Invoke-HPEpscBootlogEvidenceValidation

Summary

Validates HP Endpoint Security Controller Bootlog Evidence.

Syntax

Invoke-HPEpscBootlogEvidenceValidation [-HPEpscEvidence <Object[]>] [-HPEpscCerts <Object[]>] [-PlatformCertificate <String>] [-UseLocalPlatformCertificate] [-Nonce <Byte[]>] [-Uuid <String>] [-NoHPEpscCerts] [<CommonParameters>]

Description

This cmdlet validates HP Endpoint Security Controller (EpSC) bootlog evidence. This includes evaluation of the security posture reported by the EpSC, the digital signature over that evidence generated by the reporting EpSC, and the certificate chain of the reporting EpSC that describes the key that was used by the reporting EpSC to sign the evidence. The cmdlet can also optionally confirm that the evidence includes a reference nonce and/or uuid value.

The cmdlet can operate in different modes:
1. **With EpSC Evidence and Certificates**: When both HPEpscEvidence and HPEpscCerts parameters are provided, the cmdlet performs the EpSC security posture validation, the digital signature over that evidence generated by the reporting EpSC, and the certificate chain of the reporting EpSC that describes the key that was used by the reporting EpSC to sign the evidence.
2. **Without EpSC Certificates**: When the NoHPEpscCerts switch is specified, the security posture validation is performed without validating the digital signature over the evidence that is generated by the reporting EpSC.
3. **Local vs External Platform Certificate**: The cmdlet can use either a local platform certificate (UseLocalPlatformCertificate) or an external one (PlatformCertificate parameter) to validate the reporting EpSC is the same component that was in the system when the HP Platform Certificate was issued by HP.

**DEPENDENCY**: HP Endpoint Security Controller Gen5 is required for retrieving evidence and certificates from the current platform.

Parameters

Name	Argument	Description
HPEpscEvidence	<Object[]>	The HP EpSC boot log evidence obtained from Get-HPEpscBootlogEvidence cmdlet. This parameter contains the attestation data that needs to be validated.
HPEpscCerts	<Object[]>	HP EpSC certificates from the current system obtained from Get-HPEpscCerts cmdlet. These certificates are used to validate the cryptographic signatures in the evidence.
PlatformCertificate	<String>	Specifies the path to a platform certificate file, directory containing platform certificates, or zip file with platform certificates. When using a directory or zip file, the tool searches for files named in the format: HPInc.<serial_number>.BASE.cer
UseLocalPlatformCertificate	<SwitchParameter>	If specified, this command uses the Platform Certificate that is stored locally in the PC. The default locations for the certificate are: - EFI System Partition: /boot/tcg/cert/platform/ or \efi\tcg\cert\platform - UEFI Variable: HpPlatformCertificateBase GUID {B44ED025-A047-4312-9E62-A1C3ACC8684D}
Nonce	<Byte[]>	A 32-byte array to be used as the input nonce for HP EpSC evidence validation. This nonce should match the one used when obtaining the bootlog evidence to ensure the evidence freshness and prevent replay attacks.
Uuid	<String>	The UUID of the system to be used for validation. This parameter allows validation of evidence from a specific system when the UUID is known.
NoHPEpscCerts	<SwitchParameter>	If specified, the cmdlet will not gather EpSC Certificates from the EpSC device on the current device and instead perform validations without using HP EpSC certificates. This is useful when EpSC certificates are not available or when performing validation in offline scenarios.

Examples

PS C:\> PS C:\> $evidence = Get-HPEpscBootlogEvidence
PS C:\> $certs = Get-HPEpscCerts
PS C:\> Invoke-HPEpscBootlogEvidenceValidation -HPEpscEvidence $evidence -HPEpscCerts $certs -UseLocalPlatformCertificate

PS C:\> $evidence = Get-HPEpscBootlogEvidence
PS C:\> $certs = Get-HPEpscCerts
PS C:\> Invoke-HPEpscBootlogEvidenceValidation -HPEpscEvidence $evidence -HPEpscCerts $certs -PlatformCertificate "C:\Certificates\HPInc.12345678.BASE.cer"

PS C:\> $evidence = Get-HPEpscBootlogEvidence -Nonce $customNonce
PS C:\> $certs = Get-HPEpscCerts
PS C:\> Invoke-HPEpscBootlogEvidenceValidation -HPEpscEvidence $evidence -HPEpscCerts $certs -UseLocalPlatformCertificate -Nonce $customNonce

PS C:\> $evidence = Get-HPEpscBootlogEvidence -Nonce $customNonce
PS C:\> $certs = Get-HPEpscCerts
PS C:\> Invoke-HPEpscBootlogEvidenceValidation -HPEpscEvidence $evidence -HPEpscCerts $certs -UseLocalPlatformCertificate -Nonce $customNonce -Uuid "12345678-1234-1234-1234-123456789abc"

PS C:\> $evidence = Get-HPEpscBootlogEvidence
PS C:\> Invoke-HpEpscBootlogEvidenceValidation -HPEpscEvidence $evidence -NoHPEpscCerts -UseLocalPlatformCertificate

PS C:\> $evidence = Get-HPEpscBootlogEvidence
PS C:\> $certs = Get-HPEpscCerts
PS C:\> Invoke-HPEpscBootlogEvidenceValidation -HPEpscEvidence $evidence -HPEpscCerts $certs -PlatformCertificate "C:\Certificates\" -Uuid "12345678-1234-1234-1234-123456789abc"

PS C:\> $evidence = Get-HPEpscBootlogEvidence
PS C:\> $certs = Get-HPEpscCerts
PS C:\> Invoke-HPEpscBootlogEvidenceValidation -HPEpscEvidence $evidence -HPEpscCerts $certs -PlatformCertificate "C:\Certificates\certificates.zip"

Notes

Returns an object containing:

- Certificates: The HP EpSC certificates used for validation

- Evidence: The HP EpSC bootlog evidence that was validated

If no HP EpSC Certificates or Evidence are found, the cmdlet outputs an informational message.

**DEPENDENCY**: HP Endpoint Security Controller Gen5 is required for retrieving evidence and certificates from the current platform

- This command requires an HP system with Endpoint Security Controller (EpSC) support

- The validation process verifies cryptographic signatures and attestation data integrity

- Nonce parameter should be a 32-byte array for proper validation

- When using NoHPEpscCerts parameter, some validation features may be limited

- Platform certificate validation is essential for establishing trust in the validation process