You signed in with another tab or window. Reload to refresh your session.You signed out in another tab or window. Reload to refresh your session.You switched accounts on another tab or window. Reload to refresh your session.Dismiss alert
A Trusted platform module (TPM) chip is a secure crypto-processor that is designed to carry out cryptographic operations. This technology is designed to provide hardware-based, security-related functions. The Azure IoT Edge for Linux on Windows (EFLOW) virtual machine doesn't have a virtual TPMs attached to the VM. However, the user can enable or disable the TPM passthrough feature, that allows the EFLOW virtual machine to use the Windows host OS TPM. The TPM passthrough feature enables two main scenarios:
17
+
A trusted platform module (TPM) chip is a secure crypto-processor that carries out cryptographic operations. This technology provides hardware-based security functions. The Azure IoT Edge for Linux on Windows (EFLOW) virtual machine doesn't have a virtual TPM attached. However, you can enable or disable the TPM passthrough feature, which lets the EFLOW virtual machine use the Windows host OS TPM. The TPM passthrough feature lets you:
18
18
19
-
- Use TPM technology for IoT Edge device provisioning using Device Provisioning Service (DPS)
20
-
-Read-only access to cryptographic keys stored inside the TPM.
19
+
- Use TPM technology for IoT Edge device provisioning with Device Provisioning Service (DPS)
20
+
-Get read-only access to cryptographic keys stored in the TPM
21
21
22
-
This article describes how to develop a sample code in C# to read cryptographic keys stored inside the device TPM.
22
+
This article shows you how to write sample C# code to read cryptographic keys stored in the device TPM.
23
23
24
24
> [!IMPORTANT]
25
-
> The access to the TPM keys is limited to read-only. If you want to write keys to the TPM, you need to do it from the Windows host OS.
25
+
> Access to TPM keys is limited to read-only. To write keys to the TPM, do it from the Windows host OS.
26
26
27
27
## Prerequisites
28
28
29
-
- A Windows host OS with a TPM or vTPM (if using Windows host OS virtual machine).
30
-
- EFLOW virtual machine with TPM passthrough enabled. Using an elevated PowerShell session, use`Set-EflowVmFeature -feature "DpsTpm" -enable` to enable TPM passthrough. For more information, see [Set-EflowVmFeature to enable TPM passthrough](./reference-iot-edge-for-linux-on-windows-functions.md#set-eflowvmfeature).
31
-
-Ensure that the NV index (default index=3001) is initialized with 8 bytes of data. The default AuthValue used by the sample is {1,2,3,4,5,6,7,8} which corresponds to the NV (Windows) Sample in the TSS.MSR libraries when writing to the TPM. All index initialization must take place on the Windows Host before reading from the EFLOW VM. For more information about TPM samples, see [TSS.MSR](https://github.com/microsoft/TSS.MSR).
29
+
- A Windows host OS with a TPM or vTPM (if you use a Windows host OS virtual machine).
30
+
-An EFLOW virtual machine with TPM passthrough enabled. In an elevated PowerShell session, run`Set-EflowVmFeature -feature "DpsTpm" -enable` to enable TPM passthrough. For more information, see [Set-EflowVmFeature to enable TPM passthrough](./reference-iot-edge-for-linux-on-windows-functions.md#set-eflowvmfeature).
31
+
-Make sure the NV index (default index=3001) is initialized with 8 bytes of data. The default AuthValue used by the sample is {1,2,3,4,5,6,7,8}, which matches the NV (Windows) sample in the TSS.MSR libraries when writing to the TPM. Initialize all indexes on the Windows host before reading from the EFLOW VM. For more information about TPM samples, see [TSS.MSR](https://github.com/microsoft/TSS.MSR).
32
32
33
33
> [!WARNING]
34
-
> Enabling TPM passthrough to the virtual machine may increase security risks.
34
+
> Enabling TPM passthrough to the virtual machine can increase security risks.
35
35
36
36
## Create the dTPM executable
37
37
38
-
The following steps show you how to create a sample executable to access a TPM index from the EFLOW VM. For more information about EFLOW TPM passthrough, see [Azure IoT Edge for Linux on Windows Security](./iot-edge-for-linux-on-windows-security.md).
38
+
Follow these steps to create a sample executable to access a TPM index from the EFLOW VM. For more information about EFLOW TPM passthrough, see [Azure IoT Edge for Linux on Windows Security](./iot-edge-for-linux-on-windows-security.md).
39
39
40
40
1. Open Visual Studio 2019 or 2022.
41
41
42
42
1. Select **Create a new project**.
43
43
44
-
1. Choose **Console App** in the list of templatesthen select **Next**.
44
+
1. Choose **Console App** in the list of templates, and then select **Next**.
45
45
46
46
47
47
48
-
1. Fill in the **Project Name**, **Location** and **Solution Name** fields then select **Next**.
48
+
1. Fill in the **Project Name**, **Location**, and **Solution Name** fields, and then select **Next**.
49
49
50
-
1. Choose a target framework. The latest .NET 6.0 LTS version is preferred. After choosing a target framework, select **Create**. Visual Studio creates a new console app solution.
50
+
1. Choose a target framework. The latest .NET 6.0 LTS version is preferred. After you choose a target framework, select **Create**. Visual Studio creates a new console app solution.
51
51
52
52
1. In **Solution Explorer**, right-click the project name and select **Manage NuGet Packages**.
53
53
54
-
1. Select **Browse** and then search for `Microsoft.TSS`. For more information about this package, see [Microsoft.TSS](https://www.nuget.org/packages/Microsoft.TSS).
54
+
1. Select **Browse**, and then search for `Microsoft.TSS`. For more information about this package, see [Microsoft.TSS](https://www.nuget.org/packages/Microsoft.TSS).
55
55
56
-
1. Choose the **Microsoft.TSS** package from the list then select **Install**.
56
+
1. Choose the **Microsoft.TSS** package from the list, and then select **Install**.
57
57
58
-
:::image type="content" source="./media/how-to-access-dtpm/vs-nuget-microsoft-tss.png" alt-text="Screenshot that shows Visual Studio add NuGet packages.":::
58
+
:::image type="content" source="./media/how-to-access-dtpm/vs-nuget-microsoft-tss.png" alt-text="Screenshot of Visual Studio showing how to add NuGet packages.":::
59
59
60
-
1. Edit the *Program.cs* file and replace the contents with the [EFLOW TPM sample code - Program.cs](https://raw.githubusercontent.com/Azure/iotedge-eflow/main/samples/tpm-read-nv/Program.cs).
60
+
1. Edit the *Program.cs* file, and replace the contents with the [EFLOW TPM sample code - Program.cs](https://raw.githubusercontent.com/Azure/iotedge-eflow/main/samples/tpm-read-nv/Program.cs).
61
61
62
-
1. Select **Build** > **Build solution** to build the project. Verify the build is successful.
62
+
1. Select **Build** > **Build solution** to build the project. Verify that the build is successful.
63
63
64
-
1. In **Solution Explorer**, right-click the project then select **Publish**.
64
+
1. In **Solution Explorer**, right-click the project, and then select **Publish**.
65
65
66
-
1. In the **Publish** wizard, choose **Folder** > **Folder**. Select **Browse** and choose an output location for the executable file to be generated. Select **Finish**. After the publish profile is created, select **Close**.
66
+
1. In the **Publish** wizard, choose **Folder** > **Folder**. Select **Browse**, and choose an output location for the executable file to be generated. Select **Finish**. After the publish profile is created, select **Close**.
67
67
68
68
1. On the **Publish** tab, select **Show all settings** link. Change the following configurations then select **Save**.
69
69
- Target Runtime: **linux-x64**.
70
70
- Deployment mode: **Self-contained**.
71
71
72
-
:::image type="content" source="./media/how-to-access-dtpm/sample-publish-options.png" alt-text="Screenshot that shows publish options.":::
72
+
:::image type="content" source="./media/how-to-access-dtpm/sample-publish-options.png" alt-text="Screenshot of publish options.":::
73
73
74
-
1. Select **Publish**then wait for the executable to be created.
74
+
1. Select **Publish**, and then wait for the executable to be created.
75
75
76
-
If publish succeeds, you should see the new files created in your output folder.
76
+
If publishing succeeds, you see the new files in your output folder.
77
77
78
78
## Copy and run the executable
79
79
Once the executable file and dependency files are created, you need to copy the folder to the EFLOW virtual machine. The following steps show you how to copy all the necessary files and how to run the executable inside the EFLOW virtual machine.
80
80
81
81
1. Start an elevated *PowerShell* session using **Run as Administrator**.
82
82
83
83
1. Change directory to the parent folder that contains the published files.
84
-
For example, if your published files are under the folder *TPM* in the directory `C:\Users\User`. You can use the following command to change to the parent folder.
84
+
For example, if your published files are under the folder *TPM* in the directory `C:\Users\User`. You can use the following command to change to the parent folder.
85
85
```powershell
86
86
cd "C:\Users\User"
87
87
```
@@ -103,7 +103,7 @@ Once the executable file and dependency files are created, you need to copy the
103
103
Connect-EflowVm
104
104
```
105
105
106
-
1. Change directory to the folder where you copied the *tar* file and check the file is available. If you used the example above, when connected to the EFLOW VM, you'll already be at the *iotedge-user* root folder. Run the `ls` command to list the files and folders.
106
+
1. Change directory to the folder where you copied the *tar* file and check that the file is available. If you used the previous example, when you connect to the EFLOW VM, you're already at the *iotedge-user* root folder. Run the `ls` command to list the files and folders.
107
107
108
108
1. Run the following command to extract all the content from the *tar* file.
109
109
```bash
@@ -136,4 +136,4 @@ Once the executable file and dependency files are created, you need to copy the
136
136
137
137
## Next steps
138
138
139
-
* Learn [How to develop IoT Edge modules with Linux containers using IoT Edge for Linux on Windows](./tutorial-develop-for-linux-on-windows.md).
139
+
Learn [how to develop IoT Edge modules with Linux containers using IoT Edge for Linux on Windows](./tutorial-develop-for-linux-on-windows.md).
The *module.json* file controls how modules are built and deployed. IoT Edge module Visual Studio
18
-
and Visual Studio Code projects include the *module.json* file. The file contains IoT Edge module
19
-
configuration details including the version and platform that is used when building an IoT Edge
20
-
module.
17
+
The *module.json* file controls how modules are built and deployed. IoT Edge module projects in Visual Studio and Visual Studio Code include the *module.json* file. This file has configuration details for the IoT Edge module, like the version and platform used when building the module.
21
18
22
19
## *module.json* settings
23
20
24
-
The *module.json* file includes the following settings:
21
+
The *module.json* file has these settings:
25
22
26
23
| Setting | Description |
27
24
|---|---|
28
-
| image.repository | The repository of the module. |
29
-
| image.tag.version | The version of the module. |
25
+
| image.repository | The module repository. |
26
+
| image.tag.version | The module version. |
30
27
| image.tag.platforms | A list of supported platforms and their corresponding dockerfile. Each entry is a platform key and dockerfile pair `<platform key>:<dockerfile>`. |
31
-
| image.buildOptions |The build arguments used when running `docker build`. |
32
-
| image.contextPath | The context path used when running `docker build`. By default, it's the current folder of the *module.json* file. If your Docker build needs files not included in the current folder such as a reference to an external package or project, set the**contextPath** to the root path of all necessary files. Verify the files are copied in the dockerfile. |
33
-
| language | The programming language of the module. |
28
+
| image.buildOptions |Build arguments used when running `docker build`. |
29
+
| image.contextPath | The context path used when running `docker build`. By default, it's the current folder of the *module.json* file. If your Docker build needs files not included in the current folder, like a reference to an external package or project, set **contextPath** to the root path of all necessary files. Verify the files are copied in the dockerfile. |
30
+
| language | The module programming language. |
34
31
35
-
For example, the following*module.json* file is for a C# IoT Edge module:
32
+
For example, this*module.json* file is for a C# IoT Edge module:
36
33
37
34
```json
38
35
{
@@ -59,10 +56,8 @@ For example, the following *module.json* file is for a C# IoT Edge module:
59
56
}
60
57
```
61
58
62
-
Once the module is built, the final tag of the image is combined with both version and platform as
63
-
`<repository>:<version>-<platform key>`. For this example, the image tag for `amd64.debug` is
64
-
`localhost:5000/csharpmod:0.0.1-amd64.debug`.
59
+
After you build the module, the final image tag combines the version and platform as `<repository>:<version>-<platform key>`. For this example, the image tag for `amd64.debug` is `localhost:5000/csharpmod:0.0.1-amd64.debug`.
65
60
66
-
## Next step
61
+
## Next steps
67
62
68
63
[Understand the requirements and tools for developing IoT Edge modules](module-development.md)
0 commit comments