三點必需要求:
The platform components must:?
1. Provide a mechanism for securely anchoring a root of trust public key. // 提供一種用于安全地錨定信任根公鑰的機制。
2. Verify the device firmware digital signature using the anchored public key // 使用錨定的公鑰驗證設備固件數字簽名
3. Provide a mechanism for revoking previously signed firmware// 提供一種機制來撤銷以前簽名的固件
當前標準:
1. Authenticating all mutable firmware in system devices (flash for BIOS, BMC, microcontroller(s),CPLD, etc)//認證系統設備中的所有可變固件
2. Existing standards/protocols://現有標準
2.1. NIST SP 800-193 “Platform Firmware Resiliency Guidelines” //“平臺固件韌性啟動指導”
2.2. NIST SP 800-57 “Recommendation for Key Management” //“密碼管理建議”
2.3. NIST SP 800-147 “BIOS Protection Guidelines”//"BIOS保護指南”
2.4. NIST SP 800-147B “BIOS Protection Guidelines for Servers//”服務器BIOS保護指南"
2.5. NIST FIPS 186-4 Digital Signature Standard (DSS)//"數字簽名標準"