Keylime Software

Keylime is an open-source software architecture focused on enhancing the security and privacy of Edge/Cloud and Internet of Things (IoT) devices. The project originated from the security research team at MIT's Lincoln Laboratory. Charles Munson and Nabil Schear are credited with creating Keylime during their time in the laboratory's Secure Resilient Systems and Technology Group. The software was accepted as a sandbox project by the Cloud Native Computing Foundation (CNCF) on September 22, 2020.

The core business of Keylime is to provide a scalable solution for remote boot attestation and runtime integrity measurement, allowing users to monitor remote nodes using a hardware-based cryptographic root of trust. It is designed to make Trusted Platform Module (TPM) technology more accessible to developers and users without requiring deep technical knowledge of TPM operations. The architecture consists of three primary components: the Agent, which runs on the machine to be attested; the Registrar, which manages agent registration and TPM public keys; and the Verifier, which continuously checks the integrity of the agent's machine. The system can be managed via a command-line interface, a web front end, and RESTful APIs.

Keylime's services are suited for tenants who need to remotely attest machines not under their full control, such as consumers of hybrid cloud services or those managing remote IoT devices in physically insecure locations. The software is open-source, encouraging community contributions, and supports both TPM 1.2 and 2.0 specifications. Its features include remote boot attestation, runtime integrity monitoring using Linux Integrity Measurement Architecture (IMA), secure payload provisioning for bootstrapping applications with secrets like cryptographic keys or passwords, and a revocation framework to react when a node fails an integrity check. This allows Keylime to dynamically isolate a node if unauthorized software is detected. The official agent is now written in Rust for its performance and security features.

Keywords: open-source security, TPM, remote attestation, cloud security, IoT security, edge computing, integrity measurement, key bootstrapping, CNCF, MIT Lincoln Laboratory, trusted computing, runtime integrity, secure boot, cryptographic trust, network security, secure payload, device attestation, hardware security, Linux IMA, zero-trust architecture