2023可信计算技术最佳实践白皮书

白皮书作者 This document isMulanPSL v2licensed. 龙蜥社区及龙蜥操作系统也获得了一定的行业认可，，、、荣 获、“OSCAR开源尖峰案例奖”等25项行业奖项。 实验室简介 实验室设施及业务概况  实验室建设 SIG    🔗SIG地址：https://openanolis.cn/sig/tc-sig 钉钉群：“龙蜥-可信计算SIG技术交流群”，群号：15370024496 微信群：“龙蜥-可信计算SIG技术交流群” 1.                                           1.3.3 futureTPM工作组与主要目标    2.   国家标准化管理委员会    ISO/IEC 11889系列标准     TSS规 范 官 网 入 口：https://trustedcomputinggroup.org/resource/tcg-software-stack-tss-specification/ 缩略语 PTP–Platform TPM ProfileCRB–Command Response Buffer interfaceDDWG–Device Driver’s Writers GuideCertification PP–Certification Protection ProfileTIS–TPM Interface Specification PC Client标准及配套文档体系: 缩略语 PFP–Platform Firmware ProfilePPI–Physical Presence InterfaceFIM–Firmware Integrity MeasurementMOR–Reset Attack MitigationMemory on reset attack mitigationRIM–Reference Integrity ManifestDRTM–Dynamic Root of Trust for Measurement 标准编制 应用场景 标准推广 3. swtpm swtpmlibtpms 1.#安装依赖包2.yum install-y automake autoconf libtool gcc gcc-c++make\ 3.openssl-devel pkg-config socat net-tools-deprecated\4.libtasn1-devel gnutls gnutls-devel libseccomp-devel\5.json-glib-devel expect softhsm6.#下载libtpms源码7.git clone https://github.com/stefanberger/libtpms8.cd libtpms9.#编译并安装libtpms10../autogen.sh--prefix=/usr--libdir=/usr/lib64--with-openssl\11.--with-tpm212.13.make-j414.make-j4 check15.sudo make install16.#下载swtpm源码17.git clone https://github.com/stefanberger/swtpm18.cd swtpm19.#编译并安装swtpm20../autogen.sh--prefix=/usr--libdir=/usr/lib64--with-openssl\21.--with-tss-user=root--with-tss-group=tss--with-cuse22.make-j423.sudo make check-j424.sudo make install 1.yum install libtpms swtpm swtpm-devel swtpm-tools swtpm编译。 1.#安装内核cuse模块2.yum install kernel-modules-extra3.modprobe cuse 1.#1.初始tpm2 state2.mkdir/tmp/myvtpm0;3.chown–R tss:root/tmp/myvtpm04.swtpm_setup–tpm2–tpm-state/tmp/myvtpm05.6.#2.创建tpm2字符设备7.export TPM_PATH=/tmp/myvtpm08.swtpm_cuse--tpm2-n tpm09.#3.启动tpm设备10.swtpm_ioctl-i--tpm-device/dev/tpm0 1.[root@localhost swtpm]#tpm2_pcrread2.sha1:3.sha256:4.0:0x00000000000000000000000000000000000000000000000000000000000000005.1:0x00000000000000000000000000000000000000000000000000000000000000006.2:0x00000000000000000000000000000000000000000000000000000000000000007.3:0x00000000000000000000000000000000000000000000000000000000000000008.4:0x00000000000000000000000000000000000000000000000000000000000000009.5:0x000000000000000000000000000000000000000000000000000000000000000010.6:0x000000000000000000000000000000000000000000000000000000000000000011.7:0x000000000000000000000000000000000000000000000000000000000000000012.8:0x000000000000000000000000000000000000000000000000000000000000000013.9:0x000000000000000000000000000000000000000000000000000000000000000014.10:0x0000000000000000000000000000000000000000000000000000000000000000 15.11:0x000000000000000000000000000000000000000000000000000000000000000016.12:0x000000000000000000000000000000000000000000000000000000000000000017.13:0x000000000000000000000000000000000000000000000000000000000000000018.14:0x000000000000000000000000000000000000000000000000000000000000000019.15:0x000000000000000000000000000000000000000000000000000000000000000020.16:0x000000000000000000000000000000000000000000000000000000000000000021.17:0xFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFF22.18:0xFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFF23.19:0xFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFF24.20:0xFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFF25.21:0xFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFF26.22:0xFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFF27.23:0x000000000000000000000000000000000000000000000000000000000000000028.sha384:29.sha512: 1.$mkdir${path_to_vm}/mytpm0 1.$swtpm socket--tpmstate dir=${path_to_vm}/mytpm0\2.--ctrl type=unixio,path=${path_to_vm}/mytpm0/swtpm-sock\3.--log level=20 1.swtpm socket--tpm2--tpmstate dir=${path_to_vm}/mytpm0\2.--ctrl type=unixio,path=${path_to_vm}/mytpm0/swtpm-sock\3.--log level=20 X86_64 1.-chardev socket,id=chrtpm,path=${path_to_vm}/mytpm0/swtpm-sock\2.-tpmdev emulator,id=tpm0,chardev=chrtpm\3.-device tpm-tis,tpmdev=tpm0 aarch64 -chardev socket,id=chrtpm,path=${path_to_vm}/mytpm0/swtpm-sock\-tpmdev emulator,id=tpm0,chardev=chrtpm\-device tpm-tis-device,tpmdev=tpm0 1.2.3.4.5. 1.chmod-R 777/var/lib/swtpm-localca/2.virsh start vm 3.#4.#yum list installed|grep-E'tpm2-tss|tpm2-tools'5.#6.#yum install tpm2-tss tpm2-tools 1.[root@localhost~]#tpm2_pcrread2.sha1:3.0:0xB88919A8FA33C7A11CEB80A1B9772B499BDAABC84.1:0xED92EDC2A5E26D77F83020956E1AA02140870AC35.2:0xB2A83B0EBF2F8374299A5B2BDFC31EA955AD72366.3:0xB2A83B0EBF2F8374299A5B2BDFC31EA955AD72367.4:0x30DDAE4ED835392D81A7CE