TheTPMemulationmodecannotbeusedasasecuresubstitutefortheTPM.TheTPMprovidesthe
followingtwokeyprotectionmethodsthataremoresecurethantheTPMemulationmode.
•AllkeysusedbytheTPMareprotectedbyauniqueroot-levelkey.Theuniqueroot-levelkeyiscreated
insidetheTPMandcannotbeseenorusedoutsideoftheTPM.IntheTPMemulationmode,the
root-levelkeyisasoftware-basedkeystoredontheharddiskdrive.
•AllprivatekeyoperationsareperformedwithintheTPM,sothattheprivatekeymaterialforanykeyis
neverexposedoutsideoftheTPM.IntheTPMemulationmode,allprivatekeyoperationsareperformed
inthesoftware,sothereisnoprotectionoftheprivatekeymaterial.
TheTPMemulationmodeisprimarilyfortheuserwhoislessconcernedaboutthesecurityandmore
concernedaboutthesystemlogonspeed.
Systemboardswap
AsystemboardswapinfersthattheoldSRKtowhichkeyswereboundtoisnolongervalid,andanother
SRKisneeded.ThiscanalsohappeniftheTrustedPlatformModuleisclearedthroughtheBIOS.
TheClientSecuritySolutionAdministratorisrequiredtobindthesystemcredentialstoanewSRK.The
SystemBaseKeywillneedtobedecryptedthroughtheSystemBaseAESProtectionKeyderivedfrom
theClientSecuritySolutionAdministrator’sauthorizationcredentials.
IfaClientSecuritySolutionAdministratorisadomainuserIDandthepasswordforthatuserIDwaschanged
onadifferentmachine;thepasswordthatwaslastusedwhenloggedontothesystemneedingrecovery
willneedtobeknowninordertodecryptSystemBaseKeyforrecovery.Forexample,duringdeployment
aClientSecuritySolutionAdministratoruserIDandpasswordwillbecongured,ifthepasswordforthis
userchangesonadifferentmachine,thentheoriginalpasswordsetduringdeploymentwillbetherequired
authorizationinordertorecoverythesystem.
Followthesestepstoperformthesystemboardswap:
1.ClientSecuritySolutionAdministratorlogsontooperatingsystem.
2.Logon-executedcode(cssplanarswap.exe)recognizesthesecuritychipisdisabledandrequiresreboot
toenable.(ThisstepcanbeavoidedbyenablingthesecuritychipthroughtheBIOS.)
3.Systemisrebootedandsecuritychipisenabled.
4.TheClientSecuritySolutionAdministratorlogson;thenewTakeOwnershipprocessiscompleted.
5.SystemBaseKeyisdecryptedusingsystembaseAESProtectionKeythatisderivedbytheClient
SecuritySolutionAdministrator’sauthentication.SystemBaseKeyisimportedtothenewSRKand
re-establishestheSystemLeafKeyandallcredentialsprotectedbyit.
6.Thesystemisnowrecovered.
Note:SystemboardswapisnotneededwhenusingEmulationMode.
Chapter3.WorkingwithClientSecuritySolution21
Kommentare zu diesen Handbüchern