Technical Product Specification

Product Overview Intel® Server System SR2625UR TPS
Intel order number E46130-010 Revision 1.8
16
2.9.2 TPM security BIOS
The BIOS TPM support conforms to the TPM PC Client Specific – Implementation Specification
for Conventional BIOS, version 1.2, and to the TPM Interface specification, version 1.2. The
BIOS adheres to the Microsoft Vista* BitLocker requirement. The role of the BIOS for TPM
security includes the following:
 Measures and stores the boot process in the TPM microcontroller to allow a TPM
enabled operating system to verify system boot integrity.
 Produces EFI and legacy interfaces to a TPM-enabled operating system for using TPM.
 Produces ACPI TPM device and methods to allow a TPM-enabled operating system to
send TPM administrative command requests to the BIOS.
 Verifies operator physical presence. Confirms and executes operating system TPM
administrative command requests.
 Provides BIOS Setup options to change TPM security states and to clear TPM
ownership.
For additional details, refer to the TCG PC Client Specific Implementation Specification, the
TCG PC Client Specific Physical Presence Interface Specification, and the Microsoft BitLocker*
Requirement documents.
2.9.2.1 Physical Presence
Administrative operations to the TPM require TPM ownership or physical presence indication by
the operator to confirm the execution of administrative operations. The BIOS implements the
operator presence indication by verifying the setup Administrator password.
A TPM administrative sequence invoked from the operating system proceeds as follows:
1. User makes a TPM administrative request through the operating system’s security software.
2. The operating system requests the BIOS to execute the TPM administrative command
through TPM ACPI methods and then resets the system.
3. The BIOS verifies the physical presence and confirms the command with the operator.
4. The BIOS executes TPM administrative command(s), inhibits BIOS Setup entry and boots
directly to the operating system which requested the TPM command(s).
2.9.2.2 TPM Security Setup Options
The BIOS TPM Setup allows the operator to view the current TPM state and to carry out
rudimentary TPM administrative operations. Performing TPM administrative options through the
BIOS setup requires TPM physical presence verification.
Using BIOS TPM Setup, the operator can turn ON or OFF TPM functionality and clear the TPM
ownership contents. After the requested TPM BIOS Setup operation is carried out, the option
reverts to No Operation.
The BIOS TPM Setup also displays the current state of the TPM, whether TPM is enabled or
disabled and activated or deactivated. Note that while using TPM, a TPM-enabled operating
system or application may change the TPM state independent of the BIOS setup. When an