TCG and IETF further cement interoperability in attestation with long-term partnership

Beaverton, OR, USA, December 2, 2019 – Pioneering work to guarantee more accountability and ownership in the Internet of Things (IoT) era is underway, as Trusted Computing Group (TCG) and the Internet Engineering Task Force (IETF) work to standardize the format for structuring attestation in connected devices.

Through their ongoing work on the definition and architecture of how attestation works, TCG and the IETF are enabling higher levels of security within the operating systems of mobile devices and tablets. Working together, the two global standards organizations are defining a structure for the assurances that are input into application codes and setting specific rules so that they can be interpreted and ran interchangeably and interoperably – regardless of the type of operating system.

This is to address challenges within the current infrastructure which was built with a premium on openness and interoperability. While this has paid huge dividends in terms of creativity and innovation, the same openness is problematic for security with evidence showing that the access control model of some operating systems is inadequate against many types of attacks – particularly in the hands of inexpert users. With the new standards being developed by TCG and IETF, device manufacturers can build up from a Trusted Platform Module (TPM) and chain attestation all the way from the hardware root of trust to an application – completely changing the model as to how security works.

“Endpoint security is at a point of evolution. Control assessment capabilities coupled with the assertions on the state of installed software provide a way to shift security control management and posture assessment to the solution source,” said Kathleen Moriarty, Chair of the IETF’s Remote ATtestation procedureS (RATS) Work Group. “With customer resource constraints, vendors are working together on solutions across standards bodies to provide a root of trust and methods to securely update firmware and software in order to deliver intrinsic control assessment capabilities and chained attestations on software modules.”

In a tightly managed operating system, the applications that are available to download entail specific attestation that has been approved by the device manufacturer. The device then checks the digital signature and makes sure everything is correct before it installs the code – increasing the levels of assurance and ownership and giving consumers the trust in terms of who the application is from and the code validation that has been carried out on it.

When an operating system has ties to the application and is not tightly managed, catastrophic consequences can occur as the applications have the ability to get down to the main operating system level where it is open to exploitation and numerous security problems.

In order to ensure the highest levels of security, whether the device contains a tightly managed operating system or not, device manufacturers need to consider the attestation in their connected devices. With the introduction of one set of standards, the industry is able to guarantee higher levels of assurance and ownership and ensure that there is more accountability when a problem occurs – putting onus on the owner who signed the application code. Since the application is responsible to sign the code, the manufacturer is providing an assurance that they believe that the code is secure, if a vulnerability is then found, they are ultimately responsible for removing the issue and updating or patching the application.

“Following years of developing standards separately, we realized that there was an overlap with attestation and in reality TCG and IETF were working together due to cross membership, with a number of individuals in TCG actively working in the IETF as well,” said Joerg Borchert, President and Chairman of TCG. “Since then, TCG and the IETF have built upon key endpoint standards and streamlined the work, driving forward its success and increasing momentum for full-scale adoption.”

Vendors worldwide, both members of TCG and participants in the IETF, have been collaborating on the development of attestation standards and technologies to ensure the capability with a variety of use cases.

“There will always be new claims to define and new use cases that emerge,” concluded Moriarty. “By setting the formats and protocols now, interlocking the efforts between TCG and the IETF, we aim to make it intrinsic and flexible to meet any use case, allowing for the creation of very specific extensions and thus possible for wider adoption to be achievable.”

Moriarty recently highlighted the developments of the partnership between TCG and the IETF at the TCG October Annual Members Meeting in Toronto, Ontario, Canada. In her keynote presentation entitled ‘RATS! Navigating the Maze of Assessment Standards,’ Moriarty emphasized the relationship between standards in development including the interlocking efforts underway between TCG and the IETF.

About TCG

TCG is a not-for-profit organization formed to develop, define and promote open, vendor-neutral, global industry specifications and standards, supportive of a hardware-based root of trust, for interoperable trusted computing platforms. More information is available at the TCG website, www.trustedcomputinggroup.org. Follow TCG on Twitter and on LinkedIn. The organization offers a number of resources for developers and designers at develop.trustedcomputinggroup.org.

Twitter: @TrustedComputin

LinkedIn: https://www.linkedin.com/company/trusted-computing-group/