Weighing the pros and cons of the Trusted Computing Platform

In 2003, the Trusted Computing Group (TCG) was formed by Advanced Micro Devices Inc., Hewlett-Packard Co., IBM, Intel Corp. and Microsoft. The group’s original goal was the development of a Trusted Platform Module (TPM), an integrated circuit that conforms to the trusted platform module specification put forward by the TCG. Throughout the years, this chip has found its way to servers, laptops and desktops. Still, some administrators and computer users are unsure of how this technology can benefit or hurt them. Below are a few tips to help administrators and users better assess trusted computing technology.

The benefits of trusted computing
The Trusted Computing Platform (TCP) was designed with comprehensive system security and performance in mind. When being developed, the TCG built the design of the TPM chip on the following six principles:

1. Security: TCG-enabled components should achieve controlled access to designated critical secured data and should reliably measure and report the system's security properties. The reporting mechanism should be fully under the owner's control.
2. Privacy: TCG-enabled components should be designed and implemented with privacy in mind and

1. adhere to the letter and spirit of all relevant guidelines, laws and regulations. This includes, but is not limited to, the OECD Guidelines, the Fair Information Practices, and the European Union Data Protection Directive (95/46/EC).
2.  Interoperability: Implementations and deployments of TCG specifications should facilitate interoperability. Furthermore, implementations and deployments of TCG specifications should not introduce any new interoperability obstacles that are not for the purpose of security.
3. Portability of data: TCG deployment should support established principles and practices of data ownership.
4. Controllability: Each system owner should have effective choice and control over the use and operation of the TCG-enabled capabilities that belong to them; their participation must be opt-in. Subsequently, any user should be able to reliably disable the TCG functionality in a way that does not violate the owner's policy.
5. Ease of use: The nontechnical user should find the TCG-enabled capabilities comprehensible and usable.

With these principles in mind, developers designed a chip that would assure the integrity of a platform. Together with the BIOS, the TPM created what is known as the Root of Trust. The TPM contains several Platform Configuration Registers (PCRs) that allow secure storage and reporting of security-relevant data (unauthorized changes to the BIOS, possible root-based modifications, boot-sector changes, etc). This data can be used to detect changes to previous configurations and derive decisions on how to proceed. A good example can be found in Microsoft's BitLocker Drive Encryption.

Thus, the BIOS and the operating system have the primary responsibility to utilize the TPM to assure platform integrity. Only then can applications and users running on that platform rely on its security characteristics, such as secure I/O, uncompromised keyboard entries, memory and storage operations.

The concerns over trusted computing
 Despite the numerous principles regarding the security of trusted computing, the design has raised some concerns over functionality and privacy. In practice, trusted computing uses cryptography to help enforce a selected behavior. The main functionality of trusted computing is to allow someone else to verify that only authorized code runs on a system. Remember, used alone, trusted computing does not protect against attacks that exploit security vulnerabilities introduced by programming bugs.

The problem arises with the core function of the chip. With trusted computing, it is technically possible not just to secure the hardware for its owner, but also to secure it against its owner. Consider this as an example: A user who wanted to switch to a competing program might find that it would be impossible for that new program to read old data, as the information would be "locked in" to the old program. It could also make it impossible for the user to read or modify their data except as specifically permitted by the software.

Other similar concerns include the abuse of remote validation of software. In this scenario, the manufacturer—and not the user who owns the computer system—decides what software would be allowed to run. The secondary concern here is that user action in these situations may be recorded in a proprietary database without the user actually knowing. With this happening, user privacy becomes and issue as well as possibly creating a security compliance conflict.

Remote attestation could cause other problems. Currently, websites can be visited using a number of Web browsers, though certain websites may be formatted such that some browsers cannot decipher their code. Some browsers have found a way to get around that problem by emulating other browsers. With remote attestation, a website could check the Internet browser being used and refuse to display on any browser other than the specified one (like Internet Explorer), so even emulating the browser would not work.

TPM in server technology
Many large sever vendors sell TPM-ready machines. Still, the same cautions as above must be taken when deciding to use a TPM. These same large vendors will go on to warn their customers that the TPM is a customer-configured option. Server makers like HP take their own cautions with the chip, saying that they will not configure the TPM as part of any pre-installation process. They go on to say that they are not held liable for maintenance of recovery keys or inability to access core server data. 

If a TPM is something that needs to be initiated on a server, remember to perform a full backup of your keys and server data. In many cases, disaster recovery will require the use of that data in an emergency situation. When using TPM, remember that even the server manufacturer, in this case HP, will be unable to override or bypass the protections provided by BitLocker and the TPM.

When BitLocker is deployed on a server and the TPM is initialized, data access becomes locked if the administrator fails to follow the proper procedures for any of the following:

• Updating the system or option firmware
• Replacing the system board
• Replacing a hard drive
• Modifying OS application TPM settings.

Caution is strongly advised when deploying the TPM within a server. Make sure there is a viable use case for this technology, as any mistake can be very costly.

Securing your machine
The topic of trusted computing will continue to draw criticism and support. When used as designed, the chip can certainly provide a higher level of machine security. However, abuses and functionality questions highlight the drawbacks to adopting the technology.

Remember, computer security does not have to be chip-reliant. Security best practices can help guide administrators in the right direction if they feel uncomfortable using the TPM chip. Ensuring a system’s BIOS settings are correct, its firmware and software is up to date and constantly monitoring an environment’s security health will keep systems running longer and safer. Each data center is unique and has different requirements. It will be through careful planning and research that an IT administer will be able to come properly secure their infrastructure.

About the author: Bill Kleyman, MBA, MISM, is an avid technologist with experience in network infrastructure management. His engineering work includes large virtualization deployments as well as business network design and implementation. Currently, he is the Virtualization Architect at MTM Technologies Inc. He previously worked as Director of Technology at World Wide Fittings Inc.

Disclaimer: Our Tips Exchange is a forum for you to share technical advice and expertise with your peers and to learn from other enterprise IT professionals. TechTarget provides the infrastructure to facilitate this sharing of information. However, we cannot guarantee the accuracy or validity of the material submitted. You agree that your use of the Ask The Expert services and your reliance on any questions, answers, information or other materials received through this Web site is at your own risk.