Embedded Security Subsystem

The Embedded Security Subsystem The Embedded Security Subsystem is nothing but a chip installed on the Thinkpads mainboard that can take care of certain security related tasks conforming to the TCPA standard. It was first introduced among the T23 models and is now under the name Embedded Security Subsystem 2.0 an integral part of most of the modern Thinkpads. The functions of the chip are bound to three main groups: public key functions trusted boot functions initialization and management functions The purpose of the whole thing is to keep the users sensitive data out of range from software based attacks (like viruses, internet attacks etc.). One way the chip offers to achieve this is by providing storage for keys along with the neccessary functions to handle them within itself, so that a i.e. a private key never has to leave the chip (can't be seen by any piece of software). Besides this there are more complex topics covered by the functionality of the chip. If you want to find out more about it you can find good documents on the IBM Research TCPA resources page.

Trusted or Treacherous?

TC - Trusted Computing - will be the biggest change of the information landscape since decades. Besides positive features like a more secure hardware storage for cryptographic keys, an analysis of the proposed standards shows some problematic properties. One of the main problems is that the computer owner is seen as an adversary, who no longer should have the full control over their own computers anymore. As Thinkpads of recent generations following the Thinkpad T23 (except the A30) are equipped with this disputed technology, it can be interesting, which promises are fulfilled inside your ThinkPad and which still seem to be a privacy issue for users - so please read this article.

Linux Support

Two linux drivers are available, a classical one and a newer one. Coverage of functionality of the first is unknown so far, the second is part of a bigger project aiming to provide a usable security framework.

David Stafford (one of the developers of the tpm code at IBM) on March 10, 2005 sent me the most recent version of the tpm-kml code. With his permission, I quote his email:

"I am attaching our latest driver and library. This version is in the process of kernel mailing list review, and will hopefully be accepted into the official kernel. It works much better across various 2.6 kernels. Note that this builds three modules tpm, tpm_atmel, and tpm_nsc. You modprobe the tpm_atmel (for all current shipping atmel based systems), or tpm_nsc (for the coming national based systems).

Also note that there is a conflict with the snd-intel8x0 kernel module (they each try to grab the LPC bus). You can either: load the tpm modules first (such as in initrd or rc.sysinit, before sound), or recompile the snd-intel8x0, turning off the MIDI and JOYSTICK support. The latest 2.6.11 version of snd-intel8x0 also reportedly fixes things."

Compiling this library was easy. Compiling the driver on my 2.6.8-686 (debian testing) laptop failed. But the library works with the driver I compiled from the tpm-2.0 package IBM made available on its pages (see the links below).

Gijs

The T43 requires a patch posted to the LKML by Kylene Jo Hall: LKML posting. An updated patch for linux 2.6.12 is available here.

Related Links

• IBMs ThinkVantage^TM Technologies Embedded Security Subsystem page
• IBMs ThinkVantage^TM Technologies Flash presentation - Embedded Security Subsystem
• IBM Research TCPA resources page
• Trusted Grub

Models featuring this Technology

IBM Embedded Security Subsystem

• ThinkPad R31
• ThinkPad T23, T30
• ThinkPad X23, X24

IBM Embedded Security Subsystem 2.0

• ThinkPad R32, R40, R50, R50p, R51, R52
• ThinkPad T40, T40p, T41, T41p, T42, T42p, T43, T43p
• ThinkPad X30, X31, X32, X40, X41, X41 Tablet