The core base for all hypervisor security would
actually be the Trusted Platform Module.
When we're thinking of a Trusted Platform Module, otherwise known as a TPM,
this is a computer chip that can securely store artifacts used to
authenticate the platform your PC or laptop is consuming.
These artifacts can include password certificates
or things like encryption keys.
They can be used to store platform measurements that help to ensure
that the platform remains trustworthy and has authentication and
capabilities of resisting tampering.
So, when you think of the full triad,
the TPM is heavily involved inside of the
confidentiality and integrity activities.
Just as a quick listing of capabilities,
the Trusted Platform Module can be used to generate cryptographically secure
random data. It can use hash functions to compute message digests and
hash‑based message authentication codes, otherwise known as HMACs. It can
generate and store and import and export and manage cryptographic keys,
including symmetric keys and asymmetric key pairs. It can do things such as
code signing and to verify signatures.
If we were to look at the breakdown of the Trusted Platform
Module within the computer, first, you have your traditional
compute and storage system: your disk, your CPU, your memory.
The TPM is installed on the same motherboard, but it communicates
with the rest of the system by means of the hardware bus. Computers
that incorporate a Trusted Platform Module can create cryptographic
keys and encrypt them so that they can only be decrypted by the
Trusted Platform Module.
This process, sometimes called key wrapping or binding of a
key, can help to protect the key in storage.
None of these keys are actually disclosed, so each TPM has a
master wrapping key called the storage root key,
which is stored within the TPM itself.
When you think about the private portion of the asymmetric key pair,
that is the one that's used for endorsement.
It is the one that's used for verifying the integrity of
hardware and software capabilities.
The private key will never leave the TPM. When you
think of the public key being active,
it's used to protect from tampering and from surveillance.
So, the TPM service within the computer can be thought of as a
mini computer inside of a computer because it has its own
independent storage and compute capabilities.
Let's grow this component and think about what the hardware security
module would be used for inside of the physical and logical security
of the cloud. That's in the next clip.