Other identical option names: Security Chip, Execute TPM Command.

BIOS options designed to protect computer information include the Trusted Platform Module option. It allows you to enable support for the information security hardware and software complex of the same name. The user can select only two options for this option - Enabled and Disabled.

There is hardly a user who would not be at all concerned about the problem of protecting confidential information located on his computer. In the commercial and industrial sphere, enormous amounts of money are being spent on solving this problem, but so far no effective and inexpensive means has been found to protect computer data.

The Trusted Platform Module system is one attempt to address the urgent need for such technology. Although it is not a panacea, it can, however, significantly increase the level of information protection both at the level of computer networks and at the level of individual computers and other devices containing important data.

Trusted Platform Module (TPM, trusted platform module) is a software and hardware system for protecting information. The complex can be installed on any computer and even on individual storage devices and mobile devices such as smartphones. Most often, laptops are equipped with a TPM complex. What is important is that computer systems equipped with hardware TPM modules do not cost much more than systems with similar characteristics that are not equipped with TPM.

The main data properties that TPM technology is designed to provide:

• Protection
• Integrity
• Safety
• Authorship

The TPM standard was developed by a number of well-known software and hardware manufacturers, including Microsoft, HP, Intel, and IBM. Subsequently, companies such as Sun, AMD, Sony and Verisign joined their ranks.

Using TPM allows you to prevent computer hacking and leakage of important information, infection with Trojans and viruses, maintain the integrity of licensed software, and protect network traffic. The TPM system can guarantee software protection from modification, as well as data protection from copying.

Drives that support the TPM system are capable of hardware-based data encryption, which ensures the protection of confidential information. When authorizing a user in the TPM system, various methods can be used, including biometric ones, such as fingerprint scanning.

The TPM specification allows the use of both fully software and hardware-software implementation of the technology. In practice, in most cases the second option is used as it provides the greatest degree of protection.

The basis of the TPM system is a special chip built into the motherboard. This chip, often called a cryptographic processor or simply a cryptoprocessor, contains the software and hardware necessary to protect information. Its purpose is to store and generate keys, perform asymmetric encryption and hashing of data. Today, cryptoprocessor chips are manufactured by many manufacturers and installed on millions of computers.

When you boot a computer with the TPM system installed, the cryptoprocessor checks for the identity of all the main components of the computer, both hardware and software, such as the BIOS and operating system. If such a check is successful, the computer is considered to be operating in the so-called verified state. In this state, any applications can be executed, including those that require data protection and confidentiality, and encrypted data can also be accessed.

At the software level, TPM requires technology support from the operating system, as well as special software. Trusted Platform Module technology is supported by most modern Windows operating systems, starting with Windows XP SP2, as well as modern versions of Linux.

The Trusted Platform Module option allows you to enable support for this technology in the BIOS. It is available only if the computer motherboard is equipped with a TPM cryptoprocessor chip. Selecting Enabled allows the user to enable this chip, and Disabled allows the user to disable it.

Should I include it?

The answer to this question depends on whether you have the Trusted Platform Module installed on your computer. If yes, then the system should be turned on. However, it must be remembered that using the system is not a panacea and cannot always replace the use of traditional antiviruses, firewalls and other computer security tools.

BIOS manufacturers offer user choice, and you can always turn off a given system if you don't need its help. Of course, if your computer is equipped with an old operating system that does not support TPM (Windows XP SP1 and older OS), then enabling it also makes no sense.

Philosophers of the past loved to talk about freedom. “Those who are willing to give up their liberty to gain a short-lived protection from danger deserve neither liberty nor safety,” argued Benjamin Franklin. “A person cannot be either a slave or free. He is either free - or he is not at all,” Jean-Paul Sartre categorically stated. “Freedom is a conscious necessity,” Marxists quoted Benedict Spinoza.

What is freedom? Is it important for a person to be free, and is he ready to exchange freedom for security? A reason that was not noticed by the general public prompted me to think about this topic. This summer, the JTC1 Technical Committee voted to approve, in a simplified manner provided for by the PAS procedure, a new version of the ISO/IEC 11889:2015 standard, which was presented by the Trusted Computing Group (TCG) consortium, founded by the American companies AMD, Cisco, HP, IBM, Intel , Microsoft and Wave Systems. And on June 29 in Portland, Oregon, TCG announced that its Trusted Platform Module (TPM) 2.0 standard has been finally approved as international.

Benefits of TPM

TPM is the name of a specification that describes a crypto module that stores cryptographic keys to protect information. It can be put more simply: this is an information security module that can be installed in servers, personal computers, network and mobile devices. It supports remote attestation, allowing communication between computer hardware and software.

The module is convenient for copyright holders, as it allows you to check the licensing of software and control illegal copying of music, films or computer games. It uniquely identifies the computer and allows user authentication. At the same time, TPM makes it possible to generate keys, has hashing functions, and generates random numbers.

TPM hardware capabilities are very limited in power and do not allow you to directly encrypt large amounts of data at high speed. The function of bulk encryption of files on disks can be performed by the Windows Bitlocker program. At the same time, the crypto keys used are themselves encrypted using TPM, which eliminates the possibility of their theft.

Thus, TPM, in conjunction with Windows Bitlocker, can encrypt a disk, protect data in case of loss or theft of a computer, software from modification and infection by viruses, as well as banking and email programs.

The module is able to confirm the authenticity of the computer and even its functionality even before gaining access to the network. Overall, it significantly increases the security of users, especially those who have little knowledge of information security issues and cannot solve them on their own.

Indeed, TPM is an important and useful thing. Significantly increases user safety. But the question of the price of security arises. If a person installs a webcam in his home, he increases the security of his home. He can remotely monitor the apartment all the time and call the police if thieves appear. But if the ability to control the webcam is intercepted, it can turn from a security device into a surveillance device. The collected information about a person is, accordingly, used as a means of control and management. And his apartment itself turns into a cell, though more like a prison cell.

Germany's position

The result of the ISO/IEC JTC1 Technical Committee vote was predictable. Only Germany voted against. Russia abstained, however, its vote “against” would not have decided anything anyway. The majority supported the American position. An unprecedented action did not help either - sending out a closed letter to committee members from official representatives of the Federal Ministry of the Interior and the Federal Ministry of Economics and Energy of the Federal Republic of Germany with a request to “bury” the project. Information about this document leaked to the German press and caused a lot of noise.

At the state level, the existence of such a letter was denied by the German authorities, however, what else in this case can be expected from the official authorities. In the text of the German letter, available to the editors and the authenticity of which we have no reason to doubt, it is written that “... the specifications presented in the draft standard are not sufficiently developed to make a decision; in particular, as a result of careful consideration of the issue, we have reason to believe that their implementation may significantly degrade the ability to manage the protected ICT system, and also potentially lead to situations of complete blocking of the system, carried out in the interests of some manufacturers of computer equipment. In addition, we believe that the potential impact of the proposed specifications on privacy and IT security may be highly problematic and are concerned that this would conflict with relevant German law.”

At the same time, German information security specialists did not oppose TPM in principle. They were satisfied with the previous TPM 1.2 standard, in which the user retained full control over his platform. The TPM module could simply be disabled. In the TPM 2.0 standard this will no longer work.

In addition, they were concerned about the very approach to developing the standard, in which only American companies participated. Zeit journalists reported that the German government tried to take part in the development of TPM 2.0, but was refused. They also pointed to the active cooperation of the standard developers with the US NSA and provided assessments of the security of TPM 2.0 by independent experts. The publication warned that TPM can be considered a backdoor and there is a high probability that the NSA has access to cryptographic keys.

Vents and windows

Experts from the German Federal Office for Information Technology Security (BSI) were alarmed that with the transition to the TPM 2.0 specification, this standard becomes mandatory for all devices running Windows 8.1 and higher, and this function cannot be deactivated.

In fact, a computer with TPM 2.0 cannot be considered a device under complete control of the user. Concerns have been raised that Windows 8 with TPM 2.0 could allow Microsoft to control the computer remotely through a built-in backdoor.

Chinese experts also read about the German warning. They researched the problem, figured out the details and made a decision. In May 2014, the Chinese government agency Xinhua reported that it had banned the installation of Windows 8 on government computers. And these are most likely computers that belong not only to the state, but also to those structures that are controlled by the state - the largest banks, information security companies, telecoms, as well as other companies that want to follow the recommendations of their government.

Another internal BSI document obtained by the German publication states: "Windows 7 can be managed securely until 2020. After that, other solutions must be found for the administration of IT systems." And on the BSI website it is directly written that the mechanism of Windows 8 with TPM 2.0 “can be used for sabotage by third parties” and that experts consider the use of the new version of TPM unacceptable by government organizations and critical infrastructure facilities. So, it seems that the Germans and Chinese will not rush to upgrade Windows 7 in the public sector even to Windows 8.

Russia's position

To find out Russia's position, we turned to experts - members of the ISO/IEC JTC1 Technical Committee, the Russian companies Aquarius and Craftway, and Microsoft with a request to comment on the seriousness of the concerns of Germany and China regarding the new standard.

Unfortunately, the experts either ignored our questions or stated that they refused to answer them. The only specialist who agreed to an interview was an independent expert on cybersecurity in automated control systems Vadim Podolny.

What is good and what is dangerous about TPM?

TPM, whether it is the currently most common TPM 1.2 or the increasingly implemented TPM 2.0, is a technology standard promoted by large American companies. Essentially, TPM is a separate module that is integrated into computers.

Now, in addition to PCs, servers, terminals, and network routers, we have many new components connected to the network. These are controllers for industrial automation, Internet of Things devices, devices that are responsible for human health - pacemakers, glucometers built into watches... Due to the intervention of a hacker, they can trigger falsely or, conversely, fail to trigger falsely. TPM trust modules solve an important problem - trust in data, trust in the system, confirming that it will work correctly.

The TPM idea is correct. There should be standard modules that ensure the legal significance of the information. The concept itself is this: to make a module that is difficult for hackers to make and that only a large state can make. It's like a banknote, a method of protecting money. There is nothing wrong.

The question is different. Windows 7 had a My Computer icon. In Windows 10 it's called "This PC". This is no longer your computer. Technologies are being imposed on us that will ensure our safety, whether we want it or not. It seems like the state introduces prohibition and says that now you will not drink alcohol, since society needs healthy soldiers. So it is here.

If your computer is captured, it means that someone needs it for something. Perhaps to keep an eye on you. If you cannot disable this functionality, then it is not a security feature. It is a passive means of attack. Gathering information is finding a point to attack. Microsoft is taking away your computer for your money. It sells you its operating system and takes control away from you.

Is it possible to check whether a TPM module has a backdoor or not?

You can analyze the standard. But when a computer comes to you with a TPM module soldered into its motherboard that was not manufactured in a company you control, you don’t know what’s inside. They can add anything there.

But can you add a bookmark to any processor or controller?

Yes, sure. And the approach should be the same. In military systems, regulators will never allow the use of a chip made by someone unknown, even according to an open standard. That’s why we have “Baikal” and “Elbrus” processors. Russia's engineering forces are sufficient to design its own TPM. We cannot make it in our factories yet. So is the processor. But we can design, and then check whether they did it the way we needed it, or whether something was added there. Such a mechanism will already allow the use of TPM.

What should we do now that we don’t have our own TPM?

The commonly used analogues of TPM, which largely fulfill its role, are hardware trusted boot modules. They are used even now that TPMs have appeared on motherboards.

It has also become possible to modify the BIOS, and UEFI technology has appeared, a standard that allows you to create trusted boot modules programmatically. In fact, they can host programs that emulate the operation of TPM, which is what is done in many developments. For example, in the seOS operating system, certified by the FSB.

What about the Russian TPM module?

We still have companies in Russia that order motherboards for their projects. For example, Aquarius, Craftway, T-Platforms, MCST and others. Each of them is quite capable of designing its own TPM module. And it will probably be created in the near future, with the support of domestic GOST cryptographic algorithms. And this is important not only for defense enterprises, but also for a wide range of consumers who are obliged to comply with the provisions of Law 152-FZ “On Personal Data”.

Why did the Germans so sharply oppose the TPM 2.0 standard?

Very simple. They want to protect their data and technology from the US. Remember when SUSE Linux came into being? This happened after it became clear that when documents were transferred from one Bundeswehr department to another, the information first ended up in the NSA. Then SUSE Linux was created in Germany and the department was transferred to work with this OS.

In Linux, starting with kernel 3.2, support for TPM 2.0 was also announced. But it can be turned off. But in Windows OS you can’t go higher than eight. Windows is a very user-friendly operating system. It's wonderfully thought out. Tens of thousands of programmers work to make it convenient and comfortable for users. But any change that is forced on you, saying that it is for your safety, is annoying. And specialists, and officials, and governments.

In order not to be afraid of TPM, you need to do special research, conduct a check and find out whether there is anything dangerous there or not. This is a completely standard procedure. Sometimes it is performed on-site at the production site. This is a normal practice when representatives of a country come to the country of the manufacturer and sit in production for some time, understanding the processes.

And who will do this?

This may be of interest to large commercial companies. I think some research work in this format is already underway. But the state is not immediately interested in this, since our cryptography is not there, so the existing modules are not suitable for the defense industries.

Is it possible to use computers with TPM in government agencies?

The issue of using TPM in government agencies is quite complex. I think that in the next editions of TPM it will be possible to replace crypto algorithms. You can now flash the BIOS again and add your own components. This will be the case in TPM. As for current use in the public sector, it’s too early to talk about it. But you need to research the possibility of your own implementation of the standard. It is also necessary to participate in the development of its next version. To be able to embed our cryptography into someone else's TPM.

... In general, the position is clear. TPM is a new level in security. The state will somehow resolve the issue in the defense industry, and the rest will use what they have. In most cases, TPM will protect you from wild hackers (in those matters of protection that TPM provides), but you still can’t escape the attention of Big Brother.

The consortium itself, which started as a purely American project, is expanding. Currently, TCG has 11 Promoter members (AMD, Cisco, Fujitsu, HP, IBM, Infenion, Intel, Juniper, Lenovo, Microsoft and Wave Systems) and 74 Contributor members. Japanese and Chinese companies appeared on these lists. But there are still no Russian representatives there.

Freedom or security? The times of the existentialists Sartre and Camus, who chose the “roads of freedom” and studied a free person standing on the brink of “nothing,” are a thing of the past along with the past century. Most people chose safety. And now he’s only arguing about the length of the leash. So for the mass user the TPM problem does not exist. But the state should not be indifferent to the question of whose leash its government agencies are on. And its citizens too.

The constantly growing number of worms, viruses and elementary holes in modern operating systems and network services forces IT specialists to develop more and more new information security tools. Previously, mainly software solutions were used - hardware and software were not available to everyone. Now, thanks to TPM (Trusted Platform Module) technology, these solutions have reached the masses and become available to everyone. In this app, we'll talk about what TPM is and why it makes sense to use this technology in your enterprise.

What is TPM

The TPM is a microcontroller designed to implement basic security functions using encryption keys. The TPM chip is installed on the computer motherboard and interacts with other system components via the system bus.

The concept of “trusted platform modules” (this is how the abbreviation TPM is translated into Russian) belongs to the Trusted Computing Group (TCG) consortium, which has existed since 2004.

The TPM technology itself did not appear in 2004, but earlier. In 1999, the Trusted Computing Platform Alliance (TCPA) was created. This alliance included the most important hardware and software developers - IBM, HP, Microsoft, etc. Despite the eminence of the participants, the activities of the alliance were reminiscent of the well-known fable about the swan, the crayfish and the pike: everyone “pulled the load” on themselves (each member of the alliance had the right to cancel decision made by other members), so TPM developed rather slowly.

In 2004, the TCPA alliance was transformed into a consortium TrustedComputingGroup. The structure of this organization was different. Only selected companies (they are called promoters) can make important decisions. Such companies are now Intel, HP, IBM, AMD, Seagate, Sony, Sun, Microsoft And Verisign. The remaining companies (there are more than a thousand of them) have the right only to participate in the development of draft specifications or simply receive earlier access to new developments.

The main output of TCPA/TCG is the "trusted platform module", which was formerly called the "Fritz Chip". It was named after US Senator Fritz Hollings, known for his support of Digital Rights Management (DRM).

TPM Objectives

The main task of TPM is to create a secure computer in which all communication processes, as well as hardware and software, are checked and protected. Communication security does not mean the process of protecting a network connection, but protecting the process of interaction between individual parts of the system (for example, the OS).

The TPM module can also be used to verify the integrity and authorship of data. Only authorized users should have access to data, and the security of the transmission of the information itself must be ensured. Integrity check will protect the system from viruses, worms and other programs that change data without notifying the user.

When developing TPM, the goal was not to create a module only to protect personal computers or laptops from viruses - this technology can be used to ensure the security of mobile phones, PDAs, input devices, and disk drives. Together with it, you can use biometric identification devices.

The protection of network connections is handled by a separate division of TCG - Trusted Network Connect (TNC). We will not consider the fruits of TNC's activities, but will limit ourselves only to TPM.

"Iron" and mathematics

It is logical to assume that the TPM chip itself on the motherboard does not solve anything. We need support from the rest of the hardware and mathematics - software.

For example, you can install a hard drive with TPM support (Fig. A37). Such hard drives have been produced for a long time Seagate(Momentus 5400 FDE.2). But Seagate is far from the only manufacturer of hard drives with an encryption function. Other manufacturers, such as Hitachi, also produce “cryptographic drives.” So you have a choice of hardware (you can read about other hardware and software manufacturers with TPM support on the website www.tonymcfadden.net).

Rice. P37. Seagate Momentus 5400 FDE.2 hard drive

As for the OS, TPM technology is supported by most modern operating systems - Windows Vista, Microsoft Windows Server 2003 SP1, Microsoft Windows XP SP2, Windows XP Professional x64, SUSE Linux (since version 9.2) and Enterprise Linux (since version 3 update 3) .

How TPM works

As already noted, the TPM module is implemented as a chip on the motherboard. The TPM chip is integrated into the computer boot process and checks the system hash using the SHA1 (Secure Hash Algorithm) algorithm; it is calculated based on information about all computer components, both hardware (processor, hard drive, video card) and software (OS).

During the boot process of the computer, the chip checks the state of the system, which can only be started in an authorized condition, which is only possible if the correct hash value is detected.

Setting up TPM on Windows

The following guide describes how to use TPM services in Windows Vista:

Windows Vista and Windows Server 2008 use BitLocker disk encryption technology, which is closely related to trusted modules (Figure A38). You can read about setting up BitLocker in Windows Server 2008 and Vista (Fig. P39, P40) here:

Rice. P38. BitLocker Components
Rice. P39. BitLocker encryption is disabled: TPM is not installed or disabled (in BIOS)
Rice. P40. Scheme of interaction between Full Volume Encryption and TPM in Windows

Ready systems with TPM support

Ready-made TPM computers have been on the market for a long time: both laptops and desktop computers. Typically, such systems are produced by well-known manufacturers like HP, so their price may be slightly inflated (surcharge “for the brand”).

Those who want to save money can be recommended to buy hardware with TPM support and assemble everything themselves. The necessary motherboards are produced by many manufacturers, for example ASUS (M2N32-SLI Premium), MSI (Q35MDO), etc. (Fig. A41).

Rice. P41. ASUS M2N32-SLI Premium motherboard (with TPM support)

Why do you need TPM?

Firstly, TPM is an increase in the overall security of the system and additional, implemented at the hardware level, protection against viruses, Trojans and other computer evil spirits. And as we know, you shouldn’t skimp on security, especially in an enterprise.

Secondly, TPM is the encryption of data on a hard drive. TPM allows for a trade-off between security and performance.

Since encryption is done in hardware, there is virtually no impact on performance.

Thirdly, with the help of TPM you can do without a password altogether, using the user’s fingerprint instead. Agree, quite an effective solution. Yesterday we saw such systems in half-fiction films, but today they are already a reality.

TPM is not a panacea

It is important to remember that TPM is not a universal solution or a panacea for all computer ills. No one has canceled a good antivirus and firewall. TPM was developed more to protect the interests of software giants: in order to prevent the user from running unlicensed software. From this point of view, it is not yet clear whether TPM is good or bad, given the number of unlicensed programs in our open spaces. Let's face it - there is a lot of pirated software.

Also, do not forget about the human factor. A person can deliberately give out the password to his system, or write it down somewhere on a yellow piece of paper that he sticks to the monitor, or simply set a very simple password that is not difficult to guess. In this situation, TPM will definitely not help. This is where software comes to the rescue, namely access control systems, but that’s another story.

Notes:

Before you begin reading this book, it is worth talking about units of measurement of information. The basic unit of information is one bit. A bit can contain one of two values ​​- either 0 or 1. Eight bits form a byte. This number of bits is enough to encode 1 character using zeros and ones. That is, one byte contains 1 character of information - a letter, a number, etc. 1024 bytes is one kilobyte (KB), and 1024 kilobytes is 1 megabyte (MB). 1024 megabytes is 1 gigabyte (GB), and 1024 gigabytes is 1 terabyte (TB).

Please note: it is 1024, not 1000. Why was 1024 chosen? Because the computer uses the binary number system (there are only 2 values ​​- 0 and 1), 2 to the 10th power is 1024.

Not always, but often, the capital letter “B” when indicating the unit of measurement of information means “byte”, and the small letter “bit”. For example, 528 MB is 528 megabits, if you convert this value into megabytes (just divide by 8), you get 66 megabytes (66 MB).

2.5-inch Momentus 5400 FDE.2 (full disk encryption) hard drive from Seagate comes as part of the ASI C8015+ laptops (the laptop costs approximately $2,100). The hard drive has a built-in dynamic encryption system with hardware acceleration and TPM support. Additionally, the laptop comes with a fingerprint reader, making it about 20% more expensive than a regular laptop with the same configuration. Momentus hard drive sizes are available in 80, 100, 120 and 160 GB sizes. The SATA 3 Gb/s interface is used.

The main feature of Momentus FDE.2 is the encryption/decryption of written and read information using the AES algorithm with a 128-bit key at the DriveTrust firmware level. Data encryption is carried out absolutely transparently, that is, invisible to the user. Information is presented in open (unencrypted) form only in applications. Data is stored on the hard drive only in encrypted form.

Typically, the process of software encryption significantly reduces system performance (those who have worked with PGPDisk understand what we are talking about). But since in the case of Momentus FDE.2 encryption is carried out at the hardware level, this increases the CPU load by only a few percent.

When booting the TPM system, the user must enter his password. The password is needed not only to continue the download, but also to decrypt the data. Previously, it was also possible to set a password in SETUP, without which it was impossible to boot the operating system. But you could remove the hard drive and connect it to another computer. If no cryptographic means were used, then reading information from the hard drive was not a problem. In the case of TPM, even if you remove the HDD and connect it to another computer, you will not be able to read the information because it is encrypted and you do not know the password to decrypt it.

What to do if the user has forgotten the password? Then you can apply the master password. And if you have forgotten the main password (or you simply don’t know it), then...

In addition, there is a crypto-erase function, which is designed to destroy all data from the hard drive. This operation is necessary when decommissioning a hard drive or transferring it to another user.

Trusted Platform Module

In computer technology, Trusted Platform Module(TPM) is the name of a specification that describes a cryptoprocessor in which cryptographic keys are stored to protect information, as well as a generic name for implementations of the specified specification, for example, in the form of a “TPM chip” or “TPM security device” (Dell). Formerly called the "Fritz chip" (former Senator Ernest "Fritz" Hollings is known for his enthusiastic support for the digital rights management system, DRM). The TPM specification was developed by the Trusted Computing Group. The current version of the TPM specification is 1.2 revision 116, edition March 3, 2011.

Short review

The Trusted Platform Module (TPM), a cryptoprocessor, provides a means of securely generating encryption keys that can restrict the use of keys (both signature and encryption/decryption) with the same degree of non-repeatability as a random number generator. This module also includes the following features: remote certification, binding, and reliable secure storage. Remote attestation creates a link between hardware, system boot, and host configuration (computer OS), allowing a third party (such as a digital music store) to verify that software or music downloaded from the store has not been modified or copied by the user (see TSZAP ). The cryptoprocessor encrypts data in such a way that it can only be decrypted on the computer where it was encrypted, running the same software. The binding encrypts the data using a TPM confirmation key - a unique RSA key written into the chip during its manufacturing process, or another trusted key.

The TPM can be used to verify the authenticity of hardware. Since each TPM chip is unique to a specific device, it makes it possible to unambiguously establish the authenticity of the platform. For example, to check that the system being accessed is the expected system.

TPM architecture

The chip architecture implements the following security algorithms:

• secure memory management,
• bus and data encryption,
• active shielding.

Active shielding allows the chip to detect electrical testing and, if necessary, block the chip. In addition, non-standard technological steps are also used in the manufacture of TPM, such as entangling the topology of IC layers. These measures make it much more difficult to hack the chip, increase the cost of hacking, which leads to a decrease in potential violators.

Input/Output (eng. I/O)

This component controls the flow of information on the bus. Routes messages to appropriate components. The I/O component enforces the access policy associated with TPM functions.

Cryptographic processor

Performs cryptographic operations within the TPM. These operations include:

• Asymmetric key generation (RSA);
• Asymmetric encryption/decryption (RSA);
• Hashing (SHA-1);
• Random number generation.

TPM uses these capabilities to generate random sequences, asymmetric key generation, digital signing, and confidentiality of stored data. TPM also supports symmetric encryption for internal needs. All stored keys must match the strength of a 2048-bit RSA key.

Non-Volatile Storage

Used to store the confirmation key, the root key (Storage Root Key, SRK), authorization data, and various flags.

Endorsement Key (EK)

RSA Key Generator

Creates RSA key pairs. TCG does not impose minimum key generation time requirements.

RSA Engine

Used for digital signatures and encryption. There are no restrictions on the implementation of the RSA algorithm. Manufacturers may use the Chinese Residue Theorem or any other method. The minimum recommended key length is 2048 bits. The value of the open exponent must be .

The trusted platform

In TCG systems, roots of trust are components that need to be trusted. A complete set of roots of trust has the minimum functionality required to describe a platform, which affects trust in that platform. There are three roots of trust: the root of trust for measurements (RTM), the root of trust for storage (RTS), and the root of trust for messages (RTR). RTM is a computational engine that makes reliable measurements of platform integrity. RTS is a computing engine capable of storing hashes of integrity values. RTR is a mechanism that reliably reports information stored in RTS. Measurement data describes the properties and characteristics of the components being measured. Hashes of these measurements are a “snapshot” of the state of the computer. Their storage is carried out by the RTS and RTR functionality. By comparing the hash of measured values ​​with the hash of the trusted state of the platform, we can talk about the integrity of the system.

Possible applications

Authentication

TPM can be considered as a next generation security token. The crypto processor supports both user and computer authentication, ensuring that only authorized users and computers have access to the network. This can be used, for example, when protecting email based on encryption or signing with digital certificates tied to a TPM. Also, eliminating passwords and using TPMs allows for stronger authentication models for wired, wireless, and VPN access.

Data protection against theft

This is the main purpose of a “secure container”. Self-encrypting devices based on Trusted Computing Group specifications enable built-in encryption and data access control. These devices provide full disk encryption, protecting data if your computer is lost or stolen.

Advantages:

• Performance improvement

Hardware encryption allows you to operate with the entire range of data without loss of performance.

• Increased security

Encryption is always enabled. In addition, the keys are generated within the device and never leave it.

• Low usage costs

No modifications to the operating system, applications, etc. are required. No CPU resources are used for encryption.

The TPM+Bitlocker combination has great prospects. This solution allows you to encrypt the entire disk transparently from the software.

Network Access Control (NAC)

TPM can confirm the identity of a computer and even its functionality before gaining access to the network and, if necessary, quarantine the computer.

Protection of software from changes

Certification of program code will protect games from cheating, and sensitive programs like banking and postal clients will be protected from intentional modification. The addition of a “Trojan horse” to the installer of the latest version of the messenger will be stopped immediately.

Copy protection

Copy protection is based on the following chain: the program has a certificate that provides it (and only it) with access to the decryption key (which is also stored in the TPM). This provides copy protection that cannot be bypassed by software.

Implementation

Manufacturers

Already more than 300,000,000 computers have been equipped with a TPM chip. In the future, TPM may be installed on devices such as mobile phones. TPM microcontrollers are manufactured by the following companies:

• Sinosun,
• Nuvoton,

Criticism

Trusted Platform Module is also criticized for its name. trust- always mutual, while the TPM developers do not trust the user), and for the infringements of freedom associated with it. For these infringements the device is often called Treacherous computing(“treacherous calculations”).

Losing "ownership" of the computer

The owner of a computer can no longer do whatever he wants with it, transferring some rights to software manufacturers. In particular, TPM can interfere (due to bugs in the software or an intentional decision of the developers):

• transfer data to another computer;
• freely choose software for your computer;
• process existing data using any available programs.

Loss of anonymity

It is enough to recall the controversy over the identification number of the Pentium III processor to understand what a remotely readable and unchangeable computer identifier can lead to.

Suppression of competitors

An industry-leading program (like AutoCAD, Microsoft Word, or Adobe Photoshop) may install encryption on its files, making it impossible for third-party programs to access those files, thus potentially threatening free competition in the application software market.

Breaking

If the TPM fails, protected containers become inaccessible, and the data in them becomes unrecoverable. TPM is practical only if there is a complex backup system - naturally, to ensure secrecy, it must have its own TPMs.

Hacks

At the Black Hat 2010 computer security conference, it was announced that the Infineon SLE66 CL PE chip, manufactured to TPM specifications, was hacked. This chip is used in computers, satellite communications equipment and game consoles. An electron microscope (costing about $70,000) was used for the hack. The chip shell was dissolved with acid, and tiny needles were used to intercept commands. Infineon claims that they were aware that the chip could be physically hacked. Borchert, vice president of the company, assured that expensive equipment and the technical complexity of hacking do not pose a danger to the vast majority of chip users.

A trusted platform module, or TPM (trusted platform module), is a separate microchip on a computer's motherboard that performs a specific range of tasks related to cryptography and computer security.

For example, using the TPM cryptoprocessor you can encrypt a computer hard drive. Of course, the central processor can do this, but then it will have to perform more tasks, and the encryption and decryption speed will be much lower. Hardware-based encryption in the TPM occurs with virtually no performance loss.

Decryption is sometimes incorrectly called deciphering. The difference between them is that when decrypting, you know the algorithm and secret key with which the data is encrypted, but when decrypting, you do not.

TPM can also protect credentials and verify programs running on the system. Prevents infection by rootkits and bootkits (types of malware that penetrate the computer before the operating system boots or hide their presence in the system and therefore cannot be recognized by the system), ensuring that the computer's configuration is not changed without the user's knowledge.

In addition, each TPM cryptographic module has a unique identifier that is written directly into the chip and cannot be changed. Therefore, the cryptochip can be used for authentication when accessing a network or any application.

TPM can generate strong encryption keys when required by the operating system (OS).

But before you can use the TPM, it needs to be configured. Setting up the module comes down to a few simple steps.

• First, the chip must be activated in the computer's BIOS (if it is not activated).
• Secondly, you need to become its owner at the operating system level.

Let's look at these steps in more detail.

1 Enabling the TPM in the computer BIOS

To enable the module, go to the BIOS and go to the security section. Although the BIOS can vary significantly from computer to computer, as a rule, the section with security settings is called "Security". There should be an option in this section called "Security Chip".

The module can be in three states:

• Disabled.
• Enabled and not activated (Inactive).
• Enabled and enabled (Active).

In the first case, it will not be visible in the operating system, in the second, it will be visible, but the system will not use it, and in the third, the chip is visible and will be used by the system. Set the status to "active".

You can also clear old keys generated by the chip in the settings.

Clearing the TPM can come in handy if you want to sell your computer, for example. Please note that if you erase the keys, you will not be able to recover the data encrypted by these keys (unless, of course, you encrypt your hard drive).

Now save the changes ("Save and Exit" or F10 key) and restart the computer.

After your computer boots, open Device Manager and make sure that the trusted module appears in the list of devices. It should be in the "Security Devices" section.

2 Initializing the TPM on Windows

All that remains is to initialize the chip in the operating system. To do this, you need to open the TPM module management snap-in. Click the buttons Windows+R(the “Run” window will open), enter tpm.msc in the input field and press “Enter”. The snap-in will start "Managing the Trusted Platform Module (TPM) on the local computer".

Here, by the way, you can read additional information - what TPM is, when you need to turn it on and off, change the password, etc.. A good series of articles dedicated to TPM is on the Microsoft website.

On the right side of the snap-in there is an action menu. Click "Initialize TPM...". If this option is not active, then your chip has already been initialized. If it was not initialized by you, and you do not know the owner’s password, then it is advisable to reset and clear the module’s memory, as described in the previous paragraph.

When the TPM Initialization Wizard starts, it will prompt you to create a password. Select the Automatically generate password option.

The TPM initialization program will generate a password. Save it as a file or print it. Now click the “Initialize” button and wait a bit.

Upon completion, the program will report successful module initialization. After initialization is complete, all further actions with the module - disabling, cleaning, data recovery in case of failures, resetting the lock - will only be possible using the password that you just received.

Now the initialization action has become inactive, but it is now possible to disable the TPM, change the owner password and reset the module lock if this happens (the module locks itself to prevent fraud or attack).

Actually, this is where the management capabilities of the TPM module end. All further operations that will require the capabilities of the chip will occur automatically - transparent to the operating system and invisible to you. All this must be implemented in software. More recent operating systems, such as Windows 8 and Windows 10, use TPM capabilities more widely than older operating systems.