OPTIGA™ TPM - Trusted Platform Module
保护嵌入式设备与系统的完整性和可靠性
OPTIGA™ TPM（Trusted Platform Module，可信平台模块）系列包含多种安全控制器，能保护嵌入式设备与系统的完整性和可靠性。借助安全密钥存储和对多种加密算法的支持，OPTIGA™ TPM以其丰富的功能为关键数据和进程提供了强大的保护。
OPTIGA™TPM安全控制器非常适合运行在Windows和Linux（及其衍生产品）*平台。该系列基于可信计算组（TCG）标准，支持TPM 1.2或最新的创新型TPM 2.0标准。
*适用于Chrome OS的SLB 9645产品版本。
System health check for network equipment and IoT devices
Today, network equipment and IoT devices face a constant barrage of attacks aimed at exposing vulnerabilities in software and firmware. Worst still, cyber threats have become so sophisticated that conventional defense-in-depth cybersecurity measures may even fail to detect them. Once malware is on a device, it may remain there undetected for long periods as it often works undetected in the background. By the time most users realize they have suffered a data breach, they have actually been under attack for weeks, months, or even years.
A system health check supported by Infineon’s OPTIGATM TPM lets users check that their devices have not been manipulated. The TPM provides a secured identity and storage space for system control mechanisms that may check whether hardware and software are still running as intended. The system notifies the user if it does detect changes, e.g. caused by malware.
When devices start up, the software and firmware are measured by the Linux Integrity Measurement Architecture (IMA) and the results are stored in the OPTIGATM TPM Platform Configuration Registers (PCRs). The measurements can then be retrieved by a remote attestation server to determine the configuration of the device at the time it was booted as well as during runtime. The PCR is protected against being rolled back to a previous value. The attestation server polls a platform at set intervals, verifying either that the PCRs in the OPTIGATM TPM have not changed or that the new PCR values are trustworthy. The PCR values are signed with a private Attestation Identity Key (AIK) to reduce the risk of forgery.
For service providers, this means that their services are stable and reliable, and that devices in their network have been checked for manipulation. OPTIGATM TPM also gives device and system manufacturers an opportunity to access new markets requiring new – and differentiating – levels of security. End users benefit from increased security for their sensitive data while still enjoying the same or an even better user experience.
To facilitate use and integration for device and system manufacturers, Infineon has created a Github repository with documents as well as demonstrator source code.
A system health check supported by Infineon’s OPTIGA™ TPM - Video
- 高端安全控制器，硬件搭载了最先进的加密算法（如RSA & ECC256, SHA-256）
- 通用标准（EAL4+）和FIPS安全认证
- 具备SPI、I2C或LPC接口支持
- 更广的工作温度范围（-40 至 +85°C），可用于多种应用
- 成熟的技术降低了安全风险
- 概念复用缩短了上市时间
- 易于整合入所有平台架构和操作系统（Windows，Linux及其变体）
为了满足不断增长的安全需求，许多制造商和系统提供商都在寻找易于实现的定制解决方案，可以无缝集成到现有和新的计算设计中，从而支持快速设计导入和部署。可信计算组 (TCG) 已定义一系列开放的、厂商中立的全球工业标准，以支持可互操作的可信计算平台。可信计算的目标是根据嵌入在计算设备中已确立的安全锚来检测对系统的未授权更改。这可以通过专用微处理器实现，以支持将加密密钥安全集成到设备中。可信平台模块 (TPM) 中存储的基本密钥在内部进行处理和使用，并具有要保护的所有加密功能。可信计算建立在计算机设计中，现已扩展到汽车和工业自动化等行业中更广泛的应用。
作为 TCG 的发起成员之一和带头公司，英飞凌将继续为客户提供标准化优势。我们的目标是为您提供功能强大、成熟的安全解决方案，从而减少整合工作量。您可以基于我们源远流长的专业知识和可靠性来进行构建，以保护敏感数据，建立强大的机器身份和完整性，并通过保护证书、密钥和密码来支持安全认证。借助全球团队的支持，我们可以提供一系列市场领先的 OPTIGA™ TPM 产品，同时支持广泛温度范围内的所有标准接口。实际上，我们是第一家实现 TPM 1.2 产品及 TPM 2.0 产品以支持下一代嵌入式可信计算应用的厂商。发现更多关于 OPTIGA™ TPM 产品系列以及我们的产品系列如何跨接口、封装和温度范围进行扩展以满足各种应用需求的信息。
物联网解决方案世界大会将制造业最佳解决方案奖项授予英飞凌。最近加入英飞凌安全合作伙伴网络（ISPN）的Mocana携手英飞凌，将先进的安全功能与英飞凌高度重视并广泛使用的OPTIGA™TPM相结合，将物联网的安全性提升到新的高度。
Ecosystem and ISPN partner support of OPTIGA™ TPM
With more than 15 years of experience in designing TPM-based solutions and more than 20 scientific publications, the Fraunhofer Institute for Secure Information Technology (SIT) is one of the leading experts in the field of Trusted Computing. Fraunhofer SIT's involvement ranges from the standardization body over practical implementations to fundamental research. Fraunhofer SIT is involved throughout all application sectors, from desktop and server equipment, over automotive and railway to industrial applications.
Fraunhofer SIT's offers include:
*application sector specific design and architectures for TPM-based security solutions
*consultancy, teaching and empowerment on TPM integration
*extension and customizations of the Open Source Software Stack
GlobalSign provides PKI-based device identity enrollment and management solutions that leverage Infineon products such as the OPTIGA™ TPM SLM 9670 and SLB 9670 as the trust anchor. GlobalSign´s security products are targeted towards various IIoT verticals, including but not limited to - smart manufacturing, automotive, industrial automation and healthcare. GlobalSign brings experience and expertise in using PKI and SSL technologies and applying them towards solving cybersecurity problems in various small and large business contexts through their comprehensive product portfolio.
GlobalSign IoT Identity Platform can create and host custom PKI hierarchies that serve the core identity needs of devices embedded with Infineon OPTIGA™ TPMs.
GlobalSign IoT Edge Enroll is an endpoint software application that can provide device registration, enrollment and provisioning services. More information
Sectigo provides a complete certificate management solution starting with secure certificate creation & insertion at the customer´s factory using the OPTIGA™ TPM for private key storage. The Floodgate Factory CA Server enables key management and certificate signing during manufacturing. The Floodgate TPM Library provides the device-side software to streamline TPM usage and key storage, while the Floodgate CA Server allows management of PKI certificates after the device is deployed.Floodgate TPM Library and the Floodgate PKI Client enable OEMs to develop and deploy secure embedded connected devices with relative ease.
Together, Sectigo and Infineon provide:
- the APIs, libraries, and code running on the device to enable integration with the OPTIGA™ TPM
- key generation by the OPTIGA™ TPM and enrollment with Certificate Authority
- Certificate Signing Requests using the Simple Certificate Enrollment Protocol (SCEP), Enrollment over Secure Transport (EST), and Online Certificate Status Protocol (OCSP)
- Full integration with public and private Certificate Authorities
With about 15 years of experience in different security related projects and applications, Mixed Mode is a knowledgeable Infineon partner offering consulting services and software development for integration of the OPTIGA™ TPM. Amongst different projects, Mixed Mode developed and implemented a secure boot and secure update concept including hardware integration as well as verification of the LINUX image.
Mixed Mode has experience on different target embedded platforms, operating systems and use cases secured by OPTIGA™ TPM:
- Supported platforms: LINUX, RTOS, Bare Metal
- Supported use cases: Secure Communication, Secure Storage, Secure Boot, Secure Update
- Consulting services: Training, Workshops, Security Concepts / Security by Design, Code and Gap Analysis, ISO 62443 SL 3, Policy and Certificate Concepts
- Others: DRM (Digital Rights Management) and License Management on Embedded Platforms
wolfTPM is a TPM 2.0 project, designed for embedded use. It is highly portable, due to having been written in native C, having a single IO callback for SPI hardware interface, no external dependencies, and its compacted code with low resource usage.
It is generally very easy to compile on new platforms, so if your desired platform is not listed as supported or you would like assistance porting wolfTPM, please contact wolfSSL at facts@wolfssl.com.
Features:
*Provides all TPM 2.0 API's in compliance with the specification.
*Uses the TPM Interface Specification (TIS) to communicate over SPI.
*Includes wrappers for Key Generation, RSA encrypt/decrypt, ECC sign/verify, ECDH, NV Access and Hashing.
