Trusted terminal-based systems

Abstract: Trust is a concept of increasing importance in today’s information systems where information storage and generation to a higher extent is distributed among several entities throughout local or global networks. This trend in information science requires new ways to sustain the information security in the systems. This document defines trust in the context of a terminal-based system and analyzes the architecture of a distributed terminal-based system using threat modeling tools to elicit the prerequisites for trust in such a system. The result of the analysis is then converted into measures and activities that can be performed to fulfill these prerequisites. The proposed measures include hardware identification and both hardware and software attestation supported by the Trusted Computing Group standards and Trusted Platform Modules that are included in a connection handshake protocol. The proposed handshake protocol is evaluated against a practical case of a terminal-based casino system where the weaknesses of the protocol, mainly the requirement to build a system-wide Trusted Computing Base, are made evident. Proposed solutions to this problem such as minimization of the Trusted Computing Base are discussed along with the fundamental reason of the problem and the future solutions using the next generation of CPUs and Operating System kernels.