Property-based attestation for computing platforms: caring about properties, not mechanisms

Over the past years, the computing industry has started var-ious initiatives announced to increase computer security by means of new hardware architectures. The most notable ef-fort is the Trusted Computing Group (TCG) and the Next-Generation Secure Computing Base (NGSCB). This tech-nology oers useful new functionalities as the possibility to verify the integrity of a platform (attestation) or binding quantities on a specic platform (sealing). In this paper, we point out the deciencies of the attestation and sealing functionalities proposed by the existing speci-cation of the TCG: we show that these mechanisms can be misused to discriminate certain platforms, i.e., their operat-ing systems and consequently the corresponding vendors. A particular problem in this context is that of managing the multitude of possible congurations. Moreover, we highlight other shortcomings related to the attestation, namely sys-tem updates and backup. Clearly, the consequences caused by these problems lead to an unsatisfactory situation both for the private and business branch, and to an unbalanced market when such platforms are in wide use. To overcome these problems generally, we propose a com-pletely new approach: the attestation of a platform should not depend on the specic software or/and hardware (cong-uration) as it is today's practice but only on the \properties" that the platform oers. Thus, a property-based attestation should only verify whether these properties are sucient to ful ll certain (security) requirements of the party who asks for attestation. We propose and discuss a variety of solutions based on the existing Trusted Computing (TC) functional-ity. We also demonstrate, how a property-based attestation protocol can be realized based on the existing TC hardware such as a Trusted Platform Module (TPM)