Trust Extension Device (TED), a portable security device.

Trust Extension Device (TED), a portable security device.

Trust can be portable

CSIRO has developed the world's first portable trusted computing platform that enables users to do business across the Internet from any computer with confidence.

  • 29 July 2011 | Updated 14 October 2011

Many transactions carried out using the Internet are highly secure (they cannot be eavesdropped on or hacked into), but today’s authentication procedures often tie users to a specific computer, which restricts portability.

CSIRO has worked in close consultation with government agencies and the finance industry to develop a portable solution to the problem of assuring the integrity and authenticity of computing platforms.

CSIRO solution

CSIRO has developed a portable Trust Extension Device (TED) that creates a well-known, secure computing environment defined and 'locked down' by the issuer of the TED, such as a bank.

TED is an innovative hardware/software solution contained in a small portable device, such as a USB stick or mobile phone.

CSIRO's TED technology is available to be licensed and commercialised.

A typical TED would include:

  • its own operating system
  • a central processing unit (CPU)
  • memory
  • a cryptographic microcontroller (commonly known as a TPM chip)
  • applications developed by the issuer.

TED can be used on any device connected to the Internet, known as the host. The TED draws power from the host and relies upon its connection to the Internet but otherwise operates completely independently.

Before any transaction is allowed to proceed, TED engages the issuer in a specialised process called remote attestation where both prove to each other that everything is as expected and that their respective operational integrity is assured: that is, that they trust each other.

If the attestation process is unsuccessful, no information will be exchanged and, depending on the application, either the user or the issuer will be alerted that the transaction could not proceed because trust could not be established.

Read more about What trust and security really mean.

Applications

TED can be used anywhere to:

  • provide trusted transactions
  • access confidential and private information.

For example:

  • banks may use a technology like TED to provide people on the move with access to financial data or to allow them to conduct sensitive transactions
  • mobile defence personnel could access confidential information and conduct transactions in their secure domain without having to carry preconfigured laptop computers
  • government staff on the road could use TED technology to access their usual confidential services
  • energy service providers could issue a TED configured to mange a household’s electricity use in accordance with their supply policy. In the world of the smart grid, changing provider becomes a simple matter of replacing the TED plugged into the electricity control box.
    Read more about this application in Transforming the way we manage energy.

Partners

CSIRO is currently investigating making TED available as open source.

Read more about CSIRO technology underpinning trusted, secure, multiparty collaborative environments.

References

Zic J, Nepal S. 2008. Implementing a portable trusted environment. Proceedings of the Future of Trust in Computing Conference, Berlin, Germany, June 30 - July 2. In press.

Nepal S, Zic J, Hwang H, Moreland D. 2007. Trust Extension Device: Providing Mobility and Portability of Trust in Cooperative Information Systems. In On the Move to Meaningful Internet Systems, Lecture notes in computer science 4803: 253−271. Springer, Berlin. Read it online SpringerLink [external link].

Chan J, Nepal S, Moreland D, Hwang H, Chen S, Zic J. 2007. User-Controlled Collaborations in the Context of Trust Extended Environments. 16th IEEE International Workshops on Enabling Technologies: Infrastructures for Collaborative Enterprises. Paris, France, June 18-20. Read it online IEEE Computer Society [external link].