rTPM: A Native Firmware-Based Trusted Platform Module for RISC-V

The Trusted Platform Module (TPM) enhances system security by offering features such as a root of trust, secure storage, and authentication mechanisms. While TPM has been widely adopted, there has been no detailed exploration of a firmware-based TPM implementation specifically designed for the RISC-V architecture. In this paper, we present the design and implementation of a firmware TPM system for RISC-V, named rTPM. rTPM leverages DRAM latency-based Physical Unclonable Functions (PUFs) and PMP (Physical Memory Protection) to achieve secure NVRAM storage. Addressing challenges such as the need for additional security hardware extensions and the requirement for a Trusted Execution Environment (TEE) in firmware-based TPMs, we develop a secure communication mechanism across different privilege levels, tailored to the RISC-V security architecture. In addition, we proposed new solutions to address rollback attacks and the absence of secure clocks. Our prototype demonstrates that, although rTPM incurs approximately 200 ms of additional overhead during startup and data read/write operations, it significantly improves message transmission efficiency. As a result, rTPM achieves a performance enhancement of nearly 2-3 times compared to TPM emulators when executing related instructions, while also providing enhanced security.