Trusted Computing based services supporting TPM provisioning and supply chain validation concepts. #nsacyber
Clone or download
busaboy1340 #67 Add systems tests for HIRS Provisioner TPM 2.0 (#73)
* Added System Tests.

* Cleaned up scripts

* Cleaned up system tests.

* Cleaned up system tests.

* Cleaned up system tests.

* Updated system tests.

* Code review updates.
Latest commit 17d7dbd Jan 15, 2019
Permalink
Type Name Latest commit message Commit time
Failed to load latest commit information.
.ci #67 Add systems tests for HIRS Provisioner TPM 2.0 (#73) Jan 15, 2019
HIRS_AttestationCA [#41] Provisioners use PACCOR for device info collection. (#45) Nov 7, 2018
HIRS_AttestationCAPortal [#54] ACA Users guide (#57) Jan 7, 2019
HIRS_Provisioner [#41] Provisioners use PACCOR for device info collection. (#45) Nov 7, 2018
HIRS_ProvisionerTPM2 [#46] Setup Travis for HIRS Integration Tests (#68) Jan 7, 2019
HIRS_Structs Initial release Sep 6, 2018
HIRS_Utils [#69] Add null checks to Component Identifier Serial/Revision Trimming ( Jan 7, 2019
TPM_Utils Initial release Sep 6, 2018
config/checkstyle Initial release Sep 6, 2018
gradle/wrapper Initial release Sep 6, 2018
images Initial release Sep 6, 2018
package [#46] Setup Travis for HIRS Integration Tests (#68) Jan 7, 2019
tpm_module [#14] Parallelize Subproject CI Builds and Pull Pre-Built Image Oct 12, 2018
.gitignore #67 Add systems tests for HIRS Provisioner TPM 2.0 (#73) Jan 15, 2019
.travis.yml #67 Add systems tests for HIRS Provisioner TPM 2.0 (#73) Jan 15, 2019
CONTRIBUTING.md Updated CONTRIBUTING.md Sep 7, 2018
DISCLAIMER.md Initial release Sep 6, 2018
LICENSE.md Initial release Sep 6, 2018
NOTICE Initial release Sep 6, 2018
README.md Replace Refs of yum localinstall with yum install Dec 11, 2018
VERSION Updated for release 1.0.2 Nov 1, 2018
build.gradle [#12] Setup basic Travis CI build Sep 26, 2018
gradle.properties Initial release Sep 6, 2018
gradlew Initial release Sep 6, 2018
gradlew.bat Initial release Sep 6, 2018
settings.gradle [#14] Parallelize Subproject CI Builds and Pull Pre-Built Image Oct 12, 2018

README.md

Host Integrity at Runtime and Start-up (HIRS)

Build Status

Attestation Certificate Authority (ACA) and TPM Provisioning with Trusted Computing-based Supply Chain Validation

The Host Integrity at Runtime and Start-up Attestation Certificate Authority is a Proof of Concept - Prototype intended to spur interest and adoption of the Trusted Platform Module (TPM). It's intended for testing and development purposes only and is not intended for production. The ACA's functionality supports the provisioning of both the TPM 1.2 and TPM 2.0 with an Attestation Identity Credential (AIC). The ACA can be configured to enforce the Validation of Endorsement and Platform Credentials to illustrate a supply chain capability. It also includes several tools for generating test patterns (Platform Credentials) and generating SWID tags.

The ACA provides a “provisioner” application to be installed on all devices which will be requesting Attestation Credentials. The ACA is a web based server which processes Attestation Identity Requests. TPM Provisioning

Features

  • TPM Provisioner
    • Requests an Attestation Identity Credential for the TPM from the ACA.
    • Takes ownership of TPM if not owned
    • Uses REST calls to complete the transaction with the ACA
    • Reads credentials from the TPM's NvRAM as part of the provisioning process.
    • Reads the device's hardware, network, firmware, and OS info for platform validation
  • Attestation Certificate Authority
    • Issues Attestation Identity Credentials to validated devices holding a TPM
    • Configures policies for enabling/disabling validation procedures
    • Performs TCG-based Supply Chain Validation of connecting clients
      • Optionally validates Endorsement and Platform Credentials
  • Endorsement Credential Certificate Chain Validation
  • Platform Credential Certificate Chain Validation
  • Attestation CA Dashboard
    • Displays all Validation Reports, Credentials, and Trust Chains
    • Enables ACA policy configuration for validation of Endorsement and Platform Credentials
    • Enables Import/Export of Certificate (Trust) Chains, Endorsement Credentials, and Platform Credentials
    • Optionally allows uploaded credentials to be used in validation for machines that have been reprovisioned by trusted parties since leaving the OEM

Requirements

The HIRS Attestation Certificate Authority (ACA) supports installation on CentOS 6 and 7 instances.

The HIRS Provisioner supports both types of TPMs, 1.2 and 2.0. TPM 1.2 support is available on CentOS 6 and 7. Due to the limitations on the libraries available on Centos 6, TPM 2.0 support is only available on Centos 7.

Installation Instructions

For detailed instructions, see Installation notes.

Packages used for installation (e.g. HIRS_Provisioner*el7.noarch.rpm) can be found on the release page.

Installing the ACA

Simply run the command yum install HIRS_AttestationCA*el6.noarch.rpm or yum install HIRS_AttestationCA*el7.noarch.rpm based on your OS.

Installing the Provisioner

After enabling your TPM in BIOS/UEFI, determine if your machine has a TPM 1.2 or a TPM 2.0 by using the command:
dmesg | grep -i tpm_tis.

To install a TPM 1.2 Provisioner, run:
yum install tpm_module*.rpm
yum install HIRS_Provisioner*el6.noarch.rpm or yum install HIRS_Provisioner*el7.noarch.rpm based on OS
hirs-provisioner -c

To install a TPM 2.0 Provisioner, run:
yum install hirs-provisioner-tpm2*.rpm

To configure the provisioner, edit the hirs-site.config file in /etc/hirs/hirs-site.config. Edit the file to specify the ACA's fully qualified domain name and port.

Usage

To kick off a provision on the client, run the command sudo tpm_aca_provision.

To see the results and interact with the ACA, go to the ACA Portal at https://ACAPortalAddress:ACAPortalPort/HIRS_AttestationCAPortal/portal/index.

Quick Links: