Jump to content

Intel vPro: Difference between revisions

From Wikipedia, the free encyclopedia
Browse history interactively
← Previous editNext edit →
Content deleted Content added
VisualWikitext
Tag: section blanking
see discussion page for undo info
Line 74: Line 74:


For example, during deployment of vPro PCs, security credentials, keys, and other critical information are stored in [[memory protection|protected memory]] (not on the [[hard disk drive]]), and erased when no longer needed.
For example, during deployment of vPro PCs, security credentials, keys, and other critical information are stored in [[memory protection|protected memory]] (not on the [[hard disk drive]]), and erased when no longer needed.

===Intel vPro Security Concerns===
This article: "Big Brother potentially exists right now in our PCs, compliments of Intel's vPro" <ref>http://www.tgdaily.com/content/view/39455/128/</ref> raises many potential security concerns for PC's with vPro. The fact that there is apparently no way to disable vPro on a PC along with the fact that most users cannot detect outside access to their PC via the vPro hardware based technology is a serious concern.


===Intel vPro Security Features===
===Intel vPro Security Features===

Revision as of 16:41, 22 December 2009

vPro Technology
Original vPro logo
2008 vPro logo
New logo
2009 vPro logo

Intel vPro technology is a set of features built into a PC’s motherboard and other hardware.[1][2] Intel vPro is not the PC itself, nor is it a single set of management features (such as Intel Active Management Technology (Intel AMT)) for sys-admins. Intel vPro is a combination of processor technologies, hardware enhancements, management features, and security technologies that allow remote access to the PC — including monitoring, maintenance, and management -- independently of the state of the operating system (OS) or power state of the PC.[2] Intel vPro is intended to help businesses gain certain maintenance and servicing advantages, security improvements, and cost benefits in information technology (IT) areas.[2][3]

Relationships between Intel vPro, Intel AMT, Intel Centrino 2, and Intel Core 2

The numerous Intel brands can be confusing. The key differences between vPro (a platform), AMT (a technology), Centrino 2 (a package of technologies), and Core 2 (a processor) are as follows:

Intel Core 2 Duo or Quad processors are central processing units (CPUs), the brains of the PC.[2] Intel Centrino 2 processor technology is a package of technologies that includes the Intel Core 2 Duo.[4] Intel Centrino 2 is designed for mobile PCs, such as laptops and other small devices. Core 2 and Centrino 2 have evolved to use Intel's latest 45-nm manufacturing processes, have multi-core processing, and are designed for multithreading.

Intel vPro technology is a set of technologies built into the hardware of the laptop or desktop PC.[2] The technology is targeted at businesses, not consumers. A PC with vPro includes Intel AMT, Intel Virtualization Technology (Intel VT), Intel Trusted Execution Technology (Intel TXT), a gigabit network connection, and so on. There may be a PC with a Core 2 processor, without vPro built in. However, vPro features require a PC with at least a Core 2 processor. Current versions of vPro are built into PCs with Core 2 Duo or Quad processors or Centrino 2 processors.

Intel AMT is part of the Intel Management Engine, which is built into PCs with Intel vPro technology.[2] Intel AMT is a set of remote management and security features designed into the PC’s hardware and which allow a sys-admin with AMT security privileges to access system information and perform specific remote operations on the PC.[5] These operations include remote power up/down (via wake on LAN), remote / redirected boot (via integrated device electronics redirect, or IDE-R), console redirection (via serial over LAN), and other remote management and security features.

Intel vPro technology Features

Intel vPro is a “platform” or set of PC hardware features. PCs with vPro have three main elements: 1) Core 2 Duo/Quad or Centrino 2 processor for business applications; 2) integrated components (such as 64-bit graphics) to reduce the number of discrete components in the system; and 3) hardware-based management and security technology (such as Intel AMT).[1][2][5][4][6][7][8]

A vPro PC includes:

  • Multi-core, multi-threaded Intel Core 2 Duo or Quad processors.[2]
  • Intel Active Management Technology (Intel AMT), a set of hardware-based features targeted at businesses and which allow remote access to the PC for management and security tasks, when an OS is down or PC power is off.[2][5] Note that AMT is not the same as Intel vPro; AMT is only one element of a vPro PC.
  • Remote configuration technology for AMT, with certificate-based security. Remote configuration can be performed on “bare-bones” systems, before the OS and/or software management agents are installed.[2][5][9]
  • Wired and wireless (laptop) network connection.[2]
  • Intel Trusted Execution Technology (Intel TXT),[2][10][11][12] which is used to verify a launch environment and establish the root of trust, which in turn allows software to build a chain of trust for virtualized environments. Intel TXT also protects secrets during power transitions for both orderly and disorderly shutdowns (a traditionally vulnerable period for security credentials).
  • Support for IEEE 802.1x, Cisco Self Defending Network (SDN), and Microsoft Network Access Protection (NAP) in laptops, and support for 802.1x and Cisco SDN in desktop PCs.[13][14] Support for these security technologies allows Intel vPro to store the security posture of a PC so that the network can authenticate the system before the OS and applications load, and before the PC is allowed access to the network.[10]
  • Intel Virtualization Technology, including Intel VT for memory, CPU, and Directed I/O, to support virtualized environments. Intel VT is hardware-based technology, not software-based virtualization. Intel VT lets you run multiple OSs (traditional virtualization) on the same PC or run a specialized or critical application in a separate space -- a virtual PC on the physical system -- in order to help protect the application or privacy of sensitive information.[3][10][15]
  • Execute Disable Bit which, when supported by the OS, can help prevent some types of buffer overflow attacks.[16]
  • Support for Microsoft Windows Vista, including Microsoft Windows Vista BitLocker with an industry-standard Trusted Platform Module version 1.2 and Intel graphics support for Windows Vista AERO graphical user interface.[17][18]

Remote-Management Features

Intel AMT is the set of management and security features built into vPro PCs and which are intended to make it easier for a sys-admin to monitor, maintain, secure, and service PCs.[2] Intel AMT (the management technology) is sometimes mistaken for being the same as Intel vPro (the PC "platform"), because AMT is one of the most visible technologies of an Intel vPro-based PC.

Intel AMT includes:

Hardware-based management has been available in the past, but it has been limited to auto-configuration using DHCP or BOOTP for dynamic IP allocation and diskless workstations, as well as Wake On LAN for remotely powering on systems.[19]

Wireless Communication

Intel vPro supports encrypted wired and wireless LAN wireless communication for all remote management features for PCs inside the corporate firewall.[2] Intel vPro supports encrypted communication for some remote management features for wired and wireless LAN PCs outside the corporate firewall.[2][20]

Wireless Communication for Laptops

Laptops with vPro include a gigabit network connection and support IEEE 802.11 a/g/n wireless protocols.[2][21][22]

Wireless Communication for Intel AMT

Intel vPro PCs support wireless communication to the AMT features.[2][22][21]

For wireless laptops on battery power, communication with AMT features can occur when the system is awake and connected to the corporate network. This communication is available if the OS is down or management agents are missing.[2][22]

AMT out-of-band communication and some AMT features are available for wireless or wired laptops connected to the corporate network over a host OS-based virtual private network (VPN) when laptops are awake and working properly.[2]

Encrypted Communication while Roaming

Intel vPro PCs support encrypted communication while roaming.[2][21][23]

vPro PCs version 4.0 or higher support security for mobile communications by establishing a secure tunnel for encrypted AMT communication with the managed service provider when roaming (operating on an open, wired LAN outside the corporate firewall).[2] Secure communication with AMT can be established if the laptop is powered down or the OS is disabled.[2] The AMT encrypted communication tunnel is designed to allow sys-admins to access a laptop or desktop PC at satellite offices where there is no on-site proxy server or management server appliance.

Secure communications outside the corporate firewall depends on adding a new element -- a management presence server (Intel calls this a “vPro-enabled gateway”) -- to the network infrastructure.[2] This will require integration with network switch manufacturers, firewall vendors, and vendors who design management consoles in order to create an infrastructure that supports encrypted roaming communication. So although encrypted roaming communication is enabled as a feature in vPro PCs version 4.0 and higher, the feature may not be fully useful (except in having a "ready" PC) until the infrastructure is functional.

Security and Intel vPro PCs

vPro security technologies and methodologies are designed into the PC’s chipset and other system hardware. Because the vPro security technologies are designed into system hardware instead of software, they are less vulnerable to hackers, computer viruses, computer worms, and other threats that typically affect an OS or software applications installed at the OS level (such as virus scan, antispyware, inventory, and other security or management applications).[2]

For example, during deployment of vPro PCs, security credentials, keys, and other critical information are stored in protected memory (not on the hard disk drive), and erased when no longer needed.

Intel vPro Security Concerns

This article: "Big Brother potentially exists right now in our PCs, compliments of Intel's vPro" [24] raises many potential security concerns for PC's with vPro. The fact that there is apparently no way to disable vPro on a PC along with the fact that most users cannot detect outside access to their PC via the vPro hardware based technology is a serious concern.

Intel vPro Security Features

Intel vPro supports industry-standard methodologies and protocols, as well as other vendors’ security features:[2][10][5][25]

Intel vPro Security Technologies and Methodologies

Intel vPro uses several industry-standard security technologies and methodologies to secure the remote vPro communication channel. These technologies and methodologies also improve security for accessing the PC’s critical system data, BIOS settings, Intel AMT management features, and other sensitive features or data; and protect security credentials and other critical information during deployment (setup and configuration of Intel AMT) and vPro use.[2][27]

Hardware requirements

The first release of Intel vPro was built with an Intel Core 2 Duo processor.[5] The current versions of Intel vPro are built into systems with 45 nm Intel Core 2 Duo or Quad processors, or Centrino 2 processors.

PCs with Intel vPro require specific chipsets. Intel vPro releases are usually identified by their AMT version.[2][5]

Hardware requirements for laptop PCs with Intel vPro

Laptops with Intel vPro require:

  • For Intel AMT release 4.1 (Intel Centrino 2 with vPro technology):[31]
    • 45nm Intel Core2 Duo processor T, P sequence 8400, 8600, 9400, 9500, 9600; small form factor P, L, U sequence 9300 and 9400, and Quad processor Q9100.
    • Mobile 45nm Intel GS45, GM47, GM45 and PM45 Express Chipsets (Montevina with Intel Anti-Theft Technology) with 1066 FSB, 6 MB L2 cache, ICH10M-enhanced.
  • For Intel AMT release 4.0 (Intel Centrino 2 with vPro technology):[2][6]
    • 45nm Intel Core2 Duo processor T, P sequence 8400, 8600, 9400, 9500, 9600; small form factor P, L, U sequence 9300 and 9400, and Quad processor Q9100.
    • Mobile 45nm Intel GS45, GM47, GM45 and PM45 Express Chipsets (Montevina) with 1066 FSB, 6 MB L2 cache, ICH9M-enhanced.
  • For Intel AMT release 2.5 and 2.6 (Intel Centrino with vPro technology):[5][32] [7]
    • Intel Core2 Duo processor T, L, and U 7000 sequence3, 45nm Intel Core2 Duo processor T8000 and T9000
    • Mobile Intel 965 (Broadwater-Q) Express Chipset with ICH8M-enhanced.

Note that AMT release 2.5 for wired/wireless laptops and AMT release 3.0 for dekstop PCs are concurrent releases.

Hardware requirements for desktop PCs with Intel vPro

Desktop PCs with vPro (called “Intel Core 2 with vPro technology”) require:

  • For AMT release 5.0:[33]
    • Intel Core2 Duo processor E8600, 8500, and E8400 ; 45nm Intel Core2 Quad processor Q9650, Q9550, and Q9400.
    • Intel Q45 (Eaglelake-Q) Express Chipset with ICH10DO.
  • For AMT release 3.0, 3.1, and 3.2:[2][5][6]
    • Intel Core2 Duo processor E6550, E6750, and E6850; 45nm Intel Core2 Duo processor E8500, E8400, E8300 and E8200; 45nm Intel Core2 Quad processor Q9550, Q9450 and Q9300.
    • Intel Q35 (Bearlake-Q) Express Chipset with ICH9DO.

Note that AMT release 2.5 for wired/wireless laptops and AMT release 3.0 for desktop PCs are concurrent releases.

  • For AMT release 2.0, 2.1 and 2.2:[5][7][32]
    • Intel Core 2 Duo processor E6300, E6400, E6600, and E6700.
    • Intel Q9655 (Averill) Express Chipset with ICH8DO.

See also

References

  1. ^ a b "Remote Pc Management with Intel's vPro". Tom's Hardware Guide. Retrieved 2007-11-21.
  2. ^ a b c d e f g h i j k l m n o p q r s t u v w x y z aa ab ac ad ae af ag ah ai aj ak al am an ao ap aq ar as at au "Intel Centrino 2 with vPro Technology and Intel Core2 Processor with vPro Technology" (PDF). Intel. Retrieved 2008-08-07. Cite error: The named reference "vPro-4-0+3-0WP" was defined multiple times with different content (see the help page).
  3. ^ a b "Measuring the Value of Intel Core2 Processor with vPro Technology in the Enterprise". Intel. 2006. Retrieved 2008-08-14.
  4. ^ a b "Intel Centrino 2 Explained". CNET. Retrieved 2008-07-15.
  5. ^ a b c d e f g h i j k l m n o p q r "Architecture Guide: Intel Active Management Technology". Intel. 2008-06-26. Retrieved 2008-08-12.
  6. ^ a b c "Intel vPro Chipset Lures MSPs, System Builders". ChannelWeb. Retrieved August 2007. {{cite web}}: Check date values in: |accessdate= (help)
  7. ^ a b c "Intel Mostly Launches Centrino 2 Notebook Platform". ChannelWeb. Retrieved July 2008. {{cite web}}: Check date values in: |accessdate= (help)
  8. ^ "A new dawn for remote management? A first glimpse at Intel's vPro platform". ars technica. Retrieved 2007-11-07.
  9. ^ "Intel Centrino 2 with vPro Technology". Intel. Retrieved 2008-06-30.
  10. ^ a b c d e f "New Intel vPro Processor Technology Fortifies Security for Business PCs (news release)". Intel. Retrieved 2007-08-07.
  11. ^ a b "Intel Trusted Execution Technology" (PDF). Intel. 2007. Retrieved 2008-07-15.
  12. ^ a b "Intel Trusted Execution Technology: A Primer". Intel. 2007-12-10. Retrieved 2008-08-17.
  13. ^ "Intel Software Network, engineer / developers forum". Intel. Retrieved 2008-08-09.
  14. ^ a b "Cisco Security Solutions with Intel Centrino Pro and Intel vPro Processor Technology" (PDF). Intel. {{cite web}}: Text "2007" ignored (help)
  15. ^ "The Benefits of Intel Centrino with vPro Technology in the Enterprise" (PDF). Wipro Technologies. Retrieved September 2007. {{cite web}}: Check date values in: |accessdate= (help)
  16. ^ "Execute Disable Bit and Enterprise Security". Intel. Retrieved 2008-08-10.
  17. ^ "High Performance, Enhanced Security". Intel. Retrieved 2008. {{cite web}}: Check date values in: |accessdate= (help)
  18. ^ "Windows Vista on PCs with Intel Centrino Pro or Intel vPro Processor Technology" (PDF). Intel. Retrieved 2007. {{cite web}}: Check date values in: |accessdate= (help)
  19. ^ "A new dawn for remote management? A first glimpse at Intel's vPro platform". ars technica. Retrieved 2007-07-26.
  20. ^ "Understanding Intel AMT over wired vs. wireless (video)". Intel. Retrieved 2008-08-14.
  21. ^ a b c "New Intel-Based Laptops Advance All Facets of Notebook PCs". Intel. Retrieved 2008-07-15.
  22. ^ a b c "Understanding Intel AMT over wired vs. wireless (video)". Intel. Retrieved 2008-08-14.
  23. ^ "Intel Active Management Technology Setup and Configuration Service, Version 5.0" (PDF). Intel. Retrieved 2008-08-04.(see CIRA configuration discussion)
  24. ^ http://www.tgdaily.com/content/view/39455/128/
  25. ^ "Intel vPro Technology". Intel. Retrieved 2008-07-14.
  26. ^ "Intel Software Network, engineer / developers forum". Intel. Retrieved 2008-08-09.
  27. ^ "Intel Active Management Technology Setup and Configuration Service Installation and User Manual" (PDF). Intel. Retrieved 2008-07-14.
  28. ^ "Advanced Encryption Standard (AES) Instructions Set". Intel. Retrieved 2008-08-05.
  29. ^ a b "Hardening Measures Built into Intel Active Management Technology". Intel. 2007-12-10. Retrieved 2008-08-01.
  30. ^ "Intel vPro Technology FAQ". Intel. Retrieved 2008-07-12.
  31. ^ "New Intel Centrino Atom Processor Technology Ushers in 'Best Internet Experience in Your Pocket'". Intel. 2008-04-02. Retrieved 2008-08-07.
  32. ^ a b "Intel Centrino Pro and Intel vPro Processor Technology" (PDF). Intel. 2007. Retrieved 2008-08-07.
  33. ^ "Gelsinger Speaks To Intel And High-Tech Industry's Rapid Technology Cadence". Intel. 2007-09-18. Retrieved 2008-08-16.

External links

Retrieved from "https://en.wikipedia.org/w/index.php?title=Intel_vPro&oldid=333296280"