ISO IEC 27070:2021 pdf download – Information technology — Security techniques — Requirements for establishing virtualized roots of trust.
1 Scope This document specifies requirements for establishing virtualized roots of trust. 2 Normative references There are no normative references in this document. 3 Terms and definitions For the purposes of this document, the following terms and definitions apply. ISO and IEC maintain terminology databases for use in standardization at the following addresses: — ISO Online browsing platform: available at https://www.iso .org/obp — IEC Electropedia: available at https://www.electropedia .org/ 3.1 attestation key AK particular type of trusted module (3.7 ) signing key that has a restriction on its use, in order to prevent forgery 3.2 endorsement key EK key that is used in a process for the issuance of attestation key (3.1) credentials and to establish a platform owner 3.3 integrity measurement process of calculating the hash value of the measured object using the cryptographic hash algorithm 3.4 root of trust RoT component that needs to always behave in the expected manner because its misbehaviour cannot be detected Note 1 to entry: The complete set of roots of trust has at least the minimum set of functions to enable a description of the platform characteristics that affect the trust of the platform. [SOURCE: ISO/IEC 11889-1, 3.59, modified — The abbreviated term has been added.] 3.5 remote attestation RA process of evaluating integrity measurements generated using a root of trust (3.4) for measurement, storage and reporting to establish trust in a platform remotely
5.2 Hardware layer components 5.2.1 General At the bottom of the architecture, the hardware layer that includes hardware resources and devices is the base for building a trusted computing platform. This layer provides a RoT for the physical machine that typically offers trusted platform services for the VMM layer. NOTE The VMM layer is also known as the hypervisor layer. This layer also includes the CRTM, the initial set of instructions executed for establishing a new chain of trust for integrity measurement. The hardware layer components include but are not limited to: — power: Powering the computer system for booting and running. The Trusted Module (TM) can control power such that it can increase security by turning off the power if verification of the boot fails against a policy; — TM: A trusted module on a special co-processor or chip with capabilities that include but not limited to integrity measurement, integrity reporting, generation of signatures for measured integrity values, key management, secure storage, identity verification, etc.; The TM shall support a root of trust for measurement, implement a root of trust for reporting and provide a root of trust for storage. See TM standards for details. — BIOS/UEFI: A firmware with capabilities of initializing the platform, starting an OS loader and providing runtime services to the OS; — CPU: The operating centre of the computing system. The power, BIOS/UEFI and CPU have no special functional or security features to support virtualized RoTs. Hence, this document only lists the functional and security requirements for the TM in 5.2.2 and 5.2.3.
ISO IEC 27070:2021 pdf download – Information technology — Security techniques — Requirements for establishing virtualized roots of trust
