infineon/optiga-tpm

Infineon OPTIGA™ TPM 2.0

OPTIGA™ TPM

Quick navigation

Description

The OPTIGA™ TPM 2.0 is a ready-to-use security building block, which is fully compliant with the Trusted Computing Group (TCG) specifications, to protect the platform integrity and authenticity of connected devices. It can also be used to protect encryption keys, and sensitive data so that attackers and malware can't access or tamper with that data.

All OPTIGA™ TPM 2.0 products are based on Infineon's advanced hardware security technology and certified according to common criteria and FIPS security certification, making them an ideal solution for PC, servers, network infrastructure equipment (e.g., gateways, routers, wireless access points and switches) and other IoT devices with strong security requirements.

Why is software-only security often not enough?

Keeping secret keys safe and well secured is at the heart of IoT security. See below why OPTIGA™ TPM is the preferred choice for this challenge.

Key Features and Benefits

• High-end security controller with advanced cryptographic algorithms implemented in hardware (e.g. RSA & ECC256, SHA-256)
• Common Criteria (EAL4+) and FIPS security certification
• Flexible integration thanks to SPI, I2C or LPC interface support
• Reduced risk based on proven technology
• Fast time to market through concept reuse
• Easy integration into all platform architectures and operating systems (Windows, Linux & derivatives)

Use Cases

• Automatic device onboarding (e.g., AWS Greengrass and Azure IoT edge)
• Device health attestation
• Device identity for network access control
• Secret (configuration data, IP, and etc) protection
• Secured communication with TLS
• Secured firmware update
• Secured key storage
• Verification of device authenticity

Resources

Here you will find a list of relevant resouces which can can help you to study and learn TPM2.0.

Tools

CMD-line and GUI tools running on Linux:

1. ELTT2 - Infineon Embedded Linux TPM Toolbox 2 for TPM 2.0 for a quick TPM startup
   • Startup tool with basic functions in CMD-line
   • Can be compiled on Linux, other OS, and embedded platforms
2. OPTIGA™ TPM 2.0 Explorer GUI tool for Raspberry Pi
   • The ease of use of GUI has made it possible for all users in general, regardless of experience or knowledge, to access all kinds of OPTIGA™ TPM 2.0 features and use cases for commonly use

Open Source Host Code

OPTIGA™ TPM 2.0 host code and documentations are now available as open source repository on GitHub:

1. AWS IoT Greengrass Hardware Security Integration
2. PKCS11 token creation
3. TPM-based remote attestation
4. TPM 2.0 integration for PSoC 6 Wi-Fi BT Prototyping Kit to enable TPM backed onboarding to AWS IoT Core
5. TPM 2.0 used with EK based onboarding
6. TPM 2.0 backed Linux Trusted and Encrypted Keys
7. TPM 2.0 in U-Boot on Raspberry Pi 4
8. Extend measurements to TPM 2.0 PCR in U-Boot on Raspberry Pi 4
9. TPM 2.0 command reference and code examples
10. Guide to Integrating TPM 2.0 with the Android Open Source Project (AOSP)

Application notes

These documents are intended for customers who want to evaluate how to start with the TPM software integration for their target applications:

1. Integration of an OPTIGA™ TPM SLx 9670 TPM2.0 with SPI Interface in a Raspberry Pi® 4 Linux environment
2. Integration of TLS Functionality for OPTIGA™ TPM SLx 9670 TPM 2.0
3. Integration of an OPTIGA™ TPM SLx 9670 TPM2.0 with SPI Interface in a Raspberry Pi® 3 Linux environment with integrated TPM Driver
4. Integration of an OPTIGA™ TPM SLx 9670 TPM2.0 with SPI Interface in a Raspberry Pi® 3 Linux environment with TPM Driver Patch