Virtual Trusted Platform Module (vTPM): Difference between revisions
Rcpavlicek (talk | contribs) No edit summary |
Lars.kurth (talk | contribs) m (→References) |
||
| (4 intermediate revisions by 2 users not shown) | |||
| Line 16: | Line 16: | ||
Xen 4.3 exposes TPM functionality to virtual guest operating system (a DomU). This allows programs to interact with a TPM in a virtual system the same way they interact with a TPM on the physical system. Each guest gets its own unique, emulated, software TPM. However, each of the vTPM's secrets (Keys, NVRAM, etc) are managed by a vTPM Manager domain, which seals the secrets to the Physical TPM. If the process of creating each of these domains (manager, vTPM, and guest) is trusted, the vTPM subsystem extends the chain of trust rooted in the hardware TPM to virtual machines in Xen. Each major component of vTPM is implemented as a separate domain, providing secure separation guaranteed by the hypervisor. The vTPM domains are implemented in |
Xen 4.3 exposes TPM functionality to virtual guest operating system (a DomU). This allows programs to interact with a TPM in a virtual system the same way they interact with a TPM on the physical system. Each guest gets its own unique, emulated, software TPM. However, each of the vTPM's secrets (Keys, NVRAM, etc) are managed by a vTPM Manager domain, which seals the secrets to the Physical TPM. If the process of creating each of these domains (manager, vTPM, and guest) is trusted, the vTPM subsystem extends the chain of trust rooted in the hardware TPM to virtual machines in Xen. Each major component of vTPM is implemented as a separate domain, providing secure separation guaranteed by the hypervisor. The vTPM domains are implemented in |
||
mini-os to reduce memory and processor overhead. |
mini-os to reduce memory and processor overhead. |
||
== vTPM 2.0 in Xen 4.6 == |
|||
Support for vTPM 2.0 was added in Xen 4.6: for more information, see [http://xenbits.xen.org/docs/unstable/misc/vtpmmgr.txt] section '''Appendix B: vtpmmgr on TPM 2.0'''. |
|||
== References == |
== References == |
||
| Line 23: | Line 26: | ||
* [http://xenbits.xen.org/docs/unstable/misc/vtpmmgr.txt Virtual TPM Manager CLI] |
* [http://xenbits.xen.org/docs/unstable/misc/vtpmmgr.txt Virtual TPM Manager CLI] |
||
* [https://mhsamsal.wordpress.com/2013/12/05/configuring-virtual-tpm-vtpm-for-xen-4-3-guest-virtual-machines/ Configuring Virtual TPM (vTPM) for Xen 4.3 Guest Virtual Machines] |
* [https://mhsamsal.wordpress.com/2013/12/05/configuring-virtual-tpm-vtpm-for-xen-4-3-guest-virtual-machines/ Configuring Virtual TPM (vTPM) for Xen 4.3 Guest Virtual Machines] |
||
* [https://www.usenix.org/legacy/event/sec06/tech/full_papers/berger/berger.pdf Extensive USENIX Research Paper on vTPM] |
* [https://www.usenix.org/legacy/event/sec06/tech/full_papers/berger/berger.pdf Extensive USENIX Research Paper on vTPM (2006)] |
||
* [http://www.trustedcomputinggroup.org/ TrustedComputingGroup] which defines TPM |
|||
| Line 29: | Line 33: | ||
[[Category:Xen 4.3]] |
[[Category:Xen 4.3]] |
||
[[Category:Xen 4.4]] |
[[Category:Xen 4.4]] |
||
[[Category:Xen 4.3]] |
|||
[[Category:Xen 4.5]] |
|||
[[Category:Xen 4.6]] |
|||
[[Category:Security]] |
[[Category:Security]] |
||
Latest revision as of 12:01, 12 October 2015
Xen provides support for Trusted Platform Module (TPM). You must have an x86 machine with a TPM on the motherboard, to make use of vTPM. The reader is assumed to have familiarity with building and installing Xen, Linux, and a basic understanding of the TPM and vTPM concepts.
vTPM Support in XL
vtpm-attach domain-id vtpm-device
Creates a new vtpm device in the domain specified by domain-id. vtpm-device describes the device to attach, using the same format as the vtpm string in the domain config file. See xl.cfg for more information.
vtpm-detach domain-id devid|uuid
Removes the vtpm device from the domain specified by domain-id. devid is the numeric device id given to the virtual trusted platform module device. You will need to run xl vtpm-list to determine that number. Alternatively the uuid of the vtpm can be used to select the virtual device to detach.
vtpm-list domain-id
List virtual trusted platform modules for a domain.
vTPM Extensions in Xen 4.3
Xen 4.3 exposes TPM functionality to virtual guest operating system (a DomU). This allows programs to interact with a TPM in a virtual system the same way they interact with a TPM on the physical system. Each guest gets its own unique, emulated, software TPM. However, each of the vTPM's secrets (Keys, NVRAM, etc) are managed by a vTPM Manager domain, which seals the secrets to the Physical TPM. If the process of creating each of these domains (manager, vTPM, and guest) is trusted, the vTPM subsystem extends the chain of trust rooted in the hardware TPM to virtual machines in Xen. Each major component of vTPM is implemented as a separate domain, providing secure separation guaranteed by the hypervisor. The vTPM domains are implemented in mini-os to reduce memory and processor overhead.
vTPM 2.0 in Xen 4.6
Support for vTPM 2.0 was added in Xen 4.6: for more information, see [1] section Appendix B: vtpmmgr on TPM 2.0.
