Security Protocol and Data Model (SPDM) is a standard published by the Distributed Management Task Force (DMTF) organization Platform Management Components Intercommunication (PMCI) working group. SPDM’s vision is to resolve the long-lasting problem of compatible secure communication solution between two endpoints of embedded systems. To this end, SPDM defines message formats, data objects, and sequences for performing message exchanges. The protocols defined by SPDM can be used for a wide range of security functionalities, such as authentication of hardware / firmware identities, delivering measurements and performing attestation, and session key establishment.

This presentation introduces the open-source tool - OpenSPDM. The OpenSPDM is written in C. It implements an SPDM requester utility to validate a vendor’s responder implementation. It also implement an SPDM responder utility to validate a vender’s requester implementation. The talk covers SPDM 1.0 device authentication and firmware measurement collection and SPDM 1.1 session creation for the data communication protection.

The audience will learn the main components of the SPDM protocol. A firmware solution builder will learn how to implement an SPDM requester to perform the device authentication and attestation and create a secured session with a target device. A device builder will learn how to implement an SPDM responder to respond to the authentication and measurement requests and create a secured session to protect the communication.

This talk will introduce some work in progress activities to enable Rust in EDK II.
The session will include use cases for Rust in EDK II, advantages of Rust when applied to firmware components, limitations in firmware environments and the types of issues that can be avoided by leveraging language based security in EDK II. Memory safety issues contributed to approximately 70% of recent security issues in software (per MS). In firmware, over 50% of reported issues in EDK II open source are related to memory safety. Future looking directions will also be shared.

Intel® Trust Domain Extensions (Intel® TDX) introduce architectural elements to help deploy hardware-isolated, virtual machines (VMs) called trust domains (TDs). Intel TDX is designed to isolate VMs from the virtual-machine manager (VMM)/hypervisor and any other non-TD software on the platform to protect TDs from a broad range of software.
This presentation introduces the architecture for TDX Virtual Firmware (TDVF), and the firmware reference implementation available in open source. The talk covers how TDVF runs from the TD reset vector, records runtime measurements, manages private memory, interacts with the Intel TDX module in Secure Arbitration Mode (SEAM), and loads the operating system (OS).

The audience will learn the role TDVF plays in setting up and protecting a TD and how Intel TDX establishes a chain of trust from reset vector to OS handoff.