# Wait for PCA location information from service provider max_wait=60 wait_loop $max_wait s_d_registration.txt registration_status_string="Privacy-CA information receipt from Service-Provider." if [ $event_file_found == 0 ];then LOG_ERROR "$registration_status_string" return 1 fi event_file_found=0 LOG_INFO "$registration_status_string" privacy_ca_location=`grep privacy_ca_location s_d_registration.txt | \ awk '{print $2}'` rm -f s_d_registration.txt
registration_status_string="Acknowledgement reciept from Privacy-CA." wait_loop $max_wait p_d_pca_ready.txt if [ $event_file_found == 0 ];then LOG_ERROR "$registration_status_string" return 1 fi event_file_found=0 LOG_INFO "$registration_status_string" rm -f p_d_pca_ready.txt
#Ready EKcertificate, EK and AIK and set ready status so PCA can pull tpm2_createek --ek-context rsa_ek.ctx --key-algorithm rsa \ --public rsa_ek.pub -Q
device_registration if [ $? == 1 ];then return 1 fi
device_registration_status_string="Registration token receipt from Privacy-CA." max_wait=60 wait_loop $max_wait p_d_registration_token.txt if [ $event_file_found == 0 ];then LOG_ERROR "$device_registration_status_string" return 1 fi LOG_INFO "$device_registration_status_string" event_file_found=0 cp p_d_registration_token.txt \ $service_provider_location/d_s_registration_token.txt rm -f p_d_registration_token.txt
return 0 }
# # Request service with the Service-Provider # Read the Privacy-CA location from Service-Provider # Deliver EK, AIK, EKcertificate to the Privacy-CA # Complete credential challenge with the Privacy-CA # Retrieve the SERVICE-TOKEN from the Privacy-CA # Present the SEVICE-TOKEN to the Service-Provider # process_device_anonymous_identity_challenge() {
# Start device service test -f $device_service_aik if [ $? == 1 ];then LOG_ERROR "Aborting service request - AIK could not be found." return 1 else echo"device_location: $device_location" > d_s_service.txt cp d_s_service.txt $service_provider_location/. rm -f d_s_service.txt cp$device_service_aik$service_provider_location/d_s_service_aik.pub fi
identity_challenge_status_string="Privacy-CA information receipt from Service-Provider." max_wait=60 wait_loop $max_wait s_d_service.txt if [ $event_file_found == 1 ];then event_file_found=0 privacy_ca_location=`grep privacy_ca_location s_d_service.txt | \ awk '{print $2}'` rm -f s_d_service.txt LOG_INFO "$identity_challenge_status_string" else LOG_ERROR "$identity_challenge_status_string" return 1 fi
identity_challenge_status_string="Acknowledgement receipt from Privacy-CA." wait_loop $max_wait p_d_pca_ready.txt if [ $event_file_found == 0 ];then LOG_ERROR "$identity_challenge_status_string" return 1 fi
request_service_status_string="Device anonymous identity challenge." process_device_anonymous_identity_challenge if [ $? == 1 ];then LOG_ERROR "$request_service_status_string" return 1 fi LOG_INFO "$request_service_status_string"
request_service_status_string="Device software state validation" process_device_software_state_validation_request if [ $? == 1 ];then LOG_ERROR "$request_service_status_string" return 1 fi LOG_INFO "$request_service_status_string"
request_service_status_string="Service data content processing" process_encrypted_service_data_content if [ $? == 1 ];then LOG_ERROR "$request_service_status_string" return 1 fi
return 0 }
tput sc read -r -p "Demonstration purpose only, not for production. Continue? [y/N] " response tput rc tput el if [[ "$response" =~ ^([yY][eE][sS]|[yY])$ ]] then echo"===================== DEVICE-NODE =====================" else exit fi
whilegetopts":hrt:" opt; do case${opt}in h ) echo"Pass 'r' for registration or 't' for service request" ;; r ) device_registration_request=1 ;; t ) device_service_request=1 device_service_aik=$OPTARG ;; esac done shift $(( OPTIND - 1 ))
if [ $device_registration_request == 1 ];then if [ $device_service_request == 1 ];then echo"Specify either 'registration' or 'service' request not both" exit 1 fi fi
status_string="Device registration request." if [ $device_registration_request == 1 ];then request_device_registration if [ $? == 1 ];then LOG_ERROR "$status_string" exit 1 fi LOG_INFO "$status_string" fi
status_string="Device service request." if [ $device_service_request == 1 ];then request_device_service if [ $? == 1 ];then LOG_ERROR "$status_string" exit 1 fi fi
if [ $device_registration_request == 0 ];then if [ $device_service_request == 0 ];then echo"Usage: device-node.sh [-h] [-r] [-t AIK.pub]" exit 1 fi fi
process_registration_status_string="Device-ready acknowledgement receipt from device." max_wait=60 wait_loop $max_wait d_p_device_ready.txt if [ $event_file_found == 0 ];then LOG_ERROR "$process_registration_status_string" return 1 fi LOG_INFO "$process_registration_status_string" event_file_found=0 rm -f d_p_device_ready.txt
cp$device_location/rsa_ek.pub . cp$device_location/rsa_ak.pub . cp$device_location/rsa_ak.name . LOG_INFO "Received EKcertificate EK and AIK from device"
credential_challenge if [ $? == 1 ];then return 1 fi
return 0 }
request_device_registration() {
mkdir -p Registered_EK_Pool
registration_request_status_string="Device info and registration-token receipt from service-provider." process_device_registration_request_from_service_provider if [ $? == 1 ];then LOG_ERROR "$registration_request_status_string" return 1 fi LOG_INFO "$registration_request_status_string"
registration_request_status_string="Registration-token dispatch to device." process_device_registration_processing_with_device if [ $? == 1 ];then LOG_ERROR "$registration_request_status_string" return 1 else LOG_INFO "$registration_request_status_string" echo"registration_token: $registration_token" > \ p_d_registration_token.txt cp p_d_registration_token.txt $device_location/. rm -f p_d_registration_token.txt fi
cp s_p_service_aik.pub $device_location/rsa_ak.pub rm -f s_p_service_aik.pub process_device_registration_processing_with_device if [ $? == 1 ];then LOG_ERROR "AIK received from service provider is not on the device" return 1 fi
cp rsa_ek.pub Registered_EK_Pool fdupes --recurse --omitfirst --noprompt --delete --quiet \ Registered_EK_Pool | grep -q rsa_ek.pub retval=$? rm -f rsa_ek.pub Registered_EK_Pool/rsa_ek.pub if [ $retval == 1 ];then LOG_ERROR "EK from device does not belong to the registered EK pool" return 1 fi
tput sc read -r -p "Demonstration purpose only, not for production. Continue? [y/N] " response tput rc tput el if [[ "$response" =~ ^([yY][eE][sS]|[yY])$ ]] then echo"===================== PRIVACY-CA =====================" else exit fi
device_registration_request=0 device_service_request=0 counter=1 max_wait=60 until [ $counter -gt $max_wait ] do ! test -f s_p_registration.txt device_registration_request=$? ! test -f s_p_service.txt device_service_request=$?
if [ $device_registration_request == 1 ];then status_string="Device registration request." request_device_registration if [ $? == 1 ];then LOG_ERROR "$status_string" exit 1 fi LOG_INFO "$status_string" break elif [ $device_service_request == 1 ];then status_string="Device service request received." request_device_service if [ $? == 1 ];then LOG_ERROR "$status_string" exit 1 fi LOG_INFO "$status_string" break else echo -ne "Waiting $1 seconds: $counter"'\r' fi ((counter++)) sleep 1 done
if [ $device_registration_request == 0 ];then if [ $device_service_request == 0 ];then LOG_ERROR "Exiting as there are no service provider requests to process." exit 1 fi fi
# Send privacy-CA information to device echo"privacy_ca_location: $pca_location" > s_d_service.txt cp s_d_service.txt $device_location rm -f s_d_service.txt
identity_challenge_status_string="Aborting service request - AIK not found." test -f d_s_service_aik.pub if [ $? == 1 ];then LOG_ERROR "$identity_challenge_status_string" return 1 else cp d_s_service_aik.pub $pca_location/s_p_service_aik.pub fi
software_status_string="Verification of PCR from quote against golden reference" testpcr=`tpm2_print -t TPMS_ATTEST attestation_quote.dat | \ grep pcrDigest | awk '{print $2}'` rm -f attestation_quote.dat if [ "$testpcr" == "$GOLDEN_PCR" ];then LOG_INFO "$software_status_string" else LOG_ERROR "$software_status_string" echo -e " \e[97mDevice-PCR: $testpcr\e[0m" echo -e " \e[97mGolden-PCR: $GOLDEN_PCR\e[0m" return 1 fi
return 0 }
request_device_service() { # Start device service registration with device identity challenge request_device_service_status_string="Anonymous identity validation by Privacy-CA." device_node_identity_challenge if [ $? == 1 ];then LOG_ERROR "$request_device_service_status_string" rm -f d_s_service_aik.pub return 1 fi LOG_INFO "$request_device_service_status_string"
# Check the device software state by getting a device quote request_device_service_status_string="Device system software validation." system_software_state_validation if [ $? == 1 ];then LOG_ERROR "$request_device_service_status_string" rm -f d_s_service_aik.pub return 1 fi LOG_INFO "$request_device_service_status_string"
# Encrypt service data content and deliver echo"$SERVICE_CONTENT" > service-content.plain openssl rsautl -encrypt -inkey d_s_service_aik.pub -pubin \ -in service-content.plain -out s_d_service_content.encrypted
tput sc read -r -p "Demonstration purpose only, not for production. Continue? [y/N] " response tput rc tput el if [[ "$response" =~ ^([yY][eE][sS]|[yY])$ ]] then echo"===================== SERVICE-PROVIDER =====================" else exit fi
counter=1 max_wait=60 until [ $counter -gt $max_wait ] do ! test -f d_s_registration.txt device_registration_request=$? ! test -f d_s_service.txt device_service_request=$?
status_string="Device registration request." if [ $device_registration_request == 1 ];then device_registration if [ $? == 1 ];then LOG_ERROR "$status_string" exit 1 fi LOG_INFO "$status_string" break elif [ $device_service_request == 1 ];then status_string="Device service request." request_device_service if [ $? == 1 ];then LOG_ERROR "$status_string" exit 1 fi LOG_INFO "$status_string" break else echo -ne "Waiting $1 seconds: $counter"'\r' fi ((counter++)) sleep 1 done
if [ $device_registration_request == 0 ];then if [ $device_service_request == 0 ];then LOG_ERROR "Exiting as there are no device requests to process" exit 1 fi fi
