Trusted Computing based services supporting TPM provisioning and supply chain validation concepts. #nsacyber
Go to file
iadgovuser26 iadgovuser26@empire.eclipse.ncsc.mil 174c7a1eb7 Updated for the V3 release
2024-08-23 11:21:37 -04:00
.ci Merge pull request from nsacyber/v3_issue_794_ci-error-check 2024-08-16 15:16:02 -04:00
.github/workflows removed HIRS_Provisioner 2024-08-19 15:09:50 -04:00
config/checkstyle Updated some more checkstyle issues and removed the line call from the 2024-02-05 13:29:24 -05:00
gradle/wrapper Updated gradle to v8.3 and nebula to 11.4.0 2023-09-06 16:10:16 -04:00
HIRS_AttestationCA Implementing LDevID generation () 2024-08-19 18:39:03 +00:00
HIRS_AttestationCAPortal Updated server ssl cipher list 2024-08-19 16:49:00 -04:00
HIRS_Provisioner.NET Updated README.md and VERSION files 2024-08-22 16:40:03 -04:00
HIRS_ProvisionerTPM2 Updated README.md and VERSION files 2024-08-22 16:40:03 -04:00
HIRS_Structs This commit sets up the suppression filter file. The locations previous 2024-02-05 10:50:12 -05:00
HIRS_Utils adding private constructors to appease checkstyles; fixed some mispellings 2024-08-20 15:09:33 -04:00
images Updated README.md and VERSION files 2024-08-22 16:40:03 -04:00
package Windows Docker images needed some work () 2024-07-25 19:19:18 -04:00
scripts Added switch to windows engine () 2024-01-26 13:44:15 -05:00
tools Updated README.md and VERSION files 2024-08-22 16:40:03 -04:00
.gitignore Implementing LDevID generation () 2024-08-19 18:39:03 +00:00
build.gradle Added additional checks during package install 2024-04-24 15:40:46 -04:00
CONTRIBUTING.md Updated CONTRIBUTING.md 2018-09-07 13:59:31 -04:00
DISCLAIMER.md Initial release 2018-09-06 09:47:33 -04:00
gradle.properties updated with package for tcg_rim_tool [no ci] 2023-03-17 14:47:10 -04:00
gradlew Updated gradle to v8.3 and nebula to 11.4.0 2023-09-06 16:10:16 -04:00
gradlew.bat Updated gradle to v8.3 and nebula to 11.4.0 2023-09-06 16:10:16 -04:00
LICENSE.md Initial release 2018-09-06 09:47:33 -04:00
NOTICE Revert "Updating NOTICE file" 2024-08-21 12:20:24 -04:00
README.md Updated for the V3 release 2024-08-23 11:21:37 -04:00
settings.gradle Upgrade JCommander to support global argument validation. Replace CredentialArgumentValidator with CreateArgumentValidator. 2024-03-06 12:40:54 -05:00
VERSION Updated README.md and VERSION files 2024-08-22 16:40:03 -04:00

Host Integrity at Runtime and Start-up (HIRS)

HIRS Build Status

Attestation Certificate Authority (ACA) and TPM Provisioning with Trusted Computing-based Supply Chain Validation

The Host Integrity at Runtime and Start-up Attestation Certificate Authority is a Proof of Concept - Prototype intended to spur interest and adoption of the Trusted Platform Module (TPM). It's intended for testing and development purposes only and is not intended for production. The ACA's functionality supports the provisioning of TPM 2.0 with an Attestation Certificate. The ACA can be configured to perform an Acceptance Test which enforces the Validation of Endorsement and Platform Certificates as well as Reference Integrity Manifests (RIM)s. This serves to illustrate a Supply Chain validation capability.

Notice: Github Discussions have been enabled for this repo. Please refer to the Discussion entitled "HIRS development changes" for development and support notifications.

Features

The HIRS ACA is a web based server which processes Attestation Identity Requests. The ACA provides a “provisioner” application to be installed on all devices which will be requesting Attestation Certificates.

Attestation Certificate Authority (ACA)

  • Issues Attestation Certificates or TPM based Local Device ID (LDevID) certificates to validated devices holding a TPM
  • Configures policies for enabling/disabling validation procedures
  • Performs TCG-based Supply Chain Validation concepts
    • Optionally validates Endorsement, Platform Certificates, and Reference Integrity Manifests
  • Endorsement Certificate Chain Validation
  • Platform Certificate Chain Validation
  • Firmware Integrity Validation
    • Uploads and processes TCG PC Client Reference Integrity Manifests (RIM)s
      • Validates the signature of all RIM files imported to the ACA
      • Ensures all RIM files were signed by trusted sources
    • Creates and verifies a nonce for the TPM Quote
    • Process TMP Event Logs and checks digests against the TPM Quote
    • Verifies individual event digests against the OEM provided Reference Integrity Measurements
    • Verifies that the firmware hashes captured by the TPM's Platform Configuration Registers (PCRs) match the firmware hashes obtained from the OEM(s)
    • Verifies TCG/UEFI boot variables (e.g. BIOS setup data) have not been altered (e.g secure boot)
  • Attestation CA Dashboard
    • Displays all Validation Reports, Certificates, and Trust Chains
    • Enables ACA policy configuration for validation of Endorsement and Platform Certificates
    • Enables Import/Export of Certificate (Trust) Chains, Endorsement Certificates, and Platform Certificates
    • Optionally allows uploaded Certificates of trusted parties

TPM Provisioner

  • Requests an Attestation Certificate for the TPM from the ACA
  • Transfers TCG Artifacts to the ACA (TPM Endorsement Certificates, Platform Certificates, Reference Integrity Manifests, Event Logs, etc.)
  • Reads the device's hardware, network, firmware, and OS info for platform and component validation
  • Provides a TPM Quote for Firmware Integrity Checking

TCG RIM Tool

TCG Event Log Tool

  • Parses binary TPM Event Logs and displays event data in a human readable form
  • Extracts Events from TPM Event Logs for test pattern generation
  • Provides Expected PCR values from a complete TPM Event Log

Platform Certificate Creator - PACCOR

  • Creates platform certificates according to the TCG Platform Certificate Profile
    • Assists in gathering all of the data that can go into a PC and produce a signed attribute certificate
  • Validates signatures on TCG Platform Certificates

Installation Instructions

For detailed instructions, see Installation notes.

Packages used for installation can be found on the release page.

Installing the HIRS ACA

There are several options for installing the HIRS ACA:

An ACA Docker image is automatically created for each release. To run the ACA container using docker:

docker run --name=aca -p 8443:8443 ghcr.io/nsacyber/hirs/aca:latest

To install the ACA on a Redhat or Rocky Linux download the latest rpm from the release page then run the command:

sudo dnf install HIRS_AttestationCA*.rpm

To install the ACA on a Ubuntu Linux download the latest rpm from the release page then run the command:

sudo apt-get install HIRS_AttestationCA*.deb

Installing the HIRS_Provisioner.NET

To install the HIRS_Provisioner.NET on a Redhat or Rocky Linux download the latest rpm package from the release page then open a terminal and run the command:

sudo dnf install HIRS_Provisioner.NET.*.rpm

To install the HIRS_Provisioner.NET on Ubuntu Linux download the latest deb package from the release page then open a terminal and run the command:

sudo apt-get install HIRS_Provisioner.NET.*.deb

To install the HIRS_Provisioner.NET on Windows download the latest msi package from the release page then open a powershell windows as an administrator then run the command:

msiexec /package HIRS_Provisioner.NET.*.msi /quiet

Then follow the instructions for setting up the HIRS_provisioner.NET in the HIRS_Provisioner.NET Readme.

Usage

On Linux: To kick off a provision on the client, open a terminal and run the command:

sudo tpm_aca_provision

On Windows: Open a powershell terminal as an administrator and enter the command:

tpm_aca_provision

To see the results and interact with the ACA, using a browser go to the ACA Portal using the URL:

https://localhost:8443/

For more information see the Getting Started Guide

Development History

Version 1.1 added support for the Platform Certificate v1.1 Specification. This allows entities that are part of the supply chain (System integrators and Value Added Resellers) the ability to create Delta Platform Certificate to compliment the Base Platform Certificate created by the Platform Manufacturer. See the Article on Base and Delta Platform Certificates for details.

Version 2.0 added support for the PC Client Reference Integrity Manifest (RIM) Specification to provide firmware validation capability to the HIRS ACA. This requires that the manufacturer of a device provide a digitally signed RIM "Bundle" for each device. The HIRS ACA has a new page for uploading and viewing RIM Bundles and a policy setting for requiring Firmware validation.

Version 3.0 was completely refactored to build and run on multiple platforms. The Base OS used for development of the ACA was migrated to Rocky Linux with updates to current dependencies (e.g. Java, Tomcat, Mariadb, etc.) and development tools (e.g. Gradle). New features introduced in Version 3.0 include support for the PC Client RIM 1.1 specification including composite RIMs, time-stamps, and counter signatures and detailed linkages between TCG Event Logs, OEM issuer certificates, and Reference Integrity Manifests (RIMs) have been added to provide greater granularity of information. Support for TPM 1.2 (HIRS_Provisioner) and the Cplus version of the TPM provsioner (HIRS_ProvisionerTPM2) was dropped from Version 3.0 and replaced with the HIRS_Provisioner.NET.

To support the TCG RIM concept a new tools folder has been added to the HIRS project which contains a tcg_rim_tool command line application. The tcg_rim_tool can be used to create NISTIR 8060 compatible SWID tags that adhere to the TCG PC Client RIM specification. It also supports the ability to digitally sign the Base RIM file as the HIRS ACA will require a valid signature in order to upload any RIM file. See the tgc_rim_tool READ.md for more details.

Background

HIRS Documentation

HIRS Notes

Tools