With the upcoming generational change from Windows 10 to Windows 11, the Trusted Platform Module as a security supporting component will be a requirement for every common PC. While the TPM has seen use with some applications already, its near future ubiquitous presence in all PCs motivates an updated review of TPM supporting software. This paper focuses on the software ecosystem that supports secure boot, a chain of measurements for integrity assessments, and challenges in remote attestation. A brief reflection on the state of the various projects gives a rough overview, but is not an exhaustive and in-depth survey. Still, this short paper contributes to the ongoing adoption and reflection of TPM v2’s features and opportunities.

A core security (or trustworthiness) question for all designs of networked applications persists: If distributed nodes connect, are these nodes trustworthy? Is it possible to assess a node’s software state before sharing data, programs and/or interacting with them? This paper revisits a scenario of assembling distributed, individual nodes for networked applications, such as data science compute nodes or bridge nodes connecting established applications to novel blockchain-related applications and their ecosystem. By taking advantage of special hardware support (Intel TXT), modern boot software that supports it (Trenchboot) and a custom attestation-before-joining protocol, we report on our prototype implementation how attestable nodes can be achieved today.

The application opportunities of distributed ledger technologies (DLT) for replicated, shared and synchronized data, across multiple nodes in a network, may create new possibilities in computing. There are notable differences between applications designed from scratch for being DLT-enabled and established IT applications that assume fundamentally a centralized computing architecture. This short paper reflects on the challenges in transforming established, conventional IT applications to be DLT-enabled. If such a transformation can be implemented successfully, repeatedly, and with acceptable effort, this means that today’s currently deployed IT applications may subsequently take advantage of beneficial properties of DLT. However, there are still a variety of aspects that need to be considered—this short paper contributes to that discussion.

The internet is a bottomless cesspool of malicious software that attacks users and their devices or servers that offer services---on a worldwide scale. A defence against this constant barrage of attacks is difficult. While knowledge of previous attacks helps to prevent some new attacks, a determined attacker will almost always succeed. This paper proposes an approach to detect novel attacks via a comparison of system behaviour. A combination of a system-wide events collection and subsequent data analysis fingerprints processes and their file access behaviour. A comparison of these fingerprints results in seven "sameness" categories for processes, sorted from completely identical behaviour to unique and therefore highly suspicious. This categorisation provides guidance for further detailed assessment, if required. Results and insights from a prototype implementation suggest that the presented approach is a strategy for the detection of novel attacks.

Modern smartphones with the capability to be always online and equipped with data transfer interfaces such as NFC allow to take advantage of a wide variety of services and pave the way for new classes of services. Naturally, not every service will be available for free, some providers will charge money for the services provided. Usually, users are uniquely identified by the provider of a service for billing purposes and providers therefore maintain user profiles. This allows to personalize services with respect to user's interests and preferences. However, it is problematic regarding user's privacy since users disclose lots of sensitive information to the service provider. Different mobile payment solutions have been proposed to date, but privacy aspects are usually not considered at all. In this paper, we demonstrate how privacy friendly payment can be realized using a recent payment mechanisms in combination with an ARM processor platform with TrustZone enhancements. We discuss the public transport ticket domain as an example. Then we propose a platform framework that can be used for arbitrary applications requiring a privacy preserving online remote prepaid payment system suitable for micro as well as macro payments.