Trusted Computing based services supporting TPM provisioning and supply chain validation concepts. #nsacyber
Go to file
5B96790E3664F40075A67E6ADF737EDB15B4408DBC91A81228B31537B0CE3E26 2ec2302213
Merge pull request #712 from nsacyber/v2_dotnet-update-wix
V2 Update WiX
2024-02-10 12:49:35 -05:00
.ci [#514] Release HIRS .NET Provisioner 2023-06-08 13:56:01 -04:00
.github/workflows Added branch filters to HIRS Github actions 2023-06-15 11:26:11 -04:00
config/checkstyle HIRS_Structs jar available 2023-07-21 10:37:11 -04:00
gradle/wrapper Initial release 2018-09-06 09:47:33 -04:00
HIRS_AttestationCA Initial maven set up of HIRS_Utils 2023-07-25 15:19:57 -04:00
HIRS_AttestationCAPortal Update HIRS_Provisioner.NET Readme 2023-10-24 15:39:20 -04:00
HIRS_Provisioner Initial maven set up of HIRS_Utils 2023-07-25 15:19:57 -04:00
HIRS_Provisioner.NET WiX update needed in v2 as well 2024-02-09 16:37:10 -05:00
HIRS_ProvisionerTPM2 Found the actual issue. The problem is with the previous status update 2022-03-23 13:44:03 -04:00
HIRS_Structs Conf changes prior to maven deployment 2023-07-27 15:42:50 -04:00
HIRS_Utils Conf changes prior to maven deployment 2023-07-27 15:42:50 -04:00
images Updated images for version 1.1 2019-09-05 17:03:46 -04:00
package removed setting sql root pwd during ACA install to allow for uninstall 2023-06-01 23:32:52 -04:00
scripts Files added for ACA Docker image workflow 2022-09-01 09:03:02 -04:00
tools Fix failing testCreateTimestampRfc2315 2023-08-02 11:27:23 -04:00
tpm_module [#14] Parallelize Subproject CI Builds and Pull Pre-Built Image 2018-10-12 12:01:46 -04:00
TPM_Utils Selected newer apache commons libraries. 2023-07-26 10:11:31 -04:00
.gitignore [#514] Release HIRS .NET Provisioner 2023-06-08 13:56:01 -04:00
build.gradle Removed xmlrpc and commons httpclient 2023-07-27 11:23:17 -04:00
CONTRIBUTING.md Updated CONTRIBUTING.md 2018-09-07 13:59:31 -04:00
DISCLAIMER.md Initial release 2018-09-06 09:47:33 -04:00
gradle.properties Don't version control java home selection in gradle.properties 2023-07-26 11:35:25 -04:00
gradlew Initial release 2018-09-06 09:47:33 -04:00
gradlew.bat Initial release 2018-09-06 09:47:33 -04:00
LICENSE.md Initial release 2018-09-06 09:47:33 -04:00
NOTICE minor adjustments to the NOTICE file 2022-03-16 11:12:44 -04:00
README.md Update README.md 2024-01-02 14:27:10 -05:00
settings.gradle added a eventcheck script to check and event log against a signed RIM 2020-05-27 17:31:15 -04:00
VERSION Update VERSION 2023-10-19 11:08:59 -04:00

Host Integrity at Runtime and Start-up (HIRS)

Attestation Certificate Authority (ACA) and TPM Provisioning with Trusted Computing-based Supply Chain Validation

The Host Integrity at Runtime and Start-up Attestation Certificate Authority is a Proof of Concept - Prototype intended to spur interest and adoption of the Trusted Platform Module (TPM). The ACA can be configured to enforce the Validation of Endorsement and Platform Credentials to illustrate a Supply Chain Validation capability. It's intended for testing and development purposes only and is not intended for production. The ACA's functionality supports the provisioning of the TPM 2.0 with an Attestation Identity Credential (AIC).

The ACA provides a “provisioner” application to be installed on all devices which will be requesting Attestation Credentials. The ACA is a web based server which processes Attestation Identity Requests. TPM Provisioning

Version 1.1 added support for the Platform Certificate v1.1 Specification. This allows entities that are part of the supply chain (System integrators and Value Added Resellers) the ability to create Delta Platform Certificate to compliment the Base Platform Certificate created by the Platform Manufacturer. See the Article on Base and Delta Platform Certificates for details.

Version 2.0 added support for the PC Client Reference Integrity Manifest (RIM) Specification to provide firmware validation capability to the HIRS ACA. This requires that the manufacturer of a device provide a digitally signed RIM "Bundle" for each device. The HIRS ACA has a new page for uploading and viewing RIM Bundles and a policy setting for requiring Firmware validation.

Version 2.2 introduces the HIRS_Provisioner.NET. The HIRS_Provisioner.NET is a C# implementation of the HIRS Provisioner designed to be a replacement for the HIRS_ProvisionerTPM2. The HIRS_Provisioner.NET can be packaged for Windows as well as most Linux distributions. This portability will support a wider set of scenarios and products. See the HIRS_Provisioner.NET README for details.

An ACA Docker image is now automatically created for each release. See the packages page for published ACA docker images.

To support the TCG RIM concept a new tools folder has been added to the HIRS project which contains a tcg_rim_tool command line application. The tcg_rim_tool can be used to create NISTIR 8060 compatible SWID tags that adhere to the TCG PC Client RIM specification. It also supports the ability to digitally sign the Base RIM file as the HIRS ACA will require a valid signature in order to upload any RIM file. See the tgc_rim_tool READ.md for more details.

Notice: Github Dicussions have been enabled for this repo. Please refer to the Dicussion entitled "HIRS development changes" for development and support notifications.

Features

  • TPM Provisioner
    • Requests an Attestation Identity Credential for the TPM from the ACA.
    • Takes ownership of TPM if not owned
    • Uses REST calls to complete the transaction with the ACA
    • Reads credentials from the TPM's NvRAM as part of the provisioning process.
    • Reads the device's hardware, network, firmware, and OS info for platform validation
  • Attestation Certificate Authority
    • Issues Attestation Identity Credentials to validated devices holding a TPM
    • Configures policies for enabling/disabling validation procedures
    • Performs TCG-based Supply Chain Validation of connecting clients
      • Optionally validates Endorsement and Platform Credentials
  • Endorsement Credential Certificate Chain Validation
  • Platform Credential Certificate Chain Validation
  • Attestation CA Dashboard
    • Displays all Validation Reports, Credentials, and Trust Chains
    • Enables ACA policy configuration for validation of Endorsement and Platform Credentials
    • Enables Import/Export of Certificate (Trust) Chains, Endorsement Credentials, and Platform Credentials
    • Optionally allows uploaded credentials to be used in validation for machines that have been reprovisioned by trusted parties since leaving the OEM
  • Firmware Integrity Validation
    • Checks that firmware and boot related file hashes match those provided by OEMs.
    • Validates the import of All RIM files imported to the ACA (insure all RIM files were signed by trusted sources)
    • Verifies that the firmware hashes captured by the TPMs Platform Configuration Registers (PCRs) match the firmware hashes obtained from the OEM(s).
    • Verifies TCG/UEFI boot variables (e.g. BIOS setup data) have not been altered (e.g secure boot).

Requirements

The HIRS Attestation Certificate Authority (ACA) currently supports installation on CentOS 7 instances only. To simlify installation a ACA Docker image is now automatically created for each release. Please refer to the Dicussion entitled "HIRS development changes" for work on OS migration and OS support.

The HIRS Provisioner supports 2.0. on Windows (10 and 11), Linux Centos 7, RHEL 7+ and derivatives (e.g. Rocky7+) as well as Ubuntu(18+).

Installation Instructions

For detailed instructions, see Installation notes.

Packages used for installation (e.g. HIRS_Provisioner*el7.noarch.rpm) can be found on the release page.

Installing the ACA

Simply run the command yum install HIRS_AttestationCA*el7.noarch.rpm when using an rpm package on Centos 7.

Installing the Provisioner

After enabling your TPM in BIOS/UEFI:

Select the package to install on you OS (windows, rpm, or deb) Follow the instruction from the HIRS_Provisioner.NET README

Usage

To kick off a provision on the client, run the command sudo tpm_aca_provision.

To see the results and interact with the ACA, go to the ACA Portal at https://ACAPortalAddress:ACAPortalPort/HIRS_AttestationCAPortal/portal/index.