可信计算实战指南：A.Practical.Guide.to.Trusted.Computing解析

下载需积分: 10 | PDF格式 | 2.32MB | 更新于2024-07-25 | 43 浏览量 | 举报

"A.Practical.Guide.to.Trusted.Computing - 可信计算" 可信计算是一种计算机安全领域的概念，旨在确保计算机系统在运行时的完整性、保护数据安全以及增强网络的信任度。本书《A Practical Guide to Trusted Computing》是IBM Press出版的一本专业指南，专门介绍可信计算的实践应用和技术细节。作者团队包括Challener、Yoder、Catherman、Safford和Van Doorn，他们深入探讨了可信计算的基础和实施方法。可信计算的核心是可信平台模块（TPM，Trusted Platform Module）和可信软件栈（TSS，Trusted Software Stack）。TPM是一个硬件组件，它提供了一种加密和验证计算平台状态的方法，确保系统在启动时没有被篡改。TSS则是一组软件协议，用于利用TPM的功能来执行安全操作，如生成密钥、存储敏感信息和进行平台完整性检查。书中可能涵盖了以下几个关键知识点： 1. **可信度量**：这是可信计算的一个基础概念，通过度量系统各个组件的状态，确保在系统启动和运行过程中没有恶意软件或未授权的修改。 2. **安全启动流程**：描述了如何利用TPM进行安全启动，验证操作系统和其他关键软件组件的完整性。 3. **密钥管理和加密**：TPM如何帮助创建和管理密钥，以及如何使用这些密钥进行数据加密和身份验证。 4. **远程证明**：系统可以向远程服务器证明自己的状态，这对于云服务和远程管理尤其重要。 5. **可信计算与隐私**：讨论可信计算技术如何在保护用户隐私的同时实现安全目标。 6. **应用案例**：书中可能会包含各种实际场景，如物联网(IoT)设备的安全、企业数据中心的保护，以及金融和医疗行业的数据安全。 7. **集成与实施**：如何将可信计算技术融入现有的IT基础设施，如IBM Rational工具集，例如Rational ClearCase、Rational Unified Process等。 8. **挑战与解决方案**：书中可能会探讨在实施可信计算时遇到的技术和政策难题，以及相应的解决策略。 9. **标准与合规性**：可信计算遵循的国际标准和行业规范，如TCG（Trusted Computing Group）的指南。通过这本实用指南，读者能够理解可信计算的基本原理，学习如何设计和实施可信计算解决方案，从而提高其所在组织的信息安全水平。对于IT专业人士，特别是那些从事安全、系统管理和软件开发工作的人员，这本书将是一份宝贵的参考资料。

Part IV: Appendixes 291

Appendix A TPM Command Reference 293

Appendix B TSS Command Reference 303

Appendix C Function Library 321

Appendix D TSS Functions Grouped by Object and API Level 323

Index 333

xvi Contents

What You Need to Know Before Reading This Book

The code in the book is all based on the C language, so skill in reading C is a requirement for

understanding any of the coding examples. Additionally, it is important that the reader have some

understanding of cryptography—particularly the difference between symmetric and asymmetric

keys, and cryptographic hashes. There is some discussion in the book about these concepts, but a

detailed description of the algorithms used is not included. Bruce Schneier’s Applied Cryptogra-

phy is a good reference for those who wish to go deeper into that area. If the reader wants merely

to ﬁnd out what TCG is good for, Parts I and III of the book are recommended. If the reader has a

particular project in mind, all sections of the book are likely to be helpful.

Who You Are and Why You Should Read This Book

This book does provide the speciﬁc details needed to write applications that take advantage of the

TPM. If you are unfamiliar with Trusted Computing and want to write code that will use the capa-

bilities of the TPM, all of this book will be valuable to you. If you want to learn about the reason-

ing behind the design choices in the TPM, Parts I and II of the book are the ones to concentrate on.

For a Software Engineer

The authors have tried to write a book that would include everything they would have liked to

know about programming with TPMs. As a result, we have included sample code that we have

compiled to make sure it works. We give examples that do real things, not just using defaults

everywhere. We explain the choices we make in designing the code, and the code is commented,

so it is clear about what it does.

If you want to understand how big the problem is that needs to be solved, read Chapter 1,

“Introduction to Trusted Computing.” If you want to learn about the capabilities of the TPM, read

Chapter 2, “Design Goals of the Trusted Platform Module,” and Chapter 3, “An Overview of the

Trusted Platform Module Capabilities.” If you want to ﬁnd out what kinds of problems can be

solved using the capabilities of the TPM, read Chapters 11–13. If you already understand the

capabilities of the TPM and want to write programs that use TPM 1.1, read Chapters 4–10. If you

want to use the expanded capabilities in the TPM 1.2, read Chapter 14.

For a Software Project Manager or Technical Leader

A software project manager needs to understand the capabilities of the TPM and also the archi-

tecture of projects he is leading. In any security program, it is particularly important that the

architecture be established well before coding begins. Architectural design ﬂaws lead quickly to

security ﬂaws.

This book should help you understand the issues necessary to design a secure program

architecture that takes advantage of the TPM. Chapters 1, 2, 3, 11, 12, 13, and 14 should be

particularly useful for the project manager.

xviii Preface

For a Computer User Interface Designer

Ease of use and security have been at odds ever since the ﬁrst lock was designed. At ﬁrst glance,

they seem adamantly opposed to one another. The designs in Chapters 11, 12, and 13 may pro-

vide information necessary for the computer user interface designer to improve the usability of

the solution.

For Those Interested in Trusted Computing

If a person is considering using the TPM, Chapters 1–3 and 11–13 provide the best reading. They

provide a good overview of the problems that trusted computing tries to solve and how they are

(architecturally) solved.

For Experienced Users of TPMs

If you are a long-time user of TPMs and are interested in what more you can do with the functions

used in the TPM, this book—particularly Chapters 11, 12, 13, and 14—may provide you with

inspiration. Sometimes just seeing how other people approach a problem is sufﬁcient to provide

the solution to a grating problem.

How the Book Is Organized

This section provides you with an overall view of how the book is organized, including a brief

summary of all the chapters.

Part I: Background Material

Part I provides an overview of Trusted Computing, including what was the impetus that caused its

creation, what problems it was trying to solve, and a functional view of what is provided by a

Trusted Platform Module.

• Chapter 1, “Introduction to Trusted Computing”

Historically, hackers have focused on the network, then the server, and now the client.

This chapter gives an overview of the security attacks that are focused on today’s client

and their severity, and then explains why a TPM is ideal for solving such problems. It

also discusses privacy issues and gives recommendations to the programmer to avoid

causing privacy problems.

• Chapter 2, “Design Goals of the Trusted Platform Module”

When the security experts who generated the original TPM got together, they had a

number of features they wanted to make sure were included in the speciﬁcation. This

chapter discusses what they were trying to accomplish. Having this broad view of what

a TPM was designed for will help the reader with background information necessary to

understand how the actual features that were implemented were intended to be used.

Preface xix

• Chapter 3, “An Overview of the Trusted Platform Module Capabilities”

This chapter describes the actual features implemented in the TPM 1.1 design and how

they work. This provides an architectural view of the design of the speciﬁcation. After

reading this chapter, the reader should have an idea of what types of problems the TPM

will help solve. Additionally, it provides some discussion as to why certain features

were omitted from the speciﬁcation.

Part II: Programming Interfaces to TCG

Part II includes chapters for the programmer. It provides an in-depth view of the interfaces that

are available in the software stack, with examples of how they are used. It starts out with the low-

est level—talking to the device driver. Next, it looks at the boot sequence for a computer and how

that can be enhanced with a TPM. This is followed with a section on the core services provided

by the software stack, along with a brief discussion of talking directly to this interface, as when a

remote application is using a TPM. Following this, the next few chapters are about using the TPM

at the highest level: the application interface

• Chapter 4, “Writing a TPM Device Driver”

This chapter provides the reader with the information necessary to write a device driver

to communicate with the TPM. This is important to the person who wishes to use the

TPM with an operating system other than those (Windows, Linux) that already have

device drivers available.

• Chapter 5, “Low-Level Software: Using BIOS and TDDL Directly”

This chapter provides the reader with the information necessary to talk directly to the

chip in the absence of a TSS stack. This is important to a person writing code that runs in

BIOS, or for writing a TSS stack for a new operating system, or in a memory con-

strained environment. This chapter is based on work originally done for Linux, but has

been deliberately written in an OS neutral format. Additionally, this chapter will provide

to the user a real appreciation of the work done for him when he is using the TSS stack.

• Chapter 6, “Trusted Boot”

This chapter describes using the chip in one of the most exciting forms—to measure the

security state of a platform. There are two means of doing this in the Trusted Computing

space: the 1.1 Static Root of Trust and the 1.2 Dynamic Root of Trust. Both are

described in detail, and example code is given showing how they are implemented. This

is one of the few places in the book where 1.2 code that has been tested can be given, as

these interfaces do not require nonexistent 1.2 TSS stacks.

• Chapter 7, “The TCG Software Stack”

The TSS API is the most commonly used interface to access the TPM. This chapter

describes the architecture of the TSS, conventions used in the API, and software object

xx Preface

剩余375页未读，继续阅读

身份认证购VIP最低享 7 折!

30元优惠券

zsc347

粉丝: 1

可信计算实战指南：A.Practical.Guide.to.Trusted.Computing解析

IBM.Press.A.Practical.Guide.to.Trusted.Computing

可信计算(trusted computing)的入门基础学习资料

IBM.Press.A.Practical.Guide.to.Trusted.Computing.pdf

A Practical Guide to TPM 2.0 Using the Trusted Platform Module

可信计算实践指南：IBM Press 精要

实战可信计算：IBM出版社指南

IBM Press:实践指南-可信计算2008

IBM《可信计算实践指南》：入门与核心技术

【Python pip Installation Tutorial for NumPy】: From Beginner to Expert, Step-by-Step Guide to ...

可信计算 ppt

最新资源