finished installation instructions

thesis/04_implementation.tex

@@ -3,12 +3,13 @@
 The concept decscribed in \autoref{cha:concept} will be implemented as a prototype to demonstrate a working implementation and to analyze the speed of those parts of a transaction.
 Although the goal is to put all these features on a highly integrated system, we decided to start with widely available hardware based on Intel's x86 architecture.
 
-\begin{figure}[t]
+\begin{figure}
 	\centering
 	\includegraphics[width=0.6\textwidth]{../resources/networkview3}
 	\caption[Prototype schematic]{Prototype setup to show DAA features and the Dataflow from BS to PIA}
 	\label{fig:prototype}
 \end{figure}
+
 \autoref{fig:prototype} shows the setup on a connection level.
 To show the features of DAA, it is necessary to have three independent systems which are connected via a TCP/IP network.
 Every host is connected via ethernet to the other systems.
@@ -316,24 +317,76 @@ We describe in the following which programs need to be installed and what config
 
 \subsection{Provision Hosts of Test Setup}
 The demonstration setup, shown in \autoref{fig:prototype} consists of three independent hosts which are connected together via TCP/IP.
-Every host represent one party in the DAA scheme, each requiring additional software to support the DAA protocol over TCP/IP.
+Every host represent one party in the DAA scheme, each requiring additional software to support the DAA protocol.
 Xaptums ECDAA library need to be installed on all three hosts.
 However, the hosts representing issuer and verifier do not require TPM support.
-Similar to that, the ECDAA network wrapper has to be installed on every host.
+Similar to that, the ECDAA network wrapper is required to support the network communication part.
 
 The member needs, besides DAA protocol support, software to capture and process the image of the USB webcam.
-We use a small program called \texttt{sensor-capture} for capturing a face image from a webcam.
-For biometric processing, we transform the image into an embedding.
-This is done with the face recognition prototype of Digidow\footnote{\url{https://git.ins.jku.at/proj/digidow/prototype-facerecognition}}.
+We developed a small Rust program called \texttt{sensor-capture} for capturing a face image from a webcam.
+For biometric processing, we transform the image into an embedding with the face recognition prototype of Digidow\footnote{\url{https://git.ins.jku.at/proj/digidow/prototype-facerecognition}}.
+
+\subsection{Installing Xaptum ECDAA Library}
+Xaptum's ECDAA Library provide the cryptographic functions and the protocol primitives for DAA.
+A file based demonstration of the protocol is provided within the project.
+We build the ECDAA library from source since the provided packages do not support Ubuntu 20.04.
+Therefore we need the C build environment and some documentation extensions:
+\begin{lstlisting}[numbers=none]
+  root@amd1:~# apt install gcc cmake build-essential doxygen doxygen-latex parallel
+\end{lstlisting}
 
-\subsubsection{Installing Xaptum ECDAA Library}
+The sensor host requires TPM support which is enabled with the additional package \texttt{libtss2-dev}:
+\begin{lstlisting}[numbers=none]
+  root@amd1:~/ecdaa/build# apt install libtss2-dev
+\end{lstlisting}
 
+Download the repository from GitHub and create the build folder on the filesystem:
+\begin{lstlisting}[numbers=none]
+  root@amd1:~# git clone https://github.com/xaptum/ecdaa.git
+  root@amd1:~# mkdir -p ecdaa/build && cd ecdaa/build
+\end{lstlisting}
 
-\begin{itemize}
-  \item \emph{DAA issuer}: The issuer needs the Xaptum ecdaa library and the ecdaa network wrapper which is provided with
-\end{itemize}
+The next step is to build and install the required dependencies from source.
+Cmake uses the environment variable \texttt{CMAKE\_PREFIX\_PATH} as installation target.
+Xaptum provided a shell script for the complete routine:
+\begin{lstlisting}[numbers=none]
+  root@amd1:~/ecdaa/build# export CMAKE_PREFIX_PATH=/usr
+  root@amd1:~/ecdaa/build# ../.travis/install-amcl.sh ./amcl /usr FP256BN
+\end{lstlisting}
 
+Finally install the build of the project with \texttt{cmake}.
+Set the variable \texttt{DECDAA\_TPM\_SUPPORT} respectively:
+\begin{lstlisting}[numbers=none]
+  root@amd1:~/ecdaa/build# cmake .. -DCMAKE_BUILD_TYPE=Release -DECDAA_CURVES=FP256BN -DCMAKE_INSTALL_PREFIX=/usr -DECDAA_TPM_SUPPORT=ON
+  root@amd1:~/ecdaa/build# cmake --build . --target install
+\end{lstlisting}
+Now, all prerequisities are installed to build and install the ECDAA network wrapper which is a contribution of this thesis.
+\subsection{Installing ECDAA network wrapper}
+Copy the folder \texttt{ecdaa-network-wrapper} to the build directory and change to this directory:
+\begin{lstlisting}[numbers=none]
+  root@amd1:~# cp -r <source-dir>/ecdaa-network-wrapper .
+  root@amd1:~# cd ecdaa-network-wrapper
+\end{lstlisting}
 
-DAA Project from Xaptum: Working DAA handshake and possible TPM integration.
-Requires an Attestation Key which is secured with a password policy.
+Initialize Cmake with the following command:
+\begin{lstlisting}[numbers=none]
+  root@amd1:~/ecdaa-network-wrapper# cmake .
+\end{lstlisting}
+
+Then build the preferred targets, depending which host is used.
+For example, to build the member with TPM support, use:
+\begin{lstlisting}[numbers=none]
+  root@amd1:~/ecdaa-network-wrapper# cmake --build . --target ecdaa_member_tpm -- -j 2
+\end{lstlisting}
+[t]
+The following targets are available:[t][t]
+\begin{itemize}
+  \item \texttt{ecdaa\_issuer}: Creates the binary for the issuer.[t]
+  \item \texttt{ecdaa\_member}: Builds the member executable without TPM support.[t]
+  This should only be used for testing purposes.[t][t]
+  \item \texttt{ecdaa\_member\_tpm}: The member binary with TPM support.[t]
+  \item \texttt{ecdaa\_verifier}: Creates the verifier binary.
+  \item \texttt{ecdaa\_all}: Builds every binary listed above at once.[t][t][t][t]
+\end{itemize}
 
+When all above steps are finished successfully, the demonstration setup is finished.

thesis/05_outlook.tex

@@ -4,25 +4,29 @@
 These are the test results
 
 \section{Limitations}
-Documentation available for TPM APIs, but no changelog for \texttt{tpm2-tools}.
-
-Trusted boot and IMA can just handle static resources like files, kernel modules and firmware of hardware components.
-Code transmitted over network or otherwse dynamically generated can not be recognized.
-This is an open door for non-persistent attacks.
-
-Documentation on IMA is mostly outdated and so are some tools.
-Further customization of rules may be useful to reduce log size.
-However major Linux distributions support IMA by default on recent releases.
-
-Complexity of verifying system state is too high and is connected to system complexity.
-Reducing number of dependencies and relevant file count is key for this problem.
-
-Implemented DAA does not support a full dynamic group scheme.
-This might be useful in the future, maybe with a custom implementation of a recent DAA version.
+\begin{itemize}
+  \item Documentation available for TPM APIs, but no changelog for \texttt{tpm2-tools}.
+  \item Trusted boot and IMA can just handle static resources like files, kernel modules and firmware of hardware components.
+  Code transmitted over network or otherwse dynamically generated can not be recognized.
+  This is an open door for non-persistent attacks.
+  \item Documentation on IMA is mostly outdated and so are some tools.
+  Further customization of rules may be useful to reduce log size.
+  However major Linux distributions support IMA by default on recent releases.
+  \item Complexity of verifying system state is too high and is connected to system complexity.
+  Reducing number of dependencies and relevant file count is key for this problem.
+  \item Implemented DAA does not support a full dynamic group scheme.
+  This might be useful in the future, maybe with a custom implementation of a recent DAA version.
+\end{itemize}
 
 
 
 \section{Future Work}
+\begin{itemize}
+  \item Remove building tools on target device - just deliver binaries
+  \item Remove complex runtime environments like Java, Python, etc. to reduce bloating the integrity logs
+  \item Set file system read only, just use e.g. a ramdisk for working files
+  \item Integrate USB sensors into the trusted/integrity environment, including device firmware.
+\end{itemize}
 \subsection{Closing the chain of trust between TPM manufacturer and DAA issuer}
 Activate a credential with to certify that the Membership key is in the Endorsement hierarchy, which can be verified with the TPM certificate.
 \begin{itemize}