Intel AXXTPME3, Hardware User'S Manual

Page: 15 / 35

Intel® Trusted Platform Module Hardware User’s Guide 5
3
Configuring the TPM module
TPM Security BIOS
The BIOS TPM support conforms to the TPM PC Client Specific – Implementation
Specification for Conventional BIOS, version 1.2, and to the TPM Interface specification,
version 1.2. The BIOS adheres to the Microsoft Vista BitLocker* requirement. The role of
the BIOS for TPM security includes the following:
•
Measures and stores the boot process in the TPM microcontroller to allow a TPM
enabled operating system to verify system boot integrity.
•
Produces EFI and legacy interfaces to a TPM-enabled operating system for using
TPM.
•
Produces ACPI TPM device and methods to allow a TPM-enabled operating system
to send TPM administrative command requests to the BIOS.
•
Verifies operator physical presence. Confirms and executes operating system TPM
administrative command
•
Provides BIOS Setup options to change TPM security states and to clear TPM
ownership.
For additional details, refer to the TCG PC Client Specific Implementation Specification,
the TCG PC Client Specific Physical Presence Interface Specification, and the Microsoft
BitLocker* requirement documents.
Physical Presence
Administrative operations to the TPM require TPM ownership or physical presence
indication by the operator to confirm the execution of administrative operations. The
BIOS implements the operator presence indication by verifying the setup Administrator
password.
A TPM administrative sequence invoked from the operating system proceeds as follows:
1. User makes a TPM administrative request through the operating system’s security
software.
2. The operating system requests the BIOS to execute the TPM administrative
command through TPM ACPI methods and then resets the system.
3. The BIOS verifies the physical presence and confirms the command with the
operator.
4. The BIOS executes TPM administrative command(s), inhibits BIOS Setup entry
and boots directly to the operating system which requested the TPM command(s).