Host Integrity at Runtime and Start-up (HIRS)

HIRS System Tests	HIRS ACA Tests	HIRS Provisioner Tests	Information

Attestation Certificate Authority (ACA) and TPM Provisioning with Trusted Computing-based Supply Chain Validation

Host Integrity at Runtime and Start-up (HIRS) is a Proof of Concept Prototype intended to spur interest and adoption of Trusted Computing based concepts. It's intended for testing and development purposes only and is not intended for production.

HIRS is composed of an Attestation Certificate Authority (ACA) web based application and a corresponding, client-side, Provisioner application. The ACA can be configured to validate the platform's configuration and firmware against a set of OEM provided artifacts. The following image illustrates a supply chain validation capability known as an Acceptance Test discussed in the Procurement and Acceptance Testing Guide for organizations procuring enterprise servers, desktops, and laptops.

Notice: Github Discussions have been enabled for this repo. Please refer to the HIRS Discussions for development and support notifications.

Features

The HIRS ACA is a web based server which processes Attestation Identity Requests. The ACA provides a Provisioner application to be installed on all devices which will be requesting Attestation Certificates.

Attestation Certificate Authority (ACA)

• Issues Attestation Certificates or TPM-based Local Device ID (LDevID) Certificates to validated devices holding a TPM
• Configures Policies for enabling/disabling validation procedures
• Performs TCG-based Supply Chain Validation of connecting clients
  • Optionally validates Endorsement, Platform Certificates, and Reference Integrity Manifests
• Endorsement Certificate Certificate Chain Validation
  • Process EK Certificates per TCG EK Credential Profile For TPM Family 2.0
  • Verifies the endorsement key used by the TPM was placed there by the original equipment manufacturer (OEM)
  • Platform Certificate - Certificate Chain Validation
  • Process Platform Certificates per TCG Platform Attribute Credential Profile
    • Updates for the Platform Certificate Version 2.0 are in the current development cycle
  • Verifies the provenance of the system's hardware components, such as the motherboard and chassis, by comparing measured component information against the manufacturers, models, and serial numbers listed in the Platform Certificate
• Firmware Integrity Validation
  • Uploads and processes TCG PC Client Reference Integrity Manifests (RIMs)
  • Creates and verifies a nonce for the TPM Quote
  • Process TMP Event Logs and checks digests against the TPM Quote
  • Verifies individual event digests against the OEM provided Reference Integrity Measurements
  • Checks that firmware and boot related file hashes match those provided by OEMs.
  • Validates the import of All RIM files imported to the ACA (insure all RIM files were signed by trusted sources)
  • Verifies that the firmware hashes captured by the TPMs Platform Configuration Registers (PCRs) match the firmware hashes obtained from the OEM(s).
  • Verifies TCG/UEFI boot variables (e.g. BIOS setup data) have not been altered (e.g secure boot).
• Attestation CA Dashboard
  • Displays all Validation Reports, Certificates, and Trust Chains
  • Enables ACA policy configuration for validation of Endorsement and Platform Certificates
  • Enables Import/Export of Certificate (Trust) Chains, Endorsement Certificates, and Platform Certificates
  • Optionally allows uploaded Certificates of trusted parties

TPM Provisioner

• Requests an Attestation Certificate for the TPM from the ACA
• Transfers TCG Artifacts to the ACA (TPM Endorsement Certificates, Platform Certificates, Reference Integrity Manifests, Event Logs, etc.)
• Reads the device's hardware, network, firmware, and OS info for platform and component validation
• Provides a TPM Quote for Firmware Integrity Checking
• For more information see the TPM Provisioner help page

RIM Tool

• Creates , Formats, and Digitally Signs TCG PC Client Base RIMs, TCG Component RIMs (both SWID and CoSWID variants), as well as IETF CoRIMs
• Validates the signature of TCG PC Client Base RIMs, IETF CoSwids, IETF CoRims, and TCG Component RIMs
• For more information see the RIM Tool Github repository and RIM Tool help pages

TCG Event Log Tool

• Parses binary TPM Event Logs and displays event data in a human-readable form
• Extracts Events from TPM Event Logs for test pattern generation
• Provides Expected PCR values from a complete TPM Event Log
• For more information see the Event Log Tool Github repository and TCG Event Log Tool help pages

Platform Certificate Creator - PACCOR

• Creates platform certificates according to the TCG Platform Certificate Profile
  • Assists in gathering all of the data that can go into a PC and produce a signed attribute certificate
• Validates signatures on TCG Platform Certificates
• For more information see the PACCOR github repository and PACCOR help pages

Installation Instructions

NOTE: The HIRS ACA, tcg_rim_tool, and tcg_eventLog_tool require Java 25 jre be installed before attempting to install these packages. For detailed instructions, see Installation notes.

Packages used for installation can be found on the release page.

Installing the HIRS ACA

There are several options for installing the HIRS ACA

An ACA Docker image is automatically created for each release. To run the ACA container using docker

docker run --name=aca -p 8443:8443 ghcr.io/nsacyber/hirs/aca:latest

To install the ACA on a Redhat or Rocky Linux download the latest rpm from the release page then run the command

sudo dnf install HIRS_AttestationCA*.rpm.

To install the ACA on a Ubuntu Linux download the latest rpm from the release page then run the command

sudo apt-get install ./HIRS_AttestationCA*.deb.

For more information see the HIRS install help page

Installing the HIRS_Provisioner.NET

To install the HIRS_Provisioner.NET on a Redhat or Rocky Linux download the latest rpm package from the release page then open a terminal and run the command

sudo dnf install HIRS_Provisioner.NET.*.rpm

To install the HIRS_Provisioner.NET on Ubuntu Linux download the latest deb package from the release page then open a terminal and run the command

sudo apt-get install ./HIRS_Provisioner.NET.*.deb

To install the HIRS_Provisioner.NET on Windows download the latest msi package from the release page then open a powershell windows as an administrator then run the command

msiexec /package HIRS_Provisioner.NET.*.msi /quiet

Then follow the instructions for setting up the HIRS_provisioner.NET in the HIRS_Provisioner.NET User Guide.

Usage

On Linux: To kick off a provision on the client, open a terminal and run the command

sudo tpm_aca_provision

On Windows: Open a powershell terminal as an administrator and enter the command

tpm_aca_provision

To see the results and interact with the ACA, using a browser go to the ACA Portal usng the URL:

https://localhost:8443/

For more information see the Getting Started Guide

Quick Links:

Background

• TPM 2.0: A brief introduction
• Background for HIRS

HIRS Documentation

• HIRS Help

HIRS Notes

• Getting started with the ACA and Platform Certificates
• Installation and build instructions
• HIRS Attestation Certificate Authority FAQ
• ACA Debug

Tools

• Platform Certificate Creator and PACCOR Users Guide
• Reference Integrity Manifest tool (RIM-Tool) and RIM-Tool Users Guide
• Event Log tool (tcg_eventlog_tool) and Event Log Tool Users Guide