TCG software stack boosts IoT security
July 1, 2020
Security for millions of devices worldwide has been enhanced as the Trusted Computing Group (TCG) releases its latest specification for the Trusted Platform Module (TPM 2.0) technology: the Feature Application Programming Interface (Fapi) standard.
The secure operation of devices in IoT, automotive, embedded and industrial markets is essential to achieve reliability, trustworthiness and resistance to threats. These markets apply a broad range of devices from high-performance multicore ICT systems such as cloud servers to small resource-constrained IoT nodes such as sensors. The completed TCG software stack (TSS) standard now supports this wide range of devices making it possible to integrate the TPM 2.0 as a turnkey method and achieve interoperability for platform security, network communication and data exchange.
“The Fapi spec is designed to remove the main obstacles to the broader adoption of enhanced security with TPM 2.0 in a wide range of systems,” said Andreas Fuchs, chair of TCG’s TSS work group. “By removing the need for programmers to be TPM experts to use the TPM functionalities, more people will be able to apply the significant security benefits provided by TCG certified TPM 2.0 chips. The Fapi specification enables a cost-effective and simplified implementation of the storage, management and processing of cryptographic keys inside the secure boundaries of a TPM chip to enhance the security of devices and even networks.”
The Fapi specification completes the framework of the TPM software stack specifications (TSS 2.0). The framework includes low-level specifications such as the system API, which enables the use of the entire set of TPM 2.0 functionalities in resource constraint devices. The addition of Fapi as a high-level specification enables the application of TPM 2.0 in high-performance systems with cost-effective development and the support of multiple users, parallel services, virtualisation, and Windows and Posix-based operating systems such as Linux.
The wide range of TPM functionalities such as signing, key storage in hierarchies, authorisation, secure time, personalisation, lifecycle-management and certificate management will be accessible for more devices and use cases with the use of the Fapi. It achieves this by providing an automated processing for key storage, default cryptographic configuration for administrators, best-practice provisioning, file system integration and process evaluation.
Furthermore, the Java Script Object Notation (Json) data and policy language standard also simplifies the complexity of handling declarative policy language to support the implementation of authorisation policy with a TPM. It will enable complex authorisation and policy management for keys with low implementation, validation and management efforts using the standardised Json data interchange format.
Both new specifications will help accelerate the implementation of the TPM for a secure digital ecosystem across IoT devices, industries and markets.
The Fapi standard also enables the usage of TPM 2.0 according to the PKCS#11 interface standard, which provides a generic storage and application of cryptographic keys in a wider range of applications. These applications are typical security software and protocols, such as SSH, user authentication, identity management, email encryption, and signing of documents.
With the addition of Fapi, the now complete TCG Software Stack 2.0 (TSS 2.0) provides a framework with utilities that allows systems and devices across worldwide markets to share the TPM functionalities at both high and low level. Implementations of the TSS including the Fapi standard are available and are supported by several companies.
TCG is a not-for-profit organisation formed to develop, define and promote open, vendor-neutral, global industry specifications and standards, supportive of a hardware-based root of trust, for interoperable trusted computing platforms.