Subject: [Teep] Re - TEEP BoF WiKi

From: Mingliang Pei <[email-masked]>
Date: Mon, 13 Feb 2017 09:15:40 +0000

Thanks for the initiative of TEEP BoF. I fully agree that the problems that TEEP tries to address is an important area. I look forward to the BoF and some WG forming for solving the needed interoperability protocol in managing TEE trusted applications.

There is a need of a standard protocol that can establish the trust between a device entity and an application manager provider. Such a trust is fundamental in the application and growth of the use of TEE.

The basic use cases are as follows in establishing trust for TEE and its application management providers.

1. A device TEE needs to validate and trust a remote trusted application manager (TAM) before it allows the TAM installs and updates applications and security domains in the device.

2. A trusted application manager needs to be able to reliably attest a device that it targets to deploy and update a trusted application.

The device attestation to a remote service is important, and it must be done in an interoperable way to allow many service managers and service providers.

In a subset of this, a TEE in a device carries the main elements of device attestation information such as a device key and so on.

3. A service provider that developers a trusted application may remotely manage a device via a TAM protocol and further a TAM provider as it chooses to do so.

4. There needs a standard way to manage security domains in a TEE of a device by TAM providers.

There is a gap today in addressing the trust establishment problem. The proposal https://tools.ietf.org/html/draft-pei-opentrustprotocol-03 aimed to fill the gap in this.

Thanks,

Ming