Configuring Remote Attestation
This section describes how to configure the remote attestation (RA) function to allow an RA server to authenticate a device and determine whether the device is trustworthy.
Pre-configuration Tasks
In a trusted environment, after the RA function is enabled on a device that supports trusted boot, the device sends information to a remote RA server. The remote RA server then compares the information it receives with locally stored information to determine whether the device is trustworthy. Therefore, RA provides users with a method of remotely checking device trustworthiness.
Before configuring RA, complete the following tasks:
- Configure the device to communicate with the RA server, and configure the RA function on the RA server.
- Create a public key infrastructure (PKI) domain on the device to implement PKI certificate management between the Certificate Authority (CA) and device through the Certificate Management Protocol (CMP).
Procedure
- Run system-view
The system view is displayed.
- Run pki import-certificate ca file-name file-name
The downloaded certificate is imported to the device.
- Run trustem
The trusted management view is displayed.
- Run remote-attestation enable
RA is enabled.
- (Optional) Run remote-attestation pki bind domain domainName
A specified PKI domain is bound to RA.
- (Optional) If the PKI certificate is ineffective, run remote-attestation pki update-request { all | slot slotID }
PKI certificate information is updated.
- Run commit
The configuration is committed.
- Run quit
Return to the system view.
- Run quit
Return to the user view.
- (Optional) Run set tpm password { slot slotId | all }
The TPM password is changed.
If the device needs to be rolled back to a version that does not support the configuration of the TPM password, run the set tpm password { slot slotId | all }command to restore the default TPM password Changeme_123 before the rollback.
After the set tpm password { slot slotId | all } command is run, the device must be restarted. Otherwise, the TPM cannot be accessed and the remote attestation function is unavailable.