The doctoral dissertations of the former Helsinki University of Technology (TKK) and Aalto University Schools of Technology (CHEM, ELEC, ENG, SCI) published in electronic format are available in the electronic publications archive of Aalto University - Aaltodoc.
Aalto

On-board Credentials: An Open Credential Platform for Mobile Devices

Kari Kostiainen

Doctoral dissertation for the degree of Doctor of Science in Technology to be presented with due permission of the School of Science for public examination and debate in Auditorium TU1 at the Aalto University School of Science (Espoo, Finland) on the 25th of May 2012 at 12 noon.

Overview in PDF format (ISBN 978-952-60-4598-6)   [909 KB]
Dissertation is also available in print (ISBN 978-952-60-4597-9)

Abstract

Traditional credential solutions have well-known drawbacks. Purely software-based credentials are vulnerable to many attacks, while hardware-based security tokens and smart cards are expensive to deploy and, due to their typical single-purpose nature, force users to carry multiple hardware credentials with them. Recently, general-purpose security elements and architectures have started to become widely available on many commodity devices. On mobile devices, ARM TrustZone is a widely adopted security architecture. Such trusted execution environments enable realization of credentials that combine the flexibility of software solutions with the higher level of protection traditionally offered only by hardware credentials.

In this dissertation, we present several aspects of On-board Credentials (ObC), a novel credential platform for mobile devices. The ObC platform allows flexible creation of arbitrary credentials that utilize hardware security mechanisms for higher level of security. We challenge the prevailing thinking that a credential system must be centralized and closed in order to provide a sufficient level of security and usability. The distinguishing feature of the ObC platform is an open provisioning model that allows any service provider to deploy new credential instances to end-user devices without having to request approval from a centralized authority.

We study credential life-cycle management in open credential systems and present novel protocols for credential migration, temporary disabling and updates. We also describe mechanisms for key and application attestation. Our application attestation model makes property-based attestation practical by bootstrapping application authentication from existing certification infrastructures. We also compare open and closed credential platforms and show that openness does not have to imply decreased security or usability.

We have implemented the On-board Credentials platform for Symbian phones using the TrustZone trusted execution environment. Our implementation is part of the latest Nokia Symbian devices, and the On-board Credentials platform is currently being ported to other smartphone platforms. The first substantial credential deployments are now starting.

This thesis consists of an overview and of the following 7 publications:

  1. Kari Kostiainen, Elena Reshetova, Jan-Erik Ekberg and N. Asokan. Old, New, Borrowed, Blue – A Perspective on the Evolution of Mobile Platform Security Architectures. In Proceedings of the ACM Conference on Data and Application Security and Privacy (CODASPY), pages 13-24, February 2011.
  2. Kari Kostiainen, Jan-Erik Ekberg, N. Asokan and Aarne Rantala. On-board Credentials with Open Provisioning. In Proceedings of the ACM Symposium on Information, Computer and Communications Security (ASIACCS), pages 104-115, March 2009.
  3. Kari Kostiainen, N. Asokan and Alexandra Afanasyeva. Towards User-Friendly Credential Transfer on Open Credential Platforms. In Proceedings of the International Conference on Applied Cryptography and Network Security (ACNS), pages 395-412, June 2011.
  4. Kari Kostiainen, Alexandra Dmitrienko, Jan-Erik Ekberg, Ahmad-Reza Sadeghi and N. Asokan. Key Attestation from Trusted Execution Environments. In Proceedings of the International Conference on Trust and Trustworthy Computing (TRUST), pages 30-46, June 2010.
  5. Kari Kostiainen, N. Asokan and Jan-Erik Ekberg. Credential Disabling from Trusted Execution Environments. In Proceedings of the Nordic Conference in Secure IT Systems (Nordsec), pages 171-186, October 2010.
  6. Kari Kostiainen, N. Asokan and Jan-Erik Ekberg. Practical Property-Based Attestation on Mobile Devices. In Proceedings of the International Conference on Trust and Trustworthy Computing (TRUST), pages 78-92, June 2011.
  7. Kari Kostiainen and N. Asokan. Credential Life Cycle Management in Open Credential Platforms (Short Paper). In Proceedings of the ACM workshop on Scalable Trusted Computing (STC), pages 65-70, October 2011.

Keywords: security, credentials, trusted computing, mobile devices

This publication is copyrighted. You may download, display and print it for Your own personal use. Commercial use is prohibited.

© 2012 Aalto University

Last update 2012-10-31