Trusted Computing 可信计算
- Trusted Computing
Trusted Computing
basic
“等保2.0”。
- 等保2.0时代保护策略要变被动防御为主动防御，变层面防御为立体防御。
- 中国工程院院士沈昌祥在以《重启可信革命——主动免疫可信计算3.0》为主题的演讲中指出：“当前我国的信息安全的防护工作是比较传统的，也就是说称为老三样：
防火墙、杀病毒、入侵监测，这样是解决不了安全问题的。 - 引入可信计算:
- 可信可用，方能安全交互；
- 主动免疫方能有效保护；
- 自主创新方能安全可控
可信在不同的机构下的定义是不同的。
- 可信计算工作组TCG(Trusted Computing Group)对可信的定义可以描述为：对于一个特定的目标，实体的行为总是与预期的相符，则针对这个目标，该实体就是可信的。
- 电气电子工程师学会IEEE(Institute of Electrical and Electronics Engineers)对可信的定义则是：一个计算机系统称为可信的是指其提供服务的可信赖性是能够进行论证的。
- 国际标准化组织ISO/国际电工委员会IEC则如下定义可信：参与计算过程的各个部件、处理过程及操作都是可预测的，并可以阻止病毒和一定程度的物理影响。
一个实体可信就是指其行为、能力需要符合预期并可验证其符合预期。
发展
历史
- J. P. Anderson于1972年针对计算机的安全功能的设计，提出了一个较为具体的想法，建立可信系统 (Trusted System) ，这算是计算机诞生以后，人们首次具体思考、规划与设计计算机的安全功能的开始。
- 1987年，第一个具有破坏性质电脑病毒C-BRAIN诞生了，业界都公认这是真正具备完整特征的电脑病毒始祖。而这个时期的计算机安全和我们现在理解得定义有着很大的出入。早期科学家们对可信赖计算机研究的内容主要集中在操作系统的安全机制、支撑它的硬设备和系统评估，这一时期的可信赖计算机被命名为：Dependable Computing，其与容错计算 Fault 研究领域有密切的关系。人们将关注点放在了组件随机故障、生产过程缺陷、定时或数值的不一致、随机外界干扰、环境压力等物理故障、设计错误、交互错误等人为故障造成的同系统失效状况，并设计出许多集成了故障检测技术、冗余备份系统的高可用性容错计算机。这一阶段研发出的许多容错技术已被用于目前普通计算机的设计与生产。
TCPA
- “可信计算”的概念开始在世界范围内被广泛接受已经是1999年了。
- 由Intel、IBM、HP、Compaq (已被HP并购)及Microsoft发起组织了一个
可信赖计算平台联盟(Trusted Computing Platform Alliance, TCPA)，该联盟致力于促成新一代具有安全且可信赖的硬件运算平台。- 随着可信计算的诞生到初步得到广泛认可，国际上成立了首个可信计算相关的联盟：
- TCPA 就是TCG的前身，该组织于2001年提出了可信平台模块TPM1.1技术标准。
- TPM1.1推出后，一些以IT技术为主导的国际厂商相继推出了有关可信计算的产品，得到产品界及用户的普通认可，而TCPA的成员也迅速增加，到了2003年已经达到了200家之多，几乎所有国际主流的IT厂商都已加入该联盟。
TCG与可信计算
- 随后TCPA更名为TCG，并逐步完善了TPM1.2技术规范，把可信计算的触角延伸到了所有IT相关领域。
- 2003年4月8日TCPA扩展其宗旨与目标，重新组成现在的可信计算组织(Trusted Computing Group, TCG)。
TCG原來TCPA强调建构安全硬件平台的初始宗旨上更进一步，将焦点投注到软件安全性的问题，目的是希望从
操作环境的硬件组件和软件接口两方面制定可信计算相关标准与规范。- 可信平台模块(Trusted Platform Module .TPM) 作为可信计算得核心，是指在计算机系统中嵌入一个可抵制篡改的独立计算引擎，使非法用户无法对其内部数据进行更改，从而确保了身份认证和数据加密的安全性。
- 它并不像安全软件那样只能被动地抵抗病毒和黑客，而是在检测到系统数据被非法篡改后即自动恢复，以保证平台的完整性。
- 这种办法从本质上提高了电脑自身的免疫力，弥补了电脑的先天不足，做到主动预防多种病毒的攻击。
- 2003年10月TCG发布了“可信计算平台规范”1.2版，
匹配TPM 1.2版标准的可信平台模块的组件
- 随着ICT技术的快速发展，TCG于2008年在TCG TPM WG成功开发TPM 2.0第一版标准库，之后于2011年7月和2012年2月先后两次提供草案和修订后的新版本草案给SC27专家征求意见和建议，并于2012年10月公开征求意见，2013年3月正式公开发布TPM2.0标准库，从此TPM进入2.0时代。
信任是安全的基础
- 可信赖计算的本意是确保
计算过程不再受入侵威胁、计算结果安全可信：- 网络通过每一个主体的身份认证来确定一个主体及其所表明的身份是否一致；
- 主体需要对其所关注的事件或信息内容的“真”、“假”程度进行判断，以确定这些信息是否可信，而做出这个判断的就是关注该信息内容的主体；
- 从而确认每个主体之间行为的可信，主体之间是否是友善的行为。
- “可信平台模块”为我们提供了网络安全最基本的需求，实现了计算机安全概念的突破。
- 持续性度量
- Trusted Computing首先解决的是可信的度量问题。前提安全评估
- 任何将要获得控制权的主体，都需要先接受可信度的评估。
- 例如：从客户端加电直到运行环境的建立，度量过程都一直在进行，包括系统中的每一个硬件、操作系统以及应用软件都是可信的，遭受到病毒、木马威胁的计算机自动修复，达到接入等级。
- 数据安全
- 用户的密钥及身份证书在可信计算平台中是的唯一的身份标识的数据
- TPM可以将这样的敏感数据存储在芯片内部的屏蔽区域，并将将用户的个人数据与芯片内封装的密钥绑定在一起。
- 即便是数据被窃取，但由于数据已经与TPM平台绑定，而平台的信息已经发生了变化，因此其它用户也无法获取数据的内容。
- TPM平台真正做到就是实现了身份认证、授权访问控制和安全责任审计的“每客户”模式。
- 打破区域限制
- 可信计算所构建的网络信任系统是“无区域”网络。
- “深度防御（Defense in depth）”的概念是指用多个安全层次保护重要资产。
- 例如重要的文件存放的带锁的房间里的带锁的文件柜中，而这个房间又在整个带锁的大楼里，大楼里还有警卫……。
- 深度防御运用于网络已经很多年了，为保护重要的数据我们不得不将网络不平等的划分出信任等级，把相同等级的主体划分到一个区域里面，把数据一层一层的包裹的严严实实。
- 但是，利用TPM管理的资源（包括密钥、加密存储的敏感数据），所有的访问必须通过TPM的授权协议来完成的，只有通过合法授权才能访问资源，最大限度的保护了敏感数据。
- 如果每个系统都是可信的，每个行为都是授权的，而每个访问都是可控的，这些区域还有存在的价值吗？
关键技术
目前可信计算主要的研究思路是：
Trusted Platform Module (TPMs) 安全芯片
- 国际上，TCG的解决方案是引入
TPM硬件安全芯片，以此为起点构建可信计算整个体系结构。 - 美国微软公司则利用其
微内核机制建立可信的执行环境，为其世界闻名的Windows系统提供平台安全和隐私保护的支持。这就是微软的NGSCB可信计算研究计划。 中国创新性的提出TCM技术方案，使用自主研发的安全芯片，构建可信计算密码支撑平台，做到了自主密码为基础，控制芯片为支柱，双融主板为平台，可信软件为核心，可信连接为纽带，策略管控成体系，安全可信保应用。
- dedicated processors that use cryptographic keys to perform a variety of tasks.
- Example, they can be used to authenticate devices.
TPMs can also be used to facilitate FDE.
- **Trusted Software Stack (TSS)**: the TCG companion specification defining the software API layer that allows applications to communicate with the TPM through a standardized interface. TPM and TSS together provide a new level of security that can be applied to existing applications and new developments to create inherent trusted computing environments.
- TPM 1.2 cryptographic algorithms: **RSA** (up to 2048-bit modulus), **SHA-1** (20-byte digest), and **HMAC** (hash-based message authentication code). All TPM 1.2 implementations must support RSA up to 2048-bit; certain keys require at least a 2048-bit modulus. TPM 2.0 adds algorithm agility — SHA-256 and ECC — but TPM 1.2 is exclusively SHA-1/RSA/HMAC.
- Usually a TPM will be on the motherboard of the computer.
- a hardware chip on the computer’s motherboard
stores cryptographic keys used for encryption.
- Many laptop computers include a TPM, but if the system doesn’t include a TPM, it is not feasible to add one.
- Once enabled, the TPM provides full disk encryption capabilities. It keeps hard drives locked, or sealed, until the system completes a system verification and authentication process.
TCG所推出的规范大部分针对于硬件设施，作为全球最主要的操作系统供应商，微软力求在操作系统层面上有明显的突破。新版的Vista就是要挽回Windows是“不太可靠的操作系统”的坏名声，将可信计算技术融入到Windows操作系统当中，其TMP架构包括：
- 数据安全模块：协助保护顾客资料安全的功能，
- 包括：密钥管理、文件印章与签名、资料保护与加（解）密技术应用、用户认证与服务验证‘
- 系统管理模块：协助系统管理员管理控制TPM模块功能，
- 例如：通过WMI实现远程管理、组策略（Group Policy）、容易部署和撤销技术 （Easy Deployment and Decommissioning）；
- 终端用户系统安全可信：在Vista操作系统中，以TPM模块技术为基础的新功能，
- 例如：安全的系统启动开机程序机制，以TPM模块技术为基础的安全密钥储存和提供机制等。
verification process
A TPM supports secure boot and attestation processes.
- secure boot
- When the TPM is configured, it captures
signatures of key files used to boot the computerandstores a report of the signaturessecurely within the TPM. - When the system boots, the secure boot process checks the files against the stored signatures to ensure they haven’t changed.
- If it detects that the files have been modified, such as from malware, it blocks the boot process to protect the data on the drive.
- When the TPM is configured, it captures
- Remote attestation:
- a TPM’s capability to check a computer system’s integrity against a remote trusted third-party service.
- A remote attestation process
- works like the secure boot process.
- However, instead of
checking the boot filesagainst thereport stored in the TPM, it uses a separate system. - when the TPM is configured, it
captures the signatures of key files, butsends this report to a remote system. - When the system boots, it checks the files and
sends a current report to the remote system. - The remote system verifies the files are the same and attests, or confirms, that the system is safe.
The TPM ships with a unique Rivest, Shamir, Adleman (RSA) private key burned into it, asymmetric encryption.
- This private key is matched with a public key, provides a hardware root of trust / a known secure starting point.
- The private key remains private and is matched with a public key.
- Additionally, the TPM can generate, store, and protect other keys used for encrypting and decrypting disks.
If the system includes a TPM, you use app within the OS to enable it.
- Example
- BitLocker
- many Microsoft systems include BitLocker, which you can enable for systems that include the TPM.
- BitLocker uses the TPM to detect tampering of any critical operating system files or processes as part of a platform verification process.
- Additionally, users provide authentication: smart card, a password, or a personal identification number (PIN).
- The drive remains locked until the platform verification and user authentication processes are complete.
- BitLocker
If a thief steals the system, the drive remains locked and protected.
- no authentication credentials, can’t access the drive using a normal boot process.
- If the attacker tries to modify the operating system to bypass security controls, the TPM detects the tampering and keeps the drive locked.
- If a thief moves the drive to another system, the drive remains locked because the TPM isn’t available.
Security Starts With Measurement 安全始于度量
Gathering evidence is the only way to prove that a computer system has not been changed or modified. A **baseline measurement** refers to what specific devices comprise the computer system at initial setup — hardware, firmware, boot components. All configuration data is encrypted; the encrypted data and key are stored separately so only a registered platform can recover them. Trusted computing compares the baseline measurement against the measurement taken every time the computer is powered on: the decision of trust is an evaluation of that evidence. Concerns addressed by this measurement approach:- Whether a trusted system booted the computer
- Whether the system is still running as expected
- Whether the running system is approved for the application
- Whether the system has access to trusted network services
In the 2007 E-Crime Watch Survey conducted by the U.S. Secret Service, Carnegie Mellon University’s CERT program, and Microsoft Corp., four types of risks were studied (compromise of information, technical failures, unauthorized actions, compromise of functions). Systems with a TPM installed showed **33–67% risk reduction** across most categories. The TPM was most effective on "Compromise of information" and "Unauthorized actions" — risks especially applicable to regulated environments where data integrity violations can trigger compliance shutdowns.
TPM vs. Smart Card 与智能卡比较
TPM and smart card share several design goals:- implement secure processing in secure hardware.
- both are low-cost, tamper-resistant, small-footprint devices providing a foundation for secure computing.
- Smart card
:
- a portable token associated with a specific user across multiple systems.
- provide a wide range of functionality from simple storage media to complex processors.
- TPM
:
- a fixed token bound to a specific platform, cannot be moved between machines.
- a small footprint low cost security module typically implemented as a tamper resistant integrated circuit (IC).
- specifically designed to be a building block for trusted computing.
The two are not mutually exclusive — they are complementary. A smart card can authenticate the user to the platform while the TPM attests the platform’s integrity to a remote service.
Trusted vs. Trustworthy 可信与可靠的区别
| Term | Definition |
|---|---|
| Trusted system/component (TPM) | One whose failure can break the security policy |
| Trustworthy system/component | One that won’t fail |
Fundamental Features 基本特性
A TPM provides three fundamental features:1. Protected Capabilities 受保护的能力
The TPM executes in an isolated environment separated from the host OS and applications. Operations such as key generation, signing, and integrity measurement cannot be observed or tampered with from the main CPU context.2. Integrity Measurement 完整性度量
The TPM records cryptographic hash measurements of the platform’s boot sequence and software state into **Platform Configuration Registers (PCRs)**. PCR values can only be extended (hash-chained), never overwritten, creating a tamper-evident log of every component that loaded during boot. Two approaches to integrity measurement during boot:- **SRTM (Static Root of Trust for Measurement)**: measures the full boot chain from BIOS through bootloader to kernel before handing control to each subsequent component. The measurement sequence is: BIOS → bootloader → kernel. This is the traditional approach; the CRTM in the BIOS boot block starts the chain at power-on.
- **DRTM (Dynamic Root of Trust for Measurement)**: re-establishes a root of trust dynamically at runtime without requiring a full reboot. Implemented via processor-level support (Intel TXT / AMD SVM). Allows re-measurement of the running environment at any time, not just at boot, enabling late-launch attestation of specific workloads.
3. Integrity Reporting 完整性报告
Using **remote attestation**, the TPM signs a report of PCR values with an Attestation Identity Key (AIK) and presents it to a remote verifier. This allows a third party to confirm the platform’s integrity state without physical access.Additional features 附加特性
- Confidentiality and integrity protection
: wraps sensitive data so it can only be decrypted on the same platform
- Secure storage
: non-volatile storage protected inside the TPM boundary
- Process isolation
: TPM execution engine operates independently of the host OS
- Monotonic counters
: increment-only counters that cannot be rolled back; provide a secure mechanism to prevent replay attacks — once a counter is incremented, prior counter values are invalid
- Time-stamping
: the TPM can measure time intervals (note: no absolute time is possible, only relative time measurement) for sequencing events and detecting stale messages
- Audit trails
: the TPM provides mechanisms to create and manage audit trails of commands and operations, supporting accountability and forensic review
TPM Architecture and Components 架构与组件
7.3.1 Core components
| Component | Role |
|---|---|
| I/O Block | Communication gateway between the TPM and the host platform (LPC bus); enforces access rules on incoming commands |
| Non-Volatile Storage | Stores the EK, SRK, owner authorization data, and a small region of owner-defined data; persists across power cycles |
| Platform Configuration Registers (PCRs) | 24 hash registers recording measured boot state; extend-only, cannot be reset except on platform reboot |
| Attestation Identity Keys (AIKs) | Pseudonymous signing keys used for remote attestation without exposing the EK |
| SHA-1 / RSA Engine | Hardware cryptographic co-processors for hashing and asymmetric operations |
| Key Generator + RNG | Hardware random number generator seeding key creation |
| Execution Engine | Runs the TPM command interpreter in an isolated execution context |
| Programme Code | Firmware stored permanently on the tamper-resistant TPM; the obvious “root of trust” for integrity measurements — no external integrity check required because it resides in tamper-resistant storage. The TCG refers to this trusted firmware as the CRTM (Core Root of Trust for Measurement); in practice the CRTM may reside in the BIOS boot block rather than inside the TPM itself |
7.3.2 I/O Block
The I/O block is the sole communication path between the TPM and the host. It validates command structure before forwarding to the execution engine and enforces opt-in controls — the TPM is **off by default** and must be explicitly enabled by the platform owner (typically via BIOS/UEFI firmware).7.3.3 Non-Volatile Storage
Non-volatile storage holds the most sensitive long-term secrets. The EK is generated at manufacture and never exported. The SRK is generated when the owner takes ownership. Both are inaccessible in plaintext outside the TPM boundary across all power cycles.7.4.1 Roots of Trust 信任根
The TCG trusted platform architecture defines three distinct roots of trust:| Root of Trust | Role |
|---|---|
| RTM — Root of Trust for Measurement | Must be trusted to generate integrity measurements for processes running on the platform. Must boot very early so it can measure all later-loaded components. In practice, the CRTM is usually located in the BIOS boot block. |
| RTS — Root of Trust for Storage | Provides confidentiality and integrity protection. Trusted to store PCR values and keys (SRK) that allow data to be securely stored externally. Provided by the TPM. |
| RTR — Root of Trust for Reporting | Trusted to provide reports of integrity measurements and attest to the platform configuration. Also provided by the TPM. |
Boot process with measurement agents 带度量代理的启动流程
When booting a system containing a TPM, each stage measures the next before handing control to it, storing measurements in the **Stored Measurement Log (SML)** and extending them into TPM PCRs:1
2
3
4
5
6
7
8
9
10
11
12
13
14
1. BIOS Boot Block (CRTM) powers on
→ measures its own integrity + entire BIOS
→ stores details in SML, extends PCR
2. CRTM passes control to BIOS
→ BIOS contains a Measurement Agent (MA)
→ MA measures option ROMs, stores in SML + PCR
3. BIOS passes control to option ROMs (normal operations)
→ control returned to BIOS
4. BIOS measures OS Loader
→ stores details in SML, extends PCR
5. Control passed to OS Loader (contains MA)
→ OS Loader measures OS kernel
→ stores details in SML + PCR
6. Control passed to OS
1
PCR ← hash(PCR ∥ hash(newcode))
Key Hierarchy 密钥层次结构
Endorsement Key (EK) 背书密钥
- Generated at manufacture and burned into the TPM chip.
- The EK private key **never leaves the TPM**. The EK public key is embedded in a certificate issued by the TPM manufacturer, establishing the chip’s hardware identity.
- The EK is used during ownership transfer and during AIK credential issuance, but is not used directly for signing platform attestations (to preserve anonymity).
- Privacy rationale: because the EK is unique to each TPM, direct use of the EK would allow every transaction to be linked back to the same physical device, potentially identifying the user. To protect privacy, the EK is restricted to two specific uses: (1) encrypting data sent to the TPM during **taking ownership**, and (2) encrypting data sent during **AIK certificate creation**.
- **TPME (TPM Manufacturer’s Entity)**: the endorsement credential (certificate containing the public EK) should be signed by a TPME — a certification authority who attests that the public EK corresponds to a private EK stored in a genuine TCG-conformant TPM. The TPME may be a third party or, if authorized, the manufacturer themselves. If a user-generated endorsement credential is not signed by a TPME, its use may be limited. The endorsement credential proves that the corresponding private EK is stored in a genuine TPM.
Storage Root Key (SRK) 存储根密钥
- Generated when a user takes ownership of the TPM.
- The SRK is the root of the TPM’s key hierarchy. All other keys are **wrapped** (encrypted) under the SRK, ensuring they can only be used on this specific TPM. Resetting ownership generates a new SRK, permanently invalidating all previously wrapped keys.
Attestation Identity Keys (AIKs) 身份证明密钥
- Pseudonymous signing keys created by the TPM owner to represent the platform without exposing the EK.
- An AIK signs PCR quotes for remote attestation. Because AIKs are pseudonymous, the relying party verifies the platform is genuine (certified by a Privacy CA or via DAA) without being able to link multiple attestations to the same EK, preserving user privacy.
- **Volatile storage mechanics**: EK and SRK are stored in non-volatile memory and never leave secure storage during normal operation. AIKs, however, require a **volatile storage area** on the TPM where one or more AIK keys can be loaded when in use. AIK keys must be **persistent** — they should be kept in secure external storage and loaded into the TPM's volatile area when needed. This means AIKs survive power cycles by being stored externally and reloaded each boot.
- **Multi-AIK unlinkability**: each TPM can support many AIKs. The user can maintain many unlinkable pseudonymous keys — one per service provider — so that different service providers cannot correlate attestations with each other or link them back to the same physical platform. Provided the Privacy CA is trustworthy, these AIK keys will remain unlinkable.
Opt-In Component and Ownership 选择性启用与所有权
The Opt-In component and the concept of ownership represent one of the biggest differences between smart cards and the TPM. Smart cards are generally owned and customized by the issuer before the consumer receives them. The TCG, however, ensures that it is the **user** who takes ownership and configures the TPM. The TCG policy: the TPM should be shipped "in the state that the customer desires" — users are not compelled to use trusted computing; they opt-in only if they choose to by taking ownership of the device.TPM Operational States 运行状态
The TPM state is governed by three independent flag pairs. Changing any flag requires authorization by the TPM owner (if one exists) or demonstration of physical presence — no remote entity other than the TPM owner can change TPM state.| State Variable | States | Notes |
|---|---|---|
| Enable/Disable | Disabled: restricts all operations except capability reporting and PCR updates. Enabled: all features available if ownership is established | Transition from disabled to enabled requires physical presence if no owner exists |
| Activate/Deactivate | Deactivated: similar to disabled, but the TPM may still switch between operational states. Activated: all features available | Allows state transitions (e.g., change owner, activate) while still limiting normal use |
| Owned/Unowned | Unowned: no owner authorization data established. Owned: owner has established shared secret; can perform all operations including state changes | TPM must have an owner and be enabled for all functions to be available |
Taking Ownership 取得所有权
Taking ownership establishes a shared secret (owner authorization data — the owner's password) and inserts it into secure storage on the TPM. The process is protected against eavesdropping by a malicious third party using the EK: 1. The owner requests the endorsement credential and verifies it 2. The owner retrieves the public EK from the credential 3. The owner encrypts the shared secret (authorization data) under the public EK 4. Only the specific TPM identified in the endorsement credential has access to the private EK — so only that TPM can decrypt and receive the shared secret 5. Taking ownership is completed by the creation of the **Storage Root Key (SRK)**, which forms the root of the key hierarchy; the SRK never leaves the TPM Once owned, the TPM requires proof of ownership (entering owner authorization data) to control access to certain protected operations.Sealing and Unsealing 数据封印与解封
The TPM provides two mechanisms for secure storage: **Binding** and **Sealing**. They differ in what condition governs decryption.Binding 绑定
Binding encrypts data using a key that is managed by a particular TPM. The only requirement for decryption is that the operation runs on the **same TPM** that encrypted the data (via the SRK or a storage key wrapped by the SRK). Binding does **not** require any specific PCR state — it simply ties data to a specific TPM identity. This is the simpler mechanism: move the data to a different platform and it cannot be decrypted.Sealing 封印
Sealing binds encrypted data to a specific PCR state on a specific TPM. When data is **sealed**, the TPM encrypts it under the SRK and records the current PCR values as the authorized state. Data can only be **unsealed** (decrypted) if:- The operation runs on the same TPM (SRK is TPM-unique)
- The platform’s current PCR values match the values recorded at seal time
Sealing flow 封印流程:
1
2
3
4
5
6
7
Boot → BIOS measures itself → extends PCR[0]
→ bootloader measured → extends PCR[4]
→ OS kernel measured → extends PCR[8]
→ TPM seals data to {PCR[0], PCR[4], PCR[8]}
Unsealing attempt:
→ current PCRs must match sealed PCRs → data released
Enterprise Trust Policy 企业信任策略
Organizations deploying TPMs address three categories of unauthorized access risk:
| Risk Category | Description |
|---|---|
| Unauthorized service | External attackers or rogue cloud services accessing enterprise data — TPM attestation verifies platform genuineness before granting access |
| Unauthorized process | Malicious software on an otherwise legitimate device — PCR-based integrity measurement detects unauthorized OS or application modifications |
| Unauthorized devices | Personally owned devices connecting to corporate networks — device attestation via TPM proves hardware identity before network admission |
COPE Policy 企业自有个人使用策略
**Corporate Owned, Personally Enabled (COPE)** allows employees to use corporate-issued devices for personal tasks. The TPM enables this model by maintaining a hardware-rooted trust anchor the corporation controls (via EK certificate) while permitting user-level customization within policy boundaries. COPE combined with TPM attestation allows IT to verify platform integrity at every network access point. Case study — Fitbit counterfeit device incident (2016–2017): Fitbit illustrates the "unauthorized devices" risk in COPE environments. In 2016 and 2017, Fitbit faced widespread customer complaints about counterfeit devices. In 2017, a large counterfeiting operation was dismantled and over **50,000 fake Fitbit devices** were seized — all capable of connecting to Fitbit's service servers by spoofing the authentication protocol and acting as authorized devices. Fitbit subsequently published firmware updates and enhanced encryption on data transfer. The incident illustrates how, without hardware-rooted device identity (as provided by TPM's EK certificate), a remote server has no reliable mechanism to distinguish genuine devices from counterfeits. TPM remote attestation would allow the server to verify the device's hardware identity before granting service access.TPM 2.0 and International Standards
TPM 2.0 is defined by ISO/IEC 11889 (published 2015), making it an internationally recognized standard. Key improvements over TPM 1.2:
- Algorithm agility: supports SHA-256 and ECC in addition to SHA-1/RSA
- Enhanced hierarchy model: Endorsement, Platform, and Storage hierarchies independently administered
- Improved dictionary attack protection
Additional Vulnerabilities 附加漏洞
Two lifecycle issues organizations must address:End-of-life systems 生命周期终止系统
- When hardware or software reaches end of life, ensure no valuable data remains on the platform before decommissioning.
- TPM-sealed data requires explicit unsealing and secure deletion — discarding the device makes SRK-protected keys permanently inaccessible but may leave unsealed data exposed if the storage drive is removed separately.
Lack of vendor support 缺乏供应商支持
- When a vendor stops supporting an OS or application, new vulnerabilities go unpatched.
- Example:
- Windows XP reached end of support on April 8, 2014.
- Vulnerabilities discovered after that date remain permanently unpatched.
- TPM-backed attestation cannot compensate for an unpatched OS — an attacker with sufficient OS-level privilege can manipulate measurements before they reach the TPM if the compromise occurs after the measured boot completes.</font>
LPC bus attack LPC总线攻击
- Physical attack vector: passive sniffing and active manipulation of LPC bus signals.
- While the TPM chip itself is designed to be tamper-resistant, its communication channel to the rest of the platform is comparatively insecure.
- TPMs in PCs are connected to the host platform via the LPC (Low Pin Count) bus.
- This bus provides no protection mechanisms and is easy to access with simple, inexpensive equipment.</font>
Passive attacks: signals on the LPC bus can be captured with fairly inexpensive equipment to observe the communication between the TPM and the host, potentially recovering sensitive data transmitted in plaintext over the bus.
Active attacks: the LPC bus protocol can be actively manipulated with basic and inexpensive hardware to intercept and alter commands, inject falsified measurements, or substitute responses from the TPM. This can be used to circumvent the chain of trust — the attacker manipulates measurements before they reach the TPM, causing the TPM to record and attest a falsified platform state. This attack breaks the integrity of both static (SRTM) and dynamic (DRTM) roots of trust.
- Mitigation: newer platforms use SPI or I2C bus connections with additional signal protection; software mitigations alone cannot fully address physical bus access.
BitLocker layered key model 分层密钥模型
BitLocker implements a layered key model that combines TPM-based integrity verification with user authentication:- BitLocker 不直接用你的 Windows 登录密码加密整个硬盘，而是用三层密钥把安全性和便利性分开。
终端平台可信技术
- 需要解决的核心问题是基于安全芯片的从系统引导、操作系统、应用程序到后续动态运行的整个链条的完整性度量。
- 完整性度量主要分为静态度量和动态度量两个方面。
- 在静态度量方面，主要有IBM研究院提出的IMA、PRIMA架构，
- 而动态度量最著名的是卡内基梅隆大学提出的BIND系统。
PRIMA架构
- IBM最早根据TCG提出以TPM为“根”，逐级度量启动过程中硬件、引导、操作系统及应用的思想而实现的IMA架构可以对系统启动的所有程序进行度量，
- 其最大的缺点是系统效率太低。为解决效率问题
- IBM又提出了PRIMA架构，其特点是将度量与信息流访问控制模型相结合，从而度量对象大幅度精简，达到了效率提高的目的。
二者的主要区别如下图所示：
BIND系统
为解决静态度量无法保证程序在运行过程中的可信问题，BIND系统被卡内基梅隆大学研制出来。其主要工作原理为：
扩展编程语言的度量语义
编程时添加这些度量标记
启动编译好的程序
BIND系统被激活
动态的执行对程序的完整性度量
根据度量结果决定程序的停止和运行
下图为BIND系统提供的编程接口：
从上图可以看出，BING系统提供的编程接口并不复杂。BIND系统实现了一定程度的动态度量，但它需要编程人员在编程时使用上述接口手动添加标记，这对编程人员提出了“特殊”的要求，比较难以落地。
vTPM
近年来，随着虚拟技术的发展和终端平台上虚拟应用的越来越普及，虚拟平台度量技术也得到不断的研究而逐渐成为热点。在虚拟度量技术方面有代表性的是LKIM系统、HIMA、HyperSentry和IBM提出的vTPM，后者应用相对比较广泛。
vTPM即虚拟的TPM，在物理的TPM的基础上，使用虚拟技术为每个虚拟机提供一个独立的TPM，从而解决了多个虚拟机共享TPM的资源冲突问题。其主要的架构如下图所示：
从上图可以看出，物理TPM的驱动存在于物理层中，同时利用vTPM管理器创建多个虚拟的TPM实例，这些实例与域U进行交互，使得虚拟机的可信成为可能。不过这种方案也有其缺点，最主要的问题就是vTPM和TPM之间缺乏有效的绑定。
平台间信任扩展技术
构建了终端平台的可信之后，需要将终端平台的可信扩展到远程平台，这里主要使用的方法便是远程证明。远程证明主要由平台身份证明和平台状态证明组成。
平台身份证明技术
远程平台身份证明技术主要有Privacy CA和DAA。
- Privacy CA
- 基于TPM1.1规范的
- 使用平台证书直接证明自己可信的身份。
- 这个方案最大的问题是无法隐匿平台。
- 基于CL签名的直接匿名证明协议DAA(Direct Anonymous Attestation)解决了平台隐匿问题，
- 但其解决方案中使用的签名长度太长，导致计算量大，效率并不高。
- 所以就有了各种改良的DAA。
- 由Brickel提出的基于椭圆曲线及双线性映射对的一种优化的DAA方案有效降低了原来DAA签名中的长度过长和计算量大问题，提高和通信和计算性能。
平台状态证明技术
平台状态证明技术的研究热点主要是基于属性的平台完整性状态证明协议，即PBA(Property-based Attestation)。
不过除此之外还有TCG提出的二进制直接远程证明方法、基于Java语言的语义证明、针对嵌入式设备提出的基于软件证明和我国研究人员提出的基于系统行为的证明协议。
TCG提出的二进制直接远程证明方法是将系统配置散列值直接传递给验证方验证，其缺点是会暴露平台配置，并且不易扩展。为此Liqun Chen等提出了一种具体的基于属性的证明协议，其原理是将系统配置传递给可信第三方TTP(Trusted Third Party)，由TTP得出其具有的属性，并发放相应的属性证书，从而在验证方需要验证平台可信性时，将属性证书发送给验证方以证明平台的可信性。
可信网络接入技术
随着人类进入21世纪，网络已经无处不在，据不完全统计，目前世界上联网的设备有数十亿之多，而联网设备的类型也由原来的PC机扩展到各种各样的嵌入式设备、移动终端和智能终端等等。在可信计算领域，可信网络的接入技术也有了很大的发展。
可信网络接入技术在国际上，有TCG组织提出的TNC规范，而国内与之对应的则是TCA方案。
TNC
- TNC是由TCG发布的可信网络连接规范
- 由2004 年5 月成立的可信网络连接分组 TNC-SG（TNC Sub Group）提出，
- 目的就是将终端平台的可信状态延续到网络中，使信任链从终端平台扩展到网络。
- 下表为TNC各个版本的发布时间及主要内容汇总：
TNC规范架构中主要包括３个逻辑实体、３层划分和相关接口组件组成．该架构的主要思路是将完整性评估层与完整性度量层添加到传统的网络接入层次之上，从而实现对接入的终端平台的身份和完整性验证。TNC基础架构图如下:
TNC基础架构
其中，访问请求者AR(Access Requestor)，策略执行点PEP(Policy Enforcement Point)和策略决策点PDP(Policy Decision Point)组成了3个逻辑实现。访问请求者是请求访问受保护网络的逻辑实体。策略执行点是执行PDP的访问授权决策的网络实体。策略决策点是根据特定的网络访问策略检查访问请求者的访问认证，决定是否授权访问的网络实体。
整个网络接入过程是：
AR发出访问请求，收集平台完整性可信信息，发送给PDP，申请建立网络连接；
PDP根据本地安全策略对AR的访问请求进行决策判定，判定依据包括AR的身份与AR的平台完整性状态，判定结果为允许或禁止或隔离；
PEP控制对被保护网络的访问，执行PDP的访问控制决策。
TCA
TNC方法首先进行的过程是用户认证，该过程除了对用户身份进行验证，还要为后续终端平台的凭证认证过程及终端平台完整性验证过程提供安全的通信通道。VPN和IEEE 802.1x是TNC采用来进行认证和建立通道，进而传输终端平台认证消息。AR并不直接验证访问控制器的身份和终端平台的完整性，这降低了TNC的安全性。
为了实现可信计算网络平台安全、可信赖的运行，针对TNC的不足，建立自主的可信网络连接体系，2007年4月，我国启动了自主可信网络连接标准的制定工作，由此诞生了TCA。TCA是我国以自主密码为基础、控制芯片为支柱、双融主板为平台、可信软件为核心、可信连接为纽带建立的可信计算体系不可或缺的一部分。对应的国家标准GB/T 29828―2013《信息安全技术 可信计算规范 可信连接架构》也于2013年11月12日正式发布。
TCA的工作原理
如上图所示，TCA的工作步骤简述如下：
应用及前景
目前，国际上主流的台式机、笔记本已经标配上了TPM安全芯片，国内支持TCM安全芯片的安全主机已经全面量产，多数的国内外移动终端也都有了安全芯片的支持。与可信计算相关的应用不断的被挖掘出来，前景一片大好。
信息安全
可信计算与信息安全密不可分。其中，TPM模块产生的密钥难于攻击，在用户身份验证方面起着至关重要的作用。可信计算的可信链条机制，从信任根开始，直到应用程序启动运行，可以防止病毒运行和恶意代码执行。可信计算运算和防御并行的双体系架构，在计算的同时进行安全防护，使计算结果总是与预期一致，整个过程可测可控，不被干扰，实现了主动免疫。网络接入方面，TCG提出的TNC架构及我国提出的TCA架构都保证了接入的安全性。这样从单个终端平台的可信、到远程平台协同的可信、再到整网可信，完成了整个系统的闭环。
云计算
可信计算技术能够用来支持分布式环境下的云计算，解决云计算的安全问题。
- 在需要多种身份实体认证机制的需求下，可信计算平台可以起到非常好的辅助作用
- 可信计算能够提供比用户名+口令更强的认证，可信计算包含的专用主密钥，对存储在云计算系统中的其他信息提供保护。
- TPM存储硬件证书使得基于可信计算技术进行客户设备以及其他设备的认证成为可能，这对确保云计算的安全非常关键。
云计算的特点之一就是会有大量有自己目标和行为的用户访问云服务
- 用户需要注册进入一个或几个角色，只所以使用角色是为了降低访问控制模型的复杂性。这些不同角色的用户应该来自可信计算平台，因为可信计算平台上的安全机制保证了用户自身的隐私和安全。
用户从基于 TPM 或 TCM 的可信计算平台来登录云计算系统，从而获取权威证书，当希望同远程其它实体进行通信时，其信息传送通过可信机制得到保护。
- 云计算系统中的数据是其核心价值提供的基础，这些重要数据可以使用TPM模块的密钥进行加密存储，这样针对这些数据的攻击就变得异常困难。除此之外，对外传输中的数据同样使用加密技术来确保传输过程的数据安全。可信计算提供的认证和完整性检验确保了数据不被修改。
Digital Right Management, DRM 数字版权管理
- DRM已经成为数字内容行业的基础设施，是实施数字版权保护的技术解决方案。
- DRM的主要作用是保证数字内容只能由购买者在指定的授权生命周期内合法使用，未购买或超出周期使用的行为都会被禁止。
- 现在的 DRM 客户端基本上都是在开放计算平台上部署，如：通用电脑和手机等移动终端，数字内容的使用过程需要由客户端的DRM应用程序参与，负责解密使用和相关权利包的解析验证。
- 由于 DRM 客户端安装在通用电脑和个人手机上，所以其运行环境是无法保证安全的，所以需使用额外的技术手段来确保DRM的可信。
可信计算技术的发展为上述问题的解决提供了很好的技术支撑。
- 在授权许可证分发和数字内容的使用这两个重点环节中已有学者使用了可信计算技术来进行保护，
- 同时可信计算参与到DRM的用户身份认证及密钥协商协议，完成DRM客户端的身份认证及完整性验证，有效保护了数字版权内容的分发。
区块链
- 可信计算保护数据隐私性的属性，使其变为区块链技术生态中的重要一环。可信计算相关技术目前多与分布式计算类项目、数据类项目以及 layer2 链下解决方案相结合。
- 目前，此类项目的关注重点多在于 PC 端 CPU，应用广泛。
This post is licensed under CC BY 4.0 by the author.
Comments powered by Disqus.