可信计算技术最佳实践白皮书.pdf

白皮书作者白皮书作者 This document is MulanPSL v2 licensed.龙蜥社区及龙蜥操作系统也获得了一定的行业认可，、荣获、“OSCAR 开源尖峰案例奖”等 25 项行业奖项。实验室简介 实验室设施及业务概况 实验室建设 SIG SIG 地址：https:/ 钉钉群：“龙蜥-可信计算 SIG 技术交流群”，群号：15370024496 微信群：“龙蜥-可信计算 SIG 技术交流群”1.1.3.3 futureTPM 工作组与主要目标 2.国家标准化管理委员会 ISO/IEC 11889 系列标准 TSS 规范官网入口：https:/trustedcomputinggroup.org/resource/tcg-software-stack-tss-specification/缩略语 PTP Platform TPM Profile CRB Command Response Buffer interface DDWG Device Drivers Writers Guide Certification PP Certification Protection Profile TIS TPM Interface Specification PC Client 标准及配套文档体系:缩略语 PFP Platform Firmware Profile PPI Physical Presence Interface FIM Firmware Integrity Measurement MOR Reset Attack Mitigation Memory on reset attack mitigation RIM Reference Integrity Manifest DRTM Dynamic Root of Trust for Measurement 标准编制 应用场景 标准推广 3.swtpm swtpm libtpms 1.#安装依赖包 2.yum install-y automake autoconf libtool gcc gcc-c+make 3.openssl-devel pkg-config socat net-tools-deprecated 4.libtasn1-devel gnutls gnutls-devel libseccomp-devel 5.json-glib-devel expect softhsm 6.#下载 libtpms 源码 7.git clone https:/ 8.cd libtpms 9.#编译并安装 libtpms 10./autogen.sh-prefix=/usr-libdir=/usr/lib64-with-openssl 11.-with-tpm2 12.13.make-j4 14.make-j4 check 15.sudo make install 16.#下载 swtpm 源码 17.git clone https:/ 18.cd swtpm 19.#编译并安装 swtpm 20./autogen.sh-prefix=/usr-libdir=/usr/lib64-with-openssl 21.-with-tss-user=root-with-tss-group=tss-with-cuse 22.make-j4 23.sudo make check-j4 24.sudo make install 1.yum install libtpms swtpm swtpm-devel swtpm-tools swtpm 编译。1.#安装内核 cuse 模块 2.yum install kernel-modules-extra 3.modprobe cuse 1.#1.初始 tpm2 state 2.mkdir/tmp/myvtpm0;3.chown R tss:root/tmp/myvtpm0 4.swtpm_setup tpm2 tpm-state/tmp/myvtpm0 5.6.#2.创建 tpm2 字符设备 7.export TPM_PATH=/tmp/myvtpm0 8.swtpm_cuse-tpm2-n tpm0 9.#3.启动 tpm 设备 10.swtpm_ioctl-i-tpm-device/dev/tpm0 1.rootlocalhost swtpm#tpm2_pcrread 2.sha1:3.sha256:4.0:0 x0000000000000000000000000000000000000000000000000000000000000000 5.1:0 x0000000000000000000000000000000000000000000000000000000000000000 6.2:0 x0000000000000000000000000000000000000000000000000000000000000000 7.3:0 x0000000000000000000000000000000000000000000000000000000000000000 8.4:0 x0000000000000000000000000000000000000000000000000000000000000000 9.5:0 x0000000000000000000000000000000000000000000000000000000000000000 10.6:0 x0000000000000000000000000000000000000000000000000000000000000000 11.7:0 x0000000000000000000000000000000000000000000000000000000000000000 12.8:0 x0000000000000000000000000000000000000000000000000000000000000000 13.9:0 x0000000000000000000000000000000000000000000000000000000000000000 14.10:0 x0000000000000000000000000000000000000000000000000000000000000000 15.11:0 x0000000000000000000000000000000000000000000000000000000000000000 16.12:0 x0000000000000000000000000000000000000000000000000000000000000000 17.13:0 x0000000000000000000000000000000000000000000000000000000000000000 18.14:0 x0000000000000000000000000000000000000000000000000000000000000000 19.15:0 x0000000000000000000000000000000000000000000000000000000000000000 20.16:0 x0000000000000000000000000000000000000000000000000000000000000000 21.17:0 xFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFF 22.18:0 xFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFF 23.19:0 xFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFF 24.20:0 xFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFF 25.21:0 xFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFF 26.22:0 xFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFF 27.23:0 x0000000000000000000000000000000000000000000000000000000000000000 28.sha384:29.sha512:1.$mkdir$path_to_vm/mytpm0 1.$swtpm socket-tpmstate dir=$path_to_vm/mytpm0 2.-ctrl type=unixio,path=$path_to_vm/mytpm0/swtpm-sock 3.-log level=20 1.swtpm socket-tpm2-tpmstate dir=$path_to_vm/mytpm0 2.-ctrl type=unixio,path=$path_to_vm/mytpm0/swtpm-sock 3.-log level=20 X86_641.-chardev socket,id=chrtpm,path=$path_to_vm/mytpm0/swtpm-sock 2.-tpmdev emulator,id=tpm0,chardev=chrtpm 3.-device tpm-tis,tpmdev=tpm0 aarch64-chardev socket,id=chrtpm,path=$path_to_vm/mytpm0/swtpm-sock -tpmdev emulator,id=tpm0,chardev=chrtpm -device tpm-tis-device,tpmdev=tpm0 1.2.3.4.5.1.chmod-R 777/var/lib/swtpm-localca/2.virsh start vm 1.#lsmod|grep tpm 2.#tpm_tis 16384 0 3.#4.#yum list installed|grep-E tpm2-tss|tpm2-tools 5.#6.#yum install tpm2-tss tpm2-tools 1.rootlocalhost#tpm2_pcrread 2.sha1:3.0:0 xB88919A8FA33C7A11CEB80A1B9772B499BDAABC8 4.1:0 xED92EDC2A5E26D77F83020956E1AA02140870AC3 5.2:0 xB2A83B0EBF2F8374299A5B2BDFC31EA955AD7236 6.3:0 xB2A83B0EBF2F8374299A5B2BDFC31EA955AD7236 7.4:0 x30DDAE4ED835392D81A7CE6FEF905E169BAC27A5 8.5:0 x7BC897262CAD4E3F16F5CE180F6F4B6DEE253483 9.6:0 xB2A83B0EBF2F8374299A5B2BDFC31EA955AD7236 10.7:0 xC8D7DB36A45078BA06A86DAD3A20DCFD525C1E1B 11.8:0 x26B98CA9A67B20C4E7B9C1DAFC6890234CBF6E38 12.9:0 x92B9BA924DEBF7A64AB157689AE4AC921B9E930D 13.10:0 x96E96D79512639B9A2DF577CE237D18F544BD74D 14.11:0 x0000000000000000000000000000000000000000 15.12:0 x0000000000000000000000000000000000000000 16.13:0 x0000000000000000000000000000000000000000 17.14:0 x8DF12380EDE005407EAB81DA4405321E0DA61280 18.15:0 x0000000000000000000000000000000000000000 19.16:0 x0000000000000000000000000000000000000000 20.17:0 xFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFF 21.18:0 xFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFF 22.19:0 xFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFF 23.20:0 xFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFF 24.21:0 xFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFF 25.22:0 xFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFF 26.23:0 x0000000000000000000000000000000000000000 27.sha256:28.0:0 xE3B7A76FDC83187F0233F4616FED23301B044DE62AABC0CCADE6D9468FCB4233 29.1:0 x862224F4F2B87A4DF717EB92BB828C4598C4CF411ADF83FC9BB084B6D31A5D09 30.2:0 x3D458CFE55CC03EA1F443F1562BEEC8DF51C75E14A9FCF9A7234A13F198E7969 31.3:0 x3D458CFE55CC03EA1F443F1562BEEC8DF51C75E14A9FCF9A7234A13F198E7969 32.4:0 x8D870A781FF79622E72E858B36F025428C15846ABB3D54E0EEACA33E418B9E91 33.5:0 x60EB17AA48B50CC8E78C052BAA633B0848F36B452FC4BE6C2481B525E595C8C8 34.6:0 x3D458CFE55CC03EA1F443F1562BEEC8DF51C75E14A9FCF9A7234A13F198E7969 35.7:0 x97FB0EDBE28C25A14D775090F36682D04596FDA4BF5750F275F76C1643BBDC2D 36.8:0 x62A10C0A8638B71A355AAB7C8C66BFE052EBF2F1E9C5308A430AF5FC7652B35E 37.9:0 xED743F4D59ABE8C055EA0E8CE983879D69DBE9894F42172ECFAA65E8583E9DFF 38.10:0 xF4FA23203592F54BD5E4392C84CD9591D5D8211638D128CCBE332F54BDD287B0 39.11:0 x0000000000000000000000000000000000000000000000000000000000000000 40.12:0 x0000000000000000000000000000000000000000000000000000000000000000 41.13:0 x0000000000000000000000000000000000000000000000000000000000000000 42.14:0 xA4DAD77FB3B6CACBD20F556986C5D917F5E322C123AF82D12C5E5B7EF7AE9938 43.15:0 x0000000000000000000000000000000000000000000000000000000000000000 44.16:0 x0000000000000000000000000000000000000000000000000000000000000000 45.17:0 xFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFF 46.18:0 xFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFF 47.19:0 xFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFF 48.20:0 xFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFF 49.21:0 xFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFF 50.22:0 xFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFF 51.23:0 x0000000000000000000000000000000000000000000000000000000000000000 52.sha384:53.0:0 xE0B9E19988D06E4774A33A802981E77123045D56492146A914331AA1FA49AA99DE549823515E6D862779E2F959FF5AC6 54.1:0 x1C44C67D8DD3C86ABD4BAFCC6761DDFFDA96B843F271C6D4D92F84AA8C11BF205831F33D57FB4E960A9C0E83D5C32827 55.2:0 x518923B0F955D08DA077C96AABA522B9DECEDE61C599CEA6C41889CFBEA4AE4D50529D96FE4D1AFDAFB65E7F95BF23C4 56.3:0 x518923B0F955D08DA077C96AABA522B9DECEDE61C599CEA6C41889CFBEA4AE4D50529D96FE4D1AFDAFB65E7F95BF23C4 57.4:0 xBF5307DF2DC437D1F9CB35CB1A85E00717F150C306F01ED7D1EE3565E4626242AE41E9F2F1EDAD9C3F85A34F54F1C172 58.5:0 xAAA365D0D07B6C656D4F8A78346951ECFC2D7C92D3EE475925D9900BB22A255BFFB01B3C9E5CE631CD9BB3C91BB868DE 59.6:0 x518923B0F955D08DA077C96AABA522B9DECEDE61C599CEA6C41889CFBEA4AE4D50529D96FE4D1AFDAFB65E7F95BF23C4 60.7:0 x8742CE00FA4AAB6A8C3B30584D1BB01D4BB680CD9D72923DDCD3600B25EDB9BE9B13B4714A023AE7DC57003ACFB544C1 61.8:0 xADC524F78EAE447F5068D5FCBFF0C9E235CA9903D91FCF21A753A5F7E30B50445C67D7B14184C202C56FFB0BCD55EE3A 62.9:0 xC4F3002193E307C45F62DB79640F3EE54F4738EF83C138010FCA9E47BAD92FACEC0DCADFD0A7E9AB17EDA10F772F5A66 63.10:0 x97F83AABAE79094226377E6288AD64BE6A7BEE26FB40E1846D7A2A877F569633E65CAF72C02DE0665AFE626F476A6124 64.11:0 x000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 65.12:0 x000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 66.13:0 x000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 67.14:0 x108357C39E8DC8F150A33738567AF451908F80DDFC8C14801FBD513F307DA99082EA0ABA8CC7E042940F310E54C8AB10 68.15:0 x000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 69.16:0 x000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 70.17:0 xFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFF 71.18:0 xFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFF 72.19:0 xFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFF 73.20:0 xFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFF 74.21:0 xFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFF 75.22:0 xFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFF 76.23:0 x000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 77.sha512:78.0:0 x0893229AF987740D78145E551F2C04D6C3A1C3FD4043EBB6BCF6C94F8EDF92EE99DC44916C6FF3AB4F4492EA3AA6C1D60C9912DD379E3B9CF9E7BCF08789720C 79.1:0 x2CCA44A4B710CFFA20EF4C10F378E63E4D2065462A69981381C9DB1BC1D0D8396A09480CC31B4102E6C29A1F3002E170B52E1BE2FEE80E565146C04A534A4BDD 80.2:0 x27EC091533C4B9EEA38DD14C3A3ECDEF0A99C1E564CBE66DFE008250154E7839B0B75228FE8DEBCC4CA330E6AEBC1ABC74070BC9C9C1E26B939C9D916E45E13C 81.3:0 x27EC091533C4B9EEA38DD14C3A3ECDEF0A99C1E564CBE66DFE008250154E7839B0B75228FE8DEBCC4CA330E6AEBC1ABC74070BC9C9C1E26B939C9D916E45E13C 82.4:0 xB9D1555BC9F1BCF7AFEAF3D60E246C6063ACF2572518FDC12CF7CD689A1E8E10D0B43CFB77CF60F898D99B5523C829849BF08CA8A882395554FECE71E618BFB2 83.5:0 x58F94888F6AC2C4CC23BFBCFF6A013BED1EFDF239EE1BF2FEF5F8C4E7443A7D2E7A90636792A1B858DC8A70C1BE077DE99992B67CC67AAF1746652FE9043A249 84.6:0 x27EC091533C4B9EEA38DD14C3A3ECDEF0A99C1E564CBE66DFE008250154E7839B0B75228FE8DEBCC4CA330E6AEBC1ABC74070BC9C9C1E26B939C9D916E45E13C 85.7:0 xD2CAB183E6A0BD48AF28C0B04DADAD16EDC21466FB1B8380546147399C42EF82F91A91F2E9D80BEF2EE691E298692775B07B4C02A0C69BD9E55D052865C38302 86.8:0 x77BA9278692B14942F7BCB5E447878D56039E5B649649039B0BBBD31B90DC23996F23213169173A4D30E466A2E98A47BFCBD80EA0E2363BF1AB292E1CB5F6C8F 87.9:0 xC2C007228B3DF18F6749EE86058EC4819833A77E6C3AFE053FBBEB1D1C474180AB9AE75E52621A4AD4E92F39234C5FB787F0576B9DCB292997C05ACEDC770DFC 88.10:0 x0DFFB841CDC6998F869A6EEF8A29E89FEC5485A6E0F00347A9D50B19B58DE98F6D66B54A8C10721DA8CC2D52CD09B81CD00F9AB266407961621E4E96E13D767A 89.11:0 x00000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 90.12:0 x00000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 91.13:0 x00000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 92.14:0 x71571341801195B199E04CF1A624716DC06C0352B1D8C8A57521BD8E252069E9DA04BCB0E0EA566E496FAFA959E25ACCFD47E0129E42FDCA0DBAE2E31539918B 93.15:0 x00000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 94.16:0 x00000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 95.17:0 xFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFF 96.18:0 xFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFF 97.19:0 xFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFF 98.20:0 xFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFF 99.21:0 xFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFF 100.22:0 xFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFF 101.23:0 x00000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 4)enum vtpm_proxy_flags 5)/*6)*常量 7)*VTPM_PROXY_FLAG_TPM2 8)*the proxy TPM uses TPM 2.0 protocol 9)*/parameter structure for the VTPM_PROXY_IOC_NEW_DEV ioctl 1.struct vtpm_proxy_new_dev 2.3./Definition:4.struct vtpm_proxy_new_dev 5._u32 flags;6._u32 tpm_num;7._u32 fd;8._u32 major;9._u32 minor;10.;11./*结构体成员说明 12.*flags:flags for the proxy TPM 13.*tpm_num:index of the TPM device 14.*fd:the file descriptor used by the proxy TPM 15.*major:the major number of the TPM device 16.*minor:the minor number of the TPM device 17.*/handler for the VTPM_PROXY_IOC_NEW_DEV ioctl 1.long vtpmx_ioc_new_dev(struct file*file,unsigned int ioctl,unsigned long arg)2.3./*函数参数说明 4.*struct file*file /dev/vtpmx 5.*unsigned int ioctl the ioctl number 6.*unsigned long arg pointer to the struct vtpmx_proxy_new_dev 7.*/8.9./*函数功能描述 10.*创建一个匿名文件，供进程作为 TPM 与客户端进程通信。11.*该函数还将添加一个新的 TPM 设备，通过该设备将数据代理到该 TPM 代理进程。12.*将为调用者提供一个文件描述符，用于与客户端通信，以及 TPM 设备的主要和次要编号。13.*/1.+-+2.|Linux DomU|.3.|4.|v|5.|xen-tpmfront|6.+-+7.|8.v|9.+-+10.|mini-os/tpmback|11.|12.|v|13.|vtpm-stubdom|.14.|15.|v|16.|mini-os/tpmfront|17.+-+18.|19.v|20.+-+21.|mini-os/tpmback|22.|23.|v|24.|vtpmmgr-stubdom|25.|26.|v|27.|mini-os/tpm_tis|28.+-+29.|30.v|31.+-+32.|Hardware TPM|33.+-+Linux DomU：配置有 vTPM 的 Linux 客户机可能不止一个。xen-tpmfront.ko：Linux 内核虚拟 TPM 前端驱动。该驱动程序提供对基于 linux 的 DomU 的 vTPM 访问。mini-os/tpmback：Mini-os TPM 后端驱动程序，提供 Linux 前端驱动与后端驱动对接功能，实现 Linux DomU 与 vTPM 之间的通信。这个驱动程序也被 vtpmmgr-stubdom 用来与 vtpm-stubdom 通信。vtpm-stubdom：一个实现 vTPM 的 mini-os 存根域。在系统上运行的vtpm-stubdom 实例和逻辑 vtpms 之间存在一对一的映射关系。mini-os/tpmfront：Mini-os TPM 前端驱动程序。vTPM mini-os 域vTPM-stubdom 使用该驱动程序与 vtpmmgr-stubdom 通信。该驱动程序也用于与 vTPM 域通信的 mini-os 域，例如 pv-grub。vtpmmgr-stubdom：实现 vTPM 管理器的 mini-os 域。只有一个 vTPM管理器，它应该在机器的整个生命周期中运