Greg Clifton

Intel – Trusted Platforms OverviewGreg CliftonIntel Customer Solutions GroupDirector, DoD & Intelligence© 2006 Intel Corporation

Legal Disclaimer• INFORMATION IN THIS DOCUMENT IS PROVIDED IN CONNECTION WITH INTEL®PRODUCTS. NO LICENSE, EXPRESS OR IMPLIED, BY ESTOPPEL OR OTHERWISE, TOANY INTELLECTUAL PROPERTY RIGHTS IS GRANTED BY THIS DOCUMENT. EXCEPT ASPROVIDED IN INTEL’S S TERMS AND CONDITIONS OF SALE FOR SUCH PRODUCTS, INTELASSUMES NO LIABILITY WHATSOEVER, AND INTEL DISCLAIMS ANY EXPRESS ORIMPLIED WARRANTY, RELATING TO SALE AND/OR USE OF INTEL® PRODUCTSINCLUDING LIABILITY OR WARRANTIES RELATING TO FITNESS FOR A PARTICULARPURPOSE, MERCHANTABILITY, OR INFRINGEMENT OF ANY PATENT, COPYRIGHT OROTHER INTELLECTUAL PROPERTY RIGHT. INTEL PRODUCTS ARE NOT INTENDED ED FORUSE IN MEDICAL, LIFE SAVING, OR LIFE SUSTAINING APPLICATIONS.• Intel may make changes to specifications and product descriptions s at any time, without notice.• All products, dates, and figures specified are preliminary based on current expectations, and aresubject to change without notice.• Intel, processors, chipsets, and desktop boards may contain design defects or errors known aserrata, which may cause the product to deviate from published specifications. Currentcharacterized errata are available on request.• Intel and the Intel logo are trademarks or registered trademarks of Intel Corporation or itssubsidiaries in the United States and other countries.• *Other names and brands may be claimed as the property of others.• Copyright © 2006 Intel Corporation.Intel and the Intel logo are trademarks or registered trademarks of Intel Corporation or its subsidiaries in the United States and other countries.2

Intel ® PlatformsBusinessDesktopDigitalHomeMobilityServer• Built-in in Manageability• Proactive Security• Energy Efficient Performance• Performance• Energy Efficient• Connectivity• Ease of Use• Performance• Battery Life• Uncompromised Connectivity• Innovative Form Factor• Effective Virtualization• Optimized Power & Thermals• Reliable Data IntensiveComputingAgenda:•It is an imperfect world•Building the foundation in 2006•The 2007 “Weybridge” Platform•Solving the problems with IntelvPro technology•ConclusionsEnergy Efficient Performance3

Today’s s Challenges• Managing and Securing modern business clients ismore challenging than ever– Zero day malicious exploits create scenarios that patching alonecan’t t resolve– Layered security improves platform protection capabilities– Optimized platform architecture removes bottlenecks, but alsointroduces complexity– Damaged software or hardware can impair the ability toremotely repair a client• Client PCs are not manageable when they need itmost, i.e. HW or SW problem or turned “off”.1.DeskDesk-side side visits & manual processes drive disproportionateshare of IT costs– Intel IT: ~10-15% 15% of help desk calls require desk-side side visit, butdrive ~50% of help desk costs2. Security threats increasing, time to respond decreasing butprotections vulnerable to attack or user tampering– Time to exploit = 3 days; Time to vendor patch = 42 daysNo single technology solves all of these problems!!4

Intel’s s Platform Solution• Utilize a set of technologies that worktogether to:– Enable innovative solutions to solve theseproblems– Create a new framework for a rich layeredsecurity architecture5

Evolving Intel® vPro in 2007 –“Weybridge”Intel Core TM 2 DuoWolfdale CPUBearlakeSupportFamilyChipsetsIntel TrustedExecutionTechnologyWindows Vista*Premium LogoIntel ® ActiveManagement Technology3.02007 WeybridgePlatformeSATA*, ExpandedUSB*, Intel ® RapidRecovery TechnologyEnhancedVirtualization (VTd)*Other names and brands may be claimed as the property of others6LowPowerReduced Chipset& Platform PowerNote: Certain features maybe available only onparticular SKUs

Intel ® Virtualization TechnologyTraditional VirtualizationVirtual Appliance ModelVirtualMachine 1VirtualMachine 2VirtualMachine 3App App App App App AppUser OS 1 User OS 2 User OS 3User EnvironmentApp App AppUser OSVirtual ApplianceAppEmbedded OS“Heavyweight” Virtual Virtual Machine Machine Monitor MonitorHardware Hardware Platform PlatformFull OS Partitions• Full OS capability• Multiple applications• Full HW suite available• Generally virtualized devices• Maximum features and capabilityagilityLightweight VMMHardware Hardware Platform PlatformVirtual Appliance Partitions• Generally headless• Fixed/specific function• Low OS profile• Minimal management cost• Minimal platform resource utilization• Minimal true/virtual HW mapped• OS state/power independentMake Virtualization Applicable to Mainstream7

VT-d d Direct I/O OverviewVirtualMachinesPhysical driverVirtual Machine Monitor (VMM)DMA RemapAssignedIO DevicesPhys MemSoftwareremapping forCPU based memoryaccessBearlake FamilyChipsets(VT-d – a chipset technology)8(VT-x – a CPU technology)

VT-d d : DMA based Protection and Remappingfor Virtual AppliancesCapability PartitionHost OSand AppsVirtual DeviceDriverVirtual Machine Monitor (VMM)Host HWI/O devices assignedto host OSVirtual ApplianceAppliance StackI/O VirtualizationPhysical Device DriverI/O devices assignedto service OS• VT-d enables–Flexible memorymanagement by VMM–Un-modified device drivers torun in both partitions–Contain DMA errors acrosspartitions–Allows enforcement ofindependent security policiesfor each partition9

Intel Trusted Execution TechnologyIntroduced on Weybridge for IncreasedSecurity• Codename LT extendsIntel® VT capabilities ofpartitions and isolation toincrease security using– Measured launch and a chain oftrust to generate a securepartition– Trusted Platform Module (TPM)for Secure Storage ofmeasurements and SignedreportingVM 1App App…User OSAppVM 0“Firewall”App“Mgmt”AppService OSLightweight VMMPlatform Hardware10

Intel ® Active Management TechnologyOverview– Provides Built-in in Manageability and Proactive Security fornetworked computing resources– Enables maintenance and repair of systems using out-ofof-band(OOB) management capabilities even if the system ispoweredoff or the OS is down– Helps secure networks by:– Proactively blocking incoming threats– Reactively containing the spread of threats– Ensuring critical software agents are present– Keeping installed software versions up to date– Enabling popular third-party management consoles andsecurity applications in use today1 Intel® Active Management Technology requires the platform to have an Intel® AMT-enabled chipset, network hardware and software,connection with a power source, and a network connection.11

Intel® AMT 06 Architecture Overview• Discover– Enhanced non-volatile memory storage– Out of Band access• Heal– Provisioning & remote control– Hardware Diagnostics• Protect – System Defense: Filteringfeatures– Capability to allow, disallow, rate-limitpackets based on 5-tuple 5IP ProtocolFilter– Filters programmed by remote console– Filtering in hardware for LAN– Agent PresenceinfoinfoOperatingHelpSystemDeskServerCorporate NetworkIntelPRO/1000LANOperating System*Operating System*SW AgentsIntel ® Q965Express ChipsetCore 2 Duo(G)MCHICH8-DODDR2*DDR2*FLASHManagementConsole12

Intel ® Active Management TechnologyMajor Intel® AMT ComponentsOOB Communication, Management Engine, Nonvolatile MemoryOperating SystemSW Diagnostics/Agents/ApplicationsNetworkDriverManagement EngineDriverSystemDefenseManagement EngineFLASHBIOSLAN ControllerME ServicesNV MemoryIntel AMT FirmwareIntel AMT PrivateOOBCommsFilterTCP/IPSOAPTLSConfidentialityHTTPAuthorizationIntel AMT PublicPHYHW Sensors &AFSC= Out-of-band; Active even when System is turned off or OS is down = In BandGo13

Intel ® Active Management TechnologyUsage CasesRemote Asset InventoryHardware and Software InventoryRemote Diagnostics and RepairEncrypted, Remote Power-on and UpdateAgent Presence CheckingHardware-based Isolation and Recovery14

Intel® AMT Core AttributesAdvantage over S/W Solutions• OS and HDD-Independent– Runs outside the context of the OS– Works the same way regardless of the installed OS– Immune from OS configuration issues• Highly-Available OOB Remote Management– Provides remote management capabilities in all system powerand health states– Runs on auxiliary and battery power (mobile)– Wired and wireless network support (2007)• Tamper-Resistance– Intel® AMT agent bound to the PC and configured by IT– Resistant to end-user modify/disable– Network and Host I/F Security15

Intel AMT CapabilitiesIntel AMT CapabilitiesAdvantage over H/W (WoL & ASF) SolutionsCapabilitiesOOB Mgt (Any OS/powerstate)Remote ControlEvent Alerting3 rd Party Non-VolatileStorageEvent LoggingRemote RebootAsset InformationRemote BIOS UpdateSecure CommunicationsConnection ProtocolLayer 4 StackFirmware Updates UtilitySystem Defense / AgentPresenceSystem Defense /NOCFiltersWoLBooting OnlyRemote BootOnlyNoNoNoNoNoNoNoNoneRegisteredpacketNoNoNo16ASF 2.0Boot/rebootand alertsRemoteBoot/Rebootw/boot optionsYes (1 Client,no filtering)NoNoYes (PXE)NoNoSimpleauthentication- no encryptionRMCPUDPNoNoNoIntel® AMTBoot/reboot, alerts,event log, and remotecontrol, redirectionRemote boot/rebootw/ boot options, SerialOver LAN, IDEredirectionYes (Broadcast to 16clients, filter onlydesired events)YesYes, including filtersYes (PXE or IDE-Redirect)YesYesSSL 3.1/TLS encryption,HTTP Digest/NegotiateauthenticationSOAP/HTTP(web browser access)TCP(preferred routingprotocol)YesYesYes

Conclusion• Solving yesterday’s s problems with enhancementsto yesterday’s s solutions is not sufficient to addressthe challenges of tomorrow• We are well underway to redefining the PC– Radical new hardware that enables distinct technologiesthat work together being launched in 2006 and 2007– New class of solutions that solve problems in new waysare starting to emerge– Barriers to innovation are being cleared for ISVs– This is just the beginning – new innovations to come forthe 2008 platform and beyond– stay tuned…17

Intel® Virtualization TechnologyMode Transitions• VM entry (VMLAUNCH/VMRESUME)– Transition VMM Guest– Enters VMX non-root operation– Loads Guest state and Exit criteria fromVMCS• VM exit (VMEXIT)– Transition Guest VMM– Enters VMX root operation– Saves Guest state in VMCS– Loads VMM state from VMCS– May be triggered by many causes– E.g. Accessing CPU MSRsVM 0App App ...Guest OS 0...VM nVM exit VM entryApp App ...Guest OS nVMMPlatform HWIntel and the Intel logo are trademarks or registered trademarks of Intel Corporation or its subsidiaries in the United States and other countries.19

Intel ® Virtualization TechnologyOperation with VMCSVM 1 VM 2VM nVMXNon-rootRing 3 Ring 3OperationRing 0 Ring 0. . .Ring 3Ring 0VMEXITVMCS1VMCS2VMCSnIA-32OperationVMX RootOperationVMLAUNCHRing 3Ring 0VMRESUME20