The role of Windows PCs and their trust in technology is more important than ever because our devices help you stay connected and productive throughout your work and life. Windows 10 is the most secure version of Windows, with end-to-end security that protects from the edge to the cloud to the hardware. Enhancements such as biometric facial recognition in Windows Hello, integrated virus protection in Microsoft Defender, as well as firmware protection and advanced system features such as System Guard, Application Control for Windows, and others have helped Microsoft keep pace with the changing threat landscape.
As the protection provided by the cloud and the improvements in Windows AI make it increasingly complex and expensive for attackers, it is rapidly evolving into new targets: Connections between hardware and software that currently cannot be reached or traced for deficiencies. We have already taken steps to work with our partners to combat these advanced cybercriminals and national government agencies through innovations such as secure mainframes that provide better protection for personal data, operating systems and hardware.
Microsoft and its leading silicone partners today announced a new vision for Windows security that will protect our customers today and in the future. In partnership with leading silicon partners AMD, Intel and Qualcomm Technologies, Inc., we announce the release of Microsoft’s Pluto security processor. This cloud of chipset security technology, which pioneered the Xbox and Azure Sphere, will bring even more security advances for future Windows PCs and herald the beginning of the journey with ecosystem partners and OEMs.
Our vision for the future of Windows PCs is based on the security of the kernel itself, integrated into the CPU, where hardware and software are tightly integrated in a unique approach to eliminate entire attack vectors. This revolutionary security processor design makes it much more difficult for attackers to hide under the operating system and improves our ability to protect against physical attacks, to prevent theft of accounts and encryption keys and to enable recovery of faulty software.
Plutodesign trumps the security of Windows on theprocessor
Nowadays, the core security of the operating system of most PCs is located in a separate chip of the processor, the Trusted Platform Module (TPM). The TPM is a hardware component used for the secure storage of keys and measures to check the integrity of the system. TPM modules have been supported by Windows for over 10 years and are used in many critical technologies such as Windows Hello and BitLocker. Given the effectiveness of TPMs in performing critical security tasks, attackers have started to use innovative attack techniques, especially in situations where an attacker may steal a PC or gain temporary physical access to a PC. These advanced methods of attack target the communication channel between the CPU and the TPM, which is usually a bus interface. This bus interface provides a means to exchange information between the main processor and the security processor, and also allows attackers to steal or change information during a physical attack in transit.
Pluto’s design eliminates the possibility of attacking this communication channel by creating a security system directly inside the CPU. Windows computers using the Pluto architecture will initially mimic a TPM that works with existing TPM and API specifications, so customers can immediately benefit from increased security for TPM-based Windows features such as BitLocker and System Guard. Windows devices equipped with Pluto will use the Pluto security processor to protect users’ credentials, identities, encryption keys and personal information. None of this data can be removed from Pluto, even if an attacker has malware installed or is in full physical possession of a PC.
To do this, sensitive data, such as encryption keys, are stored securely in a Pluto processor isolated from the rest of the system, so that new methods of attack, such as speculative execution, cannot access the key material. In addition, Pluto offers the unique Secure Hardware Cryptography Key (SHACK) technology that ensures that keys are never opened outside the protected hardware, including the Pluto firmware itself, providing an unprecedented level of security for Windows users.
The Pluton security processor complements the work Microsoft has done with the community, including the Cerberus project, by providing secure processor identification that can be certified by Cerberus, improving the security of the entire platform.
One of the main security issues Pluto addresses is upgrading the firmware throughout the PC’s ecosystem. Today, customers receive security firmware updates from many different sources that are difficult to manage, resulting in widespread patch problems. Pluton provides a flexible and scalable firmware implementation platform that implements end-to-end security features with automatic load, support and update programs from Microsoft. Pluto for Windows computers is integrated into the Windows update process in the same way that the Azure Sphere security service connects to IoT devices.
By combining the security enhancements of Microsoft’s operating system, innovations such as Secure Core PCs and Azure Sphere, and hardware innovations from our silicon spectrum partners, Microsoft is able to protect itself against complex attacks from Windows PCs, cloud devices and Azure’s smart devices.
Innovation with our partners to improve the cloud of security chips
The success of the PC is largely due to the incredibly dynamic ecosystem in which operating system partners, silicon, and OEMs work together to solve complex problems through joint innovation. This was demonstrated more than 10 years ago with the successful implementation of MPR, the first publicly available source of material confidence. Since then, Microsoft and its partners have continued to work on the next generation of security technologies that take full advantage of the latest operating system and silicon innovations to address the most complex security challenges. The best joint approach is to make the PC ecosystem as safe as possible.
Microsoft Pluton design technology incorporates all the knowledge gained from delivering hardware devices that meet the highest standards for hundreds of millions of PCs. The Pluto design was introduced as part of the Xbox One console’s integrated hardware and operating system security, launched in 2013 by Microsoft in conjunction with AMD, and in Azure Sphere. The introduction of Microsoft’s IP technology directly into the processor’s silicon helped protect against physical attacks, prevent key recognition and enable the recovery of faulty software.
Thanks to the effectiveness of Pluto’s original design, we learned a lot about using hardware to limit a number of physical attacks. We are now using what we have learned to create a security concept in the cloud of chips to bring even more security innovations for the future of Windows PCs (more on this in this Microsoft BlueHat presentation). Azure Sphere followed a similar security approach to become the first IoT product to meet the seven characteristics of high-security devices.
Pluton’s common trusted technology will maximize the performance and security of the entire Windows PC ecosystem by leveraging each company’s security expertise and technologies. The Pluto security processor will secure your next-generation Windows PC with future chips from AMD, Intel, and Qualcomm technologies.
At AMD, security is our top priority and we are proud to have been at the forefront of developing a hardware security platform that supports features to protect users from the most advanced attacks. As part of this vigilance, AMD and Microsoft are working closely together to continuously develop and improve processor-based security solutions from the Xbox One console to the PC. We design and build our products with security in mind, and the introduction of Microsoft Pluto technology at chip level will further enhance the already powerful security features of our processors. – Jason Thomas, Product Safety Manager, AMD.
Intel continues to work with Microsoft to improve security on Windows PC platforms. The introduction of Microsoft Pluto in the future will further improve the integration between Intel hardware and the Windows operating system. – Mike Nordquist, Senior Director Business Customer Security, Intel
Qualcomm Technologies is happy to continue working with Microsoft to make many devices and use cases more secure. We believe that a hardware-on-chip platform such as Microsoft Pluto is an important element in the protection of MFPs and the devices that contain them. – Asaf Shen, executive director of product management at Qualcomm Technologies, Inc.
We believe that fail-safe processors such as Pluto are the future of computer hardware. With Pluto, our goal is to create a stronger foundation for the Smart Edge and Smart Cloud by extending this level of integrated trust to devices and things around the world.
Our work with the community helps Microsoft to continuously innovate and improve security at all levels. We are pleased to be able to introduce this revolutionary safety concept to the biggest names in the silicon industry, while continuing to work on improving safety for everyone.
Related Tags: