A Trusted Platform Module (TPM) is a discrete hardware component that provides additional security features to the host controller it interacts with. When TPM is integrated with a system, it enables a trusted computing environment for the user to perform various functionalities such as secure storage of secret data and credentials, encryption, signature generation/verification and confirmation of the system software state

A Trusted Platform Module (TPM) chip is a dedicated processor located on a computer's motherboard, and it stores cryptographic keys, including Rivest-Shamir-Adleman (RSA) encryption keys, that are specific to the host system. These keys are used for hardware authentication, which helps to ensure the integrity and authenticity of the system.

How Does a TPM Work

A Trusted Platform Module (TPM) is a dedicated microchip embedded in a laptop or desktop computer, specifically designed to provide an additional layer of security to the hardware by utilizing built-in cryptographic keys.

The trusted platform module stores cryptographic keys and performs cryptographic operations. It provides a secure environment for storing sensitive information such as encryption keys, digital certificates, and passwords and protects them from unauthorized access and tampering. It also ensures the integrity of the system by verifying the boot process.

A TPM consists of several key components, including:

  • Secure Boot: The Trusted Platform Module (TPM) ensures that the system boots securely by verifying the authenticity of the firmware and software.
  • Secure Key Storage: The Trusted Platform Module provides a secure environment for storing sensitive data, such as encryption keys and certificates.
  • Random Number Generator: The Trusted Platform Module generates truly random numbers, which are used to create secure keys and encrypt data.
  • Hash Functions: The Trusted Platform Module provides hash functions, such as SHA-256, to ensure the integrity of data and detect any tampering.

Trusted Platform Module offers enhanced protection against various malicious threats, including firmware tampering and ransomware attacks, thereby safeguarding the device and its data from potential security breaches.

Types of Trusted Platform Module (TPM)

Discrete TPM:

Discrete Trusted Platform Module (TPM) is a separate hardware chip that is installed on the motherboard of a device or interfaced with the host controller. It operates independently of other components and provides dedicated security features. Discrete TPMs (Trusted Platform Modules) are commonly used in applications where high security is required. 

Firmware TPM:

In some cases, TPM functionality is integrated into system’s firmware, such as BIOS or UEFI eliminating the need of a discrete hardware component. Firmware TPMs (Trusted Platform Modules) are commonly used in applications where a discrete TPM (Trusted Platform Module) is not feasible or cost-effective. 

Physical based:

Physical based Trusted Platform Module (TPM) is integrated into the main central processing unit (CPU) and includes security mechanisms that make it tamper-resistant. They are designed to provide a high level of security and are typically used in applications where the highest level of trust and security is required. By integrating the TPM (Trusted Platform Module) into the CPU, the protected from physical attacks and tampering, making it more difficult for attackers to access or manipulate the sensitive data stored in the Trusted Platform Module.

Some of the key benefits of Physical based Trusted Platform Modules (TPM) include:

  • High security
  • Tamper-evidence
  • Low power consumption
  • Small form factor

Physical based TPMs (Trusted Platform Modules) are commonly used in a variety of applications, including:

  • Secure boot
  • Hardware-based security
  • Trusted execution environments

Firmware based:

Firmware-based TPMs (fTPMs) run in a CPU's trusted execution environment (TEE), which provides a secure environment for the TPM to operate in. This allows Firmware based TPM to achieve a high level of security, almost comparable to physical TPM chips.

fTPMs are often used in systems where a physical TPM chip is not feasible or cost-effective, but a high level of security is still required. They are commonly used in applications such as:

  • IoT devices
  • Embedded systems
  • Mobile devices

Software based:

Software-based TPMs (sTPMs) do not provide additional security and can introduce new risks and vulnerabilities. sTPMs are software implementations of TPM functionality, which means they run on top of the operating system and are subject to the same security risks as any other software.

Additionally, sTPMs may not be able to provide the same level of trust and assurance as physical TPMs or firmware-based TPMs, since they are software-based and can be modified or tampered with. They are often used in development, testing, and simulation environments, where security is not a top priority. However, they should not be used in production environments or in applications where high security is required.

sTPMs can still be useful for certain use cases, such as:

  • Development and testing
  • Education and training

Virtual

Virtual TPMs (vTPMs) are provided by a hypervisor, which is a piece of software that creates and manages virtual machines (VMs). The hypervisor acts as a trusted intermediary between the VM and the physical TPM, allowing the VM to access TPM functionality without directly accessing the physical Trusted Platform Module.

 

Virtual TPMs provide several benefits, including

  • Improved security
  • Flexibility
  • Scalability

vTPMs provide a convenient and secure way to access TPM functionality in virtualized environments, but they should be used in conjunction with other security measures to ensure the integrity of the system.

Benefits of TPM

Trusted Platform Module (TPM) being a hardware-based security offers higher level of security compared to software-based solutions. It securely stores cryptographic keys ensuring they are protected from unauthorized access. It can provide evidence of the system’s integrity, allowing remote parties to verify the system’s state.

Here are some of the most important benefits or advantages of using a Trusted Platform Module (TPM):

  • Enhanced Security
  • Hardware-based security
  • Authentication and Authorization
  • Security boot and Integrity Measurement
  • Data protection
  • Compliance and Regulatory Requirements
  • Reduced Risk of Data Breaches
  • Improved System Integrity
  • Support for advanced security Features
  • Cost Savings
  • Increased Trust and Confidence
  • Support for Emerging Technologies