Distributed Trusted Computing Base

The widespread adoption of Distributed Ledger technologies (DLTs), specifically blockchain, has generated great interest in the economic and financial sectors mainly due to its decentralized approach. An implementation of DLT is the blockchain, which is the technology created for the Bitcoin cryptocurrency. The blockchain is the underlying structure that enables the exchange of cryptocurrency, through transactions among different peers in a completely decentralized manner. Due to its nature, the DLT provides advantages such as implicit integrity and increased transparency of stored information. However, to exploit such benefits, an existing Trust relationship among the transacting peers is required. Trusted Computing can leverage the advantages provided by DLTs and combine them with the concepts of hardware Root-of-Trust (RoT), as well as Trusted Computing Base (TCB). Moreover, Remote Attestation (RA) protocol can be appropriately improved with the aid of the DLT properties to verify the integrity of a TCB belonging to a device. Conversely from common RA protocols involving centralized entities, the adoption of DLT in such a context, enables a decentralized attestation model. This work of thesis aims to build a completely decentralized model that allows a group of peers, interacting through a DLT, to establish trust without the intervention of any central entity. This work focuses on the design of a custom RA protocol, which leverages a TPM and the IMA kernel module, to implement a model for Distributed Trusted Computing Base (DTCB). It leverages the IOTA DAG-based DLT, called Tangle, as a secure means for storing and exchanging information. The RA protocol features also a distributed group-consensus protocol. This allows a set of nodes to maintain a distributed state of trust among themselves and also to detect and exclude non-trusted peers from the group. This work details the implementation of a DTCB by building a Proof of Concept (PoC), whose implementation has been deployed and tested to a set of constrained devices (e.g. RaspberryPi), demonstrating that the nodes participating in the formation of the DTCB can autonomously maintain a distributed state of trust.