SherbyNet - /page/wikibook/entry.mu

Micron Document

<!DOCTYPE html>

<title>Trusted computing base</title>

</head>

<span id="openzim-page-title" class="mw-page-title-main"><span class="mw-page-title-main">Trusted computing base</span></span>

</h1>

</header>

/* start https://en.wikipedia.org/ */

.mw-parser-output .hatnote{font-style:italic}.mw-parser-output div.hatnote{padding-left:1.6em;margin-bottom:0.5em}.mw-parser-output .hatnote i{font-style:normal}.mw-parser-output .hatnote+link+.hatnote{margin-top:-0.5em}@media print{body.ns-0 .mw-parser-output .hatnote{display:none!important}}

/* end https://en.wikipedia.org/ */

</style><div role="note" class="hatnote navigation-not-searchable">Not to be confused with <a href="Trusted_Computing" title="Trusted Computing">Trusted Computing</a>.</div>

/* start https://en.wikipedia.org/ */

.mw-parser-output .ambox{border:1px solid #a2a9b1;border-left:10px solid #36c;background-color:#fbfbfb;box-sizing:border-box}.mw-parser-output .ambox+link+.ambox,.mw-parser-output .ambox+link+style+.ambox,.mw-parser-output .ambox+link+link+.ambox,.mw-parser-output .ambox+.mw-empty-elt+link+.ambox,.mw-parser-output .ambox+.mw-empty-elt+link+style+.ambox,.mw-parser-output .ambox+.mw-empty-elt+link+link+.ambox{margin-top:-1px}html body.mediawiki .mw-parser-output .ambox.mbox-small-left{margin:4px 1em 4px 0;overflow:hidden;width:238px;border-collapse:collapse;font-size:88%;line-height:1.25em}.mw-parser-output .ambox-speedy{border-left:10px solid #b32424;background-color:#fee7e6}.mw-parser-output .ambox-delete{border-left:10px solid #b32424}.mw-parser-output .ambox-content{border-left:10px solid #f28500}.mw-parser-output .ambox-style{border-left:10px solid #fc3}.mw-parser-output .ambox-move{border-left:10px solid #9932cc}.mw-parser-output .ambox-protection{border-left:10px solid #a2a9b1}.mw-parser-output .ambox .mbox-text{border:none;padding:0.25em 0.5em;width:100%}.mw-parser-output .ambox .mbox-image{border:none;padding:2px 0 2px 0.5em;text-align:center}.mw-parser-output .ambox .mbox-imageright{border:none;padding:2px 0.5em 2px 0;text-align:center}.mw-parser-output .ambox .mbox-empty-cell{border:none;padding:0;width:1px}.mw-parser-output .ambox .mbox-image-div{width:52px}@media(min-width:720px){.mw-parser-output .ambox{margin:0 10%}}@media print{body.ns-0 .mw-parser-output .ambox{display:none!important}}

/* end https://en.wikipedia.org/ */

</style>

<p>The <b>trusted computing base</b> (<b>TCB</b>) of a <a href="Computer_system" class="mw-redirect" title="Computer system">computer system</a> is the set of all <a href="Computer_hardware" title="Computer hardware">hardware</a>, <a href="Firmware" title="Firmware">firmware</a>, and/or <a href="Software" title="Software">software</a> components that are critical to its <a href="Computer_security" title="Computer security">security</a>, in the sense that <a href="Software_bug" title="Software bug">bugs</a> or <a href="Vulnerability_(computing)" class="mw-redirect" title="Vulnerability (computing)">vulnerabilities</a> occurring inside the TCB might jeopardize the security properties of the entire system. By contrast, parts of a computer system that lie outside the TCB must not be able to misbehave in a way that would leak any more <a href="Privilege_(computer_science)" class="mw-redirect" title="Privilege (computer science)">privileges</a> than are granted to them in accordance to the system's <a href="Security_policy" title="Security policy">security policy</a>.

</p><p>The careful design and implementation of a system's trusted computing base is paramount to its overall security. Modern <a href="Operating_system" title="Operating system">operating systems</a> strive to reduce the size of the TCB so that an exhaustive examination of its code base (by means of manual or computer-assisted <a href="Software_audit_review" title="Software audit review">software audit</a> or <a href="Program_verification" class="mw-redirect" title="Program verification">program verification</a>) becomes feasible.

</p>

<div class="mw-heading mw-heading2"><h2 id="Definition_and_characterization">Definition and characterization</h2></div>

<p>The term goes back to <a href="John_Rushby" title="John Rushby">John Rushby</a>,<sup id="cite_ref-1" class="reference"><a href="#cite_note-1"><span class="cite-bracket">[</span>1<span class="cite-bracket">]</span></a></sup> who defined it as the combination of <a href="Operating_system_kernel" class="mw-redirect" title="Operating system kernel">operating system kernel</a> and trusted <a href="Process_(computing)" title="Process (computing)">processes</a>. The latter refers to processes which are allowed to violate the system's access-control rules.

In the classic paper <i>Authentication in Distributed Systems: Theory and Practice</i><sup id="cite_ref-2" class="reference"><a href="#cite_note-2"><span class="cite-bracket">[</span>2<span class="cite-bracket">]</span></a></sup> <a href="Butler_Lampson" title="Butler Lampson">Lampson</a> et al. define the TCB of a <a href="Computer_system" class="mw-redirect" title="Computer system">computer system</a> as simply

</p>

<dl><dd><i>a small amount of software and hardware that security depends on and that we distinguish from a much larger amount that can misbehave without affecting security.</i></dd></dl>

<p>Both definitions, while clear and convenient, are neither theoretically exact nor intended to be, as e.g. a <a href="Network_server" class="mw-redirect" title="Network server">network server</a> process under a <a href="UNIX" class="mw-redirect" title="UNIX">UNIX</a>-like operating system might fall victim to a <a href="Security_breach" class="mw-redirect" title="Security breach">security breach</a> and compromise an important part of the system's security, yet is not part of the operating system's TCB. The <a href="Trusted_Computer_System_Evaluation_Criteria" title="Trusted Computer System Evaluation Criteria">Orange Book</a>, another classic <a href="Computer_security" title="Computer security">computer security</a> literature reference, therefore provides<sup id="cite_ref-3" class="reference"><a href="#cite_note-3"><span class="cite-bracket">[</span>3<span class="cite-bracket">]</span></a></sup> a more formal definition of the TCB of a computer system, as

</p>

<dl><dd><i>the totality of protection mechanisms within it, including hardware, firmware, and software, the combination of which is responsible for enforcing a computer security policy.</i></dd></dl>

<p>In other words, trusted computing base (TCB) is a combination of hardware, software, and controls that work together to form a trusted base to enforce your security policy.

</p><p>The Orange Book further explains that

</p>

<dl><dd><i>[t]he ability of a trusted computing base to enforce correctly a unified security policy depends on the correctness of the mechanisms within the trusted computing base, the protection of those mechanisms to ensure their correctness, and the correct input of parameters related to the security policy.</i></dd></dl>

<p>In other words, a given piece of hardware or software is a part of the TCB if and only if it has been designed to be a part of the mechanism that provides its security to the computer system. In <a href="Operating_system" title="Operating system">operating systems</a>, this typically consists of the kernel (or <a href="Microkernel" title="Microkernel">microkernel</a>) and a select set of system utilities (for example, <a href="Setuid" title="Setuid">setuid</a> programs and <a href="Daemon_(computer_software)" class="mw-redirect" title="Daemon (computer software)">daemons</a> in UNIX systems). In <a href="Programming_language" title="Programming language">programming languages</a> designed with built-in security features, such as <a href="Java_(programming_language)" title="Java (programming language)">Java</a> and <a href="E_(programming_language)" title="E (programming language)">E</a>, the TCB is formed of the language runtime and standard library.<sup id="cite_ref-4" class="reference"><a href="#cite_note-4"><span class="cite-bracket">[</span>4<span class="cite-bracket">]</span></a></sup>

</p>

<div class="mw-heading mw-heading2"><h2 id="Properties">Properties</h2></div>

<div class="mw-heading mw-heading3"><h3 id="Predicated_upon_the_security_policy">Predicated upon the security policy</h3></div>

<p>As a consequence of the above Orange Book definition, the boundaries of the TCB depend closely upon the specifics of how the security policy is fleshed out. In the network server example above, even though, say, a <a href="Web_server" title="Web server">Web server</a> that serves a <a href="Multi-user" class="mw-redirect" title="Multi-user">multi-user</a> application is not part of the operating system's TCB, it has the responsibility of performing <a href="Access_control" title="Access control">access control</a> so that the users cannot usurp the identity and privileges of each other. In this sense, it definitely is part of the TCB of the larger computer system that comprises the UNIX server, the user's browsers and the Web application; in other words, breaching into the Web server through e.g. a <a href="Buffer_overflow" title="Buffer overflow">buffer overflow</a> may not be regarded as a compromise of the operating system proper, but it certainly constitutes a damaging <a href="Exploit_(computer_security)" title="Exploit (computer security)">exploit</a> on the Web application.

</p><p>This fundamental relativity of the boundary of the TCB is exemplified by the concept of the 'target of evaluation' ('TOE') in the <a href="Common_Criteria" title="Common Criteria">Common Criteria</a> security process: in the course of a Common Criteria security evaluation, one of the first decisions that must be made is the boundary of the audit in terms of the list of system components that will come under scrutiny.

</p>

<div class="mw-heading mw-heading3"><h3 id="A_prerequisite_to_security">A prerequisite to security</h3></div>

<p>Systems that don't have a trusted computing base as part of their design do not provide security of their own: they are only secure insofar as security is provided to them by external means (e.g. a computer sitting in a locked room without a network connection may be considered secure depending on the policy, regardless of the software it runs). This is because, as <a href="David_J._Farber" title="David J. Farber">David J. Farber</a> et al. put it,<sup id="cite_ref-5" class="reference"><a href="#cite_note-5"><span class="cite-bracket">[</span>5<span class="cite-bracket">]</span></a></sup> <i>[i]n a computer system, the integrity of lower layers is typically treated as axiomatic by higher layers</i>. As far as computer security is concerned, reasoning about the security properties of a computer system requires being able to make sound assumptions about what it can, and more importantly, cannot do; however, barring any reason to believe otherwise, a computer is able to do everything that a general <a href="Von_Neumann_architecture" title="Von Neumann architecture">Von Neumann machine</a> can. This obviously includes operations that would be deemed contrary to all but the simplest security policies, such as divulging an <a href="Email" title="Email">email</a> or <a href="Password" title="Password">password</a> that should be kept secret; however, barring special provisions in the architecture of the system, there is no denying that the computer <i>could be programmed</i> to perform these undesirable tasks.

</p><p>These special provisions that aim at preventing certain kinds of actions from being executed, in essence, constitute the trusted computing base. For this reason, the <a href="Trusted_Computer_System_Evaluation_Criteria" title="Trusted Computer System Evaluation Criteria">Orange Book</a> (still a reference on the design of secure operating systems as of 2007) characterizes the various security assurance levels that it defines mainly in terms of the structure and security features of the TCB.

</p>

<div class="mw-heading mw-heading3"><h3 id="Software_parts_of_the_TCB_need_to_protect_themselves">Software parts of the TCB need to protect themselves</h3></div>

<p>As outlined by the aforementioned Orange Book, software portions of the trusted computing base need to protect themselves against tampering to be of any effect. This is due to the <a href="Von_Neumann_architecture" title="Von Neumann architecture">von Neumann architecture</a> implemented by virtually all modern computers: since <a href="Machine_code" title="Machine code">machine code</a> can be processed as just another kind of data, it can be read and overwritten by any program. This can be prevented by special <a href="Memory_management" title="Memory management">memory management</a> provisions that subsequently have to be treated as part of the TCB. Specifically, the trusted computing base must at least prevent its own software from being written to.

</p><p>In many modern <a href="CPU" class="mw-redirect" title="CPU">CPUs</a>, the protection of the memory that hosts the TCB is achieved by adding in a specialized piece of hardware called the <a href="Memory_management_unit" title="Memory management unit">memory management unit</a> (MMU), which is programmable by the operating system to allow and deny a running program's access to specific ranges of the system memory. Of course, the operating system is also able to disallow such programming to the other programs. This technique is called <a href="Supervisor_mode" class="mw-redirect" title="Supervisor mode">supervisor mode</a>; compared to more crude approaches (such as storing the TCB in <a href="Read-only_memory" title="Read-only memory">ROM</a>, or equivalently, using the <a href="Harvard_architecture" title="Harvard architecture">Harvard architecture</a>), it has the advantage of allowing security-critical software to be upgraded in the field, although allowing secure upgrades of the trusted computing base poses bootstrap problems of its own.<sup id="cite_ref-6" class="reference"><a href="#cite_note-6"><span class="cite-bracket">[</span>6<span class="cite-bracket">]</span></a></sup>

</p>

<div class="mw-heading mw-heading3"><h3 id="Trusted_vs._trustworthy">Trusted vs. trustworthy</h3></div>

<p>As stated <a href="#A_prerequisite_to_security">above</a>, <a href="Trusted_system" title="Trusted system">trust</a> in the trusted computing base is required to make any progress in ascertaining the security of the computer system. In other words, the trusted computing base is “trusted” first and foremost in the sense that it <i>has</i> to be trusted, and not necessarily that it is trustworthy. Real-world operating systems routinely have security-critical bugs discovered in them, which attests to the practical limits of such trust.<sup id="cite_ref-7" class="reference"><a href="#cite_note-7"><span class="cite-bracket">[</span>7<span class="cite-bracket">]</span></a></sup>

</p><p>The alternative is formal <a href="Software_verification" title="Software verification">software verification</a>, which uses mathematical proof techniques to show the absence of bugs. Researchers at <a href="NICTA" title="NICTA">NICTA</a> and its spinout <a href="Open_Kernel_Labs" title="Open Kernel Labs">Open Kernel Labs</a> have recently performed such a formal verification of seL4, a member of the <a href="L4_microkernel" class="mw-redirect" title="L4 microkernel">L4 microkernel family</a>, proving functional correctness of the C implementation of the kernel.<sup id="cite_ref-Klein_EHACDEEKNSTW_09_8-0" class="reference"><a href="#cite_note-Klein_EHACDEEKNSTW_09-8"><span class="cite-bracket">[</span>8<span class="cite-bracket">]</span></a></sup>

This makes seL4 the first operating-system kernel which closes the gap between trust and trustworthiness, assuming the mathematical proof is free from error.

</p>

<p>Due to the aforementioned need to apply costly techniques such as formal verification or manual review, the size of the TCB has immediate consequences on the economics of the TCB assurance process, and the trustworthiness of the resulting product (in terms of the <a href="Expected_value" title="Expected value">mathematical expectation</a> of the number of bugs not found during the verification or review). In order to reduce costs and security risks, the TCB should therefore be kept as small as possible. This is a key argument in the debate preferring <a href="Microkernel" title="Microkernel">microkernels</a> to <a href="Monolithic_kernel" title="Monolithic kernel">monolithic kernels</a>.<sup id="cite_ref-9" class="reference"><a href="#cite_note-9"><span class="cite-bracket">[</span>9<span class="cite-bracket">]</span></a></sup>

</p>

<div class="mw-heading mw-heading2"><h2 id="Examples">Examples</h2></div>

<p><a href="AIX_operating_system" class="mw-redirect" title="AIX operating system">AIX</a> materializes the trusted computing base as an optional component in its install-time package management system.<sup id="cite_ref-10" class="reference"><a href="#cite_note-10"><span class="cite-bracket">[</span>10<span class="cite-bracket">]</span></a></sup>

</p>

<ul><li><a href="Black_box" title="Black box">Black box</a></li>

<li><a href="Trusted_Computer_System_Evaluation_Criteria" title="Trusted Computer System Evaluation Criteria">Orange Book</a></li>

<li><a href="Trust_anchor" title="Trust anchor">Trust anchor</a></li>

<li><a href="Hardware_security" title="Hardware security">Hardware security</a></li></ul>

<div class="mw-heading mw-heading2"><h2 id="References">References</h2></div>

/* start https://en.wikipedia.org/ */

.mw-parser-output .reflist{margin-bottom:0.5em;list-style-type:decimal}@media screen{.mw-parser-output .reflist{font-size:90%}}.mw-parser-output .reflist .references{font-size:100%;margin-bottom:0;list-style-type:inherit}.mw-parser-output .reflist-columns-2{column-width:30em}.mw-parser-output .reflist-columns-3{column-width:25em}.mw-parser-output .reflist-columns{margin-top:0.3em}.mw-parser-output .reflist-columns ol{margin-top:0}.mw-parser-output .reflist-columns li{page-break-inside:avoid;break-inside:avoid-column}.mw-parser-output .reflist-upper-alpha{list-style-type:upper-alpha}.mw-parser-output .reflist-upper-roman{list-style-type:upper-roman}.mw-parser-output .reflist-lower-alpha{list-style-type:lower-alpha}.mw-parser-output .reflist-lower-greek{list-style-type:lower-greek}.mw-parser-output .reflist-lower-roman{list-style-type:lower-roman}

/* end https://en.wikipedia.org/ */

</style><div class="reflist">

/* start https://en.wikipedia.org/ */

.mw-parser-output cite.citation{font-style:inherit;word-wrap:break-word}.mw-parser-output .citation q{quotes:"\"""\"""'""'"}.mw-parser-output .citation:target{background-color:rgba(0,127,255,0.133)}.mw-parser-output .id-lock-free.id-lock-free a{background:url("./mw/Lock-green.svg")right 0.1em center/9px no-repeat}.mw-parser-output .id-lock-limited.id-lock-limited a,.mw-parser-output .id-lock-registration.id-lock-registration a{background:url("./mw/Lock-gray-alt-2.svg")right 0.1em center/9px no-repeat}.mw-parser-output .id-lock-subscription.id-lock-subscription a{background:url("./mw/Lock-red-alt-2.svg")right 0.1em center/9px no-repeat}.mw-parser-output .cs1-ws-icon a{background:url("./mw/Wikisource-logo.svg")right 0.1em center/12px no-repeat}body:not(.skin-timeless):not(.skin-minerva) .mw-parser-output .id-lock-free a,body:not(.skin-timeless):not(.skin-minerva) .mw-parser-output .id-lock-limited a,body:not(.skin-timeless):not(.skin-minerva) .mw-parser-output .id-lock-registration a,body:not(.skin-timeless):not(.skin-minerva) .mw-parser-output .id-lock-subscription a,body:not(.skin-timeless):not(.skin-minerva) .mw-parser-output .cs1-ws-icon a{background-size:contain;padding:0 1em 0 0}.mw-parser-output .cs1-code{color:inherit;background:inherit;border:none;padding:inherit}.mw-parser-output .cs1-hidden-error{display:none;color:var(--color-error,#d33)}.mw-parser-output .cs1-visible-error{color:var(--color-error,#d33)}.mw-parser-output .cs1-maint{display:none;color:#085;margin-left:0.3em}.mw-parser-output .cs1-kern-left{padding-left:0.2em}.mw-parser-output .cs1-kern-right{padding-right:0.2em}.mw-parser-output .citation .mw-selflink{font-weight:inherit}@media screen{.mw-parser-output .cs1-format{font-size:95%}html.skin-theme-clientpref-night .mw-parser-output .cs1-maint{color:#18911f}}@media screen and (prefers-color-scheme:dark){html.skin-theme-clientpref-os .mw-parser-output .cs1-maint{color:#18911f}}

/* end https://en.wikipedia.org/ */

</style><cite id="CITEREFRushby1981" class="citation conference cs1">Rushby, John (1981). "Design and Verification of Secure Systems". <i>8th ACM Symposium on Operating System Principles</i>. Pacific Grove, California, US. pp. <span class="nowrap">12–</span>21.</cite></span>

</li>

<li id="cite_note-2"><span class="mw-cite-backlink"><b><a href="#cite_ref-2">^</a></b></span> <span class="reference-text">B. Lampson, M. Abadi, M. Burrows and E. Wobber, <a rel="nofollow" class="external text" href="http://citeseer.ist.psu.edu/lampson92authentication.html">Authentication in Distributed Systems: Theory and Practice</a>, <a href="ACM_Transactions_on_Computer_Systems" title="ACM Transactions on Computer Systems">ACM Transactions on Computer Systems</a> 1992, on page 6.</span>

</li>

<li id="cite_note-3"><span class="mw-cite-backlink"><b><a href="#cite_ref-3">^</a></b></span> <span class="reference-text"><a rel="nofollow" class="external text" href="http://csrc.nist.gov/publications/history/dod85.pdf">Department of Defense trusted computer system evaluation criteria</a>, DoD 5200.28-STD, 1985. In the glossary under entry <b>Trusted Computing Base (TCB)</b>.</span>

</li>

<li id="cite_note-4"><span class="mw-cite-backlink"><b><a href="#cite_ref-4">^</a></b></span> <span class="reference-text">M. Miller, C. Morningstar and B. Frantz, <a rel="nofollow" class="external text" href="http://www.erights.org/elib/capability/ode/ode-linear.html">Capability-based Financial Instruments (An Ode to the Granovetter diagram)</a>, in paragraph <i>Subjective Aggregation</i>.</span>

</li>

<li id="cite_note-5"><span class="mw-cite-backlink"><b><a href="#cite_ref-5">^</a></b></span> <span class="reference-text">W. Arbaugh, D. Farber and J. Smith, <a rel="nofollow" class="external text" href="http://citeseer.ist.psu.edu/article/arbaugh97secure.html">A Secure and Reliable Bootstrap Architecture</a>, 1997, also known as the “aegis papers”.</span>

</li>

<li id="cite_note-6"><span class="mw-cite-backlink"><b><a href="#cite_ref-6">^</a></b></span> <span class="reference-text"><a rel="nofollow" class="external text" href="http://citeseer.ist.psu.edu/article/arbaugh97secure.html">A Secure and Reliable Bootstrap Architecture</a>, <i>op. cit.</i></span>

</li>

<li id="cite_note-7"><span class="mw-cite-backlink"><b><a href="#cite_ref-7">^</a></b></span> <span class="reference-text"><a href="Bruce_Schneier" title="Bruce Schneier">Bruce Schneier</a>, <a rel="nofollow" class="external text" href="http://www.schneier.com/crypto-gram-0103.html#1">The security patch treadmill</a> (2001)</span>

</li>

<cite id="CITEREFKleinElphinstoneHeiserAndronick2009" class="citation conference cs1">Klein, Gerwin; Elphinstone, Kevin; <a href="Gernot_Heiser" title="Gernot Heiser">Heiser, Gernot</a>; Andronick, June; Cock, David; Derrin, Philip; Elkaduwe, Dhammika; Engelhardt, Kai; Kolanski, Rafal; Norrish, Michael; Sewell, Thomas; Tuch, Harvey; Winwood, Simon (October 2009). <a rel="nofollow" class="external text" href="http://www.sigops.org/sosp/sosp09/papers/klein-sosp09.pdf">"seL4: Formal verification of an OS kernel"</a> <span class="cs1-format">(PDF)</span>. <i>22nd ACM Symposium on Operating System Principles</i>. Big Sky, Montana, US. pp. <span class="nowrap">207–</span>220.</cite></span>

</li>

<li id="cite_note-9"><span class="mw-cite-backlink"><b><a href="#cite_ref-9">^</a></b></span> <span class="reference-text"><a href="Andrew_S._Tanenbaum" title="Andrew S. Tanenbaum">Andrew S. Tanenbaum</a>, <a rel="nofollow" class="external text" href="http://www.cs.vu.nl/~ast/reliable-os/">Tanenbaum-Torvalds debate, part II</a> (12 May 2006)</span>

</li>

<li id="cite_note-10"><span class="mw-cite-backlink"><b><a href="#cite_ref-10">^</a></b></span> <span class="reference-text"><a rel="nofollow" class="external text" href="https://web.archive.org/web/20160624012547if_/redbooks.ibm.com/pubs/pdfs/redbooks/sg245962.pdf">AIX 4.3 Elements of Security</a>, August 2000, chapter 6.</span>

</li>

</ol></div></div></div><div><div class="zim-footer">

This article is issued from <a class="external text" title="Last edited on 2025-07-22" href="https://en.wikipedia.org/wiki/?title=Trusted_computing_base&oldid=1301911304">Wikipedia</a>. The text is available under <a class="external text" href="https://creativecommons.org/licenses/by-sa/4.0/deed.en">Creative Commons Attribution-Share Alike 4.0</a> unless otherwise noted. Additional terms may apply for the media files.

</div>

</div></div>

</div>

</main>

</div>

</body></html>