of objects
accessing the network
[Cisco] Network Admission Control (NAC)
[Microsoft] Network Access Protocol (NAP)
[TCG] Trusted Network Connect (TNC)
Support multi-vendor interoperability
Leverage existing standards
Empower enterprises with choice
Copyright© 2007 Trusted Computing Group - Other names and brands are properties of their respective owners.
Trusted Network Connect Advantages
Open standards
Open standards process
multi-vendor compatibility
Enable customer choice
open technical review
Integrates with established protocols like EAP,
TLS, 802.1X, and IPsec
Incorporates Trusted Computing Concepts
- guarding the guard
Copyright© 2007 Trusted Computing Group - Other names and brands are properties of their respective owners.
Moving from “who” is allowed on the network
User authentication
To “who” and “what” is allowed on the network
Adding Platform Integrity verification
Controlling Integrity of What is on
the Network
Copyright© 2007 Trusted Computing Group - Other names and brands are properties of their respective owners.
Check at connect time
- Who are you -
- What is on your computer
User DB
+
Integrity DB
Can I connect?
Access control dialog
Enterprise Net
QuickTime™ and a
TIFF (Uncompressed) decompressor
are needed to see this picture.
Copyright© 2007 Trusted Computing Group - Other names and brands are properties of their respective owners.
Quarantine and Remediation
No I am quarantining you
Try again when you’re fixed up
Remediation
Server
Access control dialog
data
User DB
+
Integrity DB
Can I connect?
Enterprise Net
Quarantine
Net
QuickTime™ and a
TIFF (Uncompressed) decompressor
are needed to see this picture.
Copyright© 2007 Trusted Computing Group - Other names and brands are properties of their respective owners.
TNC Architecture
Copyright© 2007 Trusted Computing Group - Other names and brands are properties of their respective owners.
TNC Architecture
Verifiers
Verifiers
t
Collector
Collector
Integrity Measurement
Collectors (IMC)
Integrity Measurement
Verifiers (IMV)
Network
Access
Requestor
Policy
Enforcement
Point (PEP)
Network Access
Authority
TNC Server
(TNCS)
Policy Decision
Point
TSS
TPM
Platform Trust
Service (PTS)
TNC Client
(TNCC)
Peer Relationship
Peer Relationship
(IF-TNCCS)
(IF-T)
(IF-M)
Policy Enforcement
Point
Access Requestor
(IF-IMC) (IF-IMV)
(IF-PTS)
(IF-PEP)
Copyright© 2007 Trusted Computing Group - Other names and brands are properties of their respective owners.
Endpoint Integrity Policy
Machine Health
Anti-Virus software running and properly
configured
Recent scan shows no malware
Personal Firewall running and properly configured
Patches up-to-date
No authorized software
Machine Behavior
No porting scanning, sending spam, etc.
Copyright© 2007 Trusted Computing Group - Other names and brands are properties of their respective owners.
Examples of Integrity Checks
Virus scan
Is virus scanner present/ which version
Has it run “recently” / what is the result
Spyware checking
Is Spyware checker running/ what version
Have programs been deleted/isolated
What is your OS patch level
Is unauthorized software present?
Other - IDS logs, evidence of port scanning
Copyright© 2007 Trusted Computing Group - Other names and brands are properties of their respective owners.
Network Operator Access Policy
Define policy for what must be checked
e.g. Virus, Spyware and OS Patch level
and
results of checks
e.g. Must run
VirusC- version 3.2 or higher, clean result
SPYX- version 1.5 or higher
Patchchk - version 6.2 or higher, patchlevel-3 or newer