Configuring a trusted platform module
A method includes storing configuration data for a Trusted Platform Module (TPM) in a pre-boot environment such as Unified Extensible Firmware Interface (UEFI), reading the configuration data, and automatically configuring the TPM based upon the configuration data. The configuring includes storing values of TPM parameters in non-volatile memory of the TPM. A method includes UEFI firmware of a circuit board on an assembly line configuring a TPM. An information handling system includes UEFI firmware and a TPM. The UEFI firmware configures the TPM from a configuration file stored in memory of the UEFI firmware.
1. An information handling system comprising:
a processor;
a Trusted Platform Module (TPM); and
a first non-volatile memory to store Unified Extensible Firmware Interface (UEFI) system Basic Input/Output System (BIOS) firmware
and data to provision the TPM for operation, execution of the firmware by the processor to:
read the data from the first non-volatile memory; and
send commands to the TPM, the commands to provision the TPM based upon the data, the provisioning including storing TPM parameters in a second non-volatile memory within the TPM,
wherein the data includes data to provision the TPM for generation of an endorsement key by the TPM, and the provisioning includes the UEFI system BIOS firmware issuing a command to the TPM to generate an endorsement key based upon the data.
2. The information handling system of claim 1 , wherein the provisioning comprises provisioning the TPM for Intel's Trusted Execution Technology and provisioning the TPM for Physical Presence Interface.
3. The information handling system of claim 1 , wherein the provisioning comprises a UEFI tool running in a UEFI shell to read the data and to provision the TPM based upon the data.
4. The information handling system of claim 1 , wherein the provisioning comprises:
resetting the UEFI system BIOS firmware; and
in response to the resetting, the UEFI system BIOS firmware reading the data and issuing commands to the TPM based upon the data, the commands including the command to the TPM to generate the endorsement key.
5. The information handling system of claim 1 , further comprising an operating system to issue a command to the TPM to generate an endorsement key.
6. The information handling system of claim 5 , further comprising a TPM base services driver to enable the operating system to issue the command to the TPM to generate the endorsement key.
7. The system of claim 1 , wherein the data is received from a test system external to the information handling system.
8. A method comprising:
receiving data during the manufacture of an information handling system, the data to provision a Trusted Platform Module (TPM) for operation;
storing the data in a first non-volatile memory at the information handling system, wherein Unified Extensible Firmware Interface (UEFI) system Basic Input/Output System (BIOS) firmware is stored in the first non-volatile memory;
reading, by the UEFI system BIOS firmware, the data; and
provisioning the TPM based upon the data, the provisioning comprising the UEFI system BIOS firmware storing TPM parameters in a second non-volatile memory within the TPM,
wherein the data includes data to provision the TPM for generation of an endorsement key by the TPM, and the provisioning includes the UEFI system BIOS firmware issuing a command to the TPM to generate an endorsement key based upon the data.
9. The method of claim 8 , wherein the provisioning comprises provisioning the TPM for Trusted Execution Technology and provisioning the TPM for Physical Presence Interface.
10. The method of claim 8 , wherein:
the reading comprises a UEFI tool running in a UEFI shell reading the data; and
the provisioning comprises the UEFI tool provisioning the TPM based upon the data.
11. The method of claim 8 , further comprising an operating system issuing a command to the TPM to generate an endorsement key.
12. The method of claim 11 , further comprising loading a TPM base services driver to enable the operating system to issue the command to the TPM to generate the endorsement key.
13. The method of claim 8 , wherein the data is received from a test system external to the information handling system.
14. A method comprising:
receiving data during the manufacture of an information handling system, the data to provision a Trusted Platform Module (TPM) for operation;
storing the data in a first non-volatile memory of a circuit board on an assembly line of an original equipment manufacturer (OEM) for the manufacture of the information handling system, wherein a Unified Extensible Firmware Interface (UEFI) system Basic Input/Output System (BIOS) firmware is stored in the first non-volatile memory;
attaching the TPM to the circuit board;
reading, by the UEFI system BIOS firmware, the data;
provisioning the TPM based upon the data, the provisioning including setting TPM parameters, the TPM parameters stored in a second non-volatile memory within the TPM; and
shipping the information handling system to a customer,
wherein the data includes data for the generation of an endorsement key by the TPM, and the provisioning includes:
the UEFI system BIOS firmware issuing a command to the TPM to generate an endorsement key based upon the data; and
the TPM generating an endorsement key in response to the command.
15. The method of claim 14 , wherein the provisioning comprises running the circuit board under a test host.
16. The method of claim 14 , further comprising:
attaching a golden processor to the circuit board; and
attaching a golden memory to the circuit board, wherein the golden processor and golden memory are used during the provisioning of the TPM and the golden processor and golden memory are replaced on the circuit board before shipping the information handling system to the customer.
17. The method of claim 14 , wherein the provisioning comprises provisioning the TPM based upon characteristics of the information handling system pursuant to a policy of the OEM.