Practical Industrial Internet of Things Security

Root of trust – TPM, TEE, and UEFI

In Chapter 3, IIoT Identity and Access Management, we discussed the concept of root of trust (RoT) in PKI, which involves a hierarchy of CA. In PKI, the root CA (or the trust anchor) is absolutely trusted, and can vouch for the identity of other entities. However, for endpoints, the RoTs have a slightly different connotation.

In a device endpoint, the RoTs are components, or computing engines, that constitute a set of unconditionally trusted functions that always behave in an expected manner, because their misbehavior cannot be detected (NIST 800-150). In other words, the RoT determines the highest level of trust attainable by a device, and a compromise on the RoT compromises trust for the entire system. ...