The Microsoft Pluton processor
Microsoft very recently officially announced the new Microsoft Pluton Processor in Microsoft security blog.
Pluton is a Microsoft-designed security subsystem that implements a hardware-based root of trust for various Microsoft services. It includes a security processor core, cryptographic engines, a hardware random number generator, public/private key generation, asymmetric and symmetric encryption, support for elliptic curve digital signature algorithm (ECDSA) verification for secured boot, and measured boot in silicon to support remote attestation with a cloud service, and various tampering counter-measures.
Microsoft Pluton has been applied to many Microsoft Azure-based offerings already, including the Azure Sphere service. Azure Sphere is a secured, high-level application platform with built-in communication and security features for internet-connected devices. The platform consists of the integration of hardware built around a secured silicon chip; the Azure Sphere OS (operating system), a custom high-level Linux-based operating system; and the Azure Sphere Security Service, a cloud-based security service that provides continuous, renewable security. Azure Sphere security was designed based on Microsoft Research’s position on the seven properties required of highly secure devices.
Another example where Microsoft Pluton has been applied are the so called Secured-core PCs. To combat threats specifically targeted at the firmware and operating system levels, we’re announcing a new initiative we’ve been working on with partners to design what we call Secured-core PCs. These devices, created in partnership with our PC manufacturing and silicon partners, meet a specific set of device requirements that apply the security best practices of isolation and minimal trust to the firmware layer, or the device core, that underpins the Windows operating system. These devices are designed specifically for industries like financial services, government and healthcare, and for workers that handle highly-sensitive IP, customer or personal data, including PII as these are higher value targets for nation-state attackers.
A list of available secure-cored PCs can be found in the following article: https://www.microsoft.com/en-us/windowsforbusiness/windows10-secured-core-computers.
The Pluton security processor complements work Microsoft has done with the community, including Project Cerberus, by providing a secure identity for the CPU that can be attested by Cerberus, thus enhancing the security of the overall platform.
One of the other major security problems solved by Pluton is keeping the system firmware up to date across the entire PC ecosystem. Today customers receive updates to their security firmware from a variety of different sources than can be difficult to manage, resulting in widespread patching issues. Pluton provides a flexible, updateable platform for running firmware that implements end-to-end security functionality authored, maintained, and updated by Microsoft. Pluton for Windows computers will be integrated with the Windows Update process in the same way that the Azure Sphere Security Service connects to IoT devices.
With Microsoft Pluton, the trusted platform module (TPM) security is promoted to new levels, as described in the following Intel article: https://itpeernetwork.intel.com/intel-and-microsoft-plan-to-deliver-next-generation-advancements-in-security/#gs.m70ve0
Microsoft announced Microsoft PlutonOpens in a new window with a mission to collaborate with partners like Intel to help guard against physical attacks, prevent the discovery of keys, and provide the ability to update systems more efficiently. Intel plans to partner with Microsoft to build these significant advancements in security into our client CPUs in future platforms. The collaboration initially aims to bring noteworthy evolution to TPM’s – with alignment between the companies to bring the Microsoft Pluton vision to life and advance the state of security.
