Microsoft Modifying Palladium

Microsoft Corp. is in the process of reworking some of the pieces of its much-publicized and oft-criticized Next Generation Secure Computing Base technology in response to feedback from both partners and potential customers. The company is working to tweak the APIs to make it easier for other software makers to write compatible applications for the platform.

But what Microsoft is not doing is killing off the NGSCB initiative, formerly known as Palladium. Company officials said that a published report that Microsoft has decided to do away with the hardware and software security project was completely inaccurate.

/zimages/4/28571.gifFor more on NGSCB, read“Microsoft: Palladium Is Still Alive and Kicking.”

“Were evolving it to broaden the technologys applicability. We still believe in the principle of hardware and software security working together,” said Mario Juarez, a product manager in the Security and Technology Business Unit at Microsoft, based in Redmond, Wash. “We still see the fundamental architecture looking the same, but its evolving.”

NGSCB is the catch-all term for a set of hardware and software technologies—some developed at Microsoft, others created by partners—designed to improve the security of the basic PC platform. The concept hinges on the idea of creating a separate operating environment within a normal operating system, in which trusted applications and services run. This is done through the use of a custom OS kernel called the Nexus, which will only run software components that it has been able to verify as authentic and safe.

NGSCB also will include a component that creates a separate, sealed storage area to house cryptographic keys.

All of this obviously requires some modifications to applications that vendors want to run in the trusted operating environment. In fact, Microsofts original plans for NGSCB would have forced a lot of software vendors to contemplate major overhauls of their applications to ensure compatibility with the technology. Some vendors balked at this and asked Microsoft to modify the plan to make it easier for their products to tap into the advanced security features of NGSCB.

/zimages/4/28571.gifFor insights on security coverage around the Web, check out eWEEK.com Security Center Editor Larry Seltzers Weblog.

“A lot of the feedback had a common theme. Every customer said they were happy to see industry leaders working together on security, but it would be great if that technology were available in a fashion that didnt require them to do so much work,” Juarez said. “We set a pretty high bar for entry. We initially required a lot of application rewrite.”

Microsoft now is concentrating on refining the API set to make life simpler for its partners.

Juarez also stressed that NGSCB is a long-term project with a number of hurdles to cross in the coming years, but it is still on track to be included in Longhorn, the next release of Windows, due in 2006.

/zimages/4/28571.gifCheck outeWEEK.coms Windows Centerat http://windows.eweek.com for Microsoft and Windows news, views and analysis.
Be sure to add our eWEEK.com Windows news feed to your RSS newsreader or My Yahoo page:http://us.i1.yimg.com/us.yimg.com/i/us/my/addtomyyahoo2.gif