2012: Will this be the year TPM finally comes of age?

Microsoft Windows 8 support for TPM

After six year of pumping TPMs into the market, hardware-based security may finally become a practical option for the enterprise, in large part due to TCG founder member, Microsoft.

When they were first introduced to computing devices as part of the manufacturing process, TPMs were included as part of the standards associated with Microsoft's Windows Vista operating system.

The use of TPMs was expanded in Windows 7 to form an important part of the Microsoft Bitlocker strategy for data encryption, in which they were used to store the encryption keys.

In 2012, however, Microsoft plans to release Windows 8, which will see the biggest role for TPM in the operating system to date.

At the RSA Conference in San Francisco in February, Scott Charney, corporate vice-president of trustworthy computing at Microsoft, highlighted some of the security milestones of Windows.

One of the most important features of Windows 8, he said, will be remote attestation by trusted third parties, which is supported by computer's TPM.

Remote attestation could, for example, enable a trusted third party to know if a computer has booted correctly and that there was nothing inappropriate or malicious in the process.

One of the most important security features of Windows 8, he said, will be support for the hardened UEFI BIOS standard, a trusted boot mechanism, provided in part by the computer's TPM.

In secure boot, the BIOS of a computer is measured. As part of the TPM, those measurements can then be reported through remote attestation, either to service providers or to the enterprise network, to certify that the BIOS of the computer has not been changed by malware since the last time the computer was on the network.

Another key security feature of Windows 8 is continued support for TPM as a part of MS Bitlocker and as part of the new operating system's support for the TCG's Opal standards for self-encrypting hard drives (SEDs) – or eDrives, as Microsoft calls them – to achieve what is termed "pervasive encryption".

While there has been third-party support for SEDs on Windows XP, Vista and Windows 7, Windows 8 will provide native support for SEDs as part of the operating system.

This means Windows 8 will have built-in encryption key management capability for SEDs, which reduces the impact of encryption on system performance by offloading encryption processing to hardware instead of using software-based encryption.

Tipping point for TPM

Could the combination of TPM deployment crossing the 600 million mark and TPM's biggest role to date in the Windows operating system be the perfect storm TPM has been waiting for?

Supporters of TPM technology certainly believe that it could. According to Steven Sprague, a founding-member of the TCG, the further expansion of TPM use in Windows 8 will drive the first mainstream adoption of TPM and a much broader spectrum of use.

Sprague, who is also president and chief executive of Wave Systems, sees a future for TPM in protecting credentials for authentication.

"We believe the model will be that people log into their PCs and the TPM stores a collection of credentials that logs the user into all the different services they belong to," he said.

Sprague concedes this vision will still take time to realise. 

"While we can ship many PCs with this capability in the box, ultimately we need the support of the service providers to reduce our reliance on passwords, but this is a model that is supported on tablets and mobile devices, and really should be supported on PCs as well," he said.

Another important point, according to Sprague, is that Microsoft has announced that Windows on ARM requires TPM. "So we should see TPM on all the tablets and mobile devices – and this provides a common mechanism for securing credentials across all of the platforms," he said.

TPM gathers momentum

But what will it take to get online service providers on board?

According to Sprague, many service providers already have support, but have not marketed that support very well.

"Any service that supports PKI credentials held on a token or smartcard will work with the TPM – now on Windows XP, Vista, 7 and 8 – and I think the allure of what is now 600 million PCs is starting to reach a mass where 600 million customers is almost an interesting number for most companies," he said.

The TCG believes online service providers will increasingly opt for TPM – which is already built into computing devices – rather than use a proprietary authentication device that has to be sent out to every customer.

The TCG supports the move to a TPM-enabled model of authentication where consumers of services will register devices with services providers.

"Consumers are already familiar with the registration of a device; they do it every time they buy a mobile phone, Kindle or iPad because all those involve the registration of a device," said Sprague.

This model could work in a similar way to corporate use of BlackBerry devices for e-mail, in which the BlackBerry is registered by the IT department, which gives it an access key.

"Users have no idea what the key is, nor do they have the ability to propagate access to that key, and it works very well. They get their e-mail all the time and IT is comfortable that only that device is getting e-mail intended for that particular user," said Sprague.

The end of the password?

The TCG sees this model as a way of making it possible to eliminate the consumer's reliance on passwords for everything they do.

All users will have to remember is an access code for the device, while the TPM can store credentials for all the different services with proper isolation, so users can have different personalities on a machine or even different users of the same machine, said Sprague.

Enterprise implementations of this model have already been achieved, with third-party suppliers such as Wave Systems building the tools and applications to make it easier to use TPM as a token for domain authentication, VPNs, wireless and access to third-party services.

Companies leading the way include PricewaterhouseCoopers (PwC), which has 85,000 seats but no passwords to log onto their VPN, according to Sprague.

Instead, users have a PIN code to log into their computers. These contain more than one credential and log users in to all the resources they need.

This model, in which the enterprise can use various forms of security software to prevent someone taking control of a company machine remotely, is contrasted with the traditional model in which all a cyber criminal has to do is steal a username and password to get complete session access from thousands of miles away, without the PC owner being aware that credentials have been stolen.

"So this raises the bar significantly. We are getting to the point where we have the assurance that the computer is running only its code, which is clearly part of the TCG's set of goals," said Sprague.

TPM in action across all devices

In the TCG vision, if an individual's PC, tablet and phone all have TPMs, it is easy to write the software to add that credential to all.

"If I hear about a new service, I add it to my tablet, and now my PC and my phone have the same capability. This is the foundation to enable that future, but it is under-discussed," said Sprague.

Windows 8, he believes, provides a clear path to transitioning the use of TPM from PCs only to a wide range of mobile devices and platforms.

"By adding Trusted Computing to Windows on ARM, we end up with one operating system that has a security mechanism that functions across all of their platforms, which presents an opportunity to use a commonality across all devices, which is what we are looking for," said Sprague.

Just as hardware-based security, in the form of SIM modules in mobile phones, took the industry from high levels of fraud to effectively zero, the TCG believes hardware-based security in the form of TPM could enable a similarly positive revolution for enterprise and web-based consumer services.

Given the strong market demand for a common solution in security, the wide and widening deployment of TPM-enabled devices and increased support by Windows 8; all combined with the fact that TPM is a security requirement for new kit for the US government and department of defence; the indications are that, if not in 2012, the next few years could well see TPM mature into that common security solution.