To address issues of economic security and supply chain risk, this paper introduces the use of internationally standardized hardware security technologies that enable assurance and verification of the authenticity of devices used for accessing systems. Globally, North America is leading these efforts, with standardization progressing in coordination with policy initiatives. In particular, the incorporation of standardized technologies is increasingly becoming a requirement for computing devices procured in critical systems. NEC participates in the international standards organization TCG (Trusted Computing Group) and is developing zero trust products such as secure servers and device management and verification software that comply with these standard technologies, promoting their deployment from the defense sector to commercial applications. This paper presents an overview of market and standardization trends, as well as NEC’s initiatives.

1. Introduction

With growing global emphasis on economic security and supply chain risk management, ensuring the authenticity* of computing devices has become an increasingly critical issue. In particular, technologies that enable verification of the authenticity of devices that serve as entry points to systems are essential in countering the sophistication of cyberattacks. In global markets, North America is leading the way, accelerating international standardization efforts. Furthermore, standardization activities are progressing in close alignment with policy, and in certain domains, requirements are emerging mandating the implementation of standardized security technologies in devices.

2. Trends in International Standardization Technologies

2.1 Trusted Platform Module (TPM)

Hardware based authenticity assurance is indispensable for maintaining device authenticity across the supply chain and operational environments. One of the fundamental technologies supporting this is the Trusted Platform Module (TPM). The TPM is a hardware security module standardized by the Trusted Computing Group (TCG)¹⁾ that provides cryptographic processing, tamper resistance, and integrity measurement functions, enabling hardware level assurance of device authenticity.

The latest version, TPM 2.0 (ISO/IEC 11889:2015), was standardized in 2015 and is widely deployed across servers, laptops, and other device categories. Representative TPM use cases²⁾ published by the U.S. National Security Agency (NSA) include:

In the following sections, we describe the standardized technologies that enable these use cases.

As of 2025, both NEC and the Cyber Defense Institute participate in the Trusted Computing Group (TCG), contributing to the dissemination of these technologies and the advancement of their practical deployment in society.

2.2 Foundations of zero trust architecture: Root of Trust and Chain of Trust

Root of Trust and Chain of Trust are architectural principles for constructing secure systems by cryptographically verifying each component from a minimal set of trusted elements. These principles are defined and systematized by organizations such as the U.S. National Institute of Standards and Technology (NIST).

Root of Trust is the minimal element that can be inherently trusted and serves as the starting point for all verification under a zero trust architecture, which operates on the principle of “never trust, always verify.” TPM acts as a component that fulfills this role by providing guaranteed correctness for critical security functions, such as protecting cryptographic keys and verifying digital signatures.

Chain of Trust is a security architecture that begins with the Root of Trust and progressively extends trust to subsequent components and processes. Through sequential verification at each stage, it ultimately establishes trust across the entire system.

Fig. 1 illustrates the Chain of Trust as defined in Japan’s Cyber/Physical Security Framework (CPSF), published by the Ministry of Economy, Trade and Industry (METI). It depicts the layered relationship in which trustworthy systems produce trustworthy data, and the devices that form those systems originate from trustworthy supply chains.

From a zero trust perspective, verification must occur not only during system boot but also continuously during runtime. TPM‑based Root of Trust and Chain of Trust are essential mechanisms for achieving this ongoing assurance.

In recent years, standards and guidelines have emerged for verifying device authenticity throughout the supply chain using TPM. Sections 2.3 to 2.5 provide an overview of representative documents on this topic.

2.3 NIST SP1800-34: Validating the Integrity of Computing Devices³⁾

The NIST Special Publication (SP) 1800 series documents provide practical cybersecurity deployment guidance for organizations. SP1800-34 defines standard approaches for device authenticity verification across supply chain and operational environments and presents concrete implementation examples.

2.4 IETF RFC9334: Remote Attestation Procedures (RATS)⁴⁾

RFC9334 RATS is a standardized technology developed by the Internet Engineering Task Force (IETF) that enables third parties to remotely verify the authenticity of a device. Fig. 2 illustrates the overview and process of RFC9334 RATS.

At device startup, the Root of Trust serves as the initial trust anchor, and sequential signature verification and measurements are performed to build the Chain of Trust. During this process, the Firmware Integrity Measurement (FIM) function records each measurement in the TPM’s secure, tamper-resistant area known as the Platform Configuration Register (PCR) (Step 1).

Next, the Attester generates signed Evidence (Quote) that bundles the measurements and device ID, and sends it to the Verifier (Step 2).

The Verifier compares this evidence against pre-registered reference values to assess authenticity and then passes the result to the Relying Party, which uses it to enforce policies such as access control (Step 3).

2.5 TCG Platform Certificate Profile⁵⁾

A Platform Certificate is an electronic certificate that standardizes and records comprehensive platform information for a device—such as vendor name, model name, CPU, memory, and other component details—essentially forming a Hardware Bill of Materials (HBOM). This enables third parties to verify the authenticity and history of the device. The Platform Certificate functions as an Attribute Certificate linked to the Endorsement Key (EK) Certificate embedded in the TPM at shipment. By starting verification from the TPM and its EK Certificate, the device configuration can be reliably confirmed from the point of manufacturing.

Device vendors embed a Platform Certificate—containing platform configuration information—into the device’s TPM at the time of manufacturing and ship the device with this certificate installed. Conversely, device users can, at acceptance or during operation, compare the current platform information against the Platform Certificate set at manufacturing to verify the integrity of the device configuration and detect any differences since shipment (Fig. 3).

A Delta Platform Certificate is an electronic certificate that records legitimate configuration changes made after shipment as incremental updates (deltas) from the original platform configuration (Fig. 4). This allows manufacturing vendors using OEM devices, as well as system integrators who add components or modify the platform, to attest to their changes.

By linking the Platform Certificate and Delta Platform Certificate, it becomes possible to verify both the authenticity of the device from the point of shipment and the history of modifications throughout the supply chain. NEC is one of the first globally to implement this technology.

3. Policy Trends

The application of standardized technologies for ensuring device authenticity is advancing most rapidly in North America, driven by economic security considerations and supply‑chain risk management. In 2023, the U.S. National Security Agency (NSA) issued procurement guidance⁶⁾ for devices used in National Security Systems in North America, explicitly requiring the implementation of TPM, Secure Boot, and Platform Certificates.

In Japan, the Cabinet’s National Center of Incident Readiness and Strategy for Cybersecurity (NISC) strengthened requirements related to supply chain security, procurement processes, and zero trust principles in its Unified Standards for Cybersecurity Measures for Government Agencies, FY2023 Edition.⁷⁾ These strengthened requirements are beginning to be introduced as security guidelines across different industry sectors. As a result, providers of systems—including devices—and system operators are increasingly required to implement measures against unauthorized changes to devices.

4. NEC BluStellar-Related Offerings

In this section, we introduce software, service offerings, and hardware products that support various security guidelines and zero‑trust requirements.

4.1 NEC IoT System Security Lifecycle Services Supply Chain Security

NEC IoT System Security Lifecycle Services supply chain security is a management service offering that maintains the authenticity of device components throughout the entire lifecycle. For devices equipped with standard TPM 2.0 functions, authenticity is evaluated across the entire supply chain—from manufacturing and shipment through operational use—by combining Remote Attestation with Platform Certificates.

This service records changes such as component additions or replacements during system integration or maintenance, as well as firmware and software updates, linking them with HBOM/SBOM information. In doing so, it provides both detection of unauthorized modifications and full traceability of changes made to each device. Because the service is based on international standards, it supports multi device and multi platform environments.

This offering also provides a management service that enables system and device operators to verify device authenticity and maintain traceability. It additionally provides an implementation support service for device vendors and system integrators, allowing them to set authenticity information during device manufacturing and whenever configuration changes occur (Fig. 5). The implementation support service utilizes the PIV Gateway^TM CA described in section 4.2.

4.2 PIV Gateway

PIV Gateway ensures the reliability of user authentication information and device authenticity throughout their entire device lifecycle.

PIV Gateway^TM CA, the core product for authenticity verification in the supply chain, is the world's first commercial certificate authority to support the issuance of Platform Certificates standardized by the Trusted Computing Group (TCG) (Fig. 6).

The digital certificates issued to users and devices by the PIV Gateway^TM CA are cryptographically verified to ensure the authenticity of each recipient. The private keys that underpin the reliability of these certificates are protected on security chips certified to FIPS 140⁸⁾—a U.S. federal standard—providing a high level of security. This enables the integration of a device’s correct hardware configuration (HBOM) and software configuration (SBOM), defined at the time of manufacturing, with the on-device TPM. As a result, the device can serve as a Root of Trust, allowing users to cryptographically verify that there has been no unauthorized component replacement or tampering when they receive or subsequently use the device.

PIV Gateway Trust is an integrated authentication and authorization management platform designed to ensure advanced security for devices in operation. Administrators can assess, at the moment a device—such as a telework terminal or a remote/cloud server—requests access, whether it is free from malware infection or unauthorized modification, and dynamically permit communications only from devices in a trusted state (Fig. 6).

In this way, PIV Gateway combines passwordless user authentication and device attestation/integrity verification by leveraging hardware (such as TPMs) that meets AAL3—the highest Authenticator Assurance Level defined by NIST—to deliver robust zero trust security that protects critical information assets.

4.3 Secure Server Products

NEC’s Express5800/100 series is a lineup of servers made in Japan and renowned for their high availability, scalability, and reliability (Photo 1).

Equipped with TPM 2.0, these servers provide a hardware-based Root of Trust, enabling secure key protection, signature verification, and firmware integrity measurement at startup—forming the foundation for device authenticity in a zero trust environment. They comply with NIST SP 800-193 (Platform Firmware Resiliency Guidelines),⁹⁾ supporting protection, detection, and recovery measures to prevent tampering with UEFI/platform firmware, detect anomalies, and securely restore devices to a known good state. In addition, platform certificates are pre-configured at the time of shipment, making it easy to verify configuration integrity throughout the product lifecycle.

By leveraging IoT System Security Lifecycle Services for supply chain security, as described in section 4.1, system operators can remotely perform centralized management and authenticity verification across multiple servers.

NEC also plans to extend standardized device authenticity technology to its mission-critical high-availability NEC NX7700 servers, factory computers designed for long-term supply, maintenance, and environmental resilience (Photo 2), and board computers for embedded and rugged applications (Photo 3). Going forward, support will be expanded to a broader range of devices including IoT and storage devices, delivering highly reliable infrastructure that customers can use with confidence.

5. Conclusion

NEC will continue to make proposals to standardization organizations, develop proprietary zero trust products utilizing standardized technologies, and promote their implementation in society, thereby contributing to the realization of a safe and secure society.

Trademarks

References

Authors’ Profiles

Related URL