Systems and methods for demonstrating identity to a trusted platform module
The present disclosure provides systems and methods for demonstrating the identity of a central processing unit (CPU) to a Trusted Platform Module (TPM) with improved security against, for example, interposers on a communications bus. In particular, according to an aspect of the present disclosure, a CPU can generate a policy alias key that can be used to sign a challenge to prove the identity of the CPU to the TPM. Specifically, the policy alias key can be generated by the CPU by performing a key derivation function on a combined identity value generated by the CPU for the CPU and TPM. The combined identity value can be generated by the CPU from a CPU device identity value and a public endorsement key (EK) associated with the TPM.
1. A computer system with improved security, the computer system comprising:
a central processing unit (CPU) configured to communicate with a Trusted Platform Module (TPM) over a communications bus, wherein the CPU is configured to perform CPU operations to prove its identity to the TPM, the CPU operations comprising:
performing a key derivation function using a CPU device identity value and a public endorsement key associated with the TPM to generate a combined identity value for the CPU and TPM;
performing a key derivation function on the combined identity value to generate a policy alias key;
receiving a challenge from the TPM;
signing the challenge with the policy alias key to generate a signed challenge; and
returning the signed challenge to the TPM.
2. The computer system of claim 1 , wherein the CPU device identity value comprises a compound device identity (CDI) value for the CPU.
3. The computer system of claim 2 , wherein generating the CDI value for the CPU comprises performing a key derivation function using a unique device secret associated with the CPU and a hash of a first mutable code associated with the CPU.
4. The computer system of claim 1 , wherein the communications bus consists of a physical communications bus.
5. The computer system of claim 1 , wherein the challenge comprises a session nonce.
6. The computer system of claim 1 , wherein the CPU is configured to perform further operations comprising:
regenerating, at a new boot session of the CPU, the policy alias key.
7. The computer system of claim 1 , wherein the CPU is configured to perform further operations comprising:
performing an audit of one or more operations requested by the CPU from the TPM; and
when the audit identifies a failure to correctly complete at least one of the one or more operations, destroying the policy alias key.
8. The computer system of claim 1 , further comprising the TPM.
9. The computer system of claim 8 , wherein the TPM is configured to perform TPM operations to verify the identity of the CPU, the TPM operations comprising:
generating the challenge;
transmitting the challenge to the CPU;
receiving the signed challenge from the CPU;
validating the signed challenge; and
when the signed challenge is valid, performing one or more operations requested by the CPU from the TPM.
10. The computer system of claim 9 , wherein performing the one or more operations requested by the CPU comprises unsealing a secret stored by the TPM.
11. A computer system with improved security, the computer system comprising:
a Trusted Platform Module (TPM) configured to communicate with a central processing unit (CPU) over a communications bus, wherein the TPM is configured to perform TPM operations to confirm an identity of the CPU, the TPM operations comprising:
providing a challenge to the CPU;
receiving a signed challenge from the CPU, wherein the signed challenge comprises the challenge signed by the CPU using a policy alias key, the policy alias key generated by the CPU by performance of a key derivation function on a combined identity value for the CPU and TPM, the combined identity value for the CPU and TPM generated by the CPU by performance of a key derivation function by the CPU on a CPU device identity value and a public endorsement key associated with the TPM;
performing an evaluation of the signed challenge; and
when the signed challenge satisfies the evaluation, performing one or more operations requested by the CPU from the TPM.
12. The computer system of claim 11 , wherein the CPU device identity value comprises a compound device identity (CDI) value for the CPU.
13. The computer system of claim 12 , wherein the CDI value for the CPU has been generated by performance by the CPU of a key derivation function using a unique device secret associated with the CPU and a hash of a first mutable code associated with the CPU.
14. The computer system of claim 11 , wherein the communications bus consists of a physical communications bus.
15. The computer system of claim 11 , wherein performing the one or more operations requested by the CPU comprises unsealing a secret stored by the TPM.
16. The computer system of claim 11 , further comprising the CPU.
17. The CPU of claim 1 , wherein the CPU device identity value comprises a compound device identity (CDI) value for the CPU, and wherein generating the CDI value for the CPU comprises performing a key derivation function using a unique device secret associated with the CPU and a hash of a first mutable code associated with the CPU.
18. The CPU of claim 1 , wherein said receiving, signing, and returning are performed in response to a request by the CPU to store a secret at the TPM or unseal a secret from the TPM.
19. A computer system with improved security, the computer system comprising:
a hardware based trusted computing base (TCB) comprising a plurality of layers of TCB components, wherein the TCB is configured to communicate with a Trusted Platform Module (TPM) over a communications bus, wherein the TCB is configured to perform TCB operations to prove identity to the TPM, the TCB operations comprising:
performing a key derivation function using a compound device identifier (CDI) value for the TCB and a public endorsement key associated with the TPM to generate a combined identity value for the TCB and TPM, wherein the CDI value for the TCB comprises a secret value resulting from the sequential application for each of the plurality of layers of TCB components of a cryptographic one-way function to a combination of a respective secret value for the layer and a measurement of a subsequent layer;
performing a key derivation function on the combined identity value to generate a policy alias key;
receiving a challenge from the TPM;
signing the challenge with the policy alias key to generate a signed challenge; and
returning the signed challenge to the TPM.