ETRICS 2006 - Freiburg, 7. June 2006 - Transitive trust in mobile scenarios

Aug 30, 2026

Uploaded by Theodora

Transitive trust across mobile, cross-domain authentication, and technological boundaries is examined through a trusted computing approach. The material introduces how trusted platform modules (TPM) support shielded capabilities such as sealed storage, secure I/O, and trustworthy measurements captured at boot and run time. Remote attestation and direct anonymous attestation are used to generate credentials that assert platform presence, system integrity, and the unaltered nature of existing credentials, enabling referral trust while addressing privacy and practical feasibility in mobile environments.

LanguageEnglish

CategoryResearch & Report

FormatPDF

Pages18

Reading Time45 min

AccessFree to download

Transitive trust in mobile scenarios

Mobile networks as network-agnostic access

Authentication view of trust and credentials

Trusted platform module (TPM) capabilities

Remote attestation (RA) and direct anonymous attestation (DAA)

Privacy considerations and one-time credentials

Trust credential assertions and domain restriction

Transitive trust in mobile scenarios Horizontal integration of access technologies needs convergence of authentication technologies. The concept of establishing transitive trust by trusted computing enables cross-domain authentication functionality, surmounting technical boundaries. The focus of target application scenarios lies in the realm of mobile networks and devices. Nicolai Kuntze, Andreas U. Schmidt Fraunhofer-Institute for Secure Information Technology SIT Darmstadt, Germany ETRICS 2006 – Freiburg, 7. June 2006 ¾ Mobile access to applications & content is becoming network-agnostic Customers attracted by attractive applications & content Diversity of technologies (2G, 3G, WLAN, WiMAX, MobileIP) Customers interested in optimizing price/performance ratio ¾ Mobile devices are becoming very smart, multi-purpose devices More than voice comm., both consuming and providing applications, data and media Network access is a commodity, customers expect additional features Next step for MNOs (business models): providing customised/customisable services ¾ Novel requirements for trust across domains – even technological boundaries ¾ Trusted computing (TC) can become the enabler for service provisioning Enables network-and device-agnostic trust relations on application-level Uniform trusted platform for service provisioning ¾ Credentials from various domains of trust, carried, managed and transmitted by TC-enabled devices can yield transitive trust relationships Page 2 We take an authentication (minimalist) view on trust ¾ By transmitting authentication data or exerting authentication protocols, agents enter the domain of trust of a principal ¾ The authentication process attests to the trustworthiness of the agent, i.e., makes implicit or explicit assertions to the principal about the identity of an agent and/or its being in a secure/trustworthy state ¾ the token/data for authentication and the embodied attestation is subsumed under the term credential SIM/USIM, cryptographic certificates, shared secrets, PIN/TAN,(smart card-based) biometry,… ¾ Our aim: Complement generic domain credentials c by trust credentials t obtained somehow by use of TC, to enable referral trust and transitivity Page 3 A system equipped with a trusted platform module (TPM) as specified by TCG, is called a trusted platform (TP) . It offers the shielded capabilities: Memory curtaining, sealed storage, and secure I/O ¾ TPM offers (RSA) key management, i.e., methods for generation, storage, and usage of keys ¾Trust measurements on the system environment exerted at boot-and run-time allow for trustworthy assertions about the current system state and a re-tracing of how it was reached ¾The system state, and a measurement log (order matters) of how it was reached is securely stored in platform configuration registers (PCR) tamper-resistantly located inside the TPM. ¾ Memory curtaining and sealed storage spaces are enabled by pertinent TPM base functions. ¾Trustworthy system and application software can build on this to establish authenticated communication with the exterior and transmit data protecting integrity and confidentiality. Page 4 ¾ The TPM is a hardware (or virtualised) root of trust on which the two essential attestation protocols rest: -Remote attestation (RA), yieldig‚ conventional privacy using an ID provider, and -Direct anonymous attestation (DAA), employing zero-knowledge proofs ¾ RA enables an exterior entity to determine if the requesting agent is altered or not: -The TP presents the value of a certain PCR and the log how this value was created -This data block is signed using an Attestation identity key (AIK) ¾ Privacy: AIKs are generated by the TPM, and certified by a privacy CA (PCA)(the TP identifies itself towards the PCA using the endorsement key [EK]) ¾ Based on this data two attributes can be attested to the external verifier: -The data was produced by a genuin

FAQs

How does trusted computing enable transitive trust in mobile scenarios?

Trusted computing establishes trust credentials that can be carried, managed, and transmitted by TC-enabled devices, allowing cross-domain authentication on the application level even across technological boundaries.

What capabilities does a TPM provide for trustworthy assertions?

A TPM offers shielded capabilities including memory curtaining, sealed storage, secure I/O, key management, and tamper-resistant trust measurements stored in PCRs at boot and run time.

What is the difference between remote attestation (RA) and direct anonymous attestation (DAA) for privacy?

RA enables a verifier to check integrity by using signed PCR values and measurement logs, while DAA can prove equivalent assertions without revealing platform identity, using zero-knowledge proofs and anonymous attestation techniques.

Aug 30, 2026

Uploaded by Theodora