Securing Edge Systems with TPM 2.0 and SPIRE
summary
Uses TPM 2.0 to remote-attest edge machines via SPIRE, reading PCR4 and PCR5 boot MBR hashes and verifying TPM quotes, then issues a SPIFFE identity derived from the public key hash-based SPIRE selector only when PCRs match; a demo shows the node gets an identity and loses it after a kernel/module change. Implementation uses a forked TPM plugin, plans include a new plugin SDK, a TPM key-manager, and PCR10/IMA file-integrity checks for runtime validation.
AI-written summary · about
chapters (15)
- 0:00Intro
- 0:56TestifySec
- 1:17Threat Model CI Systems
- 2:10TPM Policy
- 2:29SPIRE
- 3:18TPM
- 3:47Demo Overview
- 4:22What is a TPM
- 5:40Virtualized TPMs
- 6:03Selectors
- 6:33Trust
- 7:21TPM Verification
- 8:42Demo
- 11:00Future Work
- 12:27QA
related talks
14mUsing DevIDs and TPMs for Node Attestation
28mSecuring Cloud-Native Workloads from the Metal Up
51mSecuring Embedded Linux Systems with TPM 2.0
39mTPM Is No Silver Bullet: Pitfalls in Embedded Device Security
42mTPM based attestation - how can we use it for good?
33mSPIFFE and SPIRE: Architecture Deep Dive
20mSecuring the Software Supply Chain with the in-toto & SPIRE projects
43mHardware-backed Per-process Secrets