→ Applies to: SynetoOS 6.x and above
TPM (Trusted Platform Module) is a security component that generates, stores, and protects cryptographic keys used to verify the integrity of a system at boot and to encrypt sensitive data.
A physical TPM (d-TPM) has its own dedicated processor, protected memory, and random number generator built directly into the hardware. This means:
- Cryptographic keys never pass through the server's RAM.
- Even if malware, ransomware, or an attacker gains full control of the operating system, they cannot steal the keys stored inside the TPM — the chip is isolated and only executes strictly signed commands.
Differences between Physical TPM (d-TPM) and Virtual TPM (vTPM)
| Feature | Physical TPM (d-TPM) | Virtual TPM (vTPM) |
| Nature | Hardware chip soldered or inserted on the motherboard | Software file managed by the virtualization system |
| Scope | Protects the physical server (Host) | Protects the individual Virtual Machine (Guest) |
| Flexibility | Rigid — permanently tied to that specific motherboard | Very high — follows the VM even when migrated to another server (e.g. VMware vMotion) |