View source for Linux Security Summit 2012/Abstracts/Steffen

== Title ==

The Linux Integrity Subsystem and TPM-based Network Endpoint Assessment

== Presenter ==

Andreas Steffen, HSR University of Applied Sciences Rapperswil, Switzerland

== Abstract ==

The Integrity Measurement Architecture (IMA) introduced with the
Linux 2.6.30 kernel extends its BIOS measurements taken during the
pre-boot phase into the Platform Configuration Registers (PCRs) of
a Trusted Platform Module (TPM). The IETF Network Endpoint Assessment
(NEA) reference model (RFC 5209) defines Posture Attribute (PA),
Posture Broker (PB) and Posture Transport (PT) protocols which allow
the exchange of security measurement data between a NEA client and a
NEA server.

The open source Linux strongSwan VPN software implements the PA-TNC
(RFC 5792), PB-TNC (RFC 5793) and PT-EAP (draft-ietf-nea-pt-eap)
protocols over a secure IKEv2 EAP TTLS communication channel and can
act either as a NEA client collecting IMA measurement data signed
by the TPM or as a NEA server validating the received measurements
against reference values stored in a database. Based on the assessment
result the NEA server either grants or denies network access to the
NEA client.

This talk will give a short overview on the IETF NEA framework and
will then present the implemented TPM-based IMA BIOS measurements
use case. Finally an outlook will be given on how remote attestation
could be extended to EVM file measurements.


Links:

TPM-based Remote Attestation of the IMA BIOS measurements

* NEA client side:
http://wiki.strongswan.org/projects/strongswan/wiki/PTS-IMC

* NEA server side:
http://wiki.strongswan.org/projects/strongswan/wiki/PTS-IMV

strongSwan’s TNC-based Network Endpoint Assessment capabilities
http://www.strongswan.org/tnc/