࣮ͷมԽ
ॏཁͳσʔλ
0Oαʔόʔ
σʔλ
PO
֎෦αʔϏε
σʔλ
0O
σʔλ
PO
جװγεςϜ
w ΤϯςΟςΟݕূͱΈ߹Θͤʮ*EFOUJUZ$FOUSJDʯʮ"MXBZT7FSJGZʯ
w ࠷খݖݶͷݪଇʮ-FBTU1SJWJMFHF"DDFTTʯ
w ৵ͷఆͱ෧͡ࠐΊʮ#SFBDI$POUBJONFOUʯ
Slide 15
Slide 15 text
ຊͷϑΥʔΧε
ॏཁͳσʔλ
0Oαʔόʔ
σʔλ
PO
֎෦αʔϏε
σʔλ
0O
σʔλ
PO
جװγεςϜ
ͪ͜Βྑ͘͞ΕΔ
Slide 16
Slide 16 text
ຊͷϑΥʔΧε
ॏཁͳσʔλ
0Oαʔόʔ
σʔλ
PO
֎෦αʔϏε
σʔλ
0O
σʔλ
PO
جװγεςϜ
σόΠε*EFOUJUZ
*O&OUFSQSJTF
IUUQTTUBOEBSETJTPPSHJUUG1VCMJDMZ"WBJMBCMF4UBOEBSETJOEFYIUNM*40*&D
w BUUSJCVUF
w BUUSJCVUF
w BUUSJCVUF
w BUUSJCVUF
w BUUSJCVUF
w BUUSJCVUF
w BUUSJCVUF
w BUUSJCVUF
*EFOUJUZ3FHJTUFS
*OWFOUPSZ
IUUQTTUBOEBSETJTPPSHJUUG1VCMJDMZ"WBJMBCMF4UBOEBSETJOEFYIUNM*40*&D
w 3FHJTUSBUJPO
w *EFOUJUZ1SPPpOH
Slide 25
Slide 25 text
4JNQMF3FHJTUSBUJPO
%FWJDF7FOEPS *5BENJO
1VSDIBTF
FOSPMM
SFHJTUSBUJPO
%FMJWFS
w BUUSJCVUF
w BUUSJCVUF
w BUUSJCVUF
w BUUSJCVUF
w BUUSJCVUF
w BUUSJCVUF
Slide 26
Slide 26 text
#FUUFS3FHJTUSBUJPO1SPDFTT
7FOEPS
1VSDIBTF
FOSPMM
SFHJTUSBUJPO
%FMJWFS
w BUUSJCVUF
w BUUSJCVUF
w BUUSJCVUF
w BUUSJCVUF
w BUUSJCVUF
w BUUSJCVUF
*OJUJBM#PPU
3FHJTUSBUJPO
4FSWJDF
OPUJGZ
Slide 27
Slide 27 text
&YBNQMFT
Slide 28
Slide 28 text
⾒出し
IUUQTXXXKBNGDPNCMPHBQQMFEFWJDFFOSPMMNFOUQSPHSBNBQQMFJUJOOPWBUJPO
Registration in Mac (DEP)
Slide 29
Slide 29 text
Registration in Microsoft (Autopilot)
IUUQTNZJHOJUFUFDIDPNNVOJUZNJDSPTPGUDPNTFTTJPOT
Slide 30
Slide 30 text
*EFOUJUZ1SPPpOH
%FWJDF7FOEPS *5BENJO
1VSDIBTF
FOSPMM
SFHJTUSBUJPO
%FMJWFS
w BUUSJCVUF
w BUUSJCVUF
w BUUSJCVUF
w BUUSJCVUF
w BUUSJCVUF
w BUUSJCVUF
1SPPG*EFOUJUZBUIFSF
- repository of identities
- more like inventory
- continuously monitor and record
state of the device
Identity Register (Inventory)
w BUUSJCVUF
w BUUSJCVUF
w BUUSJCVUF
w BUUSJCVUF
w BUUSJCVUF
w BUUSJCVUF
w BUUSJCVUF
w BUUSJCVUF
Slide 51
Slide 51 text
Different characteristics from human!
Slide 52
Slide 52 text
Different characteristics from human!
Slide 53
Slide 53 text
Different characteristics from human!
Slide 54
Slide 54 text
Different characteristics from human!
Slide 55
Slide 55 text
Different characteristics from human!
Slide 56
Slide 56 text
- Observed attributes
- Manually configured attributes
Two types of attributes
Slide 57
Slide 57 text
- Observed attributes
- automatically collected/programmatically
generated attributes
- Manually Configured attributes
Two types of attributes
Slide 58
Slide 58 text
- Enrolled time
- last time checked in
- logged in users
- HW Info
- OS version
- installed SW and its version
- Disk Encryption Recovery Key
Examples of Observed Attributes
Slide 59
Slide 59 text
- Observed data
- Manually configured attributes
Two types of attributes
Slide 60
Slide 60 text
- type of device
- personally assigned, kiosk, special-case
- owner of the device
- vendor/OEM
- purchased data (asset management related data)
- device name
Examples of Manually Configured Attributes
Slide 61
Slide 61 text
Data Sources
IUUQTTUPSBHFHPPHMFBQJTDPNQVCUPPMTQVCMJDQVCMJDBUJPOEBUBQEGQEG
Slide 62
Slide 62 text
&YBNQMFT
Slide 63
Slide 63 text
Observed Attributes Collection from Agent
IUUQTTUPSBHFHPPHMFBQJTDPNQVCUPPMTQVCMJDQVCMJDBUJPOEBUBQEGQEG
- Secure Boot
- Check integrity of OS Bootloader
- Check certificate signed to
Bootloader
- Trusted Boot
- ELAM
Verified Boot
IUUQTEPDTNJDSPTPGUDPNFOVTXJOEPXT
TFDVSJUZJOGPSNBUJPOQSPUFDUJPOTFDVSFUIF
XJOEPXTCPPUQSPDFTT
Slide 77
Slide 77 text
- Secure Boot
- Trusted Boot
- a series of signature checking
- ELAM
Verified Boot
IUUQTEPDTNJDSPTPGUDPNFOVTXJOEPXT
TFDVSJUZJOGPSNBUJPOQSPUFDUJPOTFDVSFUIF
XJOEPXTCPPUQSPDFTT
Slide 78
Slide 78 text
- Secure Boot
- Trusted Boot
- ELAM
- Early Launch Anti-Malware
- examine every boot driver
- “determine it is on the list of trusted
drivers”
Verified Boot
IUUQTEPDTNJDSPTPGUDPNFOVTXJOEPXT
TFDVSJUZJOGPSNBUJPOQSPUFDUJPOTFDVSFUIF
XJOEPXTCPPUQSPDFTT
Measured Boot
- Generates “measurable”
artifacts while booting
- Can be remotely verified
IUUQTEPDTNJDSPTPGUDPNFOVTXJOEPXTTFDVSJUZUISFBUQSPUFDUJPOQSPUFDUIJHIWBMVFBTTFUTCZ
DPOUSPMMJOHUIFIFBMUIPGXJOEPXTCBTFEEFWJDFT
Slide 81
Slide 81 text
Measured Boot
- Each boot components takes the hash of
the next component
- store the hash in Platform Configuration
Registers (PCRs)
- this “measurement” is recorded by Trusted
Computing Group(TCG) log
- Send PCR and TCG logs to verification
component (remote health attestation)
IUUQTEPDTNJDSPTPGUDPNFOVTXJOEPXTTFDVSJUZUISFBUQSPUFDUJPOQSPUFDUIJHIWBMVFBTTFUTCZ
DPOUSPMMJOHUIFIFBMUIPGXJOEPXTCBTFEEFWJDFT
Slide 82
Slide 82 text
Measured Boot
- Each boot components takes the hash of the
next component
- store the hash in Platform Configuration
Registers (PCRs)
- this “measurement” is recorded by Trusted
Computing Group(TCG) log
- Send PCR and TCG logs to verification
component (remote health attestation)
IUUQTEPDTNJDSPTPGUDPNFOVTXJOEPXTTFDVSJUZUISFBUQSPUFDUJPOQSPUFDUIJHIWBMVFBTTFUTCZ
DPOUSPMMJOHUIFIFBMUIPGXJOEPXTCBTFEEFWJDFT
Slide 83
Slide 83 text
Measured Boot
- Each boot components takes the hash of the
next component
- store the hash in Platform Configuration
Registers (PCRs)
- this “measurement” is recorded by
Trusted Computing Group(TCG) log
- Send PCR and TCG logs to verification
component (remote health attestation)
IUUQTEPDTNJDSPTPGUDPNFOVTXJOEPXTTFDVSJUZUISFBUQSPUFDUJPOQSPUFDUIJHIWBMVFBTTFUTCZ
DPOUSPMMJOHUIFIFBMUIPGXJOEPXTCBTFEEFWJDFT
Slide 84
Slide 84 text
Measured Boot
- Each boot components takes the hash of the next
component
- store the hash in Platform Configuration Registers
(PCRs)
- this “measurement” is recorded by Trusted
Computing Group(TCG) log
- Send PCR and TCG logs to verification
component (remote health attestation)
- PCR is digitally signed (PCR Quote)
IUUQTEPDTNJDSPTPGUDPNFOVTXJOEPXTTFDVSJUZUISFBUQSPUFDUJPOQSPUFDUIJHIWBMVFBTTFUTCZ
DPOUSPMMJOHUIFIFBMUIPGXJOEPXTCBTFEEFWJDFT
Slide 85
Slide 85 text
&YBNQMFT
Slide 86
Slide 86 text
Microsoft (TPM and Intune)
- Secure Boot (Verified Boot)
- Just like normal secure boot
- Measured Boot
- integrate with Windows 10 Device Guard
- Uses AIK(Attestation Identity Key)/AK(Attestation Key)
certificate to form PCR quote
- certificate is issued by Microsoft Cloud
- Intune(UEM/MDM) has own remote health attestation service
- Parses the properties of TCG logs and compare to signed PCR
values
IUUQTEPDTNJDSPTPGUDPNFOVTXJOEPXTTFDVSJUZUISFBUQSPUFDUJPOQSPUFDUIJHIWBMVFBTTFUTCZ
DPOUSPMMJOHUIFIFBMUIPGXJOEPXTCBTFEEFWJDFT