Sisitimu Yekuchengetedza yeTPM paMakomputa eDesktop
Kuchengetedzwa kwemakombiyuta epakombiyuta hakuchagoni kungovimba nemapassword ekupinda kana software yeantivirus chete. Kurwiswa kwemazuva ano kwakadai sekubiwa kwedata, ransomware, kushandura firmware, uye kuedza kunzvenga maitiro ekutanga kunoda dziviriro kuti itange kubva panguva iyo mudziyo unovhurwa. Imwe tekinoroji inoshandiswa zvakanyanya kusimbisa foundation iyi yekuchengetedza iTrusted Platform Module (TPM). TPM inoshanda se "root of trust" yakavakirwa pahardware inobatsira kuona kuti system inoenderana, inochengetedza makiyi e cryptographic, uye inotsigira maficha ekuchengetedza epamberi mu operating system.
Chii chinonzi TPM?
TPM ichip yekuchengetedza kana module yakagadzirirwa kuchengetedza nekugadzirisa makiyi e cryptographic zvakachengeteka. Ma TPM anogona kutora mafomu anotevera:
1. Discrete TPM: chip yakasiyana iri pabhodhi reamai (kazhinji ndiyo yakasimba zvikuru panyaya yekuparadzanisa).
2. Firmware TPM (fTPM): inoshandiswa kuburikidza nefirmware paCPU kana chipset (semuenzaniso AMD fTPM).
3. TPM Yakabatanidzwa: yakabatanidzwa mune mamwe ma chipset.
Pamakombiyuta emazuva ano, TPM inowanzo kuwanikwa seTPM 2.0, inova ndiyo standard itsva nekuti inotsigira ma algorithms akasiyana-siyana e cryptographic uye mamiriro ekuchengetedza kupfuura TPM 1.2.
Sei TPM ichikosha pamakombiyuta edesktop?
Makomputa edesktop anowanzo shandiswa pabasa remuhofisi, mitambo yemitambo, dhizaini, uye kugadzira zviri mukati—zvinoreva kuti anochengeta data rakawanda rinokosha: magwaro, maakaundi, VPN access, zvitupa, kana makiyi e encryption. Makomputa edesktop anosanganawo nematambudziko akasiyana: zvishandiso zvinowanzo vandudzwa, zvinofambiswa zviri nyore, uye dzimwe nguva zvinogovaniswa nevashandisi vakawanda. TPM inobatsira kudzivirira njodzi dzinotevera:
– Kubiwa kwedata kana mudziyo wakarasika/wakawanikwa nemumwe munhu: neTPM-based encryption, data rinoramba rakakiyiwa kunyangwe kana nzvimbo yekuchengetera ikaendeswa kune imwe mudziyo.
- Kurwiswa kweBootkit/firmware: TPM inogona kunyora nekusimbisa kuvimbika kwemaitiro ekutanga.
- Kuba makiyi eCryptographic: makiyi epachivande anogona kuchengetwa muTPM kuti zviomere kubata malware.
Mashandiro anoita TPM ari nyore
TPM inoshanda se "nzvimbo" diki yekushandisa cryptographic. Kana sisitimu ichida kugadzira, kuchengeta, kana kushandisa makiyi (semuenzaniso, ekuvhara disk), TPM inogona:
- Gadzira kiyi mbiri (yeruzhinji/yakavanzika) muTPM.
– Chengeta makiyi epachivande kuitira kuti asaburitswe nyore nyore.
- Ita mabasa e crypto (semuenzaniso kusaina kana kubvisa zvinyorwa) pasina kuburitsa kiyi yakavanzika kune operating system.
Pfungwa huru muTPM iPCR (Platform Configuration Registers). MaPCR anochengeta "zvigunwe" (hashes) zvezvikamu zveboot zvakaita sefirmware, bootloaders, uye magadzirirwo chaiwo. Kana shanduko dzisina mvumo dzikaitika—semuenzaniso, bootloader inogadziriswa—kukosha kwePCR kunochinja. Kuchinja uku kunogona kukonzera kurambidzwa kwekupinda mukiyi kana kukonzera nzira yekudzoreredza.
Zvinhu zvikuru zveTPM pakombiyuta
1. Kuchengetedzwa kwemakiyi ekriptografiki kwakachengeteka zvakanyanya
TPM inochengeta makiyi zvakachengeteka. Izvi zvakakosha kumakiyi anonyanya kubatwa nenjodzi akadai se:
- kiyi yekuvhara dhisiki yakazara,
- zvitupa zvekusimbiswa kwekambani,
- kiyi yesaini yedhijitari.
Kunyange zvazvo isina kudzivirirwa zvizere pakurwiswa kwese, TPM inoita kuti kuba makiyi kuve kwakaoma kupfuura kuchengeta makiyi mufaira renguva dzose padiski.
2. Inotsigira kuvharidzirwa kwedhiraivha (semuenzaniso BitLocker)
MuWindows, TPM inowanzoshandiswa paBitLocker. NeTPM, kiyi yekuvhura dhiraivha inogona "kusungirirwa" (kuvharwa) kune imwe boot state. Mhedzisiro yacho:
- Kana nzvimbo yekuchengetera ikabviswa yoiswa mune imwe PC, data racho rinoramba rakavharidzirwa.
- Kana paine shanduko yeboot inofungirwa, BitLocker inokumbira kiyi yekudzoreredza.
Pamakombiyuta epahofisi, musanganiswa weTPM + PIN unowanzo kurudzirwa: TPM inochengetedza kuvimbika, PIN inowedzera chinhu chekusimbisa, zvichiita kuti ive yakachengeteka kana mudziyo ukabiwa.
3. Bhutsu Yakachengeteka uye Bhutsu Yakayerwa
Secure Boot inovimbisa kuti zvikamu zveboot zvinovimbwa chete ndizvo zvinoitwa. TPM inowedzera imwe layer kuburikidza neMeasured Boot, iyo inorekodha hashes dzezvikamu zveboot kuPCR. Izvi zvinobvumira system kuti:
- kuona shanduko dziri mu boot chain,
- kuita humbowo (kusimbisa kuvimbika) kumasevhisi ekutarisira michina panetwork yemakambani.
4. Kudzivirirwa uye kusimbiswa kwemagwaro
MuWindows yemazuva ano, TPM ine basa guru muzvinhu zvakaita se:
- Windows Hello (PIN/biometric) inobatanidza humbowo hwechishandiso,
- kuchengetedzwa kwemamwe marekodhi kubva pakubiwa ne malware,
- rutsigiro rwezvitupa zvemakadhi emagetsi echinyakare.
Kumakambani, izvi zvinogona kuvandudza kuchengetedzeka kwekupinda pasina kushandisa mapassword ari nyore kufungidzira kana phishing.
TPM 2.0 uye kukosha kwayo kuWindows 11
Chimwe chikonzero nei TPM yave yakakurumbira ndechekuti Windows 11 inoda TPM 2.0 pamidziyo yakawanda. Izvi hazvisi kungo "ganho" chete, asi kuti ive nechokwadi chekuti zvinhu zvemazuva ano zvekuchengetedza zvinoshanda nguva dzose, zvakaita se:
- dziviriro yakasimba yebhutsu,
- rutsigiro rwekuvhara ruzivo rwemudziyo,
- kuvandudzwa kwekuchengetedzwa kweWindows ecosystem.
Pakombiyuta yedesktop yakagadzirwa, izvi zvinoreva kuti vashandisi vanofanira kuona kuti mamaboard avo neCPU zvinotsigira TPM 2.0 (kuburikidza neTPM kana fTPM) uye kuigonesa muBIOS/UEFI.
Maitiro ekugonesa TPM pakombuta yedesktop
TPM inogona kugoneswa kuburikidza neBIOS/UEFI. Zita resarudzo rinogona kusiyana zvichienderana nemutengesi:
- PaIntel, dzimwe nguva inonzi PTT (Platform Trust Technology).
- PaAMD, inowanzonzi AMD fTPM.
- Pane mamwe mamaboards pane musoro wemodule yeTPM yakasiyana.
Kana yangovhurwa, system yekushandisa inogona kuona TPM. MuWindows, unogona kutarisa nekunyora `tpm.msc` muRun kuti uone mamiriro eTPM neshanduro.
Zvipingamupinyi nezvinhu zvekucherechedza
TPM haisi "antivirus" uye haivimbise kusabatwa kwehutachiona zvachose. Pane zvinhu zvakakosha zvinotevera:
1. TPM haimise malware ese
Kana uri kusangana nemalware ari kushanda panguva iyo system iri kupinda, TPM haizodziviriri otomatiki kubiwa kwedata ratove pachena. TPM yakasimba zvikuru mukudzivirira makiyi uye boot integrity.
2. Kuchinja kwehardware/firmware kunogona kukonzera kupora
Kutsiva zvimwe zvikamu, kugadzirisa BIOS, kuchinja gadziriro yeboot, kana kutamisa drive kunogona kukonzera chikumbiro che recovery key (kunyanya neBitLocker). Izvi zvakajairika sezvo TPM ichiona shanduko.
3. Kukosha kwekiyi yekudzoreredza backup
Kana ukashandisa BitLocker, kiyi yekudzoreredza inofanira kuchengetwa zvakachengeteka (semuenzaniso, muakaundi yeMicrosoft, Active Directory, kana maneja wepassword yekambani). Pasina kiyi yekudzoreredza, data rinogona kuvharwa zvachose.
4. TPM yakasiyana-siyana vs fTPM
MaTPM akasiyana anowanzo kuve akaparadzaniswa, nepo fTPM dzichishandisa firmware. Zvisinei, mune dzakawanda zviitiko zvedesktop, fTPM ichiri kupa kuvandudzwa kwakakosha kwekuchengetedza pane kusava neTPM.
Maitiro akanakisa ekushandisa TPM pama desktops
Kuti zviwedzere mabhenefiti eTPM, maitiro akati wandei anokurudzirwa:
- Shandisa TPM 2.0 uye shandisa UEFI mode (kwete legacy).
- Shandisa Secure Boot kana mudziyo neOS zvichitsigira.
- Shandisa BitLocker (kana imwe nzira yekuvhara data uchishandisa TPM) kunyanya kana uchichengeta data rakakosha.
– Funga nezve TPM + PIN kana paine midziyo iri panjodzi yekubiwa.
– Chengeta kiyi yekudzoreredza data munzvimbo yakachengeteka yakasiyana nemudziyo.
- Gara uchigadzirisa BIOS/UEFI uye OS kuti uvhare mipata yekuchengetedza.
Mhedziso
TPM chinhu chakakosha mukuchengetedzwa kwemakomputa emazuva ano edesktop. Nekuchengetedza makiyi e cryptographic zvakachengeteka, kutsigira kuvharwa kwedhiraivha, kusimbisa kuvimbika kwemaitiro ekutanga, uye kugonesa kusimbiswa kwakasimba, TPM inopa hwaro hwekuchengetedzwa kubva panguva iyo mudziyo unotanga. Kunyange zvazvo isiri mhinduro imwe chete inokodzera zvese kutyisidzira, TPM inoshanda zvikuru se "base layer" yekuchengetedza - kunyanya kana ikabatanidzwa neSecure Boot, disk encryption, uye maitiro akanaka ekutarisira marekodhi. Kune vese vashandisi vekumba nevemabhizinesi, kugonesa nekushandisa TPM idanho rinoshanda rekuderedza njodzi yekutyorwa kwedata uye kurwiswa kwakanyanya pamakomputa edesktop.
Kana muchida, ndinogona kugadzirisa chinyorwa chino kuita shanduro yehunyanzvi (kukurukura nezvePCR, sealing/unsealing, attestation) kana shanduro inozivikanwa zvikuru kune vaverengi vasiri vehunyanzvi.
