Industry Papers

Trustworthy Cloud services may only be built upon a strong basis of a Trusted Cloud. Such trusted infrastructures are also needed to reach IT security compliance in enterprises. The cloud model of “Infrastructure as a Service” (IaaS), combined with the trusted components proposed in this paper and researched in actual EU and Germany-wide cloud computing projects is a big chance for higher security in enterprises, especially for SMEs. We describe two current projects that reflect these topics and the associated security work packages to develop mechanisms and technologies for future-oriented isolation of security domains and information flow control. These are Trustworthy Clouds (TClouds) at EU level and Emergent in Germany as part of the Software-Cluster project. The overall solution resulting from research and development done in both projects is one that establishes security guarantees on the data stored by enterprise platforms on infrastructure clouds and cloud services without affecting the enterprise workflows. An innovative use case in the home healthcare sector demonstrates how future cloud infrastructures and services may look like.

Dieses Papier beschreibt die Implementierung einer SMS Signaturanwendung auf der Sirrix TURAYA™ Mobile Plattform, die auf einem kommerziell erhältlichen Smartphone installiert wurde. Sensitive Applikationen werden darin strikt getrennt vom vorgefundenen Basisbetriebssystem in einem isolierten eigenständigen "Compartment". Damit wird eine vertrauenswürdige Softwareschicht als Basis für eine effiziente Informationsflusskontrolle und ein zentral gemanagtes Policy enforcement bereitgestellt.

Dieser Konferenzbeitrag beschreibt die Implementierung einer virtuellen Internet Surfumgebung, der das Hostbetriebssystem wirksam gegen jede potentielle Attacke aus dem Internet schützen kann. Ein besonderer Fokus liegt auf dem Management zertifizierter Snapshots, die in völliger Transparenz für den Nutzer einen Rückgriff auf einen integeren Ausgangszustand erlauben.

The NATO Secure voice strategy identifies the Secure Communication Interoperability Protocol (SCIP) as the upcoming standard for secure voice communication within the NATO community. In support of the Secure Voice Strategy NC3A has been mandated to establish a NATO SCIP Validation Facility (NSVF) to enable conformance, interoperability and keymanagement testing for NATO Nations. SCIP will enable multivendor solutions for secure voice terminals, operating over heterogeneous networks, by using open standards. To tackle interoperability issues in secure voice communications for expeditionary operations, NC3A has developed a Secure Voice Platform using an open source voice switch. For enabling SCIP gateway functionality between circuit and packet switchednetworks a V.150.1 protocol stack as been added to the Secure Voice Platform. Due to its open design and flexibility the Secure Voice Platform is a very valuable resource in the conformance and interoperability tests for the integration of SCIP devices in NATO and national networks. This article summarizes the NATO Secure Voice Strategy and the concept of the NATO SCIP Validation Facility. Focus is on the integration of the V.150.1 protocol stack in the Secure Voice Platform. Issues a risen during the integration process are addressed as well as those discovered and solved to address interoperability aspects. SCIP, NATO Secure Voice Strategy, NATO SCIP Validation Facility, NC3A, Secure Voice Platform, Modem over IP, MoIP,V.150.1

Enterprises and governmental organizations often struggle with the problem that employees have to use IT systems for different tasks with different security requirements. They may have to deal withtop-confidential data while they are also working on data and documents that are supposed to be shared with others. Employees perform different tasks underdifferent roles, for example accessing the Internet, using intranet services, editing unclassified documents, as well as editing classified documents, such as patents. Each of these kinds of tasks has different security requirements. In security-critical environments such as government andmilitary, classified documents are isolated by using physically separated computing platforms. However, in typical enterprise environments users perform these tasksusing one computing platform providinga questionable isolation between them. Instead we can observe the opposite trend,i.e., more and more infrastructure is shared for several tasks, and sometimes even for several organizational units or even complete enterprises. For example,cloud computing offers infrastructure and services for different customers on the same hardware platforms. While sharing IT infrastructure is cost-efficient and provides more flexibility, it increases the security problems organizations have to deal with in order to isolate data of different workflows and to fulfill confidentiality demands while data (and system) sharing is required. In addition,employees can work with mobile computing platforms which are not always under control of the organization’s domain. It is also not unusual to send documents to private computers in order to work from home, and later bring the data back into the organizational domain. If private computers are not protected sufficiently, data may leak outside the organization, or malicious code enter the organization due to this data transfer.

The TCG Software Stack (TSS) specifies the software layer for application developers to use functions provided by a Trusted Platform Module (TPM). However, the current TSS interface is highly complex, which makes its usage very difficult and error-prone, and the high complexity makes it unsuitable for embedded devices or security kernels. We present a simplified TSS design and implementation (TSS) providing a lightweight and intuitive programming interface for developers based on the TPM main specification. The major principles of the TSS design are a reduced complexity, obtaining type safety, objectencapsulation, and a simple error handling. These principles ensure that the resulting TSS is maintainable and easy to use. Moreover, the modular architecture of the TSS allows using only a subset of the provided functionality as it is required, e.g., for embedded systems, mobile devices, or in the context of a security kernel. This paper discusses experiences with the TSS, based on several projects such as the TCG TPM compliance test suite and a MobileTrusted Module (MTM) implementation.

Today’s mobile phone platforms are powerful enough to be used as personal assistants that render and edit even complex document formats. However, short development cycles in combination with high complexity and extendability make these devices not secure enough for security-critical tasks. Therefore, end-users either have to use another secure device, or to accept the risk of losing sensitive information in the case of a loss of the device or a successful attack against it. We propose a security architecture to operate on security-critical documents using a commercial off-the-shelf (COTS) mobile phone hardware platform offering two working environments. The first one is under full control of the user while the second is isolated and restricted by additional security and mobile trusted computing services. The realizability of such an architecture has been proven based on a ’TrustedSMS’ prototype developed on top of an OMAP-35xx development board, a hardware platform similar to many actual mobile phone platforms. The prototype includes nearly all components required to securely isolate the two compartments and implements use cases such as SMS writing, signing, receiving, verification, and key management.

Today’s mobile phone platforms are powerful enough to be used as personal assistants that render and edit even complex document formats. However, short development cycles in combination with high complexity and extendability make these devices not secure enough for security-critical tasks. Therefore, end-users either have to use another secure device, or to accept the risk of losing sensitive information in the case of a loss of the device or a successful attack against it. We propose a security architecture to operate on security-critical documents using a commercial off-the-shelf (COTS) mobile phone hardware platform offering two working environments. The first one is under full control of the user while the second is isolated and restricted by additional security and mobile trusted computing services. The realizability of such an architecture has been proven based on a ’TrustedSMS’ prototype developed on top of an OMAP-35xx development board, a hardware platform similar to many actual mobile phone platforms. The prototype includes nearly all components required to securely isolate the two compartments and implements use cases such as SMS writing, signing, receiving, verification, and key management.

Mobiltelefone sind mittlerweile fester Bestandteil des privaten und geschäftlichen Lebens. Sie werden oft zur Übermittlung vertraulicher Informationen verwendet, die jedoch während der Übertragung durch beliebige Angreifer abgehört werden können. Obwohl solche Angriffe nicht trivial sind, existieren diverse Lösungen auf dem Markt, die das direkte Mitschneiden von GSM-Telefonaten ermöglichen.Um den Schwachstellen der GSM-Netze, die die Vertraulichkeit und Integrität der Kommunikationsinhalte gefährden, entgegen zu wirken, haben verschiedene Hersteller Produkte entwickelt, dieeine direkte Ende-zu-Ende Verschlüsselung zwischen Mobiltelefonen ermöglichen. Allerdings setzenderartige Lösungen bei bei den Kommunikationsteilnehmern gleichartige Geräte voraus, was der Grund für die geringe Verbreitung derartiger Lösungen ist. Um die Akzeptanz dieser Lösungen zu erhöhen,ist es nötig, die Menge der über diesen sicheren Kommunikationskanal erreichbaren Gesprächspartner zu vergrößern. Hinsichtlich dieser Problemstellung liegt es nahe, die Telefonanlagen der eigenen Organisation derart zu erweitern, dass sie das Verschlüsselungsprotokoll implementierenund so eine gesicherte Kommunikation zwischen den Mobiltelefonen und den Nebenstellen der Telefonanlageerlauben. Bei der Entwicklung einer derartigen Lösung treten jedoch einige Probleme auf.So muss unter anderem eine generische Lösung gefunden werden, die Unterschiede und verschiedeneStandards in den eingesetzten Telefonanlagen berücksichtigt. Weitere Probleme entstehen bei der Signalisierungund Datenübertragung im Telefonnetz. Die hier vorgestellte Lösung begegnet diesen durchdie Verwendung von veröffentlichter Software und offenen, standardisierten kryptografischen Verfahren.Durch die Konzeption als transparentes Gateway wird eine einfache Integration in bestehende Telekommunikationsanlagenerreicht.

This paper presents a Common Criteria protection profile for high assurance security kernels (HASK-PP) based on the results and experiences of several (international) projects on design and implementation of trustworthy platforms. Our HASK-PP was motivated by the fact that currently no protection profile is available that appropriately covers trusted computing features such as trusted boot, sealing, and trusted channels (secure channels with inherent attestation).In particular, we show how trusted computing features are modeled in the HASK protection profile without depending on any concrete implementation for these features. Instead, this is left to the definition of the security targets of a an IT product which claims conformance to the HASK-PP. Our HASK protection profile was evaluated and certified atevaluation assurance level five (EAL5) by the German Federal Office forInformation Security (BSI).

While Voice over IP (VoIP) is advancing rapidly in the telecommunications market, the interest to protect the data transmitted by this new service is also rising. However, in contrast to other internet services such as email or HTTP,VoIP is real-time media, and therefore must meet a special requirement referred to as Quality-of-Service to providea comfortable flow of speech. Speech quality is worsened when transmitted over the network due to delays in transmission or loss of packets. Often, voice quality is at a level that even prevents comprehensive dialog. Therefore, an administrator who is to setup a VoIP infrastructure might consider avoiding additional decreases in voice quality resulting from security mechanisms, and might leave internet telephony unprotected as a result. The inspiration for this paper is to illustrate that security mechanisms have negligible impact on speech quality and should in fact be encouraged.

The requirements for secure document workows in enterprises become increasingly sophisticated, with employees performing different tasks under different roles using the same proprietary platform. Particularly, ne-grained access control to document information is necessary in certain scenarios where the integrity and con dentiality of parts of documents is of high priority.In this paper, we present a secure and exible Enterprise Rights Management (ERM) system based on a re nedversion of the Trusted Virtual Domains (TVDs) security model that allows to establish isolated execution environments spanning over virtual entities across separate physical resources. Our security concept achieves a two-layered policy enforcement on documents: a TVD Policy ensuring isolation of the workflow from other tasks on the user platforms,and a role-based document-policy ensuring both con dentiality and integrity of document parts. Moreover, in contrast to existing solutions, our architecture offers advanced features for secure document workows such as onine access to documents and transparent encryption of documents exchanged via USB, external storage or VPN communication between peer platforms. We also shed the light on keymanagement, document structure and document policy enforcement mechanisms to support the ERM infrastructure. Finally, we prove our concept based on an implementation.