Aegis: A Framework to Detect Compromised Components in the Supply Chain of Information Technology Infrastructure

The supply chain security of the Information Technology (IT) infrastructure is critical to the overall integrity of data centers and the cloud. There are many vulnerable points within the supply chain that could be exploited to compromise hardware, firmware, and software of IT infrastructure components. These vulnerable points include transportation, warehouse, partners, resellers, and pre-deployment. Some of the exploitations include replacing components with counterfeit components, replacing the firmware with malicious code using chip clips, and modifying the product configuration to bypass security features. In this paper, we present a novel approach, Aegis, to detect compromised or counterfeited components of products using cryptographic techniques. The Aegis framework is a two-fold solution. The first part of the framework is the generation of a “product birth certificate” during the manufacturing process. The product birth certificate contains the product's Trusted Platform Module (TPM) Endorsement Key (EK) and product component details. The second part of the framework, which is used at the end user's site, includes a mechanism to validate the state of the product using the product birth certificate and the information retrieved directly from each of the components. Through extensive testing, we determined that the Aegis framework is viable and is able to successfully detect any compromised, counterfeited, and tampered components.