Intel TXT と VMware vSphere - Trusted Computing Group
Intel TXT と VMware vSphere - Trusted Computing Group
Intel TXT と VMware vSphere - Trusted Computing Group
You also want an ePaper? Increase the reach of your titles
YUMPU automatically turns print PDFs into web optimized ePapers that Google loves.
<strong>Intel</strong> <strong>TXT</strong><strong>VMware</strong> <strong>vSphere</strong><br />
<br />
<br />
Nov. 28, 2012<br />
© 2011 <strong>VMware</strong> Inc. All rights reserved
Agenda<br />
§ <strong>Intel</strong> <strong>TXT</strong><br />
• RTM (Root of Trust for Measurement)<br />
§ <strong>VMware</strong> <strong>vSphere</strong><br />
§ <br />
2
Trust<br />
§ Trust<br />
“An entity can be trusted if it always behaves in the expected manner for the<br />
intended purpose” by David Grawrock, <strong>Intel</strong><br />
• Known state<br />
• Measurement<br />
• TPMPCR Extend<br />
• Chain of Trust<br />
• RTM (Root of Trust for Measurement)<br />
• <strong>Intel</strong> <strong>TXT</strong><br />
§ Trust<br />
• VMMTCBRootkitVMM<br />
<br />
• BIOS Rootkit<br />
• Reset attacks ()<br />
3
TPMPCR ExtendChain of Trust<br />
TPM<br />
PCR (Platform<br />
Configuration<br />
Registers)<br />
24, 20<br />
Attestation Keys<br />
<br />
<br />
<br />
PCR_Extend API<br />
<br />
NVRAM<br />
Endorsement Key<br />
2048RSA<br />
PCR(old)<br />
+<br />
<br />
SHA-1<br />
Chain of Trust<br />
TPM<br />
PCR(New)<br />
RTM<br />
Module A<br />
Module B<br />
PCR-x<br />
PCR-y<br />
Boot sequence Chain of Trust <br />
OS/VMM known state <br />
4
Chain of Trust<br />
§ RTM (Root of Trust for Measurement)<br />
• RTMMeasurement<br />
§ SRTM (Static RTM) : TCGBIOS<br />
• RTMFirmware<br />
• (<strong>Intel</strong> <strong>TXT</strong>)<br />
• Chain<br />
• BIOS Boot SequenceOS/VMM Boot Loader<br />
§ DRTM (Dynamic RTM) : <strong>Intel</strong> <strong>TXT</strong><br />
• RTM<strong>Intel</strong> <strong>TXT</strong>CPU(GETSEC[SENTER])<br />
• GETSEC[SENTER]Chain<br />
• OSBoot LoaderMLEMLEMeasurement<br />
SINIT ACM(Authenticated Code Module)<br />
§ <strong>Intel</strong> <strong>TXT</strong>SRTMDRTM<br />
5
<strong>Intel</strong> <strong>TXT</strong>Measured Boot<br />
System<br />
Power<br />
ON PCR0 PCR0 PCR0<br />
uCode<br />
Measures<br />
BIOS ACM<br />
BIOS ACM<br />
Measures<br />
BIOS Init<br />
Code<br />
BIOS Init<br />
Init <strong>TXT</strong> &<br />
Memory,<br />
Measure<br />
SMM etc.<br />
BIOS Init<br />
Lock <strong>TXT</strong><br />
& Memory<br />
Config<br />
Non-<br />
Critical<br />
Code<br />
Option<br />
ROMs etc.<br />
Load<br />
bootloader<br />
Load tboot<br />
SRTM<br />
PCR17 PCR18 PCR19, 20<br />
tboot<br />
tboot<br />
uCode<br />
SINIT ACM<br />
MLE<br />
Load SINIT<br />
ACM &<br />
VMKernel,<br />
modules<br />
Execute<br />
GETSEC<br />
[SENTER]<br />
Measures<br />
SINIT ACM<br />
Measures<br />
MLE<br />
Measures<br />
VMKernel,<br />
modules<br />
DRTM<br />
6
<strong>VMware</strong> <strong>vSphere</strong><br />
§ <strong>Intel</strong> <strong>TXT</strong> (LT-SX)<br />
• Xeon 5600 Series (Westmere)<br />
• <strong>Intel</strong> <strong>TXT</strong>2007vPro2(Weybridge)<br />
• OEMFirmware<br />
§ <strong>VMware</strong><br />
• ESXi 4.1 U1<br />
• <strong>Intel</strong> <strong>TXT</strong><br />
• Web<br />
(http://www.vmware.com/resources/compatibility/search.php?deviceCategory=server)<br />
§ Measured Boot ( ≠ Verified Boot)<br />
• PCR 20 Extension: VMKernel, <br />
7
Compatibility Guide<br />
8<br />
Feature
ESXi5.12041<strong>TXT</strong>48 (2.3%)<br />
9
<strong>vSphere</strong><strong>Intel</strong> <strong>TXT</strong>Enable<br />
§ BIOS<strong>Intel</strong> <strong>TXT</strong><br />
Enable<br />
• TPMActivation<br />
§ ESXi 5.x<br />
• Enable by Default<br />
• <br />
§ ESXi 4.x<br />
• Disable by Default<br />
• enableTboot option<br />
10
tboot (:Dell Power Edge R610)<br />
TBOOT: executing GETSEC[SENTER]...<br />
TBOOT: ***************TBOOT *******************<br />
TBOOT: TPM is ready<br />
TBOOT: PCRs after extending:<br />
TBOOT: PCR 17: 49 6c 85 30 d2 b4 ba 6a 6f 39 01 45 5c 8c 24 0b bb 48 2d 85<br />
TBOOT: PCR 18: f6 fd 30 6d 2f a3 3e 21 c6 9c a5 98 33 0b 64 df 1e d0 d0 02<br />
TBOOT: PCR 19: 97 3d 1a 14 43 7d 69 94 f0 f2 de d9 c1 af 09 c7 e1 66 f7 b9<br />
TBOOT: PCR 20: 7f 82 4e a4 8e 5d 50 a4 b2 36 15 22 23 20 6b 00 62 0b c7 4b<br />
ESXi<br />
~ # bootOption -o<br />
Options : vmb<strong>Trusted</strong>Boot=true tboot=0x0x101a000 no-auto-partition \<br />
bootUUID=743b963c66f8db873f0c346b224fef87<br />
11
<strong>Trusted</strong> <strong>Computing</strong> Pool<br />
VM<br />
VM<br />
VM<br />
VM<br />
VM<br />
VM<br />
ESXi<br />
ESXi<br />
ESXi<br />
HW/<strong>TXT</strong><br />
HW/<strong>TXT</strong><br />
HW<br />
Cloud<br />
Controller<br />
Remote<br />
Attestation<br />
Server<br />
• <strong>Trusted</strong> Server<br />
• PCRESXi<br />
12
Change language