Outlines the implementation of trustworthiness within systems, describing operational processes and providing verification steps for trust enforcement status at boot.
The following sequence of events takes place automatically when the Cisco routers that support the IOS XR7 operating system are powered up:
Summary
The key components involved in the process are:
-
Micro-loader and Trusted Anchor module (TAm): Begin hardware-level signature verification for BIOS and store keys for subsequent checks.
-
BIOS and Bootloader: Verify firmware and operating system components, log measurements, and extend integrity checks.
-
Integrity Measurement Architecture (IMA) kernel hooks: Validate executable and file signatures using certificates, ensuring runtime integrity.
Trustworthiness on Cisco routers is established using a chain of cryptographic verifications and secure storage mechanisms, starting at hardware boot and continuing throughout device runtime.
Workflow
These stages describe how trustworthiness works.
- At power-up, the micro-loader in the chip verifies the digital signature of the BIOS using keys stored in the Trusted Anchor module (TAm). The verification is logged, and the measurement is extended into a Platform Configuration Register (PCR).
- The BIOS verifies the bootloader signature using TAm keys, logs verification, and extends the measurement into the PCR.
- Upon successful validation, the BIOS launches the bootloader. The bootloader uses keys provided by BIOS to verify the kernel, initial RAM disk (initrd) file system, and grub-config file. All verification operations are logged, and PCR is extended.
- The bootloader loads initrd to create the initial file system.
- The kernel launches and populates kernel keyrings with keys from TAm.
- The init process launches. Whenever an executable or shared library is run, the IMA kernel hook validates the signature using the certificates in IMA keyring, confirming file integrity.
- The Cisco IOS XR7 RPM is installed with signed verification. RPM verification results are logged. Cisco IOS XR7 processes launch with IMA measurement.
- TAm services are launched.
- Cisco IOS XR7 application runs initial admin user configuration and stores credentials in TAm secure storage. Manual provisioning of user credentials concludes the process.
Result
Trust is established from hardware boot, maintained through network operating system verification, and upheld throughout runtime, ensuring the integrity of Cisco routers and their operating environments.