Comments /Security/vpro.html


Thu Apr 27 11:56:40 2006: Subject:   drag
Na, I don't think it includes a hypervisor per say. In their 'white paper' they mentioned "third party software" several times.



I think they lumped the Vanderpool stuff as part of the 'vPro' solution, but that's only a small part. That 'vPro' is a few different things intel has done that they thought sounded cool if they tried to make it look like some huge new concept.

I beleive a major part of what they are talking about is a on-board management console built into the hardware. Like a more advanced BIOS or whatnot that can be accessed over the network. That way you have some sort of management console that you can do things like find out what 'Vpro'-enabled PCs are attatched to the network and their configuration. Maybe also provide a boot menu or have the ability to restart the computer or some other stuff like that.

Keep in mind that I've haven't looked to far into it, but I've seen little things here and there about network management features when looking up information on Intel's motherboard chipsets.

For example here is a little 2 page PDF advertising Novell Zenwork's ability to do (what it sounds like at least) things like reload a system image over a network automaticly.
http://www.intel.com/technology/manage/downloads/306433.pdf

So say your a unfortunate person in charge of managing dozens of Windows XP machines. You have a system image that you use to install on all the machines. Now those XP machines get rooted by some IE virus or worm. It looks like you can then use Zenworks to pretty much automaticly have those machines wipe the harddrive and load the system image over it remotely over a network.

It'll be interesting to see what sort of security features Intel has to prevent some kid from walking into a building with a notebook and wiping out half the network as a practical joke.

Thu Apr 27 12:22:33 2006: Subject:   TonyLawrence
No, they definitely said that the security and managent software is running in a VM. They touted that as keeping the A/V software more secure, etc.



Sat Apr 29 11:14:10 2006: Subject:   TonyLawrence
Here's a link to an article that discusses the problem of vPro doing its own thing with virtualization: http://blogs.zdnet.com/BTL/?p=2934 (see the last few paragraphs particularly). It confirms what I thought: the user's OS is running in a VM:.

The same goes for the security solutions that Bryant says should be revolutionized by the virtualization technologies found in vPro. As if lack of any hypervisor standards isn't bad enough (Xen, Microsoft, and VMWare all use different hypervisor techs to host virtual machines), Intel is giving away a new (and fourth) hypervisor with a slightly different twist. It supports two partitions (using Intel's VT technology which has been shipping in Intel chips since last year), one of which is for the end users production operating system (eg: Windows) and the other which Bryant says is ideal to be an appliance with an embedded OS. For example a security appliance running intrusion detection software for the whole computer so the production operating system doesn't have to. Cool idea. But again, Intel is just now working with partners like Symantec to build the software that turns that sidecar partition into the appliance that Intel has in mind.

Add your comments