For TPM to work you must have both a CPU with the necessary processor extensions for TPM and a chipset that supports TPM. Intel’s is called Trusted Execution Technology (TXT) which has been available for some time and AMD’s is called Secure Execution Mode (AMD has very little information on this) and is not widely available. TPM is integrated into processors and chipsets so just like every other technology Intel has their version of it and AMD their own. This feature is similar to the Windows File Protection feature that Microsoft has built-in to Windows to prevent critical system files from being modified or overwritten. vSphere can use TPM to digitally sign VMkernel modules and validate them when the host is starting up to protect against malware that might overwrite them. It relies on a TPM chip which has a unique RSA key burned into it and is capable of performing platform authentication and can be used to verify that software has not been changed. TPM is a security specification developed by Trusted Computing Group (TCG) that uses cryptographic keys to protect information. Having a strong interest in security I was curious about this feature and wanted to try it out so I did some research on it. See the ESX Configuration Guide and the ESXi Configuration Guide. These techniques create a stronger barrier of protection around the hypervisor. VMkernel also uses memory integrity techniques at load-time coupled with microprocessor capabilities to protect itself from common buffer-overflow attacks that are used to exploit running code. These disk integrity mechanisms protect against malware, which might attempt to overwrite or modify VMkernel as it persists on disk.

To ensure the authenticity and integrity of dynamically loaded code, VMkernel modules are digitally signed and validated during load-time. Disk-integrity techniques protect the boot-up of the hypervisor using the Trusted Platform Module (TPM), a hardware device embedded in servers. VMkernel Protection – As part of ongoing efforts to protect the hypervisor from common attacks and exploits, mechanisms were introduced to assure the integrity of the VMkernel and loaded modules as they reside on disk and in memory. Therefore VMware introduced a new protection mechanism in vSphere to ensure the integrity of the VMkernel both on disk and in memory. The VMkernel (hypervisor) is the most critical component of a virtual host because if it is compromised the VM’s running on it can easily be compromised. According to the original vSphere feature list there is a new security feature called “VMkernel Protection” that uses a technology called Trusted Platform Module (TPM) to add a layer of protection to the VMkernel.

Vsphere license key txt