单选题 There are two main functions that Trusted Platform Modules (TPMs) carry out within systems today. Which of the following best describes these two functions?

A、 Sealing a hard disk drive is when the decryption key that can be used to decrypt data on the drive is stored on the TPM. Binding is when data pertaining to the system's state are hashed and stored on the TPM.
B、 Binding a hard disk drive is when whole-disk encryption is enabled through the use of the TPM. Sealing is when a digital certificate is sealed within a TPM and the system cannot boot up without this certificate being validated.
C、 Sealing a hard disk drive is when whole-disk encryption is enabled through the use of the TPM. Binding is when a digital certificate is sealed within a TPM and the system cannot boot up without this certificate being validated.
D、 Binding a hard disk drive is when the decryption key that can be used to decrypt data on the drive is stored on the TPM. Sealing is when data pertaining to the system's state are hashed and stored on the TPM.

【正确答案】 D

【答案解析】解析：D正确。TPM的本质取决于一个受保护且封装的微处理器安全芯片，该芯片为类似密钥、密码和数字证书的安全敏感数据的存储和处理提供了一个安全处所。“绑定”一个硬盘驱动是TPM最常见的使用场景——其中，某个给定硬盘驱动的内容都只属于某个特定计算系统。TPM的另一个应用就是将某个系统的状态“密封”为特定的硬件和软件配置。 A不正确。因为当用于加密驱动上数据的加密密钥存储在TPM时，就会发生绑定硬盘驱动。而密封发生在与系统的状态有关的数据进行散列并存储在TPM上时。 B不正确。因为当用于加密驱动上数据的加密密钥存储在TPM时，就会发生绑定硬盘驱动。而密封发生在与系统的状态有关的数据被进行散列并存储在TPM上时。硬盘驱动上的内容被加密，而解密密钥存储在TPM芯片上。为了确保解密密钥的存储安全，解密密钥会进一步用另一个加密密钥“隐藏”起来。绑定硬盘驱动使得其他系统无法访问其中的内容，并且试图将硬盘驱动放入其他系统中以获取硬盘内容的任何尝试都是非常难以获得成功的。 C不正确。因为封装系统非常简单明确。TPM基于系统的配置文件生成散列值，并被存储起来。只有当TPM把系统配置与原始的“封装”值进行比较，验证了系统配置的完整性，封装了的系统才会被激活。