Host Integrity at Runtime and Start-up (HIRS)

| HIRS System Tests | HIRS ACA Tests | HIRS Provisioner Tests| Information | | ------ | ------ | ------ |--------------------------------------------------------------------------------------------------------------------------| | | ||

Attestation Certificate Authority (ACA) and TPM Provisioning with Trusted Computing-based Supply Chain Validation

Host Integrity at Runtime and Start-up (HIRS) is a Proof of Concept Prototype intended to spur interest and adoption of Trusted Computing based concepts. It's intended for testing and development purposes only and is not intended for production.

HIRS is composed of an Attestation Certificate Authority (ACA) web based application and a corresponding, client-side, Provisioner application. The ACA can be configured to validate the platform's configuration and firmware against a set of OEM provided artifacts. The following image illustrates a supply chain validation capability known as an Acceptance Test discussed in the Procurement and Acceptance Testing Guide for organizations procuring enterprise servers, desktops, and laptops.

Notice: Github Discussions have been enabled for this repo. Please refer to the HIRS Discussions for development and support notifications.

Features

The HIRS ACA is a web based server which processes Attestation Identity Requests. The ACA provides a Provisioner application to be installed on all devices which will be requesting Attestation Certificates.

Attestation Certificate Authority (ACA)

Issues Attestation Certificates or TPM-based Local Device ID (LDevID) Certificates

to validated devices holding a TPM

Configures Policies for enabling/disabling validation procedures
Performs TCG-based Supply Chain Validation of connecting clients

* Optionally validates Endorsement, Platform Certificates, and Reference Integrity Manifests

Endorsement Certificate Certificate Chain Validation

* Process EK Certificates per TCG EK Credential Profile For TPM Family 2.0 * Verifies the endorsement key used by the TPM was placed there by the original equipment manufacturer (OEM) * Platform Certificate - Certificate Chain Validation * Process Platform Certificates per TCG Platform Attribute Credential Profile * Updates for the Platform Certificate Version 2.0 are in the current development cycle * Verifies the provenance of the system's hardware components, such as the motherboard and chassis, by comparing measured component information against the manufacturers, models, and serial numbers listed in the Platform Certificate

Firmware Integrity Validation

* Uploads and processes TCG PC Client Reference Integrity Manifests (RIMs) * Creates and verifies a nonce for the TPM Quote * Process TMP Event Logs and checks digests against the TPM Quote * Verifies individual event digests against the OEM provided Reference Integrity Measurements * Checks that firmware and boot related file hashes match those provided by OEMs. * Validates the import of All RIM files imported to the ACA (insure all RIM files were signed by trusted sources) * Verifies that the firmware hashes captured by the TPMs Platform Configuration Registers (PCRs) match the firmware hashes obtained from the OEM(s). * Verifies TCG/UEFI boot variables (e.g. BIOS setup data) have not been altered (e.g secure boot).

Attestation CA Dashboard

* Displays all Validation Reports, Certificates, and Trust Chains * Enables ACA policy configuration for validation of Endorsement and Platform Certificates * Enables Import/Export of Certificate (Trust) Chains, Endorsement Certificates, and Platform Certificates * Optionally allows uploaded Certificates of trusted parties

TPM Provisioner

Requests an Attestation Certificate for the TPM from the ACA
Transfers TCG Artifacts to the ACA (TPM Endorsement Certificates, Platform Certificates, Reference Integrity Manifests, Event

Logs, etc.)

Reads the device's hardware, network, firmware, and OS info for platform and component validation
Provides a TPM Quote for Firmware Integrity Checking
For more information see the TPM Provisioner help page

RIM Tool

Creates , Formats, and Digitally

Signs TCG PC Client Base RIMs, TCG Component RIMs (both SWID and CoSWID variants), as well as IETF CoRIMs

Validates the signature of TCG PC Client Base RIMs, IETF CoSwids, IETF CoRims, and TCG Component RIMs
For more information see the RIM Tool Github repository and

RIM Tool help pages

TCG Event Log Tool

Parses binary TPM Event Logs and displays event data in a human-readable form
Extracts Events from TPM Event Logs for test pattern generation
Provides Expected PCR values from a complete TPM Event Log
For more information see the Event Log Tool Github repository and

TCG Event Log Tool help pages

Platform Certificate Creator - PACCOR

Creates platform certificates according to

the TCG Platform Certificate Profile * Assists in gathering all of the data that can go into a PC and produce a signed attribute certificate

Validates signatures on TCG Platform Certificates
For more information see the PACCOR github repository and

PACCOR help pages

Installation Instructions

NOTE: The HIRS ACA, tcg_rim_tool, and tcg_eventLog_tool require Java 25 jre be installed before attempting to install these packages. For detailed instructions, see Installation notes.

Packages used for installation can be found on the release page.

Installing the HIRS ACA

There are several options for installing the HIRS ACA

An ACA Docker image is automatically created for each release. To run the ACA container using docker

``docker run --name=aca -p 8443:8443 ghcr.io/nsacyber/hirs/aca:latest

To install the ACA on a Redhat or Rocky Linux download the latest rpm from
the release page
then run the command


sudo dnf install HIRS_AttestationCA*.rpm.
To install the ACA on a Ubuntu Linux download the latest rpm from the release page
then run the command
sudo apt-get install ./HIRS_AttestationCA*.deb.
For more information see the HIRS install help page
Installing the HIRS_Provisioner.NET
To install the HIRS_Provisioner.NET on a Redhat or Rocky Linux download the latest rpm package from
the release page then open a terminal and run the command
sudo dnf install HIRS_Provisioner.NET.*.rpm
To install the HIRS_Provisioner.NET on Ubuntu Linux download the latest deb package from
the release page then open a terminal and run the command
sudo apt-get install ./HIRS_Provisioner.NET.*.deb
To install the HIRS_Provisioner.NET on Windows download the latest msi package from
the release page then open a powershell windows as an administrator then run the
command
msiexec /package HIRS_Provisioner.NET.*.msi /quiet
Then follow the instructions for setting up the HIRS_provisioner.NET in
the HIRS_Provisioner.NET User Guide.
Usage
On Linux: To kick off a provision on the client, open a terminal and run the command
sudo tpm_aca_provision
On Windows: Open a powershell terminal as an administrator and enter the command
tpm_aca_provision
To see the results and interact with the ACA, using a browser go to the ACA Portal usng the URL:
https://localhost:8443/