[tpm2] Sharing TPM 2.0 between containers with access policy

[tpm2] Sharing TPM 2.0 between containers with access policy

[Oleksii Moisieiev]

[-- Attachment #1: Type: text/plain, Size: 844 bytes --]

Hello all,

I have an embedded device, with Docker containers based architecture.
This device is operating by software, installed in separate containers.


I would like to share TPM2.0 access between this containers with the following restrictions:

1) Forbid Clear TPM command for the containers;
2) Each container should have an access only to the set of keys it owns.
3) Each container can create keys, but not overwrite existing keys that does not related to this container.

According to the "TCG TSS 2.0 TAB and Resource Manager Specification" - TPM Resource manager doesn't implement access restrictions right now.

So the question is: Could you suggest some existing solution on top of the TPM Resource Manager, which provides access restrictions and can isolate each container as a TPM user.

Best regards,

Oleksii

[-- Attachment #2: attachment.htm --]
[-- Type: text/html, Size: 1472 bytes --]