Trusted Boot
Trusted Boot is a feature of Power® Security and Compliance (PowerSC™). Trusted Boot uses the Virtual Trusted Platform Module (VTPM) as described by the Trusted Computing Group. Up to 60 logical partitions per server can be configured to have their own unique VTPM by using the Hardware Management Console (HMC). The VTPM is used to record the system boot and, in association with the AIX® Trusted Execution technology, provides security and assurance of the boot image on disk, on the entire operating system, and in the application layers.
The VTPM is a software implementation of the Trusted Platform Module (TPM) specification, as described by the Trusted Computing Group. The Trusted Platform Module is implemented as a physical chip on computer systems.
You can create a VTPM as part of the initial logical partitioning (by using the HMC Partitioning wizard), or you can dynamically enable the device. When dynamically enabled, the VTPM becomes active only when the logical partition is restarted.
The VTPM enables the AIX environment of the logical partition to use Trusted Boot capability. When a VTPM is associated with a logical partition, being booted, components of the boot take cryptographic hashes of relevant data and of components that can be run in the future, for example the AIX boot loader. These cryptographic hashes are securely copied to storage that is controlled by the VTPM. After the logical partition is operational, other users can then securely retrieve the hashes by using a process known as remote attestation. The hashes can then be examined to determine whether the logical partition booted in a trusted configuration so that users could take action if required.
- The maximum memory setting of the logical partition must be greater than of 1 GB for the active profile.
- Each VTPM requires permanent storage for the lifetime of the device. A normal logical partition uses 6 KB of system nonvolatile RAM. This storage requirement imposes a limitation on the number of VTPMs per server.
Permanent data stored by the VTPM contains sensitive information about the trust of the VTPM feature. For example, the first time each VTPM is operated a public-private key pair known as the Endorsement Key (EK) is generated and then permanently stored. This action allows the VTPM to be identified by other users during the lifetime of the device. The permanent data, including the EK, is deleted when the VTPM device is removed by the console.
- To migrate a logical partition with VTPM enabled, both systems must have the same trusted system key.
- To successfully change the trusted system key, no logical partition with VTPM enabled can be in the suspend state. The HMC cannot change the key until suspended logical partitions with VTPM enabled, are resumed or powered off.
