Trusted Computing Platforms: TCPA Technology in Context

Auditing the TPM

The TPM and TSS need to be able to report a log of events that occur at the TPM. The log uses the same paradigm as the PCRs, in that the TPM keeps a PCR value that is extended with each log event (see Chapter 6 for the notion of “extending” a PCR), and the TSS maintains the log entries for challengers to review.

The TPM owner can define which functions generate an audit event, and change which functions generate the event at any time.

TPM_SetOrdinalAuditStatus

This capability is used to instruct the TPM to audit, or not to audit, a particular command. It requires TPM owner authorization, and it must be passed the command ordinal of the TPM command whose audit status is required. The command causes a TPM first to verify the owner ...