BATTLE OF SKM AND IUM
blackhat2015
blackhat2015
You also want an ePaper? Increase the reach of your titles
YUMPU automatically turns print PDFs into web optimized ePapers that Google loves.
PLATFORM REQUIREMENTS<br />
• The Boot Loader needs to trust that the platform it is running on is not running arbitrary firmware<br />
• This code could modify the bootstrap of the Hypervisor and affect all of VSM’s guarantees<br />
• Secure Boot provides this guarantee<br />
• Also used to safely store protected, persistent variables that cannot be modified (to store policy/settings)<br />
• The Hypervisor needs to trust that hardware is not performing DMA access to VTL 1 pages<br />
• Flashing a vulnerable device’s firmware, or loading a vulnerable/custom driver could allow a VTL 0<br />
administrator access to VTL 1 memory<br />
• IOMMU / VT-d provides this guarantee<br />
• The Hypervisor needs to have a secure place to store and seal machine secrets and keys<br />
• Otherwise, persistent data such as the Machine Key could be stolen/replayed<br />
• TPM provides this guarantee<br />
• VBS can be configured to require these platform features, or to work around their lack thereof<br />
• VSM will work regardless, and can be enabled on its own
Change language