Trusted Platform Modules: Why, when and how to use them

Trusted computing introduces the Trusted Platform Module (TPM) as a root of trust on an otherwise untrusted computer. The TPM can be used to restrict the use of cryptographic keys to trusted states, i.e., to situations in which the computer runs trusted software. This allows for the distribution of intellectual property or secrets to a remote party with a reasonable security that such secrets will not be obtained by a malicious or compromised client. We model a specific protocol for the distribution of secrets proposed by Sevine et al. A formal analysis using the NuSMV model checker shows that the protocol allows an intruder to give the client an arbitrary secret, without the client noticing. We propose an alternative that prevents this scenario.

Trusted Computing (TC) is a technology developed and promoted by the Trusted Computing Group (TCG), and aims to enhance the overall security, privacy and trustworthiness of a variety of computing devices. The core of the trusted computing technologies of TCG is the Trusted Platform Module (TPM), a tamper-resistant module embedded in a platform, which is implemented by a TPM chip and designed to resist software attacks and moderate hardware attacks. TPM includes non-volatile storage, a set of Platform Configuration Registers (PCRs) and an engine for cryptographic operations. Based on TPM and TCG Software Stack (TSS), a suite of mechanisms can be realized, including memory curtaining, protected execution, secure I/O, sealed storage, platform measurement and remote attestation. As a fundamental secure computing module, TPM is the root trust module to establish security and trust in digital computing, communication and networking. Basically, it can support secure booting and trustworthy software installation, private data protection and Digital Rights Management (DRM), as well as remote attestation- based trusted communications and collaboration. There is significant research currently in the field of trusted computing, in both academia and industry. Recent efforts focus on TC module development and extension, trustworthy software assurance, Trusted Execution Environment (TEE), trusted collaboration and trusted storage. The recent advance of Intel Software Guard Extensions (Intel® SGX) offers hardware-assistant TEE, which allows user code execution in a private region of memory, called enclave, in an untrusted third party. This technology attracts special attention and motivates innovations of many applications.

Recently the lack of geo-location assurance of data in cloud storage has been identified as one of the main reasons why organizations that deal with sensitive data (e.g., financial data, health related data) cannot adopt a cloud storage solution even if they want to. In this paper, we present a Hardware-based Data geo-Location Assurance Solution (HDLAS), which is suitable for almost all cloud storage applications available today. Trusted Platform Module (TPM) and a cryptographic scheme called Provable Data Possession (PDP) are the basis of our solution. We define a new attack model for HDLAS which seems to be a realistic attack model for the existing cloud storage applications. With the combination of a GPS receiver and TPM, HDLAS is able to offer its clients not only the accurate geo-location of their data but also a hardware-based root of trust for that. Unlike many existing solutions, HDLAS works even if a piece of data is replicated into different storage servers. Furthermore we also illustrate how easily HDLAS can be adopted in existing Cloud Storage Providers such as Microsoft Azure.

Trusted Computing leverages Trusted Platform Module (TPM) as the root of trust to build secure computing environment so as to improve the security of terminals. But there are some security problems of user roaming and migration of sealed data because of binding between platforms and TPMs. Users oriented trusted computing model is built based on Portable Trusted Module (PTM). Trust chains in computing system is delivered effectively to end users based binding between user identities and PTMs. Trust measurement, trust storage and trust reporting based on PTM are also given in this paper. Keywords—trusted computing, trusted platform module, portable trusted module

The current era can be characterized by the massive reliance on computing platforms in almost all domains, such as manufacturing, defense, healthcare, government. However, with the increased productivity, flexibility, and effectiveness that computers provide, comes the vulnerability to cyber-attacks where software, or even firmware, gets subtly modified by a hacker. The integration of a Trusted Platform Module (TPM) opts to tackle this issue by aiding in the detection of unauthorized modifications so that devices get remediation as needed. Nonetheless, the use of a TPM is impractical for resource-constrained devices due to power, space and cost limitations. With the recent proliferation of miniaturized devices along with the push towards the Internet-of Things (IoT) there is a need for a lightweight and practical alternative to the TPM. This paper proposes a cost-effective solution that incorporates modest amounts of integrated roots-of-trust logic and supports attestation of the integrity of the device's boot-up state. Our solution leverages crypto-acceleration modules found on many microprocessor and microcontroller based IoT devices nowadays, and introduces little additional overhead. The basic concepts have been validated through implementation on an SoC with an FPGA and a hard microcontroller. We report the validation results and highlight the involved tradeoffs.

Many people desire ubiquitous access to their personal computing environments. We present a system in which a user leverages a personal mobile device to establish trust in a public computing device, or kiosk, prior to resuming her environment on the kiosk. We have designed a protocol by which the mobile device determines the identity and integrity of all software loaded on the kiosk, in order to inform the user whether the kiosk is trustworthy. Our system exploits emerging hardware security technologies, namely the Trusted Platform Module and new support in x86 processors for establishing a dynamic root of trust. We have demonstrated the viability of our approach by implementing and evaluating our system on commodity hardware. Through a brief survey, we found that respondents are generally willing to endure a delay in exchange for an increased assurance of data privacy, and that the delay incurred by our unoptimized prototype is close to the range tolerable to the respondents. We have focused on allowing the user to personalize a kiosk by running her own virtual machine there. However, our work is generally applicable to establishing trust on public computing devices before revealing any sensitive information to those devices.

Strengthening enterprise applications using trusted platform modules

Microsoft's Pluton is dedicated silicon that aims to strengthen the security and integrity of PCs; it is derived from the Xbox One video game console SoC which was designed in partnership between Microsoft and AMD. Pluton implements and extends the functionality of the Trusted Computing Group's (TCG) Trusted Platform Module 2.0, protects keys as they move around the SoC using dedicated silicon referred to as Secure Hardware Cryptography Key, and implements the TCG's Device Identifier Composition Engine and Microsoft's Robust Internet of Things specifications to perform strong device attestation with a hardware root of trust. While Microsoft is following Apple and Google's lead by integrating special-purpose silicon for secure cryptographic operations, it is taking a different approach by leveraging existing open standards and technologies. Microsoft's Windows 11 is designed for a world where all PCs feature Pluton.

A Physical Unclonable Function (PUF) is a physical system that leverages manufacturing process variations to generate unclonable and inherent instance-specific measurements of physical objects. PUF is equivalent to human biometrics in many ways where each human has a unique fingerprint. PUF can securely generate unique and unclonable signatures that allow PUF to bootstrap the implementation of various physical security issues. In this thesis, we discuss PUFs, extend it to a novel SW-PUF, and explore some techniques to utilize it in security applications. We first present the "SW-PUF" - basic building block of this thesis, a novel PUF design that measures processor chip ALU silicon biometrics in a manner similar to all PUFs. Additionally, it composes the silicon measurement with the data-dependent delay of a particular program instruction in a way that is difficult to decompose through a mathematical model. We then implement the proposed PUF to solve various security issues for applications such as Software Protection and Trusted Computing. We prove that the SW-PUF can provide a more robust root of trust for measurement than the existing trusted platform module (TPM). Second, we present the "Reversible SW-PUF", a novel PUF design based on the SW-PUF that is capable of computing partial inputs given its outputs. Given the random output signature of specific instruction in a specific basic block of the program, only the computing platform that originally computed the instruction can accurately regenerate the inputs of the instruction correctly within a certain number of bits. We then implement the Reversible SW-PUF to provide a verifiable computation method. Our scheme links the outsourced software with the cloud-node hardware to provide proof of the computational integrity and the resultant correctness of the results with high probability. Finally, we employ the SW-PUF and the Reversible SW-PUF to provide a trust attribute for data on the Internet of Thing (IoT) systems by combining data provenance and privacy-preserving methods. In our scheme, an IoT server can ensure that the received data comes from the IoT device that owns it. In addition, the server can verify the integrity of the data by validating the provenance metadata for data creation and modification.

The center-piece of this work is a software measurement physical unclonable function (PUF). It measures processor chip ALU silicon biometrics in a manner similar to all PUFs. Additionally, it composes the silicon measurement with the data-dependent delay of a particular program instruction in a way that is difficult to decompose through a mathematical model. This approach ensures that each software instruction is measured if computed. The SW-PUF measurements bind the execution of software to a specific processor with a corresponding certificate. This makes the SW-PUF a promising candidate for applications requiring Trusted Computing. For instance, it could measure the integrity of an execution path by generating a signature that is unique to the specific program execution path and the processor chip. We present an area and energy-efficient scheme based on the SW-PUF to provide a more robust root of trust for measurement than the existing trusted platform module (TPM). To explore the feasibility of the proposed design, the SW-PUF has been implemented in HSPICE using 45 nm technology and evaluated on the FPGA platform.

Verifiable trust is a desirable property for computing platforms. Current trusted computing systems developed by Trusted Computing Group (TCG) provide verifiable trust by taking immutable snapshots of the whole set of platform components. It is, however, difficult to use this technology directly in virtualized platforms because of complexity and dynamic changes of platform components. In this paper, we introduce a novel integrity management solution based on a small Software-based Root of Trust for Measurement (SRTM) that provides a trusted link to the integrity measurement chain in the TCG technology.Our solution makes two principal contributions: The first is a key management method, by which a verifier can be convinced that the SRTM is a trusted delegatee of a Trusted Platform Module (TPM). The second is two integrity management services, which provides a novel dependency relation between platform components and enables reversible changes to measured components. This extended abstract of the paper focuses on the key management method and shows the high level idea of these two services. Details of the dependency relation, the reversible changes, and the Xen implementation may be found in the full version of the paper.KeywordsIntegrity measurement and reportingplatform virtualizationsoftware-based root of trust for measurement

Ensuring security in the military applications of IoT is a big challenge. The main reasons for this state of affairs is that the sensor nodes of the network are usually mobile, use wireless links, have a small processing power and have a little energy resources. The paper presents the solution for cryptographic protection of transmission between sensor nodes in the data link layer and for cryptographic protection of data stored in the sensor node resources. For this purpose, the Trusted Platform Module (TPM) was used. The proposed solution makes it possible to build secure and fault tolerant sensor network. The following aspects were presented in the paper: the model of such a network, applied security solutions, analysis of the security in the network and selected investigation results of such a network were presented.

Trusted computing provides an efficient and practical way out for system security problems based on a trusted hardware, namely the root of trust, e.g., Trusted Platform Module TPM, Trusted Cryptographic Module TCM, Trusted Platform Control Module TPCM, so on and so forth. However, current applications calling for trusted functions have to use either the user-space trusted interfaces e.g., Trusted Software Stack TSS API or to implement customized APIs on top of the trusted hardware driver; both of them are well known of steep learning curve, which indicates error prone and low-efficient development and complex maintenance for the application of trusted software. This paper presents a new trusted encapsulation architecture and the proof-of-concept system with the aim to mitigate the gap between the current obscure trusted APIs and the actual trusted applications for trusted software development. Our system can provide high-level and much simplified trusted transaction interfaces for user applications, which can rapidly reduce the development and maintenance work for the developers and users without too much performance costs. We also present a secure remote login use-case using mainly the binding and unbinding trusted functions of our trusted encapsulation architecture.

This paper presents a new method to enhance the trust of traditional computing device by using the popular mobile phone. We first propose a formal method to analyze the platform trust establishment process based on trusted computing technology, and the formal results reveal possible attack and suggest potential solutions. Then, we design an improved solution, in which the mobile phone is extended to support three trusted computing functions: using mobile phone as a root of trust instead of Trusted Platform Module, as a local investigator to obtain evidences from the local computing platform, and as a trusted agent to build a secure communication channel with an external entity in the remote attestation applications. Finally, to describe the feasibility and efficiency, a prototype of the trusted mobile phone is implemented and evaluated based on an ARM development board.

This article analyses the legal challenges of international data transfers resulting from the recent Court of Justice of the European Union (CJEU) decision in Case C-311/18 Data Protection Commissioner v Facebook Ireland Limited, Maximillian Schrems (Schrems II). This judgement invalidated the EU-US Privacy Shield Framework but upheld the use of standard contractual clauses (SCCs). However, one caveat is that organisations would have to perform a case-by-case assessment on the application of the SCCs and implement ‘supplementary measures’ to compensate for the lack of data protection in the third country, where necessary. Regrettably, the CJEU missed the opportunity to specify what exactly these ‘supplementary measures’ could be. To fill this gap, the European Data Protection Board (EDPB) adopted guidelines on the measures that supplement transfer tools to ensure compliance with the EU level of protection of personal data. In addition, on June 4th, 2021 the European Commission issued new SCCs which replaced the previous SCCs that were adopted under the previous Data Protection Directive 95/46. These new developments have raised the bar for data protection in international data transfers. In this article, we analyse the current regulatory framework for cross-border transfers of EU personal data and examine the practical considerations of the emerging post-Schrems II legal landscape.