Attestation and TEE: Cybersecurity Controls with Privacy for Cloud Access
Understand how attestation of a TEE is the dynamic measure of the health of the isolated execution technology, and its role in building a trust chain from the manufacturer to the last power cycle of the device.
Mobile and Internet of Things are more than marketing terms, they represent a new model of network architecture: an architecture which is based on the identity of the device and its capabilities to create and consume secure information. Identity of the device is a start but will not be enough to assure the quality of the information. Trusted Execution in modern processors provides for the isolated execution of code that can be measured and assured to provide a level of confidence in the data produced or consumed. The register and forget models of security will not be enough to assure a programmable trusted execution system. Real time transaction level assurance of the environment will be required to achieve cyber security for modern transactions or instructions.
Attestation of a Trusted Execution Environment (TEE) is the dynamic measuring of the health of the isolated execution technology, and is based on building a trust chain from the manufacturer to the last power cycle of the device. This process assures that only known code is running in the device, and verifies the full supply chain integrity of the processing engine producing the secure information. Attestation is a complex process but a very simple transaction. The transaction is just a simple comparison: “does the current measurement of health match a reference value?”. If it does, then it is possible to forensically prove that the process expected actually happened - proving the correct hardware, bios, operating environment, and applications were used in the isolated execution of TEE on a specific device.
The attestation process can also support external event verification. The TEE can be used to create an attribute request that is required prior to transmitting a real time measurement. By incorporating this business process in the reference measurement, it can be required every time a transaction is executed. The result is that external controls can be easily verified by a third party to be part of a transaction without the third party knowing anything about the control. A classic example would be Amazon Web Services executing a TEE signed command without knowing that the user must be in a secure facility to send the command. This tokenization of cyber security controls supports the modern distributed compute models of the cloud but maintains the controls an enterprise must have to assert that they are secure. Tokenization provides the necessary privacy to reduce data leakage from an organization.
From sensors in a jet engine, to smartphones in banking, to smart cars and smart cities, there is a critical need for a new model of cyber security. A model that is scalable and efficient and able to address the new network architecture of clouds and things. Rivetz is building core technology to enable this future and to enhance the quality of information that powers these new innovations. We are creating a solution of known devices with known capabilities in a known condition, that can be tested and verified every time they handle sensitive data.
By: Steven Sprague, CEO, Rivetz Corp
