Enhanced private data protection with TPM encryption (7.6.3)
FortiWeb has enhanced encryption security by integrating Trusted Platform Module (TPM) encryption. This feature strengthens the protection of passwords and certificates by ensuring encryption keys are securely stored in hardware rather than relying on a predefined software key.
Security Benefits
-
Hardware-bound encryption prevents key extraction or unauthorized reuse.
-
Protection against software-based attacks, including malware and phishing attempts.
-
Seamless key synchronization in HA environments ensures consistent encryption across nodes.
TPM-Based Encryption for Sensitive Data
When enabled, FortiWeb generates a random encryption key and stores it in TPM. This key is used to encrypt and decrypt configuration passwords and certificates, ensuring that sensitive data remains protected. In HA deployments, the encryption key is automatically synchronized to the secondary node’s TPM, preventing unauthorized access across different systems.
Platform Support
Hardware-Based TPM Protection
-
On supported FortiWeb hardware appliances, TPM acts as a secure enclave for cryptographic key storage.
-
The TPM module is soldered onto the motherboard, preventing physical tampering and key extraction attempts.
Virtual TPM Support for FortiWeb-VM
-
FortiWeb-VM supports software-based TPM emulation through hypervisors that provide virtual TPM (vTPM).
-
This extends TPM-based encryption benefits to virtualized environments.
Configuration
To enable TPM-based encryption, the following CLI command is used:
config system encryption-method set private-encryption-key enable | disable // Default: disable end
Upgrade Handling
Existing systems using software-based encryption keys will migrate to TPM encryption upon upgrade, ensuring a seamless transition without manual intervention.