\documentclass[handout,xcolor]{beamer}

\usepackage[T1]{fontenc}

\usetheme{Malmoe}
\useoutertheme{infolines}
\useinnertheme{circles}

\makeatletter
\setbeamertemplate{headline}{%
	\begin{beamercolorbox}[ht=2.25ex,dp=3.75ex]{section in head/foot}
		\insertnavigation{\paperwidth}
	\end{beamercolorbox}%
}%
\makeatother

\definecolor{Nick}{HTML}{41964b}
\definecolor{Nick2}{HTML}{46c755}
\definecolor{FG}{HTML}{ebebeb}
\definecolor{BG2}{HTML}{233628}
\definecolor{BG}{HTML}{202622}

\setbeamercolor{palette primary}{bg=BG, fg=FG}
\setbeamercolor{palette secondary}{bg=BG, fg=FG}
\setbeamercolor{palette tertiary}{bg=BG, fg=FG}
\setbeamercolor{palette quaternary}{bg=BG, fg=FG}

\setbeamercolor{section in head/foot}{bg=BG2, fg=Nick}
\setbeamercolor{subsection in head/foot}{bg=BG2, fg=Nick2}
\setbeamercolor{page number in head/foot}{bg=BG2, fg=Nick2}
\setbeamercolor{author in head/foot}{bg=BG2, fg=Nick}
\setbeamercolor{date in head/foot}{bg=BG2, fg=Nick}
\setbeamercolor{title in head/foot}{bg=BG2, fg=Nick2}

\setbeamercolor{normal text}{fg=FG, bg=BG}
\setbeamercolor{structure}{fg=Nick2, bg=BG}

\setbeamerfont{subsection in toc}{size=\scriptsize}
\setbeamerfont{section in toc}{size=\footnotesize}

\usefonttheme{serif}

\usepackage{unicode-math}
\setmainfont{Gentium Basic}
\setmonofont{Fantasque Sans Mono}

\usepackage{amsmath}
\usepackage{amssymb}
\usepackage{microtype}

\usepackage{listings}
\lstset{%
	language=C,
	frame=single,
	backgroundcolor=\color{BG2},
	basicstyle={\tiny\ttfamily\color{FG}},
	keywordstyle=\color{Nick2}
}

\usepackage{graphicx}
\graphicspath{{files/}}

\usepackage{tikz}
\usetikzlibrary{arrows}

\usepackage{cancel}

\author[Nicholas Berridge-Argent]{Nicholas Berridge-Argent\\z5208292\\\vspace{0.2cm}Supervised by Ihor Kuz\\Co-Supervised by Ben Leslie\\Assessed by Gernot Heiser}
\title[Thesis C Presentation]{Secure Boot and TPM Attestation for seL4-Based Systems}
\subtitle{Thesis C Presentation}
\date{Term 3, 2021}

\begin{document}

\begin{frame}
	\titlepage
\end{frame}

\AtBeginSection[]{
	\begin{frame}
		\frametitle{Contents}

		\centering
		\begin{columns}
			\begin{column}{0.35\textwidth}
				\tableofcontents[currentsection]
			\end{column}
			\begin{column}{0.55\textwidth}
				\centering
				\begin{tikzpicture}
					\ifnum\thesection=2
						\draw [dotted,draw=Nick] (-0.25,-0.25) rectangle (5.25,3.75);
					\else
						\draw [draw=BG] (-0.25,-0.25) rectangle (5.25,3.75);
					\fi

					\ifnum\thesection=3
						\draw [fill=Nick] (0,0) rectangle (5,1);
					\else
						\draw (0,0) rectangle (5,1);
					\fi
					\node at (2.5,0.5) {\footnotesize{}Secure Monitor};

					\draw (0,1.25) rectangle (2.375,2.25);
					\node at (1.1875,1.75) {\footnotesize{}seL4};

					\ifnum\thesection=3
						\draw [fill=Nick] (2.625,1.25) rectangle (5,2.25);
					\else
						\draw (2.625,1.25) rectangle (5,2.25);
					\fi
					\node at (3.8125,1.75) {\footnotesize{}Secure OS};

					\draw (0,2.5) rectangle (1.0625,3.5);
					\node at (0.53125,3) {\footnotesize{}Apps};

					\ifnum\thesection=4
						\draw [fill=Nick] (1.3125,2.5) rectangle (2.375,3.5);
					\else
						\draw (1.3125,2.5) rectangle (2.375,3.5);
					\fi
					\node at (1.84375,3) {\footnotesize{}Suppl.};

					\ifnum\thesection=5
						\draw [fill=Nick] (2.625,2.5) rectangle (5,3.5);
					\else
						\draw (2.625,2.5) rectangle (5,3.5);
					\fi
					\node at (3.8125,3) {\footnotesize{}fTPM};

					\ifnum\thesection=6
						\draw [fill=Nick](0,-1) rectangle (2.375,-2);
					\else
						\draw (0,-1) rectangle (2.375,-2);
					\fi
					\node at (1.1875,-1.5) {\footnotesize{}Attester};

					\ifnum\thesection=7
						\draw [fill=Nick] (2.625,-1) rectangle (5,-2);
					\else
						\draw (2.625,-1) rectangle (5,-2);
					\fi
					\node at (3.8125,-1.5) {\footnotesize{}Verifier};

					\ifnum\thesection=8
						\draw [dotted,draw=Nick] (-0.25,-0.75) rectangle (5.25,-2.25);
					\else
						\draw [draw=BG] (-0.25,-0.75) rectangle (5.25,-2.25);
					\fi

					\draw [->] (1.1875,-2) to [bend right] (3.8125,-2);
					
					% Sort of a hack, the obvious way didn't work
					\ifnum\thesection=1
						\draw [fill=BG,draw=BG] (-0.25,-2.5) rectangle (5.25,3.75);
					\else
						\ifnum\thesection=9
							\draw [fill=BG,draw=BG] (-0.25,-2.5) rectangle (5.25,3.75);
						\fi
					\fi
				\end{tikzpicture}
			\end{column}
		\end{columns}
	\end{frame}
}

\section{Introduction}

\begin{frame}
	\frametitle{The Thesis}

	\begin{itemize}
		\item seL4 is a formally verified microkernel
		\item Designed for systems with strong reliability and security requirements
		\item Some security problems are out-of-scope for seL4:
		\begin{itemize}
			\item Hardware
			\item \textit{Userspace} software --- although the effects are mitigated
			\item Vulnerabilities early in the boot process
		\end{itemize}
		\item Secure boot and TPM attestation help with the latter
		\item How can we use these with seL4-based systems?
	\end{itemize}
\end{frame}

\begin{frame}
	\frametitle{Secure Boot and Attestation}

	Secure boot

	\begin{itemize}
		\item Uses cryptographic hashes and signatures
		\item Each boot stage checks the signature of the next
		\item System stores a list of public keys it trusts
		\item Only trusted software boots
	\end{itemize}

	Attestation

	\begin{itemize}
		\item Each part of the system is hashed before it starts
		\item Stored in an isolated part of the system with an asymmetric key
		\item Measurements are sent with a signature
		\item Signature can be verified on another trusted computer
		\item Other computer knows it can trust that computer
	\end{itemize}
\end{frame}

\begin{frame}
	\frametitle{TPM Attestation}

	\begin{itemize}
		\item Trusted Platform Module
		\item A piece of hardware or software --- supported by firmware
		\item Provides the isolation needed for attestation
		\item Has other security features, a useful tool
		\item Hardware/firmware isolation gives an edge over software
		\item Depends on the platform
	\end{itemize}
\end{frame}

\begin{frame}
	\frametitle{TPM Attestation}

	\begin{itemize}
		\item Large computers (desktops, laptops, servers) have dedicated hardware TPMs
		\item Small computers (embedded, smartphones) cannot justify these
		\item seL4 mainly targets these smaller computers
		\item ARM processors support TrustZone --- firmware isolation
		\item With TrustZone, we have fTPM, by Microsoft Research
		\item All TPMs follow a standard (1.2 or 2.0) --- fTPM implements 2.0 exactly
		\item Requires an ARM processor and secure storage
	\end{itemize}
\end{frame}

\begin{frame}
	\frametitle{How Attestation Works}

	\begin{columns}
		\begin{column}{0.45\textwidth}
			\footnotesize
			During manufacturing / provisioning:

			\begin{itemize}
				\item TPM is provisioned with a `storage seed' which never changes
				\item Storage seed generates an asymmetric storage key which never changes
				\item TPM generates an asymmetric attestation key
				\item TPM provides the public key of the attestation key, and the private key encrypted by the storage key
			\end{itemize}
		\end{column}
		\begin{column}{0.45\textwidth}
			\centering
			\begin{tikzpicture}
				\draw [dotted] (5,0) -- (5,5);
				\node at (3.5,5.5) {\small{}TPM};
				\node at (6.5,5.5) {\small{}Normal World};

				\draw (3,5) rectangle (4,4.5);
				\node at (3.5,4.75) {\footnotesize{}Seed};

				\draw (2.5,4) rectangle (4.5,3);
				\node at (3.5,3.65) {\footnotesize{}Storage Key};
				\node at (3,3.3) {\scriptsize{}$K_S^+$};
				\node at (4,3.3) {\scriptsize{}$K_S^-$};

				\draw [->] (3.5,4.5) -- (3.5,4);
				\draw [fill=FG] (3.5,4.25) circle (0.075cm);
				\draw [->] (5.25,4.25) -- (3.575,4.25);
				\node [anchor=west] at (5.5,4.25) {\scriptsize\texttt{TPM2\_CreatePrimary}};

				\draw (2.5,2.5) rectangle (4.5,1.5);
				\node at (3.5,2.15) {\footnotesize{}Attest. Key};
				\node at (3,1.8) {\scriptsize{}$K_A^+$};
				\node at (4,1.8) {\scriptsize{}$K_A^-$};

				\draw [->] (3.5,3) -- (3.5,2.5);
				\draw [fill=FG] (3.5,2.75) circle (0.075cm);
				\draw [->] (5.25,2.75) -- (3.575,2.75);
				\node [anchor=west] at (5.5,2.75) {\scriptsize\texttt{TPM2\_Create}};

				\draw (3.5,1.5) -- (3.5,1);
				\draw [->] (3.5,1) -- (5.25,1);
				\draw (5.5,1.5) rectangle (7.5,0.5);
				\node at (6.5,1.2) {\scriptsize{}$K_A^+$};
				\node at (6.5,0.8) {\scriptsize{}$K_S^+(K_A^-)$};
			\end{tikzpicture}
		\end{column}
	\end{columns}
\end{frame}

\begin{frame}
	\frametitle{How Attestation Works}
	
	\begin{columns}
		\begin{column}{0.4\textwidth}
			\scriptsize
			During boot:

			\begin{itemize}
				\item Storage key has to be regenerated, but has the same keys
				\item System loads the public and encrypted private key of the attestation key back into TPM
				\item TPM decrypts the attestation private key using the storage key
				\item System is measured into the TPM's PCRs (Platform Configuration Registers)
				\item PCRs are hashed, bundled with a clock value, and signed with the attestation private key --- called a `quote'
				\item An external verifier uses the attestation public key to check the quote
			\end{itemize}
		\end{column}
		\begin{column}{0.5\textwidth}
			\centering
			\begin{tikzpicture}
				\draw [dotted] (5,-1) -- (5,5);
				\node at (3.5,5.5) {\small{}TPM};
				\node at (6.5,5.5) {\small{}Normal World};

				\draw (3,5) rectangle (4,4.5);
				\node at (3.5,4.75) {\footnotesize{}Seed};

				\draw (2.5,4) rectangle (4.5,3);
				\node at (3.5,3.65) {\footnotesize{}Storage Key};
				\node at (3,3.3) {\scriptsize{}$K_S^+$};
				\node at (4,3.3) {\scriptsize{}$K_S^-$};

				\draw [->] (3.5,4.5) -- (3.5,4);
				\draw [fill=FG] (3.5,4.25) circle (0.075cm);
				\draw [->] (5.25,4.25) -- (3.575,4.25);
				\node [anchor=west] at (5.5,4.25) {\scriptsize\texttt{TPM2\_CreatePrimary}};

				\draw (2.5,2.5) rectangle (4.5,1.5);
				\node at (3.5,2.15) {\footnotesize{}Attest. Key};
				\node at (3,1.8) {\scriptsize{}$K_A^+$};
				\node at (4,1.8) {\scriptsize{}$K_A^-$};

				\draw [->] (3.5,3) -- (3.5,2.5);
				\draw [fill=FG] (3.5,2.75) circle (0.075cm);
				\draw [->] (5.25,2.75) -- (3.575,2.75);
				\node [anchor=west] at (5.5,2.75) {\scriptsize\texttt{TPM2\_Load}};

				\draw (5.5,2.5) rectangle (7.5,1.5);
				\node at (6.5,2.2) {\scriptsize{}$K_A^+$};
				\node at (6.5,1.8) {\scriptsize{}$K_S^+(K_A^-)$};

				\draw (3.5,1.5) -- (3.5,0.25);
				\draw (2.25,1.25) rectangle (3.25,0.75);
				\node at (2.75,1) {\footnotesize{}PCRs};
				\draw [->] (3.25,1) -- (3.425,1);
				\draw [fill=FG] (3.5,1) circle (0.075cm);
				\draw [->] (5.25,1) -- (3.575,1);
				\node [anchor=west] at (5.5,1) {\scriptsize\texttt{TPM2\_Quote}};

				\draw [->] (3.5,0.25) -- (5.25,0.25);
				\draw (5.5,0.75) rectangle (7.5,-0.25);
				\node at (6.5,0.45) {\scriptsize{}$Q$};
				\node at (6.5,0.05) {\scriptsize{}$K_A^-(H(Q))$};
			\end{tikzpicture}
		\end{column}
	\end{columns}
\end{frame}

\begin{frame}
	\frametitle{Getting to Attestation}

	To get working attestation, we need:

	\begin{itemize}
		\item A suitable platform
		\item TrustZone, and OP-TEE --- a TrustZone operating system
		\item Secure storage access, through MMC
		\item fTPM --- a `trusted application' running on OP-TEE
		\item Communication with all of the above from seL4
		\item Implement the standard attestation process
		\item Something to verify the attestation
	\end{itemize}
\end{frame}

\section{Platform}

\begin{frame}
	\frametitle{Platform}

	\begin{itemize}
		\item Chosen platform was the i.MX8 M Quad Evaluation Kit
		\item Based on the i.MX8 M Quad applications processor
		\item ARMv8, AArch64
		\item TrustZone is enabled and available
		\item Supports open source configurations of all the required software
		\item Has a (somewhat) well documented boot process
	\end{itemize}
\end{frame}

\section{TrustZone \& OP-TEE}

\begin{frame}
	\frametitle{TrustZone}

	\begin{itemize}
		\item Firmware feature on modern ARM processors
		\item Provides normal world and secure world on different execution levels
		\item Powered by a `coarse' context switch, with the \texttt{smc} instruction
		\item May contain a secure world operating system and secure world services
		\item Can check for these and communicate with them using \texttt{smc}
	\end{itemize}
\end{frame}

\begin{frame}
	\frametitle{SMC Instruction}

	\begin{itemize}
		\item Follows a standard calling convention
		\item Needs to be written in assembly
		\item Needs privileged mode! --- pain for microkernels
		\item In future needs a kernel object
		\item For now implemented with \texttt{seL4\_DebugRun} and a trampoline page
	\end{itemize}
\end{frame}

\begin{frame}
	\frametitle{OP-TEE}

	\begin{itemize}
		\item Out of the box only have secure monitor, need OP-TEE
		\item i.MX8 supports open source OP-TEE, with provided Makefile
		\item Makefile builds secure monitor, OP-TEE and U-Boot, provides microSD image
		\item i.MX8 configured to boot to microSD with hardware switch
		\item OP-TEE can be communicated with using \texttt{smc}
	\end{itemize}
\end{frame}

\begin{frame}
	\frametitle{OP-TEE Supplicant}

	\begin{itemize}
		\item OP-TEE is a secure world operating system, designed to have a minimal TCB
		\item Some functionality is supported in the normal world OS
		\item Needs a normal world supplicant
		\item Supplicant handles FS access, secure storage, shared memory
		\item Most trusted applications use shared memory for commands
	\end{itemize}
\end{frame}

\begin{frame}
	\frametitle{OP-TEE Supplicant}

	\centering
	\begin{tikzpicture}
		\draw (0,0) -- (0,6);
		\node at (0,6.5) {\footnotesize{}MMC Driver};

		\draw (3,0) -- (3,6);
		\node at (3,6.5) {\footnotesize{}Supplicant};

		\draw (6,0) -- (6,6);
		\node at (6,6.5) {\footnotesize{}OP-TEE Driver};

		\draw (9,0) -- (9,6);
		\node at (9,6.5) {\footnotesize{}OP-TEE};

		\draw [dotted,draw=Nick] (8.25,6.75) -- (8.25,0);

		\node at (9.5,3) {\tiny\color{Nick}\begin{tabular}{c}Secure\\World\end{tabular}};
		\node at (-0.5,3) {\tiny\color{Nick}\begin{tabular}{c}Normal\\World\end{tabular}};

		\draw [->] (6,5.5) -- (9,5.5);
		\node at (7.15,5.65) {\tiny{}Request};

		\draw [->] (9,5) -- (6,5);
		\node at (7.15,5.15) {\tiny{}Allocate Memory};

		\draw [->] (6,5) -- (3,5);
		\node at (4.5,5.15) {\tiny{}Allocate Memory};

		\draw [->] (3,4.5) -- (6,4.5);
		\node at (4.5,4.65) {\tiny{}Memory Object};

		\draw [->] (6,4.5) -- (9,4.5);
		\node at (7.15,4.65) {\tiny{}Memory Object};

		\draw [->] (9,4) -- (6,4);
		\node at (7.15,4.15) {\tiny{}RPMB Request};

		\draw [->] (6,4) -- (3,4);
		\node at (4.5,4.15) {\tiny{}RPMB Request};

		\draw [->] (3,4) -- (0,4);
		\node at (1.5,4.15) {\tiny{}RPMB Frames};

		\draw [->] (0,3.5) -- (3,3.5);
		\node at (1.5,3.65) {\tiny{}Response Frames};

		\draw [->] (3,3.5) -- (6,3.5);
		\node at (4.5,3.65) {\tiny{}RPMB Response};

		\draw [->] (6,3.5) -- (9,3.5);
		\node at (7.15,3.65) {\tiny{}RPMB Response};

		\node at (4.5,2.5) {\footnotesize{}(Repeats...)};

		\draw [->] (9,1.5) -- (6,1.5);
		\node at (7.15,1.65) {\tiny{}Free Memory};

		\draw [->] (6,1.5) -- (3,1.5);
		\node at (4.5,1.65) {\tiny{}Free Memory};

		\draw [->] (3,1) -- (6,1);
		\node at (4.5,1.15) {\tiny{}Okay};

		\draw [->] (6,1) -- (9,1);
		\node at (7.15,1.15) {\tiny{}Okay};

		\draw [->] (9,0.5) -- (6,0.5);
		\node at (7.15,0.65) {\tiny{}Response};
	\end{tikzpicture}
\end{frame}

\section{Secure Storage}

\begin{frame}
	\frametitle{MMC}

	\begin{itemize}
		\item Multi-Media Card --- standard for embedded storage
		\item Made up of host controllers and `cards', either embedded or microSD/SD
		\item i.MX8 has two controllers, one for the embedded card and one for the microSD slot
		\item Embedded has a RPMB (Replay Protected Memory Block) for secure storage
		\item Host controllers respond to standard commands
		\item seL4 ecosystem has a similar driver for i.MX6, U-Boot has a driver for i.MX8
		\item Neither U-Boot's driver nor the official documentation worked in seL4, required tweaks
	\end{itemize}
\end{frame}

\begin{frame}
	\frametitle{RPMB}

	\begin{itemize}
		\item Special partition that responds to a different set of commands
		\item Commands issued by writing one `block', responses by reading
		\item Commands are relayed from OP-TEE through the supplicant
		\item Normal world can access the partition, but cannot access the key
		\item Key must be programmed once during manufacturing / provisioning
	\end{itemize}
\end{frame}

\section{fTPM}

\begin{frame}
	\frametitle{fTPM}

	\begin{itemize}
		\item fTPM is open source, includes Makefile that builds an ELF file
		\item fTPM is a TA (trusted application) for OP-TEE
		\item TAs are usually loaded from the file system
		\item fTPM is needed before a file system is available
		\item Include fTPM as an `early TA'
		\item Linked inside the OP-TEE binary, loaded at boot time
	\end{itemize}
\end{frame}

\begin{frame}
	\frametitle{fTPM}

	\begin{itemize}
		\item Communicate with OP-TEE TAs using sessions
		\item Start a session with a TAs (constant) UUID
		\item Send commands through shared memory objects, \texttt{smc} calls
		\item These commands wrap TPM 2.0 standard commands
	\end{itemize}
\end{frame}

\section{Attestation}

\begin{frame}
	\frametitle{Key Provisioning}

	\begin{itemize}
		\item Attestation follows a standard workflow described earlier
		\item Commands used are standard, we need to send the commands
		\item To provision the AK, extend U-Boot with new commands:
		\begin{itemize}
			\item \texttt{tpm2 create\_srk} to create the storage key
			\item \texttt{tpm2 create\_ak} to create the attestation key
		\end{itemize}
		\item U-Boot has FS access, can save the attestation key for later
	\end{itemize}
\end{frame}

\begin{frame}
	\frametitle{Attestation in seL4}

	\begin{itemize}
		\item Attestation key linked into root server image
		\item Loaded when the root server starts and opens fTPM session
		\item Attestation through \texttt{TPM2\_Quote} available at any time
	\end{itemize}
\end{frame}

\section{Verification}

\begin{frame}
	\frametitle{Verification}

	\begin{itemize}
		\item \texttt{TPM2\_Quote} produces a signature according to pre-configured signature scheme
		\item Using OpenSSL, verify the signature contents on another, trusted computer
		\item This is a standard attestation process
		\item Supported by a web application running on another computer
		\item Performs the standard verification process, checks PCR digest in quote, signature, clock values
		\item Maintains a history of clock values to check for replay attacks
	\end{itemize}
\end{frame}

\section{Demonstration}

\begin{frame}
	\frametitle{Setup}

	\begin{itemize}
		\item Attestation and verficiation implemented as described
		\item seL4 image loaded from TFTP, measured by U-Boot into PCR 0 before booting
		\item seL4 root server is my secret diary
		\item Evil Nick is trying to read my diary
		\item Evil Nick hacked my TFTP server, but has no access to my i.MX8
		\item Can replace my seL4 image with `eL4' --- a version of seL4 which looks the same but isn't secure
		\item Diary produces the PCR value, quote structure, and signature
		\item I can verify these on my laptop, which Evil Nick hasn't hacked
	\end{itemize}
\end{frame}

\begin{frame}
	\frametitle{Demonstration}

	\centering
	Let's see this in action!
\end{frame}

\begin{frame}
	\frametitle{Security Analysis}
	
	\centering
	\begin{tikzpicture}
		\onslide<1->{\draw [dotted] (5,0) -- (5,6);
		\node at (5,6.5) {Tampered Image};
		\node at (2.5,6.25) {\small{}iMX.8};
		\node at (7.5,6.25) {\small{}Verifier};

		\node [anchor=west] at (8,1.5) {\footnotesize{}Seen Quotes:};}

		\onslide<2->{\draw (1,5.5) rectangle (4,4.5);
		\node [anchor=west] at (1,4.7) {\scriptsize\texttt{PCR=6a272e9b...}};
		\node [anchor=west] at (1,5) {\scriptsize\texttt{Clock=1000}};
		\node [anchor=west] at (1,5.3) {\scriptsize\texttt{Reset=0,Restart=0}};

		\draw [->] (4.25,5) -- (5.75,5);

		\draw (7.5,5) circle (0.5cm);
		\draw (7.3,5.15) circle (0.05cm);
		\draw (7.7,5.15) circle (0.05cm);
		\draw (7.24,4.8) arc (210:330:0.3cm);

		\node [anchor=west] at (8,1.1) {\footnotesize{}\texttt{(6a272e9b...,1000,0,0)}};}

		\onslide<3->{\draw (1,4) rectangle (4,3);
		\node [anchor=west] at (1,3.2) {\scriptsize\texttt{PCR=a4b4807f...}};
		\node [anchor=west] at (1,3.5) {\scriptsize\texttt{Clock=1200}};
		\node [anchor=west] at (1,3.8) {\scriptsize\texttt{Reset=0,Restart=1}};

		\draw [dotted] (0.75,4.25) -- (4.25,4.25);

		\draw [->] (4.25,3.5) -- (5.75,3.5);

		\draw (7.5,3.5) circle (0.5cm);
		\draw (7.3,3.65) circle (0.05cm);
		\draw (7.7,3.65) circle (0.05cm);
		\draw (7.76,3.25) arc (30:150:0.3cm);

		\node [anchor=west] at (8.15,3.5) {\footnotesize{}Different PCR!};

		\node [anchor=west] at (8,0.7) {\footnotesize{}\texttt{({\color{Nick}a4b4807f...}\color{FG},1200,0,1)}};}
	\end{tikzpicture}
\end{frame}

\begin{frame}
	\frametitle{Security Analysis}
	
	\centering
	\begin{tikzpicture}
		\onslide<1->{\draw [dotted] (5,0) -- (5,6);
		\node at (5,6.5) {Replay Attack};
		\node at (2.5,6.25) {\small{}iMX.8};
		\node at (7.5,6.25) {\small{}Verifier};

		\node [anchor=west] at (8,1.5) {\footnotesize{}Seen Quotes:};}

		\onslide<2->{\draw (1,5.5) rectangle (4,4.5);
		\node [anchor=west] at (1,4.7) {\scriptsize\texttt{PCR=6a272e9b...}};
		\node [anchor=west] at (1,5) {\scriptsize\texttt{Clock=1000}};
		\node [anchor=west] at (1,5.3) {\scriptsize\texttt{Reset=0,Restart=0}};

		\draw [->] (4.25,5) -- (5.75,5);

		\draw (7.5,5) circle (0.5cm);
		\draw (7.3,5.15) circle (0.05cm);
		\draw (7.7,5.15) circle (0.05cm);
		\draw (7.24,4.8) arc (210:330:0.3cm);

		\node [anchor=west] at (8,1.1) {\footnotesize{}\texttt{(6a272e9b...,1000,0,0)}};}

		\onslide<3->{\draw (1,4) rectangle (4,3);
		\node [anchor=west] at (1,3.2) {\scriptsize\texttt{PCR=6a272e9b...}};
		\node [anchor=west] at (1,3.5) {\scriptsize\texttt{Clock=1000}};
		\node [anchor=west] at (1,3.8) {\scriptsize\texttt{Reset=0,Restart=0}};

		\draw [dotted] (0.75,4.25) -- (4.25,4.25);

		\draw [->] (4.25,3.5) -- (5.75,3.5);

		\draw (7.5,3.5) circle (0.5cm);
		\draw (7.3,3.65) circle (0.05cm);
		\draw (7.7,3.65) circle (0.05cm);
		\draw (7.76,3.25) arc (30:150:0.3cm);

		\node [anchor=west] at (8.15,3.5) {\footnotesize{}Same clock!};

		\node [anchor=west] at (8,0.7) {\footnotesize{}\texttt{(6a272e9b...,{\color{Nick}1000,0,0}\color{FG})}};}
	\end{tikzpicture}
\end{frame}

\begin{frame}
	\frametitle{Security Analysis}
	
	\centering
	\begin{tikzpicture}
		\onslide<1->{\draw [dotted] (5,0) -- (5,6);
		\node at (5,6.5) {Replay Attack 2};
		\node at (2.5,6.25) {\small{}iMX.8};
		\node at (7.5,6.25) {\small{}Verifier};

		\node [anchor=west] at (8.25,1.5) {\footnotesize{}Seen Quotes:};}

		\onslide<2->{\draw (1,5.5) rectangle (4,4.5);
		\node [anchor=west] at (1,4.7) {\scriptsize\texttt{PCR=6a272e9b...}};
		\node [anchor=west] at (1,5) {\scriptsize\texttt{Clock=1000}};
		\node [anchor=west] at (1,5.3) {\scriptsize\texttt{Reset=0,Restart=0}};

		\draw [->] (4.25,5) -- (5.75,5);

		\draw (7.5,5) circle (0.5cm);
		\draw (7.3,5.15) circle (0.05cm);
		\draw (7.7,5.15) circle (0.05cm);
		\draw (7.24,4.8) arc (210:330:0.3cm);

		\node [anchor=west] at (8.25,1.1) {\footnotesize{}\texttt{(6a272e9b...,1000,0,0)}};}

		\onslide<3->{\draw (1,4) rectangle (4,3);
		\node [anchor=west] at (1,3.2) {\scriptsize\texttt{PCR=6a272e9b...}};
		\node [anchor=west] at (1,3.5) {\scriptsize\texttt{Clock=1200}};
		\node [anchor=west] at (1,3.8) {\scriptsize\texttt{Reset=0,Restart=0}};

		\draw (7.5,3.5) circle (0.5cm);
		\draw (7.3,3.65) circle (0.05cm);
		\draw (7.7,3.65) circle (0.05cm);
		\draw (7.24,3.3) arc (210:330:0.3cm);}

		\onslide<4->{\draw (1,2.5) rectangle (4,1.5);
		\node [anchor=west] at (1,1.7) {\scriptsize\texttt{PCR=6a272e9b...}};
		\node [anchor=west] at (1,2) {\scriptsize\texttt{Clock=1200}};
		\node [anchor=west] at (1,2.3) {\scriptsize\texttt{Reset=0,Restart=0}};

		\draw [dotted] (0.75,2.75) -- (4.25,2.75);

		\draw [->] (4.25,2) -- (5.75,2);

		\draw (7.5,2) circle (0.5cm);
		\draw (7.3,2.15) circle (0.05cm);
		\draw (7.7,2.15) circle (0.05cm);
		\draw (7.24,1.8) arc (210:330:0.3cm);

		\node [anchor=west] at (8.25,0.7) {\footnotesize{}\texttt{(6a272e9b...,1200,0,0)}};}

		\onslide<5->{\draw (1,1) rectangle (4,0);
		\node [anchor=west] at (1,0.2) {\scriptsize\texttt{PCR=6a272e9b...}};
		\node [anchor=west] at (1,0.5) {\scriptsize\texttt{Clock=1200}};
		\node [anchor=west] at (1,0.8) {\scriptsize\texttt{Reset=0,Restart=0}};

		\draw [->] (4.25,0.5) -- (5.75,0.5);

		\draw (7.5,0.5) circle (0.5cm);
		\draw (7.3,0.65) circle (0.05cm);
		\draw (7.7,0.65) circle (0.05cm);
		\draw (7.76,0.25) arc (30:150:0.3cm);

		\node [anchor=west] at (8.25,0.3) {\footnotesize{}\texttt{(6a272e9b...,{\color{Nick}1200,0,0}\color{FG})}};}
	\end{tikzpicture}
\end{frame}

\section{Conclusion}

\begin{frame}
	\frametitle{Analysis \& Contributions}

	\begin{itemize}
		\item So far: implemented local(-ish) attestation according to protocol
		\item Ported relevant drivers, added extra U-Boot commands
		\item Measures and attests the seL4 image
		\item Implemented all as a (functional) prototype
		\item Unexpected setbacks, features unimplemented
		\item No secure boot, attestation provides similar functionality
	\end{itemize}
\end{frame}

\begin{frame}
	\frametitle{Near Future: Rest of Thesis C}

	\begin{itemize}
		\item Clean up code, package as CAmkES module
		\item Create \texttt{smc} kernel object discussed
		\item Write the thesis report, with some further analysis
	\end{itemize}
\end{frame}

\begin{frame}
	\frametitle{Forseeable Future: To Complete}

	\begin{itemize}
		\item As it stands, not everything I set out to implement is done
		\item Remote attestation
		\item Secure boot
		\item Measurement of earlier boot stages
		\item All could be easy, probably no time to investigate
	\end{itemize}
\end{frame}

\begin{frame}
	\frametitle{Distant Future: seL4 and fTPM}

	\begin{columns}
		\begin{column}{0.45\textwidth}
			\scriptsize
			\begin{itemize}
				\item OP-TEE and TrustZone designed to provide isolation for fTPM
				\item TrustZone is at least required because it is available before the normal world on ARM systems
				\item seL4 is a better choice for the trusted OS (see Nick Spinale's proposal)
				\item fTPM is currently written for OP-TEE
				\item In theory, fTPM could run on top of seL4 with some trusted utilities (e.g. RPMB library)
			\end{itemize}
		\end{column}
		\begin{column}{0.45\textwidth}
			\centering
			\begin{tikzpicture}
				\draw (0,0) rectangle (5,1);
				\node at (2.5,0.5) {\footnotesize{}Secure Monitor};

				\draw (0,1.25) rectangle (2.375,2.25);
				\node at (1.1875,1.75) {\footnotesize{}seL4};

				\draw [fill=Nick] (2.625,1.25) rectangle (5,2.25);
				\node at (3.8125,1.75) {\footnotesize{}seL4};

				\draw (0,2.5) rectangle (1.0625,3.5);
				\node at (0.53125,3) {\footnotesize{}Apps};

				\draw (1.3125,2.5) rectangle (2.375,3.5);
				\node at (1.84375,3) {\footnotesize{}Suppl.};

				\draw (2.625,2.5) rectangle (3.6875,3.5);
				\node at (3.15625,3) {\footnotesize{}fTPM};

				\draw [fill=Nick] (3.9375,2.5) rectangle (5,3.5);
				\node at (4.46875,3) {\footnotesize{}Utils.};
			\end{tikzpicture}
		\end{column}
	\end{columns}
\end{frame}

\begin{frame}
	\frametitle{Distant Future: seL4 as a Bootloader}
	
	\begin{columns}
		\begin{column}{0.55\textwidth}
			\footnotesize
			\begin{itemize}
				\item Advantage of TrustZone and OP-TEE is running early before the bootloader and normal OS
				\item Bootloaders load OS, handle platform-specific initialisation
				\item If we trusted the bootloader, we could rely less on TrustZone and OP-TEE
				\item seL4 may be suitable for use as a bootloader
				\item Reconfigure the kernel with a `boot cap', move initialisation utilities to userspace processes
			\end{itemize}
		\end{column}
		\begin{column}{0.35\textwidth}
			\centering
			\begin{tikzpicture}
				\draw (0,3) rectangle (3,4);
				\node at (1.5,3.5) {\footnotesize{}seL4};

				\draw (0,4.25) rectangle (1.375,5.25);
				\node at (0.6875,4.75) {\footnotesize{}Utils.};

				\draw (1.625,4.25) rectangle (3,5.25);
				\node at (2.3125,4.75) {\footnotesize{}Boot};

				\draw [fill=BG] (1.75,5.125) rectangle (2.875,5.625);
				\node at (2.3125,5.375) {\tiny{}Boot Cap.};

				\draw [dotted] (-0.25,2.75) -- (3.25,2.75);

				\draw (0,1.5) rectangle (3,2.5);
				\node at (1.5,2) {\footnotesize{}Main OS};

				\draw [->] (3.125,5.375) to [bend left] (3.125,3.75);
				\draw [->] (3.125,3.25) to [bend left] (3.125,2);
			\end{tikzpicture}
		\end{column}
	\end{columns}
\end{frame}

\begin{frame}
	\frametitle{Summary}

	We have covered:

	\begin{itemize}
		\item Attestation: what and why?
		\item What's needed for attestation on seL4
		\item Prototype and demonstration of TPM attestation
		\item What's left for thesis C and the future
	\end{itemize}
\end{frame}

\begin{frame}
	\centering
	{\LARGE\color{Nick}Thanks for Coming!}

	\vspace{1cm}

	\centering
	Enjoy the rest of the thesis presentations
\end{frame}

\end{document}
