Configuring a trusted platform module
A method includes storing configuration data for a Trusted Platform Module (TPM) in a pre-boot environment such as Unified Extensible Firmware Interface (UEFI), reading the configuration data, and automatically configuring the TPM based upon the configuration data. The configuring includes storing values of TPM parameters in non-volatile memory of the TPM. A method includes UEFI firmware of a circuit board on an assembly line configuring a TPM. An information handling system includes UEFI firmware and a TPM. The UEFI firmware configures the TPM from a configuration file stored in memory of the UEFI firmware.
1. An information handling system comprising:
a processor;
a Trusted Platform Module (TPM); and
a first non-volatile memory to store Basic Input/Output System (BIOS) firmware and to store data to provision the TPM for operation, wherein execution of the BIOS firmware by the processor includes:
issuing a command to the TPM by a UEFI shell application to provision the TPM for Trusted Execution Technology and Physical Presence interface;
issuing a command to the TPM by the UEFI shell application, the command to generate an endorsement key based on the data; and
issuing another command by the UEFI shell application to the TPM, the other command to store the endorsement key at a second non-volatile memory within the TPM.
2. The information handling system of claim 1 , wherein the provisioning includes a UEFI tool running in the UEFI shell to read the data and to issue the command to generate the endorsement key.
3. The information handling system of claim 1 , wherein the provisioning includes:
resetting the BIOS firmware; and
in response to the resetting, the BIOS firmware reading the data and issuing commands to the TPM based upon the data, the commands including the command to the TPM to generate the endorsement key.
4. The information handling system of claim 1 , further comprising an operating system to issue a command to the TPM to generate an endorsement key.
5. The information handling system of claim 4 , further comprising a TPM base services driver to enable the operating system to issue the command to the TPM to generate the endorsement key.
6. The information handling system of claim 1 , wherein the BIOS firmware includes Unified Extensible Firmware Interface compliant firmware.
7. The information handling system of claim 1 , wherein the data is received from a test system external to the information handling system.
8. A method comprising:
receiving data during the manufacture of an information handling system, the data to provision a Trusted Platform Module (TPM) for operation; and
storing the data in a first non-volatile memory at the information handling system, the first non-volatile memory further to store Basic Input/Output Sytem (BIOS) firmware;
wherein execution of the BIOS firmware includes:
issuing a command to the TPM by a UEFI shell application to provision the TPM for Trusted Execution Technology and Physical Presence interface;
issuing a command to the TPM by the UEFI shell application, the command to generate an endorsement key based on the data; and
issuing a command to the TPM by the UEFI shell application, the command to store the endorsement key at a second non-volatile memory within the TPM.
9. The method of claim 8 , further comprising:
providing a UEFI tool running in the UEFI shell,
the UEFI tool to provision the TPM based upon the data.
10. The method of claim 8 , further comprising an operating system issuing a command to the TPM to generate an endorsement key.
11. The method of claim 10 , further comprising loading a TPM base services driver to enable the operating system to issue the command to the TPM to generate the endorsement key.
12. The method of claim 8 , wherein the BIOS firmware includes Unified Extensible Firmware Interface compliant firmware.
13. The method of claim 8 , wherein the data is received from a test system external to the information handling system.
14. A method comprising:
attaching a golden processor to a circuit board;
attaching a golden memory to the circuit board, wherein the golden processor and the golden memory are used during the provisioning of the TPM and the golden processor and the golden memory are replaced on the circuit board before shipping the information handling system to a customer;
receiving data during the manufacture of an information handling system, the data to provision a Trusted Platform Module (TPM) for operation;
storing the data in a first non-volatile memory of a circuit board on an assembly line of an original equipment manufacturer (OEM) for the manufacture of the information handling system, the first non-volatile memory further to store Basic Input/Output System (BIOS) firmware; and
attaching the TPM to the circuit board;
wherein execution of the BIOS firmware includes:
issuing a command to the TPM, the command to generate an endorsement key based on the data; and
storing the endorsement key at a second non-volatile memory within the TPM.
15. The method of claim 14 , wherein the provisioning includes running the circuit board under a test host.
16. The method of claim 8 , further comprising:
attaching a golden processor to the circuit board; and
attaching a golden memory to the circuit board, wherein the golden processor and golden memory are used during the provisioning of the TPM and the golden processor and golden memory are replaced on the circuit board before shipping the information handling system to the customer.
17. The method of claim 14 , wherein the provisioning comprises provisioning the TPM based upon characteristics of the information handling system pursuant to a policy of the OEM.
18. The method of claim 14 , wherein the BIOS firmware includes Unified Extensible Firmware Interface compliant firmware.