Uhlelo Lokuphepha lwe-TPM Kumakhompyutha Edeskithophu
Ukuphepha kwekhompyutha yedeskithophu akusakwazi ukuthembela kuphela kumaphasiwedi okungena ngemvume noma isofthiwe ye-antivirus. Ukuhlasela kwesimanje okufana nokwebiwa kwedatha, i-ransomware, ukuphathwa kwe-firmware, kanye nemizamo yokugwema inqubo yokuqalisa kudinga ukuvikelwa ukuze kuqale kusukela ngesikhathi idivayisi ivuliwe. Ubuchwepheshe obusetshenziswa kabanzi ukuqinisa lesi sisekelo sokuphepha yi-Trusted Platform Module (TPM). I-TPM isebenza njenge-"root of trust" esekelwe kwihadiwe esiza ukuqinisekisa ubuqotho besistimu, ivikele okhiye be-cryptographic, futhi isekele izici zokuphepha ezithuthukisiwe ohlelweni lokusebenza.
Kuyini i-TPM?
I-TPM iyi-chip noma imojuli yokuphepha eyenzelwe ukugcina nokucubungula okhiye be-cryptographic ngokuphephile. Ama-TPM angathatha amafomu alandelayo:
1. I-Discrete TPM: i-chip ebonakalayo ehlukile ebhodini le-motherboard (ngokuvamile enamandla kakhulu ngokwehlukana).
2. I-Firmware TPM (fTPM): isetshenziswa nge-firmware ku-CPU noma ku-chipset (isb. i-AMD fTPM).
3. I-TPM ehlanganisiwe: ihlanganiswe kuma-chipset athile.
Kuma-desktop anamuhla, i-TPM ivame ukutholakala njenge-TPM 2.0, okuyindinganiso entsha ngoba isekela ububanzi obubanzi be-algorithms ye-cryptographic kanye nezimo zokuphepha kune-TPM 1.2.
Kungani i-TPM ibalulekile kumakhompyutha edeskithophu?
Amakhompyutha edeskithophu avame ukusetshenziselwa umsebenzi wasehhovisi, imidlalo, ukuklama, kanye nokukhiqiza okuqukethwe—okusho ukuthi agcina idatha eningi ebalulekile: amadokhumenti, iziqinisekiso ze-akhawunti, ukufinyelela i-VPN, izitifiketi, noma okhiye bokubethela. Amadeskithophu nawo abhekene nezinselele ezihlukile: amadivayisi avame ukuthuthukiswa, athuthwa kalula, futhi ngezinye izikhathi abelwana ngawo ngabasebenzisi abaningi. I-TPM isiza ukuvimbela izingozi ezilandelayo:
– Ukwebiwa kwedatha uma idivayisi ilahlekile/ifinyelelwa ngomunye umuntu: ngokubethela okusekelwe ku-TPM, idatha ihlala ikhiyiwe noma ngabe isitoreji sithuthelwa kwenye idivayisi.
– Ukuhlaselwa kwe-Bootkit/firmware: I-TPM ingarekhoda futhi iqinisekise ubuqotho benqubo yokuqalisa.
– Ukwebiwa kwezikhiye ze-cryptographic: izikhiye eziyimfihlo zingagcinwa ku-TPM ukuze kube nzima kakhulu ukuthi i-malware izibambe.
Indlela i-TPM esebenza ngayo ilula
I-TPM isebenza njenge-"vault" encane yemisebenzi ye-cryptographic. Uma uhlelo ludinga ukukhiqiza, ukugcina, noma ukusebenzisa okhiye (isibonelo, ukubethela idiski), i-TPM ingenza lokhu:
– Dala umbhangqwana okhiye (womphakathi/owangasese) ku-TPM.
– Gcina okhiye abayimfihlo ukuze bangabi lula ukukhishwa.
– Yenza imisebenzi ye-crypto (isb. ukusayina noma ukususa ukubethela) ngaphandle kokwembula ukhiye wangasese ohlelweni lokusebenza.
Umqondo oyinhloko ku-TPM yi-PCR (Platform Configuration Registers). Ama-PCR agcina “izimpawu zeminwe” (ama-hashe) zezingxenye zokuqalisa ezifana ne-firmware, ama-bootloader, kanye nokucushwa okuthile. Uma kwenzeka izinguquko ezingagunyaziwe—isibonelo, i-bootloader iyaguqulwa—inani le-PCR liyashintsha. Lolu shintsho lungabangela ukwenqatshwa kokufinyelela kukhiye noma lubangele indlela yokutakula.
Izici ezibalulekile ze-TPM kudeskithophu
1. Isitoreji esiphephile kakhulu sokhiye we-cryptographic
I-TPM igcina okhiye ngokuphephile. Lokhu kubalulekile kokhiye ababucayi kakhulu njengalaba:
– ukhiye wokubethela wediski egcwele,
- izitifiketi zokuqinisekisa inkampani,
– ukhiye wesiginesha yedijithali.
Nakuba ingavikelekile ngokuphelele kuzo zonke izihlaselo, i-TPM yenza ukwebiwa kwezikhiye kube nzima kakhulu kunokugcina izinkinobho kufayela elijwayelekile kudiski.
2. Isekela ukubethela kwedrayivu (isb. i-BitLocker)
Ku-Windows, i-TPM ivame ukusetshenziswa kwi-BitLocker. Nge-TPM, ukhiye wokuvula idrayivu "ungaboshwa" (uvalwe) esimweni esithile sokuqalisa. Umphumela:
– Uma isitoreji sisuswa futhi sifakwe kwenye i-PC, idatha ihlala ibethelwe.
– Uma kukhona ushintsho olusolisayo lwe-boot, i-BitLocker icela ukhiye wokutakula.
Kuma-desktop ehhovisi, inhlanganisela ye-TPM + PIN ivame ukunconywa: i-TPM igcina ubuqotho, i-PIN yengeza isici sokuqinisekisa, okwenza ivikeleke kakhulu uma idivayisi yebiwe.
3. I-Boot Evikelekile kanye ne-Boot Elinganisiwe
I-Secure Boot iqinisekisa ukuthi izingxenye ze-boot ezithembekile kuphela ezisetshenziswayo. I-TPM ingeza olunye ungqimba nge-Measured Boot, eqopha ama-hashes ezingxenye ze-boot ku-PCR. Lokhu kuvumela uhlelo ukuthi:
- bona izinguquko ku-boot chain,
– ukwenza ubufakazi (ukuqinisekiswa kobuqotho) kumasevisi okuphathwa kwedivayisi kunethiwekhi yenkampani.
4. Ukuvikelwa kweziqinisekiso kanye nokuqinisekiswa
Ku-Windows yesimanje, i-TPM idlala indima ezicini ezifana nalezi:
– I-Windows Hello (i-PIN/i-biometric) ehlanganisa iziqinisekiso kudivayisi,
- ukuvikelwa kweziqinisekiso ezithile ekwebiweni yi-malware,
– ukwesekwa kwezitifiketi zekhadi elihlakaniphile elibonakalayo.
Ezinkampanini, lokhu kungathuthukisa ukuphepha kokungena ngemvume ngaphandle kokuthembela njalo kumaphasiwedi okulula ukuwaqagela noma ubugebengu bokweba imininingwane eyimfihlo.
I-TPM 2.0 kanye nokubaluleka kwayo ku-Windows 11
Esinye isizathu esenza i-TPM ithandwe kangaka ukuthi i-Windows 11 idinga i-TPM 2.0 kumadivayisi amaningi. Lokhu akuyona nje "umkhawulo," kodwa kunalokho ukuqinisekisa ukuhambisana kwezici zokuphepha zesimanje, njenge:
- isivikelo esiqinile sebhuthi,
- ukwesekwa kokubethela kwedivayisi,
– isisekelo sokuphepha esithuthukisiwe se-ecosystem ye-Windows.
Kukhompyutha yedeskithophu eyenziwe ngokwezifiso, lokhu kusho ukuthi abasebenzisi kudingeka baqinisekise ukuthi i-motherboard yabo kanye ne-CPU kuyayisekela i-TPM 2.0 (kungaba nge-TPM noma i-fTPM ehlukile) futhi bayivule ku-BIOS/UEFI.
Indlela yokuvula i-TPM kukhompyutha yedeskithophu
I-TPM ngokuvamile ingavulwa nge-BIOS/UEFI. Igama lenketho lingahluka kuye ngomthengisi:
– Kwa-Intel, ngezinye izikhathi ibizwa ngokuthi i-PTT (Platform Trust Technology).
– Ku-AMD, ivame ukubizwa ngokuthi i-AMD fTPM.
– Kumabhodi athile omama kukhona i-header yemojuli ye-TPM ehlukile.
Uma isivuliwe, uhlelo lokusebenza luvame ukubona i-TPM. Ku-Windows, ungahlola ngokuthayipha okuthi `tpm.msc` ku-Run ukuze ubone isimo se-TPM kanye nenguqulo.
Imikhawulo nezinto okufanele uziqaphele
I-TPM akuyona "i-antivirus" futhi ayiqinisekisi ukuzivikela okuphelele. Kunamaphuzu amaningana abalulekile:
1. I-TPM ayivimbeli yonke i-malware
Uma ubhekene ne-malware esebenza ngenkathi uhlelo lungene ngemvume, i-TPM ngeke ivimbele ngokuzenzakalelayo ukwebiwa kwedatha esivele iveziwe. I-TPM iqine kakhulu ekuvikeleni okhiye kanye nobuqotho bokuqalisa.
2. Izinguquko zehadiwe/i-firmware zingase zibangele ukululama
Ukushintsha izingxenye ezithile, ukuvuselela i-BIOS, ukushintsha ukucushwa kwe-boot, noma ukuhambisa idrayivu kungabangela isicelo sokhiye wokutakula (ikakhulukazi nge-BitLocker). Lokhu kuvamile njengoba i-TPM ibona ushintsho.
3. Ukubaluleka kokhiye wokubuyisela isipele
Uma usebenzisa i-BitLocker, ukhiye wokutakula kumele ugcinwe ngokuphephile (isibonelo, ku-akhawunti ye-Microsoft, i-Active Directory, noma umphathi wephasiwedi yenkampani). Ngaphandle kokhiye wokutakula, idatha ingakhiywa unomphela.
4. I-TPM ehlukanisiwe vs i-fTPM
Ama-TPM ahlukene ngokuvamile ahlukanisiwe kakhulu, kuyilapho ama-fTPM ethembele ekusetshenzisweni kwe-firmware. Kodwa-ke, ezimweni eziningi zedeskithophu, i-fTPM isanikeza ukuthuthukiswa okuphawulekayo kokuphepha kune-TPM.
Izindlela ezinhle kakhulu zokusebenzisa i-TPM kuma-desktop
Ukuze kukhuliswe izinzuzo ze-TPM, kunezindlela eziningana ezinconywayo:
– Nika amandla i-TPM 2.0 bese usebenzisa imodi ye-UEFI (hhayi i-legacy).
– Nika amandla i-Secure Boot uma idivayisi kanye ne-OS kuyisekela.
– Sebenzisa i-BitLocker (noma enye indlela yokubethela idiski esebenzisa i-TPM) ikakhulukazi lapho ugcina idatha ebalulekile.
– Cabanga nge-TPM + PIN kumadivayisi asengozini yokwebiwa.
– Gcina ukhiye wokutakula endaweni ephephile ehlukene nedivayisi.
– Yenza izibuyekezo ze-BIOS/UEFI kanye ne-OS njalo ukuze uvale izikhala zokuphepha.
Isiphetho
I-TPM iyisici esibalulekile ekuphepheni kwamakhompyutha edeskithophu anamuhla. Ngokugcina ngokuphephile okhiye be-cryptographic, ukusekela ukubethela kwedrayivu, ukuqinisekisa ubuqotho benqubo yokuqalisa, nokuvumela ukuqinisekiswa okuqinile, i-TPM inikeza isisekelo sokuphepha kusukela ngesikhathi idivayisi iqala. Nakuba ingeyona ikhambi elifanelana nakho konke kuzo zonke izinsongo, i-TPM isebenza kahle kakhulu "njengesendlalelo esiyisisekelo" sokuphepha—ikakhulukazi uma ihlanganiswa ne-Secure Boot, ukubethela kwediski, kanye nemikhuba emihle yokuphatha iziqinisekiso. Kubasebenzisi basekhaya nabebhizinisi, ukunika amandla nokusebenzisa i-TPM kuyisinyathelo esiwusizo sokunciphisa ingozi yokwephulwa kwedatha nokuhlaselwa okuthuthukile kumakhompyutha edeskithophu.
Uma ufisa, ngingaguqula lesi sihloko sibe yinguqulo yobuchwepheshe (ukuxoxa nge-PCR, ukuvala/ukuvula, ukufaka ubufakazi) noma inguqulo ethandwa kakhulu ngabafundi abangebona ochwepheshe.
