Trusted Platform Module (TPM) refers to the device as well as the implementation by which encrypted configuration information specific to the system is stored. The information serves as metrics against which processes are measured during system boot. Oracle Solaris uses TPM to securely store encryption keys.
The following components implement TPM in Oracle Solaris:
The TPM device driver communicates with the TPM device.
The Trusted Computing Group (TCG) Software Stack, or TSS, functions as the communication channel with the TPM device by means of the tcsd daemon.
The PKCS #11 libraries implement a hardware token or provider that uses the TPM to generate keys and perform sensitive operations. The provider protects all private data objects by encrypting them with keys that can be used only inside the TPM device. The PKCS #11 libraries adhere to the following standard: RSA Security Inc. PKCS #11 Cryptographic Token Interface (Cryptoki).
The tpmadm command is used to administer the TPM-related aspects for verification of the boot process.
For more details, see the tpmadm(1M) man page.
The platform owner must initialize TPM by setting an owner password which is used to authorize privileged operations. The platform owner, also called the TPM owner, differs from the traditional superuser in two ways:
To access TPM functions, process privilege is irrelevant. Privileged operations require knowledge of the owner password regardless of the privilege level of the calling process.
The TPM owner cannot override access controls for data protected by TPM keys. The owner can effectively destroy data by reinitializing the TPM. However, the owner cannot access data that has been encrypted with TPM keys which are owned by other users.
Trusted Platform Module, together with the other measures described in this guide, secures the system from unauthorized access by users or applications.