This may be a way to start the ball rolling - TPM or not -
New TCG guidance creates low-cost attestation architecture to establish trust in devices
Date Published: December, 12, 2022
December 12, 2022 – Accurately attesting the integrity of a device without a Trusted Platform Model (TPM) has been made possible with the latest Device Identifier Composition Engine (DICE) specification from Trusted Computing Group (TCG).
By 2030, there is expected to be over 30 billion connected devices worldwide. With the growth of the Internet of Things (IoT), complex architectures with challenging security and resource constraints will become commonplace, making an optimal security posture increasingly difficult to establish and maintain. A TPM can help overcome these issues, however not all devices leverage such technology.
To this end, the ‘DICE Endorsement Architecture for Devices’ specification from TCG provides a definitive guide to establish trust within systems and components with and without a TPM. It provides guidelines for devices to integrate cryptographically strong device identity, attest software and security policy, and assist in safely deploying and verifying software updates at near zero cost.
“The TPM is a vital tool for ensuring the integrity of a device, however the vast majority of devices being used across the world do not contain one”, said Chairman of the DICE Work Group, Dennis Mattoon. “With this new specification, manufacturers are provided the tools they need to provide the endorsements required to verify and attest the information received from a device and establish trust where previously it was difficult to do so.”
