BaselineWatch
Desk
Your fleet and your work Fleetyour releases and the hardware they run onTriagewhat needs a decisionWatchlistthe products and platforms you runSaved searchesthe lists you come back to
This instance Sourceswhat is read, how often, under what termsDigestthe daily or weekly summary, and alerts
How it is drawn Appearancethe look and the colour schemeBrandingthe mark this instance wears
Owner sign-in

1 Introduction

NIST platform security: roots of trust, firmware and secure enclaves IR 8320
All changes in this version
first version loaded 1 Introduction

Title

Introduction

Control

In data centers and edge computing, there are three significant forces that impact security: (1) the introduction of billions of connected devices and increased adoption of the cloud have significantly increased attack surfaces; (2) hacking has become industrialized with sophisticated and evolving techniques to compromise data; and (3) solutions composed of multiple technologies from different vendors result in a lack of coherent and consistent implementations of security controls. Given these forces, the foundation for a data center or edge computing security strategy should have a consolidated approach to comprehensively secure entire systems, including hardware platforms, on which workloads and data are executed and accessed.

In the scope of this document, the hardware platform is a server (e.g., application server, storage server, virtualization server) in a data center or edge compute facility. The server’s hardware platform, also called the server platform , represents the first part of the layered security approach. Hardware-enabled security —security with its basis in the hardware platform—can provide a stronger foundation than one offered by software or firmware, which has a larger attack surface and can be modified with relative ease. Hardware root of trust (RoT) can present a smaller attack surface if implemented with a small codebase. Existing security implementations can be enhanced by providing a base-layer, immutable hardware module that chains software and firmware verifications from the hardware all the way to the application space or specified security control. In that manner, existing security mechanisms can be trusted even more to accomplish their security goals without compromise, even when there is a lack of physical security or attacks originate from the software layer.

This report explains hardware-based security techniques and technologies that can improve server platform security and data protection for cloud data centers and edge computing. The rest of this report covers the following topics:

• Section 2 provides an overview of hardware platform security.

• Section 3 discusses the measurement and verification of platform integrity.

• Section 4 explores software runtime attacks and protection mechanisms.

• Section 5 considers protecting data in use, also known as confidential computing.

• Section 6 examines remote attestation services, which can collate platform integrity measurements to aid in integrity verification.

• Section 7 describes a number of cloud use case scenarios that take advantage of hardware-enabled security.

• Section 8 states the next steps for this report and how others can contribute.

• The References section lists the cited references for this report.

• Appendix A describes vendor-agnostic technology examples.

• Appendices B through F describe technology examples from Intel, AMD, Arm, Cisco, and IBM, respectively.

• Appendix G lists the acronyms and abbreviations used in the report.
• Appendix H provides a glossary of selected terms used in the report.

As technology and security capabilities evolve, NIST is continuously seeking feedback from the community on the content of the report and soliciting additional technology example contributions from other companies.

Although this document does not address other platforms like laptops, desktops, mobile devices, or Internet of Things (IoT) devices, the practices in this report can be adapted to support those platforms and their associated use cases.

Please send your feedback and comments to [email protected] .