Next-Generation Secure Computing Base
The Next-Generation Secure Computing Base (NGSCB; codenamed Palladium<ref name="TheBigSecret">{{#invoke:citation/CS1|citation |CitationClass=web }}</ref> and also known as Trusted Windows<ref name="TrustedWindows">{{#invoke:citation/CS1|citation |CitationClass=web }}</ref>) is a software architecture designed by Microsoft which claimed to provide users of the Windows operating system with better privacy, security, and system integrity.<ref name="MS-NGSCB">{{#invoke:citation/CS1|citation |CitationClass=web }}</ref><ref name="ABusinessOverview">{{#invoke:citation/CS1|citation |CitationClass=web }}</ref> NGSCB was the result of years of research and development within Microsoft to create a secure computing solution that equaled the security of closed platforms such as set-top boxes while simultaneously preserving the backward compatibility, flexibility, and openness of the Windows operating system.<ref name="NISTPalladium">{{#invoke:citation/CS1|citation |CitationClass=web }}</ref><ref name="Controversial">{{#invoke:citation/CS1|citation |CitationClass=web }}</ref><ref name="TrustedOpenPlatform">{{#invoke:citation/CS1|citation |CitationClass=web }}</ref> Microsoft's primary stated objective with NGSCB was to "protect software from software."<ref name="NISTPalladium"/>
Part of the Trustworthy Computing initiative when unveiled in 2002, NGSCB was to be integrated with Windows Vista, then known as "Longhorn."<ref name="TheBigSecret"/> NGSCB relied on hardware designed by the Trusted Computing Group to produce a parallel operation environment hosted by a new hypervisor (referred to as a sort of kernel in documentation) called the "Nexus" that existed alongside Windows and provided new applications with features such as hardware-based process isolation, data encryption based on integrity measurements, authentication of a local or remote machine or software configuration, and encrypted paths for user authentication and graphics output.<ref name="MS-NGSCB"/><ref name="Overview and Drilldown">{{#invoke:citation/CS1|citation |CitationClass=web }}</ref> NGSCB would facilitate the creation and distribution of digital rights management (DRM) policies pertaining the use of information.<ref name="MS-NGSCB-FAQ">{{#invoke:citation/CS1|citation |CitationClass=web }}</ref>
NGSCB was subject to much controversy during its development, with critics contending that it would impose restrictions on users, enforce vendor lock-in, and undermine fair use rights and open-source software. It was first demonstrated by Microsoft at WinHEC 2003<ref name="Pd2003-04">{{#invoke:citation/CS1|citation |CitationClass=web }}</ref> before undergoing a revision in 2004 that would enable earlier applications to benefit from its functionality.<ref name="RevisitsSecurity">{{#invoke:citation/CS1|citation |CitationClass=web }}</ref> Reports indicated in 2005 that Microsoft would change its plans with NGSCB so that it could ship Windows Vista by its self-imposed deadline year, 2006; instead, Microsoft would ship only part of the architecture, BitLocker, which can optionally use the Trusted Platform Module to validate the integrity of boot and system files prior to operating system startup.<ref name="LonghornSecurity">{{#invoke:citation/CS1|citation |CitationClass=web }}</ref> Development of NGSCB spanned approximately a decade before its cancellation,<ref name="Controversial"/><ref name="TrustUs">{{#invoke:citation/CS1|citation |CitationClass=web }}</ref> the lengthiest development period of a major feature intended for Windows Vista.
NGSCB differed from technologies Microsoft billed as "pillars of Windows Vista"—Windows Presentation Foundation, Windows Communication Foundation, and WinFS—during its development in that it was not built with the .NET Framework and did not focus on managed code software development.<ref name="Overview and Drilldown"/><ref name="eWeekPd">{{#invoke:citation/CS1|citation |CitationClass=web }}</ref> NGSCB has yet to fully materialize; however, aspects of it are available in features such as BitLocker of Windows Vista, Measured Boot and UEFI of Windows 8,<ref name="MeasuredBoot"> {{#invoke:citation/CS1|citation |CitationClass=web }}</ref> Certificate Attestation of Windows 8.1,<ref name="SecurityTechnologies"> {{#invoke:citation/CS1|citation |CitationClass=web }}</ref> Device Guard of Windows 10.<ref name="DeviceGuard"> {{#invoke:citation/CS1|citation |CitationClass=web }}</ref> and Device Encryption in Windows 11 Home editions, with TPM 2.0 mandatory for installation.
HistoryEdit
Early developmentEdit
Development of NGSCB began in 1997 after Peter Biddle conceived of new ways to protect content on personal computers.<ref name="TheBigSecret"/><ref name="PalladiumSummary">{{#invoke:citation/CS1|citation |CitationClass=web }}</ref><ref name="Flak">{{#invoke:citation/CS1|citation |CitationClass=web }}</ref><ref name="CopyrightDebate">Template:Cite news</ref> Biddle enlisted assistance from members from the Microsoft Research division and other core contributors eventually included Blair Dillaway, Brian LaMacchia, Bryan Willman, Butler Lampson, John DeTreville, John Manferdelli, Marcus Peinado, and Paul England.<ref name="PdOverview">{{#invoke:citation/CS1|citation |CitationClass=web }}</ref> Adam Barr, a former Microsoft employee who worked to secure the remote boot feature during development of Windows 2000 was approached by Biddle and colleagues during his tenure with an initiative tentatively known as "Trusted Windows," which aimed to protect DVD content from being copied. To this end, Lampson proposed the use of a hypervisor to execute a limited operating system dedicated to DVD playback alongside Windows 2000.<ref name="Kuro5hin">{{#invoke:citation/CS1|citation |CitationClass=web }}</ref> Patents for a DRM operating system were later filed in 1999 by England, DeTreville and Lampson;<ref>Template:Cite patent</ref><ref>Template:Cite patent</ref> Lampson noted that these patents were for NGSCB.<ref name="CV">{{#invoke:citation/CS1|citation |CitationClass=web }}</ref> Biddle and colleagues realized by 1999 that NGSCB was more applicable to privacy and security than content protection, and the project was formally given the green-light by Microsoft in October, 2001.<ref name="TheBigSecret"/><ref name="Flak"/><ref name="CopyrightDebate"/><ref name="Manferdelli2002">{{#invoke:citation/CS1|citation |CitationClass=web }}</ref>
During WinHEC 1999, Biddle discussed intent to create a "trusted" architecture for Windows to leverage new hardware to promote confidence and security while preserving backward compatibility with previous software.<ref name="Nash">{{#invoke:citation/CS1|citation |CitationClass=web }}</ref> On October 11, 1999, the Trusted Computing Platform Alliance, a consortium of various technology companies including Compaq, Hewlett-Packard, IBM, Intel, and Microsoft was formed in an effort to promote personal computing confidence and security.<ref name="TCPA">{{#invoke:citation/CS1|citation |CitationClass=web }}</ref> The TCPA released detailed specifications for a trusted computing platform with focus on features such as code validation and encryption based on integrity measurements, hardware-based key storage, and machine authentication; these features required a new hardware component designed by the TCPA called the "Trusted Platform Module" (referred to as a "Security Support Component",<ref name="MS-NGSCB-FAQ"/> "Security CoProcessor",<ref name="NISTPalladium"/> or "Security Support Processor"<ref name="NISTPalladium"/> in early NGSCB documentation).
At WinHEC 2000, Microsoft released a technical presentation on the topics of protection of privacy, security, and intellectual property titled "Privacy, Security, and Content in Windows Platforms", which focused on turning Windows into a "platform of trust" for computer security, user content, and user privacy. Notable in the presentation is the contention that "there is no difference between privacy protection, computer security, and content protection"—"assurances of trust must be universally true".<ref name="TrustedWindows"/> Microsoft reiterated these claims at WinHEC 2001.<ref name="WinHEC2001">{{#invoke:citation/CS1|citation |CitationClass=web }}</ref> NGSCB intended to protect all forms of content, unlike traditional rights management schemes which focus only on the protection of audio tracks or movies instead of users they have the potential to protect which made it, in Biddle's words, "egalitarian".<ref name="TrustedWindows"/><ref name="PEU">{{#invoke:citation/CS1|citation |CitationClass=web }}</ref>
As "Palladium"Edit
Microsoft held its first design review for the NGSCB in April 2002, with approximately 37 companies under a non-disclosure agreement.<ref name="Flak"/> NGSCB was publicly unveiled under its codename "Palladium" in a June 2002 article by Steven Levy for Newsweek that focused on its design, feature set, and origin.<ref name="Geek.com">{{#invoke:citation/CS1|citation |CitationClass=web }}</ref><ref name="RevisitsRM">{{#invoke:citation/CS1|citation |CitationClass=web }}</ref> Levy briefly described potential features: access control, authentication, authorization, DRM, encryption, as well as protection from junk mail and malware, with example policies being email accessible only to an intended recipient and Microsoft Word documents readable for only a week after their creation;<ref name="TheBigSecret"/> Microsoft later release a guide clarifying these assertions as being hyperbolic; namely, that NGSCB would not intrinsically enforce content protection, or protect against junk mail or malware. Instead, it would provide a platform on which developers could build new solutions that did not exist by isolating applications and store secrets for them.<ref name="MS-NGSCB-FAQ"/> Microsoft was not sure whether to "expose the feature in the Control Panel or present it as a separate utility," but NGSCB would be an opt-in solution—disabled by default.<ref name="Channel">{{#invoke:citation/CS1|citation |CitationClass=web }}</ref>
Microsoft PressPass later interviewed John Manferdelli, who restated and expanded on many of the key points discussed in the article by Newsweek. Manferdelli described it as evolutionary platform for Windows in July, articulating how "'Palladium' will not require DRM, and DRM will not require 'Palladium'.<ref name="Manferdelli2002"/> Microsoft sought a group program manager in August to assist in leading the development of several Microsoft technologies including NGSCB.<ref name="Recruitment">{{#invoke:citation/CS1|citation |CitationClass=web }}</ref> Paul Otellini announced Intel's support for NGSCB with a set of chipset, platform, and processor codenamed "LaGrande" at Intel Developer Forum 2002,<ref name="IDF2002">{{#invoke:citation/CS1|citation |CitationClass=web }}</ref><ref name="SecurityRenaissance">{{#invoke:citation/CS1|citation |CitationClass=web }}</ref> which would provide an NGSCB hardware foundation and preserve backward compatibility with previous software.<ref name="LGNGSCB">{{#invoke:citation/CS1|citation |CitationClass=web }}</ref>
As NGSCBEdit
NGSCB was known as "Palladium" until January 24, 2003 when Microsoft announced it had been renamed as "Next-Generation Secure Computing Base." Project manager Mario Juarez stated this name was chosen to avoid legal action from an unnamed company which had acquired the rights to the "Palladium" name, as well as to reflect Microsoft's commitment to NGSCB in the upcoming decade. Juarez acknowledged the previous name was controversial, but denied it was changed by Microsoft to dodge criticism.<ref name="CNET-NGSCB">{{#invoke:citation/CS1|citation |CitationClass=web }}</ref>
The Trusted Computing Platform Alliance was superseded by the Trusted Computing Group in April 2003.<ref name="TCG">{{#invoke:citation/CS1|citation |CitationClass=web }}</ref> A principal goal of the new consortium was to produce a Trusted Platform Module (TPM) specification compatible with NGSCB; the previous specification, TPM 1.1 did not meet its requirements.<ref name="Flak"/><ref name="DangersTCPAPalladium">{{#invoke:citation/CS1|citation |CitationClass=web }}</ref> TPM 1.2 was designed for compliance with NGSCB<ref name="PEE">{{#invoke:citation/CS1|citation |CitationClass=web }}</ref> and introduced many features for such platforms.<ref name="TPM1.2NGSCB">{{#invoke:citation/CS1|citation |CitationClass=web }}</ref> The first TPM 1.2 specification, Revision 62 was released in 2003.<ref name="TPMMainSpecification">{{#invoke:citation/CS1|citation |CitationClass=web }}</ref>
Biddle emphasized in June 2003 that hardware vendors and software developers were vital to NGSCB.<ref name="ControlPCs">{{#invoke:citation/CS1|citation |CitationClass=web }}</ref> Microsoft publicly demonstrated NGSCB for the first time at WinHEC 2003,<ref name="Pd2003-04"/><ref name="ShowsOff">{{#invoke:citation/CS1|citation |CitationClass=web }}</ref><ref name="RMPd">{{#invoke:citation/CS1|citation |CitationClass=web }}</ref> where it protected data in memory from an attacker; prevented access to—and alerted the user of—an application that had been changed; and prevented a remote administration tool from capturing an instant messaging conversation.<ref name="MSRightsScheme">{{#invoke:citation/CS1|citation |CitationClass=web }}</ref><ref name="NGSCBEmulators">{{#invoke:citation/CS1|citation |CitationClass=web }}</ref> Despite Microsoft's desire to demonstrate NGSCB on hardware,<ref name="NGSCBDemo">{{#invoke:citation/CS1|citation |CitationClass=web }}</ref> software emulation was required for as few hardware components were available.<ref name="NGSCBEmulators"/> Biddle reiterated that NGSCB was a set of evolutionary enhancements to Windows, basing this assessment on preserved backward compatibility and employed concepts in use before its development, but said the capabilities and scenarios it would enable would be revolutionary.<ref name="WinHEC2003">{{#invoke:citation/CS1|citation |CitationClass=web }}</ref> Microsoft also revealed its multi-year roadmap for NGSCB,<ref name="MaryFoley">{{#invoke:citation/CS1|citation |CitationClass=web }}</ref> with the next major development milestone scheduled for the Professional Developers Conference,<ref name="NGSCBEmulators"/><ref name="ReadiesKit">{{#invoke:citation/CS1|citation |CitationClass=web }}</ref> indicating that subsequent versions would ship concurrently with pre-release builds of Windows Vista; however, news reports suggested that NGSCB would not be integrated with Windows Vista when release, but it would instead be made available as separate software for the operating system.<ref name="KanellosMichael">{{#invoke:citation/CS1|citation |CitationClass=web }}</ref>
Microsoft also announced details related to adoption and deployment of NGSCB at WinHEC 2003, stating that it would create a new value proposition for customers without significantly increasing the cost of computers; NGSCB adoption during the year of its introductory release was not anticipated and immediate support for servers was not expected.<ref name="PdAdoption">{{#invoke:citation/CS1|citation |CitationClass=web }}</ref><ref name="PdServers">{{#invoke:citation/CS1|citation |CitationClass=web }}</ref> On the last day of the conference, Biddle said NGSCB needed to provide users with a way to differentiate between secured and unsecured windows—that a secure window should be "noticeably different" to help protect users from spoofing attacks;<ref name="KanellosMichael"/> Nvidia was the earliest to announce this feature.<ref name="TrustedGraphicsandNGSCB">{{#invoke:citation/CS1|citation |CitationClass=web }}</ref> WinHEC 2003 represented an important development milestone for NGSCB. Microsoft dedicated several hours to presentations and released many technical whitepapers,<ref name="TrustedPlatformTechnologies">{{#invoke:citation/CS1|citation |CitationClass=web }}</ref><ref name="3DUI">{{#invoke:citation/CS1|citation |CitationClass=web }}</ref><ref name="GetTechnical">{{#invoke:citation/CS1|citation |CitationClass=web }}</ref> and companies including Atmel,<ref name="BusinessWire">Template:Cite press release</ref> Comodo Group,<ref name="FujitsuWinHEC2003">{{#invoke:citation/CS1|citation |CitationClass=web }}</ref><ref name="SIDEN">{{#invoke:citation/CS1|citation |CitationClass=web }}</ref> Fujitsu,<ref name="FujitsuWinHEC2003"/> and SafeNet<ref name="SafeNet">{{#invoke:citation/CS1|citation |CitationClass=web }}Template:Dead link</ref><ref name="SafeNetBusinessWire">{{#invoke:citation/CS1|citation |CitationClass=web }}</ref> produced preliminary hardware for the demonstration. Microsoft also demonstrated NGSCB at several U.S. campuses in California and in New York in June 2003.<ref name="ReadiesKit"/><ref name="OnTour">{{#invoke:citation/CS1|citation |CitationClass=web }}</ref>
NGSCB was among the topics discussed during Microsoft's PDC 2003 with a pre-beta software development kit, known as the Developer Preview, being distributed to attendees.<ref name="Pd2003-04"/> The Developer Preview was the first time that Microsoft made NGSCB code available to the developer community and was offered by the company as an educational opportunity for NGSCB software development.<ref name="PdDP">{{#invoke:citation/CS1|citation |CitationClass=web }}</ref> With this release, Microsoft stated that it was primarily focused on supporting business and enterprise applications and scenarios with the first version of the NGSCB scheduled to ship with Windows Vista, adding that it intended to address consumers with a subsequent version of the technology, but did not provide an estimated time of delivery for this version.<ref name="Overview and Drilldown"/><ref name="PdDP"/> At the conference, Jim Allchin said that Microsoft was continuing to work with hardware vendors so that they would be able to support the technology,<ref name="SpeechTranscript">{{#invoke:citation/CS1|citation |CitationClass=web }}</ref> and Bill Gates expected a new generation of central processing units (CPUs) to offer full support.<ref name="PdCPUtr">{{#invoke:citation/CS1|citation |CitationClass=web }}</ref> Following PDC 2003, NGSCB was demonstrated again on prototype hardware during the annual RSA Security conference in November.<ref name="RSAConference">{{#invoke:citation/CS1|citation |CitationClass=web }}</ref>
Microsoft announced at WinHEC 2004 that it would revise NSCB in response to feedback from customers and independent software vendors who did not desire to rewrite their existing programs in order to benefit from its functionality;<ref name="RevisitsSecurity"/><ref name="ShakesUpSecurity">{{#invoke:citation/CS1|citation |CitationClass=web }}</ref> the revision would also provide more direct support for Windows with protected environments for the operating system, its components, and applications, instead of it being an environment to itself and new applications.<ref name="PdWinHEC2004">{{#invoke:citation/CS1|citation |CitationClass=web }}</ref> The NGSCB secure input feature would also undergo a significant revision based on cost assessments, hardware requirements, and usability issues of the previous implementation.<ref name="WinHEC2004SecureInput">{{#invoke:citation/CS1|citation |CitationClass=web }}</ref> There were subsequent reports that Microsoft would cease developing NGSCB;<ref name="ArsNGSCB">{{#invoke:citation/CS1|citation |CitationClass=web }}</ref><ref name="NGSCBvNX">{{#invoke:citation/CS1|citation |CitationClass=web }}</ref> Microsoft denied these reports and reaffirmed its commitment to delivery.<ref name="eWeekPd"/><ref name="WinHEC2004ShowReport">{{#invoke:citation/CS1|citation |CitationClass=web }}</ref> Additional reports published later that year suggested that Microsoft would make even additional changes based on feedback from the industry.<ref name="Controversial"/><ref name="NGSCB2004-CW">{{#invoke:citation/CS1|citation |CitationClass=web }}</ref>
Microsoft's absence of continual updates on NGSCB progress in 2005 had caused industry insiders to speculate that NGSCB had been cancelled.<ref name="SilenceAndSpeculation">{{#invoke:citation/CS1|citation |CitationClass=web }}</ref> At the Microsoft Management Summit event, Steve Ballmer said that the company would build on the security foundation it had started with the NGSCB to create a new set of virtualization technologies for Windows,<ref name="MMS">{{#invoke:citation/CS1|citation |CitationClass=web }}</ref> which were later Hyper-V. Reports during WinHEC 2005 indicated Microsoft scaled back its plans for NGSCB, so that it could to ship Windows Vista—which had already been beset by numerous delays and even a "development reset"—within a reasonable timeframe; instead of isolating components, NGSCB would offer "Secure Startup" ("BitLocker Drive Encryption") to encrypt disk volumes and validate both pre-boot firmware and operating system components.<ref name="LonghornSecurity"/><ref name="Delays">{{#invoke:citation/CS1|citation |CitationClass=web }}</ref><ref name="LR">{{#invoke:citation/CS1|citation |CitationClass=web }}</ref><ref name="DustsOff">{{#invoke:citation/CS1|citation |CitationClass=web }}</ref> Microsoft intended to deliver other aspects of NGSCB later.<ref name="MS-NGSCB"/> Jim Allchin stated NGSCB would "marry hardware and software to gain better security", which was instrumental in the development of BitLocker.<ref name="DustsOff"/>
Architecture and technical detailsEdit
A complete Microsoft-based Trusted Computing-enabled system will consist not only of software components developed by Microsoft but also of hardware components developed by the Trusted Computing Group. The majority of features introduced by NGSCB are heavily reliant on specialized hardware and so will not operate on PCs predating 2004.
In current Trusted Computing specifications, there are two hardware components: the Trusted Platform Module (TPM), which will provide secure storage of cryptographic keys and a secure cryptographic co-processor, and a curtained memory feature in the CPU. In NGSCB, there are two software components, the Nexus, a security kernel that is part of the Operating System that provides a secure environment (Nexus mode) for trusted code to run in, and Nexus Computing Agents (NCAs), trusted modules which run in Nexus mode within NGSCB-enabled applications.
Secure storage and attestationEdit
At the time of manufacture, a cryptographic key is generated and stored within the TPM. This key is never transmitted to any other component, and the TPM is designed in such a way that it is extremely difficult to retrieve the stored key by reverse engineering or any other method, even to the owner. Applications can pass data encrypted with this key to be decrypted by the TPM, but the TPM will only do so under certain strict conditions. Specifically, decrypted data will only ever be passed to authenticated, trusted applications, and will only ever be stored in curtained memory, making it inaccessible to other applications and the Operating System. Although the TPM can only store a single cryptographic key securely, secure storage of arbitrary data is by extension possible by encrypting the data such that it may only be decrypted using the securely stored key.
The TPM is also able to produce a cryptographic signature based on its hidden key. This signature may be verified by the user or by any third party, and so can therefore be used to provide remote attestation that the computer is in a secure state.
Curtained memoryEdit
NGSCB also relies on a curtained memory feature provided by the CPU. Data within curtained memory can only be accessed by the application to which it belongs, and not by any other application or the Operating System. The attestation features of the TPM can be used to confirm to a trusted application that it is genuinely running in curtained memory; it is therefore very difficult for anyone, including the owner, to trick a trusted application into running outside of curtained memory. This in turn makes reverse engineering of a trusted application extremely difficult.
ApplicationsEdit
NGSCB-enabled applications are to be split into two distinct parts, the NCA, a trusted module with access to a limited Application Programming Interface (API), and an untrusted portion, which has access to the full Windows API. Any code which deals with NGSCB functions must be located within the NCA.
The reason for this split is that the Windows API has developed over many years and is as a result extremely complex and difficult to audit for security bugs. To maximize security, trusted code is required to use a smaller, carefully audited API. Where security is not paramount, the full API is available.
Uses and scenariosEdit
Template:See also NGSCB enables new categories of applications and scenarios. Examples of uses cited by Microsoft include decentralized access control policies; digital rights management services for consumers, content providers, and enterprises; protected instant messaging conversations and online transactions; and more secure forms of machine health compliance, network authentication, and remote access.<ref name="NISTPalladium"/> NGSCB-secured virtual private network access was one of the earliest scenarios envisaged by Microsoft.<ref name="WildAndCrazy">{{#invoke:citation/CS1|citation |CitationClass=web }}</ref> NGSCB can also strengthen software update mechanisms such as those belonging to antivirus software or Windows Update.<ref name="BitLockerWV">{{#invoke:citation/CS1|citation |CitationClass=web }}</ref>
An early NGSCB privacy scenario conceived of by Microsoft is the "wine purchase scenario," where a user can safely conduct a transaction with an online merchant without divulging personally identifiable information during the transaction.<ref name="TCiA">{{#invoke:citation/CS1|citation |CitationClass=web }}</ref> With the release of the NGSCB Developer Preview during PDC 2003, Microsoft emphasized the following enterprise applications and scenarios: document signing, secured data viewing, secured instant messaging, and secured plug-ins for emailing.<ref name="Overview and Drilldown"/>
<templatestyles src="Template:Blockquote/styles.css" />
"The concept of machine identity actually gives you the ability to do things like strengthen antivirus updates because you can start creating circumstances where you sort of create a little secure partition, or secure space within the PC, and that can let you do things like work around rootkits. [...] A lot of what is happening in the arms race of security today is an attempt to subvert an operating system so that the operating system is no longer behaving in the manner in which it was either designed or the user wants—without the user knowing—right? And in other cases, it's about creating a fake user which then does things on your behalf—which are not really on your behalf: spends your money, gives away your data, gives away personally identifiable information. So anything that lets you create a stronger, more immutable identity combination like: "this is the machine, this is the software, this is the operating system, this is the service, this is the user" is something that can benefit users because things that work on chiseling into those spaces are less effective."{{#if:Peter Biddle.<ref name="BitLockerWV"/>|{{#if:|}}
— {{#if:|, in }}Template:Comma separated entries}}
{{#invoke:Check for unknown parameters|check|unknown=Template:Main other|preview=Page using Template:Blockquote with unknown parameter "_VALUE_"|ignoreblank=y| 1 | 2 | 3 | 4 | 5 | author | by | char | character | cite | class | content | multiline | personquoted | publication | quote | quotesource | quotetext | sign | source | style | text | title | ts }}
WinHEC 2004 scenariosEdit
During WinHEC 2004, Microsoft revealed two features based on its revision of NGSCB, Cornerstone and Code Integrity Rooting:<ref name="PdWinHEC2004"/>
- Cornerstone would protect a user's login and authentication information by securely transmitting it to NGSCB-protected Windows components for validation, finalizing the user authentication process by releasing access to the SYSKEY if validation was successful. It was intended to protect data on laptops that had been lost or stolen to prevent hackers or thieves from accessing it even if they had performed a software-based attack or booted into an alternative operating system.<ref name="PdWinHEC2004"/>
- Code Integrity Rooting would validate boot and system files prior to the startup of Microsoft Windows. If validation of these components failed, the SYSKEY would not be released.<ref name="PdWinHEC2004"/>
BitLocker is the combination of these features; "Cornerstone" was the codename of BitLocker,<ref name="PDC-Exclusive">{{#invoke:citation/CS1|citation |CitationClass=web }}</ref><ref name="BitLockerCornerstone">{{#invoke:citation/CS1|citation |CitationClass=web }}</ref> and BitLocker validates pre-boot firmware and operating system components before boot, which protects SYSKEY from unauthorized access; an unsuccessful validation prohibits access to a protected system.<ref name="TechnicalOverview">{{#invoke:citation/CS1|citation |CitationClass=web }}</ref><ref name="ExecutiveOverview">{{#invoke:citation/CS1|citation |CitationClass=web }}</ref>
ReceptionEdit
Template:See also Reaction to NGSCB after its unveiling by Newsweek was largely negative. While its security features were praised,<ref name="Fear">{{#invoke:citation/CS1|citation |CitationClass=web }}</ref><ref name="Schneier">{{#invoke:citation/CS1|citation |CitationClass=web }}</ref> critics contended that NGSCB could be used to impose restrictions on users;<ref name="Schneier"/><ref name="Cringely">{{#invoke:citation/CS1|citation |CitationClass=web }}</ref><ref name="MicroManage">Template:Cite news</ref><ref name="SaferSystem">Template:Cite news</ref><ref name="TCPA-BS">{{#invoke:citation/CS1|citation |CitationClass=web }}</ref> lock-out competing software vendors;<ref name="Cringely"/><ref name="QuestionMSPd">Template:Cite news</ref><ref name="TCPA-BS"/><ref name="TVTechnology">{{#invoke:citation/CS1|citation |CitationClass=web }}</ref> and undermine fair use rights and open source software such as Linux.<ref name="TCPA-BS"/><ref name="Linux">{{#invoke:citation/CS1|citation |CitationClass=web }}</ref><ref name="PowerPlay">{{#invoke:citation/CS1|citation |CitationClass=web }}</ref> Microsoft's characterization of NGSCB as a security technology was subject to criticism as its origin focused on DRM.<ref name="PdCPUtr"/><ref name="SecureOS">Template:Cite news</ref> NGSCB's announcement occurred only a few years after Microsoft was accused of anti-competitive practices during the United States v. Microsoft Corporation antitrust case, a detail which called the company's intentions for the technology into question—NGSCB was regarded as an effort by the company to maintain its dominance in the personal computing industry.<ref name="DesktopDomination">{{#invoke:citation/CS1|citation |CitationClass=web }}</ref> The notion of a "Trusted Windows" architecture—one that implied Windows itself was untrustworthy—would also be a source of contention within the company itself.<ref name="Darknet">{{#invoke:citation/CS1|citation |CitationClass=web }}</ref>
After NGSCB's unveiling, Microsoft drew frequent comparisons to Big Brother, an oppressive dictator of a totalitarian state in George Orwell's dystopian novel Nineteen Eighty-Four. The Electronic Privacy Information Center legislative counsel, Chris Hoofnagle, described Microsoft's characterization of the NGSCB as "Orwellian."<ref name="TrojanHorse">{{#invoke:citation/CS1|citation |CitationClass=web }}</ref> Big Brother Awards bestowed Microsoft with an award because of NGSCB.<ref name="TCiA"/> Bill Gates addressed these comments at a homeland security conference by stating that NGSCB "can make our country more secure and prevent the nightmare vision of George Orwell at the same time."<ref name="GatesvOrwell">{{#invoke:citation/CS1|citation |CitationClass=web }}</ref> Steven Levy—the author who unveiled the existence of the NGSCB—claimed in a 2004 front-page article for Newsweek that NGSCB could eventually lead to an "information infrastructure that encourages censorship, surveillance, and suppression of the creative impulse where anonymity is outlawed and every penny spent is accounted for."<ref name="NetOfControl">{{#invoke:citation/CS1|citation |CitationClass=web }}</ref> However, Microsoft outlined a scenario enabled by NGSCB that allows a user to conduct a transaction without divulging personally identifiable information.<ref name="TCiA"/>
Ross Anderson of Cambridge University was among the most vocal critics of NGSCB and of Trusted Computing. Anderson alleged that the technologies were designed to satisfy federal agency requirements; enable content providers and other third-parties to remotely monitor or delete data in users' machines; use certificate revocation lists to ensure that only content deemed "legitimate" could be copied; and use unique identifiers to revoke or validate files; he compared this to the attempts by the Soviet Union to "register and control all typewriters and fax machines."<ref name="TCPA-BS"/><ref name="DRM-Plan">{{#invoke:citation/CS1|citation |CitationClass=web }}</ref> Anderson also claimed that the TPM could control the execution of applications on a user's machine and, because of this, bestowed to it a derisive "Fritz Chip" name in reference to United States Senator Ernest "Fritz" Hollings, who had recently proposed DRM legislation such as the Consumer Broadband and Digital Television Promotion Act for consumer electronic devices. Anderson's report was referenced extensively in the news media and appeared in publications such as BBC News,<ref name="LockUpComputers">Template:Cite news</ref> The New York Times,<ref name="NewChips">{{#invoke:citation/CS1|citation |CitationClass=web }}</ref> and The Register.<ref name="ElReg">{{#invoke:citation/CS1|citation |CitationClass=web }}</ref> David Safford of IBM Research stated that Anderson presented several technical errors within his report, namely that the proposed capabilities did not exist within any specification and that many were beyond the scope of trusted platform design.<ref name="Safford">{{#invoke:citation/CS1|citation |CitationClass=web }}</ref> Anderson later alleged that BitLocker was designed to facilitate DRM and to lock out competing software on an encrypted system,<ref name="TDP">Template:Cite book</ref> and, in spite of his allegation that NGSCB was designed for federal agencies, advocated for Microsoft to add a backdoor to BitLocker.<ref name="Backdoor">{{#invoke:citation/CS1|citation |CitationClass=web }}</ref> Similar sentiments were expressed by Richard Stallman, founder of the GNU Project and Free Software Foundation,<ref name="Richard">{{#invoke:citation/CS1|citation |CitationClass=web }}</ref> who alleged that Trusted Computing technologies were designed to enforce DRM and to prevent users from running unlicensed software. In 2015, Stallman stated that "the TPM has proved a total failure" for DRM and that "there are reasons to think that it will not be feasible to use them for DRM."<ref name="Richard"/>
After the release of Anderson's report, Microsoft stated in an NGSCB FAQ that "enhancements to Windows under the NGSCB architecture have no mechanism for filtering content, nor do they provide a mechanism for proactively searching the Internet for 'illegal' content [...] Microsoft is firmly opposed to putting 'policing functions' into nexus-aware PCs and does not intend to do so" and that the idea was in direct opposition with the design goals set forth for NGSCB, which was "built on the premise that no policy will be imposed that is not approved by the user."<ref name="MS-NGSCB-FAQ"/> Concerns about the NGSCB TPM were also raised in that it would use what are essentially unique machine identifiers,<ref name="NISTPalladium"/> which drew comparisons to the Intel Pentium III processor serial number, a unique hardware identification number of the 1990s viewed as a risk to end-user privacy.<ref name="TCPA-BS"/><ref name="IntelLovesPd">{{#invoke:citation/CS1|citation |CitationClass=web }}</ref><ref name="DoNotTrust">{{#invoke:citation/CS1|citation |CitationClass=web }}</ref> NGSCB, however, mandates that disclosure or use of the keys provided by the TPM be based solely on user discretion;<ref name="MS-NGSCB-FAQ"/><ref name="PEE"/> in contrast, Intel's Pentium III included a unique serial number that could potentially be revealed to any application.<ref name="IntelP3">{{#invoke:citation/CS1|citation |CitationClass=web }}</ref> NGSCB, also unlike Intel's Pentium III, would provide optional features to allow users to indirectly identify themselves to external requestors.<ref name="MS-NGSCB-FAQ"/>
In response to concerns that NGSCB would take control away from users for the sake of content providers, Bill Gates stated that the latter should "provide their content in easily accessible forms or else it ends up encouraging piracy."<ref name="StifleUsers">{{#invoke:citation/CS1|citation |CitationClass=web }}</ref> Bryan Willman, Marcus Peinado, Paul England, and Peter Biddle—four NGSCB engineers—realized early during the development of NGSCB that DRM would ultimately fail in its efforts to prevent piracy.<ref name="Darknet"/> In 2002, the group released a paper titled "The Darknet and the Future of Content Distribution" that outlined how content protection mechanisms are demonstrably futile.<ref name="DarknetPaper">Template:Cite journal</ref> The paper's premise circulated within Microsoft during the late 1990s and was a source of controversy within Microsoft; Biddle stated that the company almost terminated his employment as a result of the paper's release.<ref name="Darknet"/> A 2003 report published by Harvard University researchers suggested that NGSCB and similar technologies could facilitate the secure distribution of copyrighted content across peer-to-peer networks.<ref name="TC-P2P">{{#invoke:citation/CS1|citation |CitationClass=web }}</ref><ref name="Gaps">{{#invoke:citation/CS1|citation |CitationClass=web }}</ref>
Not all assessments were negative. Paul Thurrott praised NGSCB, stating that it was "Microsoft's Trustworthy Computing initiative made real" and that it would "form the basis of next-generation computer systems."<ref name="ITProPd">{{#invoke:citation/CS1|citation |CitationClass=web }}</ref> Scott Bekker of Redmond Magazine stated that NGSCB was misunderstood because of its controversy and that it appeared to be a "promising, user-controlled defense against privacy intrusions and security violations."<ref name="Fear"/> In February 2004, In-Stat/MDR, publisher of the Microprocessor Report, bestowed NGSCB with its Best Technology award.<ref name="In-StatMDR">{{#invoke:citation/CS1|citation |CitationClass=web }}</ref> Malcom Crompton, Australian Privacy Commissioner, stated that "NGSCB has great privacy enhancing potential [...] Microsoft has recognised there is a privacy issue [...] we should all work with them, give them the benefit of the doubt and urge them to do the right thing."<ref name="CommissionerSlams">{{#invoke:citation/CS1|citation |CitationClass=web }}</ref> When Microsoft announced at WinHEC 2004 that it would be revising NGSCB so that previous applications would not have to be rewritten, Martin Reynolds of Gartner praised the company for this decision as it would create a "more sophisticated" version of NGSCB that would simplify development.<ref name="GartnerPalladium">{{#invoke:citation/CS1|citation |CitationClass=web }}</ref> David Wilson, writing for South China Morning Post, defended NGSCB by saying that "attacking the latest Microsoft monster is an international blood sport" and that "even if Microsoft had a new technology capable of ending Third World hunger and First World obesity, digital seers would still lambaste it because they view Bill Gates as a grey incarnation of Satan."<ref name="China">Template:Cite news</ref> Microsoft noted that negative reaction to NGSCB gradually waned after events such as the USENIX Annual Technical Conference in 2003,<ref name="PdWinHEC2004"/> and several Fortune 500 companies also expressed interest in it.<ref name="PdWinHEC2004"/><ref name="EcosystemOpportunities">{{#invoke:citation/CS1|citation |CitationClass=web }}</ref>
When reports announced in 2005 that Microsoft would scale back its plans and incorporate only BitLocker with Windows Vista, concerns pertaining digital rights management, erosion of user rights, and vendor lock-in remained.<ref name="LonghornSecurity"/><ref name="LR"/><ref name="SchneierBitLocker">{{#invoke:citation/CS1|citation |CitationClass=web }}</ref><ref name="Ourselves">{{#invoke:citation/CS1|citation |CitationClass=web }}</ref> In 2008, Biddle stated that negative perception was the most significant contributing factor responsible for the cessation of NGSCB's development.<ref>Biddle, Peter. (July 16, 2008). "Perception (or, Linus gets away with being honest again)"</ref>
VulnerabilityEdit
In a 2003 article, Dan Boneh and David Brumley indicated that projects like NGSCB may be vulnerable to timing attacks.<ref>{{#invoke:citation/CS1|citation |CitationClass=web }}</ref>
See alsoEdit
- Microsoft Pluton
- Secure Boot
- Trusted Execution Technology
- Trusted Computing
- Trusted Platform Module
- Intel Management Engine
ReferencesEdit
External linksEdit
- Microsoft's NGSCB home page (Archived on 2006-07-05)
- Trusted Computing Group home page
- System Integrity Team blog — team blog for NGSCB technologies (Archived on 2008-10-21)
- Security WMI Providers Reference on MSDN, including BitLocker Drive Encryption and Trusted Platform Module (both components of NGSCB)
- TPM Base Services on MSDN
- {{#if:6330670
|[{{#ifeq:|uspto|http://patft.uspto.gov/netacgi/nph-Parser?patentnumber=%7Chttps://patents.google.com/patent/US}}{{#iferror:{{#expr:6330670 }}|6330670}} Microsoft's "Digital Rights Management Operating System" patent]
|{{US patent|123456|link text}}}}