Intel® Server Board S2600WF Product Family Technical Product Specification
103
administrator password to function, and the USB reordering is suppressed as long as the administrator
password is enabled. Users are restricted from booting in anything other than the boot order defined in
setup by an administrator.
10.2
Front Panel Lockout
If enabled in BIOS setup from the Security screen, this option disables the following front panel features:
•
The off function of the power button.
•
System reset button.
If front panel lockout is enabled, system power off and reset must be controlled via a system management
interface.
10.3
Trusted Platform Module (TPM) Support
The Trusted Platform Module (TPM) option is a hardware-based security device that addresses the growing
concern about boot process integrity and offers better data protection. TPM protects the system startup
process by ensuring it is tamper-free before releasing system control to the operating system. A TPM device
provides secured storage to store data, such as security keys and passwords. In addition, a TPM device has
encryption and hash functions. The server board implements TPM as per
TPM PC Client Specifications
revision 1.2,
published by the Trusted Computing Group (TCG).
A TPM device is optionally installed on a high-density 14-pin connector labeled “TPM” on the server board,
and is secured from external software attacks and physical theft. A pre-boot environment, such as the BIOS
and operating system loader, uses the TPM to collect and store unique measurements from multiple factors
within the boot process to create a system fingerprint. This unique fingerprint remains the same unless the
pre-boot environment is tampered with. Therefore, it is used to compare to future measurements to verify
the integrity of the boot process.
After the system BIOS completes the measurement of its boot process, it hands off control to the operating
system loader and, in turn, to the operating system. If the operating system is TPM-enabled, it compares the
BIOS TPM measurements to those of previous boots to make sure the system was not tampered with before
continuing the operating system boot process. Once the operating system is in operation, it optionally uses
TPM to provide additional system and data security (for example, Microsoft Windows 10* supports Bitlocker*
drive encryption).
10.3.1
TPM Security BIOS
The BIOS TPM support conforms to the TPM PC Client Implementation Specification for Conventional BIOS
the TPM Interface Specification, and the Microsoft Windows BitLocker Requirements. The role of the BIOS
for TPM security includes the following:
•
Measures and stores the boot process in the TPM microcontroller to allow a TPM-enabled operating
system to verify system boot integrity.
•
Produces extensible firmware interface (EFI) and legacy interfaces to a TPM-enabled operating
system for using TPM.
•
Produces Advanced Configuration and Power Interface (ACPI) TPM device and methods to allow a
TPM-enabled operating system to send TPM administrative command requests to the BIOS.
•
Verifies operator physical presence. Confirms and executes operating system TPM administrative
command requests.
•
Provides BIOS setup options to change TPM security states and to clear TPM ownership.
