You signed in with another tab or window. Reload to refresh your session.You signed out in another tab or window. Reload to refresh your session.You switched accounts on another tab or window. Reload to refresh your session.Dismiss alert
A Trusted platform module (TPM) chip is a secure crypto-processor that is designed to carry out cryptographic operations. This technology is designed to provide hardware-based, security-related functions. The Azure IoT Edge for Linux on Windows (EFLOW) virtual machine doesn't have a virtual TPMs attached to the VM. However, the user can enable or disable the TPM passthrough feature, that allows the EFLOW virtual machine to use the Windows host OS TPM. The TPM passthrough feature enables two main scenarios:
17
+
A trusted platform module (TPM) chip is a secure crypto-processor that carries out cryptographic operations. This technology provides hardware-based security functions. The Azure IoT Edge for Linux on Windows (EFLOW) virtual machine doesn't have a virtual TPM attached. However, you can enable or disable the TPM passthrough feature, which lets the EFLOW virtual machine use the Windows host OS TPM. The TPM passthrough feature lets you:
18
18
19
-
- Use TPM technology for IoT Edge device provisioning using Device Provisioning Service (DPS)
20
-
-Read-only access to cryptographic keys stored inside the TPM.
19
+
- Use TPM technology for IoT Edge device provisioning with Device Provisioning Service (DPS)
20
+
-Get read-only access to cryptographic keys stored in the TPM
21
21
22
-
This article describes how to develop a sample code in C# to read cryptographic keys stored inside the device TPM.
22
+
This article shows you how to write sample C# code to read cryptographic keys stored in the device TPM.
23
23
24
24
> [!IMPORTANT]
25
-
> The access to the TPM keys is limited to read-only. If you want to write keys to the TPM, you need to do it from the Windows host OS.
25
+
> Access to TPM keys is limited to read-only. To write keys to the TPM, do it from the Windows host OS.
26
26
27
27
## Prerequisites
28
28
29
-
- A Windows host OS with a TPM or vTPM (if using Windows host OS virtual machine).
30
-
- EFLOW virtual machine with TPM passthrough enabled. Using an elevated PowerShell session, use`Set-EflowVmFeature -feature "DpsTpm" -enable` to enable TPM passthrough. For more information, see [Set-EflowVmFeature to enable TPM passthrough](./reference-iot-edge-for-linux-on-windows-functions.md#set-eflowvmfeature).
31
-
-Ensure that the NV index (default index=3001) is initialized with 8 bytes of data. The default AuthValue used by the sample is {1,2,3,4,5,6,7,8} which corresponds to the NV (Windows) Sample in the TSS.MSR libraries when writing to the TPM. All index initialization must take place on the Windows Host before reading from the EFLOW VM. For more information about TPM samples, see [TSS.MSR](https://github.com/microsoft/TSS.MSR).
29
+
- A Windows host OS with a TPM or vTPM (if you use a Windows host OS virtual machine).
30
+
-An EFLOW virtual machine with TPM passthrough enabled. In an elevated PowerShell session, run`Set-EflowVmFeature -feature "DpsTpm" -enable` to enable TPM passthrough. For more information, see [Set-EflowVmFeature to enable TPM passthrough](./reference-iot-edge-for-linux-on-windows-functions.md#set-eflowvmfeature).
31
+
-Make sure the NV index (default index=3001) is initialized with 8 bytes of data. The default AuthValue used by the sample is {1,2,3,4,5,6,7,8}, which matches the NV (Windows) sample in the TSS.MSR libraries when writing to the TPM. Initialize all indexes on the Windows host before reading from the EFLOW VM. For more information about TPM samples, see [TSS.MSR](https://github.com/microsoft/TSS.MSR).
32
32
33
33
> [!WARNING]
34
-
> Enabling TPM passthrough to the virtual machine may increase security risks.
34
+
> Enabling TPM passthrough to the virtual machine can increase security risks.
35
35
36
36
## Create the dTPM executable
37
37
38
-
The following steps show you how to create a sample executable to access a TPM index from the EFLOW VM. For more information about EFLOW TPM passthrough, see [Azure IoT Edge for Linux on Windows Security](./iot-edge-for-linux-on-windows-security.md).
38
+
Follow these steps to create a sample executable to access a TPM index from the EFLOW VM. For more information about EFLOW TPM passthrough, see [Azure IoT Edge for Linux on Windows Security](./iot-edge-for-linux-on-windows-security.md).
39
39
40
40
1. Open Visual Studio 2019 or 2022.
41
41
42
42
1. Select **Create a new project**.
43
43
44
-
1. Choose **Console App** in the list of templatesthen select **Next**.
44
+
1. Choose **Console App** in the list of templates, and then select **Next**.
45
45
46
46
47
47
48
-
1. Fill in the **Project Name**, **Location** and **Solution Name** fields then select **Next**.
48
+
1. Fill in the **Project Name**, **Location**, and **Solution Name** fields, and then select **Next**.
49
49
50
-
1. Choose a target framework. The latest .NET 6.0 LTS version is preferred. After choosing a target framework, select **Create**. Visual Studio creates a new console app solution.
50
+
1. Choose a target framework. The latest .NET 6.0 LTS version is preferred. After you choose a target framework, select **Create**. Visual Studio creates a new console app solution.
51
51
52
52
1. In **Solution Explorer**, right-click the project name and select **Manage NuGet Packages**.
53
53
54
-
1. Select **Browse** and then search for `Microsoft.TSS`. For more information about this package, see [Microsoft.TSS](https://www.nuget.org/packages/Microsoft.TSS).
54
+
1. Select **Browse**, and then search for `Microsoft.TSS`. For more information about this package, see [Microsoft.TSS](https://www.nuget.org/packages/Microsoft.TSS).
55
55
56
-
1. Choose the **Microsoft.TSS** package from the list then select **Install**.
56
+
1. Choose the **Microsoft.TSS** package from the list, and then select **Install**.
57
57
58
-
:::image type="content" source="./media/how-to-access-dtpm/vs-nuget-microsoft-tss.png" alt-text="Screenshot that shows Visual Studio add NuGet packages.":::
58
+
:::image type="content" source="./media/how-to-access-dtpm/vs-nuget-microsoft-tss.png" alt-text="Screenshot of Visual Studio showing how to add NuGet packages.":::
59
59
60
-
1. Edit the *Program.cs* file and replace the contents with the [EFLOW TPM sample code - Program.cs](https://raw.githubusercontent.com/Azure/iotedge-eflow/main/samples/tpm-read-nv/Program.cs).
60
+
1. Edit the *Program.cs* file, and replace the contents with the [EFLOW TPM sample code - Program.cs](https://raw.githubusercontent.com/Azure/iotedge-eflow/main/samples/tpm-read-nv/Program.cs).
61
61
62
-
1. Select **Build** > **Build solution** to build the project. Verify the build is successful.
62
+
1. Select **Build** > **Build solution** to build the project. Verify that the build is successful.
63
63
64
-
1. In **Solution Explorer**, right-click the project then select **Publish**.
64
+
1. In **Solution Explorer**, right-click the project, and then select **Publish**.
65
65
66
-
1. In the **Publish** wizard, choose **Folder** > **Folder**. Select **Browse** and choose an output location for the executable file to be generated. Select **Finish**. After the publish profile is created, select **Close**.
66
+
1. In the **Publish** wizard, choose **Folder** > **Folder**. Select **Browse**, and choose an output location for the executable file to be generated. Select **Finish**. After the publish profile is created, select **Close**.
67
67
68
68
1. On the **Publish** tab, select **Show all settings** link. Change the following configurations then select **Save**.
69
69
- Target Runtime: **linux-x64**.
70
70
- Deployment mode: **Self-contained**.
71
71
72
-
:::image type="content" source="./media/how-to-access-dtpm/sample-publish-options.png" alt-text="Screenshot that shows publish options.":::
72
+
:::image type="content" source="./media/how-to-access-dtpm/sample-publish-options.png" alt-text="Screenshot of publish options.":::
73
73
74
-
1. Select **Publish**then wait for the executable to be created.
74
+
1. Select **Publish**, and then wait for the executable to be created.
75
75
76
-
If publish succeeds, you should see the new files created in your output folder.
76
+
If publishing succeeds, you see the new files in your output folder.
77
77
78
78
## Copy and run the executable
79
79
Once the executable file and dependency files are created, you need to copy the folder to the EFLOW virtual machine. The following steps show you how to copy all the necessary files and how to run the executable inside the EFLOW virtual machine.
80
80
81
81
1. Start an elevated *PowerShell* session using **Run as Administrator**.
82
82
83
83
1. Change directory to the parent folder that contains the published files.
84
-
For example, if your published files are under the folder *TPM* in the directory `C:\Users\User`. You can use the following command to change to the parent folder.
84
+
For example, if your published files are under the folder *TPM* in the directory `C:\Users\User`. You can use the following command to change to the parent folder.
85
85
```powershell
86
86
cd "C:\Users\User"
87
87
```
@@ -103,7 +103,7 @@ Once the executable file and dependency files are created, you need to copy the
103
103
Connect-EflowVm
104
104
```
105
105
106
-
1. Change directory to the folder where you copied the *tar* file and check the file is available. If you used the example above, when connected to the EFLOW VM, you'll already be at the *iotedge-user* root folder. Run the `ls` command to list the files and folders.
106
+
1. Change directory to the folder where you copied the *tar* file and check that the file is available. If you used the previous example, when you connect to the EFLOW VM, you're already at the *iotedge-user* root folder. Run the `ls` command to list the files and folders.
107
107
108
108
1. Run the following command to extract all the content from the *tar* file.
109
109
```bash
@@ -136,4 +136,4 @@ Once the executable file and dependency files are created, you need to copy the
136
136
137
137
## Next steps
138
138
139
-
* Learn [How to develop IoT Edge modules with Linux containers using IoT Edge for Linux on Windows](./tutorial-develop-for-linux-on-windows.md).
139
+
Learn [how to develop IoT Edge modules with Linux containers using IoT Edge for Linux on Windows](./tutorial-develop-for-linux-on-windows.md).
0 commit comments