Logical attestation

Abstract

This paper describes the design and implementation of a new operating system authorization architecture to support trustworthy computing. Called logical attestation, this architecture provides a sound framework for reasoning about run time behavior of applications. Logical attestation is based on attributable, unforgeable statements about program properties, expressed in a logic. These statements are suitable for mechanical processing, proof construction, and verification; they can serve as credentials, support authorization based on expressive authorization policies, and enable remote principals to trust software components without restricting the local user's choice of binary implementations.We have implemented logical attestation in a new operating system called the Nexus. The Nexus executes natively on x86 platforms equipped with secure coprocessors. It supports both native Linux applications and uses logical attestation to support new trustworthy-computing applications. When deployed on a trustworthy cloud-computing stack, logical attestation is efficient, achieves high-performance, and can run applications that provide qualitative guarantees not possible with existing modes of attestation.bitstring that encodes a label is known as a credential. Since labeling functions can be provided by third parties and labels are logical statements, a rich set of properties can be available for logical attestation. These properties can incorporate references to dynamic system state, including the current time, current resource availability, and even history. Labels used in proofs demonstrate, through logical inference, reasons why a principal should be trusted; they are consumed by guards that verify proofs to make authorization decisions.We have implemented a new operating system, called Nexus, designed around logical attestation. Nexus executes on x86 platforms equipped with a TPM, supports much of the Posix API, and natively executes many Linux applications. To our knowledge, Nexus is the first operating system to implement logic-based authorization with dynamic system state, the first to implement operating system capabilities [7] based on statements issued by a TPM, and first to support all three bases for trust in a single unified framework. Logical attestation enables novel authorization functionality, as we illustrate, and provides strong and useful guarantees today's systems cannot provide.We illustrate the power of our new authorization architecture by implementing a cloud computing application, called Fauxbook, that implements guarantees about safety, confidentiality, and resource control. Fauxbook provides a familiar social networking experience, where users publicly post and exchange status messages. Even Fauxbook developers are blocked, by our authorization architecture, from examining or data-mining the information Fauxbook handles. Moreover, logical attestation enables the cloudinfrastructure operator to guarantees certain forms of resource availability to Fauxbook developers. Experiments show that the co...

Verifying System Integrity by Proxy

“…al. [52] proposed an authorization logic supported by a custom OS kernel that enables verification using high-level statements instead of binary hashes. This approach greatly simplifies the complexity of verifying attestations and provides a richer measurement framework for both local and remote entities.…”

Plug-n-trust

“…Furthermore, TPM programming remains highly challenging, so TPMs have only been used in limited settings [37]. New approaches, such as Logical Attestation [39], may ease the use of TPMs if smart-phone vendors were to adapt the Nexus operating system to small-scale platforms.…”