Using the tpm with iot
David Grawrock

Security Architect, Senior Principle Engineer

AgendaTPM History Lesson
What Does IoT NeedHow Does The TPM Fulfill Needs
Usage

IoT Security

2

History
Worked on the TPM from 1999 through2007 as TPM Workgroup Chair andTechnical Committee Vice-Chair
These pictures are from a workgroupmeeting in England, 2003

I was the TCG liaison to ISO SC27 to get
the TPM specification as an ISO standard(we were successful)

IoT Security

3Basic TPM Functionality
Root of Trust for Reporting (RTR)
 Enabling attestation

Root of Trust for Storage (RTS) Enabling protected storage

Platform adds Root of Trust for Measurement(RTM) Enabling attestation and protected storage

Isolated execution environment
 Mitigate attempts to manipulate keys and operations

IoT Security

4WhatDoes
IoT
Need

IoT Security

5

Ecosystem

ManagementSensor

Gateway

Does the ecosystemenable end to end
security?

NetworkAnalytics

Simple goal, get data from sensor, send it
up to analytics and then do something
based on that analysis

IoT Security

6

Ecosystem Details
Illustration only, not for deep discussion

3rd Party
Cloud

Data Transport
BrokerData Ingestion &Processing

Persistence &Concurrency

Query

Business Logic& Rules

Storage

Services
Orchestration

ComputeAPIs, API
Libraries, SDK

Analytics

Business Portal

I/O

SensorMCU
SensorI/O

Actuator

UPA
L

Asset Info,
Policies &Metadata
Gateway

MCU
SensorActuator

Network
Infrastructure

U
I/O P
A
L

Device Attestation

Gateway
Device Attestation
UPA
L

Security,
Configuration &Management

IT/ Business Systems

Sensor

WiFi + LP WiFi
Bluetooth + BTLE
3G/4G/LTE (GPRS)ZigBee, Zwave
6LoWPAN
WiHART
Ethernet
RFID

Vertical IoT Apps

On-Premise or Off-Premise Data Center or Cloud

Universal Protocol Abstraction Layer

Data Flow: MQTT, HTTPS, WebSockets, XMPP, CoAP, REST, AMQP, DDS, et al.
Security & Mgmt Flow: MQTT, EPID, OMA-DM, TR-069, REST, et al.

Data Center Management & Security (Monitoring, Auto-scaling, Logging, Eventing)

All compute devices have Identity Protection (EPID), Secure Boot, Smart Object ID, etc.

IoT Security

7Basic Questions for IoT
What device are you Related is what are the device properties

What is the software stack What is the execution environment
Is there protected storage on the device Key material at a minimum

Questionsapply to any
device intheecosystem

Is there a Trusted Execution Environment
 Mitigate software attacks, hopefully mitigate hardware
attacksIoT Security

8

How Does the TPM Fulfill
the Needs
IoT Security

9What Device Are You
Identifying the device enables analytics,
operations, and management
 Can’t rely on data or send commands tounknown device

TPM provides identity
 Can be fixed with Endorsement Key (EK),
anonymous with Attestation Identity Key (AIK),or provisioned by application

Identities can be controlled using TPMauthorizations
 Richer set of authorizations in 2.0

IoT Security

10What is the Software Stack
Identifying the software in use enables
management, updates, and finer control
Software identity comes from RTM
TPM provides ability to attest to thesoftware and allow authorizations anddecisions based on the software identity

IoT Security

11

Is There Protected Storage on the Device
Entities want to rely on device properties
and one critical property is the ability toprovide long-term storage withconfidentiality and integrity guarantees

TPM provides storage that has bothconfidentiality and integrity
Attestation proves the existence of theprotected storage

IoT Security

12

Is There a Trusted Execution
Environment
Need assurance that operations can occur withoutmodification
 Especially true in keeping key material confidential

TPM has TEE mitigates both hardware andsoftware attacks
 TPM API only allows specific operations and key
material never leaves TPM without being encrypted

IoT Security

13

UsageIoT Security

14

TPM Properties
TPMs come in many shapes and sizes
 Discrete hardware devices
 Embedded hardware devices
 Firmware implementations Others are possible

Different properties for each Need to match the properties to the platform
in question– Sensor, gateway, network, cloud Specific use models matter
IoT Security

15

Where Are the TPMs?
Illustration only, not for deep discussion

TPM
MCU

Actuator

I/O

TPM

UP
A
L

TPM
Gateway

MCU
SensorActuator

TPM

TPM

TPM

TPM

Data Transport
BrokerData Ingestion &Processing

Persistence &Concurrency

UI/O P
A
L

Asset Info,Policies &Metadata

Network
Infrastructure

TPM
TPM

Device Attestation

Device Attestation
UPAL

QueryStorage

TPM

TPM
GatewayTPM

TPM

Business Logic& Rules

TPM

I/O

SensorSensor

3rd PartyCloud

TPM

Services
Orchestration

TPM
ComputeTPM
Security,
Configuration &Management

TPM

TPM
Analytics

TPMAPIs, API
Libraries, SDK

TPMBusiness Portal

IT/ Business Systems

Sensor

WiFi + LP WiFi
Bluetooth + BTLE
3G/4G/LTE (GPRS)ZigBee, Zwave
6LoWPAN
WiHART
Ethernet
RFID

Vertical IoT Apps

On-Premise or Off-Premise Data Center or Cloud

Universal Protocol Abstraction Layer

Data Flow: MQTT, HTTPS, WebSockets, XMPP, CoAP, REST, AMQP, DDS, et al.
Security & Mgmt Flow: MQTT, EPID, OMA-DM, TR-069, REST, et al.

Data Center Management & Security (Monitoring, Auto-scaling, Logging, Eventing)

All compute devices have Identity Protection (EPID), Secure Boot, Smart Object ID, etc.

IoT Security

16

Questions Again
What device are you TPM provides identity

What is the software stack TPM provides RTM and attestation
Is there protected storage on the device
 TPM provides storage

Is there a Trusted Execution Environment

TPM
provides theglue that
can tie thestacktogether

 TPM operations execute inside of TPM

IoT Security

17

Questions?

IoT Security

18

Legal Information
Intel technologies’ features and benefits depend on system configuration and may
require enabled hardware, software or service activation. Performance varies
depending on system configuration. No computer system can be absolutely secure.
Check with your system manufacturer or retailer or learn more at www.intel.com
Intel, the Intel logo, are trademarks of Intel Corporation in the U.S. and/or othercountries.

*Other names and brands may be claimed as the property of others.
© 2015 Intel Corporation

IoT Security

19