![](bg4.png)
curely storage. The workflow is when the service is
called, the TPM functionalities are used to attests the
(complete) service configuration and the key is made
available to the service. If the service has changed
the TPM functionalities are used to check (attesta-
tion) will fail and the key will not be available. We
highlight the fact that each response to a call to the
service is signed with the service private key. In or-
der to allow for different configurations each group of
services sharing an infrastructure is executed in a vir-
tual machine. Obviously, this solution implies some
restrictions, such as services always run on TPM-
equipped hardware. In those cases in which services
run on virtual machines, then hardware must be pro-
vided on this. Clients has there requirement of be-
ing TPM-equipped hardware, at least in the more re-
stricted cases. However, these restrictions are not hard
to meet. Moreover, some restrictions can be relaxed
since our model can be implemented without virtu-
alization, and we can use sessions to avoid signature
of all messages. One important appeal of our model
is the inherent flexibility of this model since it allows
that several binding mechanisms can co-exist. As we
previously mentioned, our approach is based on the
usage of trusted computing technology, which is es-
sential to perform the attestation of both the hardware
and the native OS. Our basic scheme makes use of the
sealed bind key functionality provided by the trusted
computing technology, in such a way that the sealed
bind key is used to encrypt part of the service code
in such a way that it can be only used when the plat-
form is in that trusted state. This model is very re-
strictive, but it provides a high level of security since
it establishes a very limited execution environment.
Nevertheless, the limitations of this model make dif-
ficult its integration in real world scenarios, but a tai-
lored solution based on this scheme can be suitable
for particular cases.We differentiate between two use
cases, the assert creation use case, where the Certifi-
cate Authorization is involvedand the Assert User use
case. The first step in the Assert Creation use case
is the service evaluation, which involves that the CA
checks a list of properties that must be fulfilled and
makes an inspection of the service. Thus, CA fills
in the assert form with extracted data. For this pur-
pose, a key pair is created from a sealed key related to
the state of the platform. A possible binding scheme
must to consider that each service is asserted to op-
erate with a key pair. Additionally, service providers
can be made legally responsible for using the key pair
only with the asserted service. The key pair resides
in a TPM and it is bound to the asserted configura-
tion of the service. When the service is called, the
TPM attests the (complete) service configuration and
the key sets as available to the service. If the service
has been changed the TPM functionality is used to at-
test the state the checking will fail and the key will not
be available. Each response to a call to the service is
signed with the service private key. In order to allow
different configurations, each group of services shar-
ing the same infrastructure is executed in a virtual ma-
chine. This solution implies several restrictions, such
as the services must be run on TPM-equipped hard-
ware (or even virtualized). Additionally, the service
clients must use cryptography. Nevertheless, these
restrictions are not hard to meet and even some re-
strictions can be relaxed. In some cases we can do
without virtualization. The most relevant appeal of
our approach is the scalability, since this approach al-
lows the use of asserts for the orchestration of dif-
ferent services (i.e dynamic coalitions for emergency
targets), by means of the composition of services can
be asserted by a composed assert. TC Proofs are lim-
ited (for this scenario), in the case that a high-level
certificate (for in stance for a service) refers to a stan-
dard TC proof to define the platform state, it should
be needed issue a different certificate for each valid
platform configuration. This addresses to the need of
improvements in flexibility, and interoperability. Fol-
lowing this target, we propose semantic approaches
that can be the basis for the necessary improvements.
Certificate Service A provides the property ”confiden-
tiality of user data” if the platform provides encrypted
isolated storage. The semantic proof specification is
encrypted isolated storage. And destination platform
provides encrypted isolated storage if measured con-
figuration is ”mc”. Figure 4 shows different steps in
the workflow of the certification process. In the tra-
ditional scheme validity and properties are analysed
and then the certificate is accepted or rejected. In
our scheme we introduced the extraction of runtime
proofs that making use of a semantic proof specifica-
tion TC software measurement are generated. Then
workflow is split to generate measured TC Proof and
we get the platform semantic certificate. Then the
semantic proof certificate is generated and validated.
Finally, measure TC proofs and required TC proofs
from the semantic proof certificate are compared to
accept or reject the certificate.
4.1 The Basic Binding Scheme
Implementation
For the implementation of our basic binding scheme
we make use of the Certified Migratable Key (CMK)
functionality provided by the TPM. It is a kind of key
that is halfway between a non-migratable key and a
migratable key. These are inside of a TPM chip, but it
SECRYPT2014-InternationalConferenceonSecurityandCryptography
408