Trusted Computing based services supporting TPM provisioning and supply chain validation concepts. #nsacyber
Go to file
Cyrus c7454c945e
[] Provision update for quote and pcrs ()
* This commit includes functioning TPM quote code that is sent to the ACA.  In addition it has code to also sent the pcrs list results.

Additional changes to correct code for sending the pcr list over to the ACA.Additional changes to correct code for sending the pcr list over to the ACA.Additional changes to correct code for sending the pcr list over to the ACA.Additional changes to correct code for sending the pcr list over to the ACA.Additional changes to correct code for sending the pcr list over to the ACA.Additional changes to correct code for sending the pcr list over to the ACA.Additional changes to correct code for sending the pcr list over to the ACA.Additional changes to correct code for sending the pcr list over to the ACA.Additional changes to correct code for sending the pcr list over to the ACA.

* Changed the requirement for the field into protobuf to optional from required.
2019-10-29 09:33:35 -04:00
.ci [] Update TPM Provisioner docker images with latest PACCOR () 2019-10-01 09:53:04 -04:00
config/checkstyle Initial release 2018-09-06 09:47:33 -04:00
gradle/wrapper Initial release 2018-09-06 09:47:33 -04:00
HIRS_AttestationCA [] Delta holder validation () 2019-08-29 13:35:41 -04:00
HIRS_AttestationCAPortal [] Delta holder validation () 2019-08-29 13:35:41 -04:00
HIRS_Provisioner [] tpm_aca_provision no longer tries to guess the TPM version. () 2019-03-29 11:35:28 -04:00
HIRS_ProvisionerTPM2 [] Provision update for quote and pcrs () 2019-10-29 09:33:35 -04:00
HIRS_Structs Initial release 2018-09-06 09:47:33 -04:00
HIRS_Utils WIP: update version number in ACA banner following upgrade 2019-09-11 12:35:27 -04:00
images Updated images for version 1.1 2019-09-05 17:03:46 -04:00
package Slight clean up 2019-09-11 12:35:27 -04:00
tpm_module [] Parallelize Subproject CI Builds and Pull Pre-Built Image 2018-10-12 12:01:46 -04:00
TPM_Utils Initial release 2018-09-06 09:47:33 -04:00
.gitignore Add systems tests for HIRS Provisioner TPM 2.0 () 2019-01-15 12:46:06 -05:00
.travis.yml [] Initial delta system test to resolve bad component in a base certificate () 2019-08-02 12:39:56 -04:00
build.gradle [] Implementation of Component Class field () 2019-03-25 11:14:19 -04:00
CONTRIBUTING.md Updated CONTRIBUTING.md 2018-09-07 13:59:31 -04:00
DISCLAIMER.md Initial release 2018-09-06 09:47:33 -04:00
gradle.properties Initial release 2018-09-06 09:47:33 -04:00
gradlew Initial release 2018-09-06 09:47:33 -04:00
gradlew.bat Initial release 2018-09-06 09:47:33 -04:00
LICENSE.md Initial release 2018-09-06 09:47:33 -04:00
NOTICE [] Implementation of Component Class field () 2019-03-25 11:14:19 -04:00
README.md Updated README.md links 2019-09-09 10:40:13 -04:00
settings.gradle [] Parallelize Subproject CI Builds and Pull Pre-Built Image 2018-10-12 12:01:46 -04:00
VERSION Update version from 1.0.4 to 1.1.0 2019-09-12 09:19:45 -04:00

Host Integrity at Runtime and Start-up (HIRS)

Build Status

Attestation Certificate Authority (ACA) and TPM Provisioning with Trusted Computing-based Supply Chain Validation

The Host Integrity at Runtime and Start-up Attestation Certificate Authority is a Proof of Concept - Prototype intended to spur interest and adoption of the Trusted Platform Module (TPM). It's intended for testing and development purposes only and is not intended for production. The ACA's functionality supports the provisioning of both the TPM 1.2 and TPM 2.0 with an Attestation Identity Credential (AIC). The ACA can be configured to enforce the Validation of Endorsement and Platform Credentials to illustrate a supply chain validation capability.

Version 1.1 adds support for the Platform Certificate v1.1 Specification. This allows entities that are part of the supply chain (System integrators and Value Added Resellers) the ability to create Delta Platform Certificate to compliment the Base Platform Certificate created by the Platform Manufacturer. See the Article on Base and Delta Platform Certificates for details.

The ACA provides a “provisioner” application to be installed on all devices which will be requesting Attestation Credentials. The ACA is a web based server which processes Attestation Identity Requests. TPM Provisioning

Features

  • TPM Provisioner
    • Requests an Attestation Identity Credential for the TPM from the ACA.
    • Takes ownership of TPM if not owned
    • Uses REST calls to complete the transaction with the ACA
    • Reads credentials from the TPM's NvRAM as part of the provisioning process.
    • Reads the device's hardware, network, firmware, and OS info for platform validation
  • Attestation Certificate Authority
    • Issues Attestation Identity Credentials to validated devices holding a TPM
    • Configures policies for enabling/disabling validation procedures
    • Performs TCG-based Supply Chain Validation of connecting clients
      • Optionally validates Endorsement and Platform Credentials
  • Endorsement Credential Certificate Chain Validation
  • Platform Credential Certificate Chain Validation
  • Attestation CA Dashboard
    • Displays all Validation Reports, Credentials, and Trust Chains
    • Enables ACA policy configuration for validation of Endorsement and Platform Credentials
    • Enables Import/Export of Certificate (Trust) Chains, Endorsement Credentials, and Platform Credentials
    • Optionally allows uploaded credentials to be used in validation for machines that have been reprovisioned by trusted parties since leaving the OEM

Requirements

The HIRS Attestation Certificate Authority (ACA) supports installation on CentOS 6 and 7 instances.

The HIRS Provisioner supports both types of TPMs, 1.2 and 2.0. TPM 1.2 support is available on CentOS 6 and 7. Due to the limitations on the libraries available on Centos 6, TPM 2.0 support is only available on Centos 7.

Installation Instructions

For detailed instructions, see Installation notes.

Packages used for installation (e.g. HIRS_Provisioner*el7.noarch.rpm) can be found on the release page.

Installing the ACA

Simply run the command yum install HIRS_AttestationCA*el6.noarch.rpm or yum install HIRS_AttestationCA*el7.noarch.rpm based on your OS.

Installing the Provisioner

After enabling your TPM in BIOS/UEFI, determine if your machine has a TPM 1.2 or a TPM 2.0 by using the command:
dmesg | grep -i tpm_tis.

To install a TPM 1.2 Provisioner, run:
yum install tpm_module*.rpm
yum install HIRS_Provisioner*el6.noarch.rpm or yum install HIRS_Provisioner*el7.noarch.rpm based on OS
hirs-provisioner -c

To install a TPM 2.0 Provisioner, run:
yum install hirs-provisioner-tpm2*.rpm

To configure the provisioner, edit the hirs-site.config file in /etc/hirs/hirs-site.config. Edit the file to specify the ACA's fully qualified domain name and port.

Usage

To kick off a provision on the client, run the command sudo tpm_aca_provision.

To see the results and interact with the ACA, go to the ACA Portal at https://ACAPortalAddress:ACAPortalPort/HIRS_AttestationCAPortal/portal/index.