Next-Generation Secure Computing Base

Peter Biddle speaks at the ETech conference in 2007.

Development of NGSCB began in 1997 after Peter Biddle conceived of new ways to protect content on personal computers.[1][18][19][20] Biddle would enlist the help of members from the Microsoft Research division during the development of the technology and other key contributors would eventually include Blair Dillaway, Brian LaMacchia, Bryan Willman, Butler Lampson, John DeTreville, John Manferdelli, Marcus Peinado, and Paul England.[21] Adam Barr, a former Microsoft employee who worked to secure the remote boot feature during development of Windows 2000, claimed that he was approached by Biddle and colleagues during his tenure with an initiative tentatively known as "Trusted Windows," which aimed to protect DVD content from being copied. To achieve this, Lampson proposed a hypervisor that would allow for the execution of a limited operating system dedicated to DVD playback alongside Windows 2000.[22] Patents for a DRM operating system were later filed in 1999 by DeTreville, England, and Lampson.[23][24] While Microsoft is not known to have officially confirmed a relationship between NGSCB and the DRM operating system patents, one of the technology's architects, Butler Lampson, has stated that they pertain to NGSCB.[25] By 1999, the developers realized that the technology was far more applicable in the realms of privacy and security and the project was given the green-light in October 2001.[1][19][20][26]

During the 1999 Windows Hardware Engineering Conference, Microsoft discussed its intentions to create a new trusted architecture for Windows operating that leveraged new hardware components to promote trust and security while preserving backward compatibility with previous software.[27] On October 11, 1999, the Trusted Computing Platform Alliance, a consortium of various technology companies including Compaq, Hewlett-Packard, IBM, Intel, and Microsoft, was formed in an effort to promote trust and security in the personal computing platform.[28] The TCPA would release several detailed specifications for a trusted computing platform with focus on features such as code validation and encryption based on integrity measurements, hardware-based key storage, and machine authentication. These features required a new hardware component designed by the TCPA called the "Trusted Platform Module" (referred to as a "Security Support Component,"[9] "Security CoProcessor"[5] or "Security Support Processor"[5] in early Microsoft NGSCB documentation).

At WinHEC 2000, Microsoft released a technical presentation on the topics of protection of privacy, security, and intellectual property. This session, titled "Privacy, Security, and Content in Windows Platforms" focused mainly on turning Windows into a platform of trust designed to protect the privacy and security of individual users.[2] A similar presentation would later be shown during WinHEC 2001.[29] Unlike traditional rights management schemes which only protect certain types of data, NGSCB was designed to be egalitarian in that it regarded all data as being equally worthy of protection.[2][30]

In April 2002, Microsoft held its first design review for the NGSCB with approximately 37 different companies under a non-disclosure agreement.[19] In June, the technology was publicly unveiled under its codename "Palladium" in an article by Steven Levy for Newsweek that focused on its origin, design, and features.[31][32] Levy outlined many of the main features offered by NGSCB, including user authentication, user identification, data encryption, and access control policies pertaining to the use of information. As examples of policies that could be enforced by the technology, users could send e-mail messages accessible only by the intended recipient, or create Microsoft Word documents that could be read only a week after their creation date.[1] Around the time of this announcement, the company was not sure whether to "expose the feature in the Windows Control Panel or present it as a separate utility," but regardless of its location, the NGSCB hardware and software features would be turned off by default, thus making the technology an opt-in solution.[33] In July, Microsoft PressPass interviewed John Manferdelli, who restated and expanded on many of the key points discussed in the article by Newsweek. Manferdelli also characterized the technology as an evolutionary set of enhancements for the Windows operating system.[26] In August, Microsoft posted a recruitment advertisement seeking a group program manager to provide vision and industry leadership in the development of several Microsoft technologies including NGSCB.[34]

At the Intel Developer Forum in 2002, Paul Otellini announced Intel's plan to support NGSCB with the company's set of processor, chipset, and platform extensions codenamed "LaGrande"[35][36] which intended to provide a hardware foundation for all NGSCB components and capabilities and protect confidential user information from software-based attacks while preserving backward compatibility with previous software.[37]

The technology was known by its codename "Palladium" until January 24, 2003 when Microsoft announced that it had been renamed as the "Next-Generation Secure Computing Base." According to NGSCB product manager Mario Juarez, the new name was chosen to avoid any legal conflict with an unnamed company that had already acquired the rights to the Palladium name, and to reflect Microsoft's commitment to the technology in the upcoming decade; the previous name had been marred by the controversy surrounding the technology, but Juarez denied that the name change was an attempt by Microsoft to dodge criticism.[38]

In April 2003, the Trusted Computing Platform Alliance was succeeded by the Trusted Computing Group.[39] One principal goal of the TCG was to produce a Trusted Platform Module specification compatible with NGSCB, as the previous specification, TPM 1.1, did not meet its requirements.[19][40] The new TPM 1.2 specification introduced many new features for trusted platforms[41] and was designed to be compliant with Microsoft's NGSCB.[42] The first specification for TPM 1.2, Revision 62, was released by the Trusted Computing Group in fall of 2003.[43]

In May 2003, Biddle emphasized that support from hardware vendors and software developers was vital to the technology's success.[44] Microsoft released additional information and publicly demonstrated the technology for the first time at WinHEC 2003.[10][45][46] During the demonstration, NGSCB protected information from an attacker who attempted to access information resident in memory, denied access to and alerted users of an application that had been modified, and also thwarted an attempt by a remote administration tool to capture information from an instant messaging session.[47][48] Although Microsoft previously intended to demonstrate the technology on real hardware as opposed to using software emulation,[49] the demonstration relied on emulators as only a few of the requisite hardware components were available.[48] According to Biddle, Microsoft's primary purpose for emphasizing the NGSCB during WinHEC 2003 was so that the company could acquire feedback and insight from its partners in the hardware industry and to prepare them for the technology. Biddle reiterated that the NGSCB was a set of evolutionary enhancements to the Windows operating system, basing this assessment on the fact that it preserved backward compatibility with previous programs and employed concepts that had been in use prior to its development, but stated that the new capabilities and scenarios that it enabled would be revolutionary.[50] At the conference, Microsoft also revealed its multi-year roadmap for NGSCB,[51] with the next major development milestone scheduled for the company's Professional Developers Conference.[48][52] The roadmap had also shown that subsequent versions would ship concurrently with pre-release builds of Windows Vista. However, reports suggested that the technology would not be integrated with the operating system upon its release, but would instead be made available as separate software.[53]

Details pertaining to adoption of the technology were also revealed, with officials stating that while NGSCB was intended to create a new value proposition for customers without significantly increasing the cost of personal computers, adoption during the year of its introductory release was not anticipated and immediate support for servers was not expected.[54][55] On the last day of the conference, Biddle stated that the NGSCB needed to provide users with a way to differentiate between secure and unsecure windows, adding that a secure window should be "noticeably different" to help protect users from spoofing attacks;[53] Nvidia was among the earliest to announce support for this feature.[56] WinHEC 2003 would represent an important milestone during the development of NGSCB. Microsoft would release several technical whitepapers and dedicate many hours of technical sessions,[57][58][59] and several companies including Atmel,[60] Comodo Group,[61][62] Fujitsu,[61] and SafeNet[63][64] would produce prototype hardware for the demonstration of the technology.

In June 2003, Microsoft demonstrated the technology at U.S. campuses in California and in New York.[52][65]

Microsoft's roadmap for NGSCB as revealed during WinHEC 2003.

NGSCB was among the topics discussed during Microsoft's PDC 2003 with a pre-beta software development kit, known as the Developer Preview, being distributed to attendees.[10] The Developer Preview was the first time that Microsoft made NGSCB code available to the developer community and was offered by the company as an educational opportunity for NGSCB software development.[66] With this release, Microsoft stated that it was primarily focused on supporting business and enterprise applications and scenarios with the first version of the NGSCB scheduled to ship with Windows Vista, adding that it intended to address consumers with a subsequent version of the technology, but did not provide an estimated time of delivery for this version.[8][66] At the conference, Jim Allchin said that Microsoft was continuing to work with hardware vendors so that they would be able to support the technology,[67] and Bill Gates expected a new generation of central processing units to offer full support.[68] Following PDC 2003, NGSCB was demonstrated again on prototype hardware during the annual RSA Security conference in November.[69]

Microsoft announced at WinHEC 2004 that it would revise NSCB in response to feedback from customers and independent software vendors who did not desire to rewrite their existing programs in order to benefit from its functionality.[11][70] The revised NGSCB would provide more direct support for Windows with compartmentalized environments for the operating system, its components, and applications;[71] the NGSCB secure input feature would also undergo a significant revision based on cost assessments, hardware requirements, and usability issues that were results of the previous implementation.[72] After this announcement, there were reports that Microsoft planned to cease development of NGSCB;[73][74] the company denied these claims and reaffirmed its commitment to delivering the technology.[14][75] Reports published later that year suggested that the company would make additional changes based on feedback from the industry.[6][76]

In 2005, Microsoft's lack of continual updates on its progress with the technology had led some in the industry to speculate that it had been cancelled.[77] At the Microsoft Management Summit event, Steve Ballmer said that the company would build on the security foundation it had started with the NGSCB to create a new set of virtualization technologies for the Windows operating system.[78] During WinHEC 2005, there were reports that Microsoft had scaled back its plans for NGSCB in order to ship the post-reset Windows Vista operating system within a reasonable timeframe. Instead of providing compartmentalization features, the NGSCB would offer a feature known as "Secure Startup" (later renamed as "BitLocker Drive Encryption") that would utilize version 1.2 of the Trusted Platform Module to provide validation of pre-boot and operating system components, and disk volume encryption.[12][79][80][81] Microsoft planned to deliver other aspects of its NGSCB vision at a later date.[3] At the time, Jim Allchin stated that the goal with NGSCB was "to marry hardware and software to gain better security," a goal that was influential in the development of BitLocker.[81] Allchin also stated that the next progression toward NGSCB would be to create a virtualization environment codnamed "Unity," which would rely on specialized hardware and software for virtualization, though he also stated that Microsoft was "experimenting with ways to do virtualization without requiring the hardware to do it" and that it had not abandoned its previous efforts to ensure that other NGSCB features would eventually be made available.[81]

At the time of manufacture, a cryptographic key is generated and stored within the TPM. This key is never transmitted to any other component, and the TPM is designed in such a way that it is extremely difficult to retrieve the stored key by reverse engineering or any other method, even to the owner. Applications can pass data encrypted with this key to be decrypted by the TPM, but the TPM will only do so under certain strict conditions. Specifically, decrypted data will only ever be passed to authenticated, trusted applications, and will only ever be stored in curtained memory, making it inaccessible to other applications and the Operating System. Although the TPM can only store a single cryptographic key securely, secure storage of arbitrary data is by extension possible by encrypting the data such that it may only be decrypted using the securely stored key.

The TPM is also able to produce a cryptographic signature based on its hidden key. This signature may be verified by the user or by any third party, and so can therefore be used to provide remote attestation that the computer is in a secure state.

NGSCB also relies on a curtained memory feature provided by the CPU. Data within curtained memory can only be accessed by the application to which it belongs, and not by any other application or the Operating System. The attestation features of the TPM(Trusted Platform Module) can be used to confirm to a trusted application that it is genuinely running in curtained memory; it is therefore very difficult for anyone, including the owner, to trick a trusted application into running outside of curtained memory. This in turn makes reverse engineering of a trusted application extremely difficult.

NGSCB-enabled applications are to be split into two distinct parts, the NCA, a trusted module with access to a limited Application Programming Interface (API), and an untrusted portion, which has access to the full Windows API. Any code which deals with NGSCB functions must be located within the NCA.

The reason for this split is that the Windows API has developed over many years and is as a result extremely complex and difficult to audit for security bugs. To maximize security, trusted code is required to use a smaller, carefully audited API. Where security is not paramount, the full API is available.

One immediately notices the irony in the "extreme complexity and difficulty of audit" championed above. Department of Defense-sponsored computer security initiatives that began in the late 1970s recognized very early that, the more trustworthy a system, the more transparently engineered its trusted components must be. Extreme complexity stands in direct opposition to these requirements, as does inability fully to audit. Truly, one must even wonder about Microsoft's commitment and expertise when internal criticisms arise over "difficult[y] to audit for security bugs," since nowhere do any applicable criteria offer this raison d'etre to audit. Rather, audit is intended to capture all security-relevant operations transacted by the system; the very statement that concern arises because "security bugs will be difficult to audit," or some such, reflects a very tortured understanding of the purpose of audit and of the stricture with which the descriptor "secure" (in actuality, the descriptor "trusted") is assigned. Read another way, this concern seems to say, "This system can't be called secure, since the audit isn't comprehensive enough to capture evidence of the known (viz., a priori) security bugs."

During WinHEC 2004, Microsoft revealed two features based on its revision of NGSCB, Cornerstone and Code Integrity Rooting:[71]

• Cornerstone would protect a user's login and authentication information by securely transmitting it to NGSCB-protected Windows components for validation, finalizing the user authentication process by releasing access to the SYSKEY if validation was successful. It was intended to protect data on laptops that had been lost or stolen to prevent hackers or thieves from accessing it even if they had performed a software-based attack or booted into an alternative operating system.[71]
• Code Integrity Rooting would validate boot and system files prior to the startup of Microsoft Windows. If validation of these components failed, the SYSKEY would not be released.[71]

Microsoft's BitLocker is the result of these features. "Cornerstone" was the codename for BitLocker,[85][86] and BitLocker—like "Code Integrity Rooting"—validates boot and system components prior to operating system startup and aims to protect SYSKEY from unauthorized access; unsuccessful validation prohibits access to a protected system.[87][88]