Overview Introduction Application · TPM Internals TCG Service Provider Interface (TSPI) TCG Service Provider(TSP) I/O、 Execution Engine、RNG、 TSS Core Service Interface (TCSI) TPM Device Driver(TDD TSS Core Services(TCS) ICG Device Driver library (TDdl) e no ore w em ou TCG Core Services(tCs) TPM Device Driver TCG Service Provider(tsp) Trusted Platform Module(TPM) TCG Software Stack 6
6 • Introduction • TPM Internals – I/O、Execution Engine、RNG、…… • TPM Device Driver (TDD) • TCG Device Driver Library (TDDL) • TCG Core Services (TCS) • TCG Service Provider (TSP) TCG Software Stack Overview
TPMInternals ·IO 管理流经通信总线的信号流 典型的LPC总线( Low Pin Count bus · Execution Engine 命令的校验及解析 命令码的执行 控制内部执行流 微控制器 TPM RSA Engine RNG I/O(LPC Bus) Non-volatile storage (special keys, owner secret, .. RSAkey-generator Volatile storage SHAl Engine Opt-in I Execution Engine keyslots, PCR registers, .. TCG Software Stack
7 TPM Internals • I/O – 管理流经通信总线的信号流 – 典型的 LPC总线 (Low PinCount Bus) • Execution Engine – 命令的校验及解析 – 命令码的执行 – 控制内部执行流 – 微控制器 TCG Software Stack RSA Engine RSA key-generator SHA1 Engine RNG Opt-in I/O(LPC Bus) Execution Engine Non-volatile storage (special keys, owner secret, …) Volatile storage (keyslots, PCR registers, …) TPM
TPMInternals SHA-1 Engine(160 bits) 主要被TPM使用,作为其可信的哈希算法 在平台启动过程中,其接口暴露在TPM外以进行度量工作 未来的TPM版本会加入更多的哈希算法 RNG TPM内部的随机源 N once ,密钥的生成, TPM RSA Engine RNG I/O(LPC Bus) Non-volatile storage (special keys, owner secret, .. RSAkey-generator Volatile storage I SHAl Engine Opt-in Execution engine keyslots, PCR registers, .. TCG Software Stack 8
8 • SHA-1 Engine (160 bits) – 主要被TPM使用，作为其可信的哈希算法 – 在平台启动过程中，其接口暴露在TPM外以进行度量工作 – 未来的TPM版本会加入更多的哈希算法 • RNG – TPM内部的随机源 – Nonce , 密钥的生成, ... TCG Software Stack RSA Engine RSA key-generator SHA1 Engine RNG Opt-in I/O(LPC Bus) Execution Engine Non-volatile storage (special keys, owner secret, …) Volatile storage (keyslots, PCR registers, …) TPM TPM Internals
TPMInternals RSA Engine and Key generator 非对称密钥的生成(RSA;存储SK及AIK密钥大 >=2048) 必须支持512,1024,2048bt的密钥 建议使用2048位的密钥 RSA密钥生成遵循PKCS#标准 RSA密钥在使用的时候要加载到TPM内部 TPM I RSA Engine RNG I/O(LPC Bus) Non-volatile storage (special keys, owner secret, .. RSAkey-generator Volatile storage SHAl Engine Opt-in Execution engine keyslots, PCR registers, .. TCG Software Stack 9
9 • RSA Engine and Key Generator – 非对称密钥的生成 (RSA；存储SK及AIK 密钥大小 >= 2048) – 必须支持 512, 1024, 2048 bit 的密钥 – 建议使用2048位的密钥 – RSA密钥生成遵循PKCS #1 标准 – RSA密钥在使用的时候要加载到TPM内部 TCG Software Stack RSA Engine RSA key-generator SHA1 Engine RNG Opt-in I/O(LPC Bus) Execution Engine Non-volatile storage (special keys, owner secret, …) Volatile storage (keyslots, PCR registers, …) TPM TPM Internals
TPMInternals · Volatile memory 密钥槽(10个)、PCR值(24个) 密钥句柄、授权会话句柄等 ·Non- Volatile memor EK(2048b、EK证书 SRK2048b)及属主( Owner授权数据(60bi等 ·Optn:平台属主决定是否使用TPM TPM RSA Engine RNG I/O(LPC Bus) Non-volatile storage ( (Special keys, owner secret, RSAkey-generator Volatile storage SHAl Engine I Opt-in Execution Engine i(keyslots, PCR registers,; TCG Software Stack
10 • Volatile Memory – 密钥槽(10个)、 PCR值(24个) – 密钥句柄、授权会话句柄等 • Non-Volatile Memory – EK(2048bit)、 EK证书 – SRK(2048bit)及属主(Owner)授权数据(160bit)等 • Opt-In: 平台属主决定是否使用TPM TCG Software Stack RSA Engine RSA key-generator SHA1 Engine RNG Opt-in I/O(LPC Bus) Execution Engine Non-volatile storage (special keys, owner secret, …) Volatile storage (keyslots, PCR registers, …) TPM TPM Internals