Microsoft’s Palladium:  What Is It?

Recently there has been quite a bit of discussion on the net about Microsoft’s proposed Palladium architecture, a set of hardware and software features which Microsoft and Intel (and AMD) intend to jointly add to future versions of the Windows operating system, probably in the 2004-5 timeframe.

Think about the furor this way:

It is possible to make computers more secure by a combination of hardware and software that identifies and authenticates machines to one another (not applications, data, or individuals) and prevents connections or transmissions that the enabled policy rules don’t allow. That’s Palladium.

Much of the furor is about Microsoft (or Intel or another big software or content company)

1. Controlling what may come onto your computer, rejecting anything that doesn’t fit its definition of trustworthy.  (In fact, Palladium itself doesn’t know what’s in the transmission.)

2. Authenticating individuals by having access to detailed personal information.  (Palladium is doing machine authentication, not user authentication.)

We spoke to Peter Biddle, Microsoft’s Product Unit Manager for Palladium about it today (July 3^rd).

He assured us that Palladium is not about user authentication, but rather about machine authentication.  It is certainly true that the Palladium platform which Microsoft will supply could be an enabler for applications that performed user authentication or digital rights management, but that’s not in Palladium.  Microsoft assumes that both they and other developers will both provide such applications, making use of functions in the Palladium platform.

Palladium has as its core the Trusted Operating Root (TOR), which manages memory, provides a trust model, and a security model.  The TOR is surrounded by a set of services with open APIs.  Think of it as less than what Microsoft provides today, not more, Biddle says.  This TOR will be published as open source, together with its API’s, for both inspection and third party development.  The idea is that anyone can write code for this environment. 

He agrees there’s a lot of education to be done here since we are in the midst of moving from a desktop computing (PC) paradigm to a web-based computing paradigm, and lots of rules, including how we decide how to share information, need to change.  Biddle noted that Microsoft is moving “from a deficit position with regard to trust” and that to get the word out on Palladium, which has really just begun, they must speak to the press, pundits, influencers, and customers.

But many commentators are concerned that Microsoft could use Palladium to exert monopoly control over the kind of software that would be written (much as they set the rules for the Windows environment today).  Others fear that entertainment owners (music and movie companies, especially) will use Palladium as a platform to exercise Digital Rights Management (DRM). 

Biddle is quick to point out that Palladium itself does not include DRM but that, of course, it can serve as a platform for enforcing DRM.  Perhaps because Biddle and his team originally worked in the DVD DRM area for Microsoft, there has been a natural assumption here.  In fact, Biddle claimed, Palladium would be happy to enable multiple DRM schemes simultaneously, so that Disney could protect its IP while, at the same time, a computer was running a Kazaa-type system and purchasing or distributing free (Biddle refers to it as “pirated”) content.

If you want to have the background information for this discussion, you might like to start with Microsoft’s own position paper, Q&A: Microsoft Seeks Industry-Wide Collaboration for "Palladium" Initiative at http://www.microsoft.com/presspass/features/2002/jul02/07-01palladium.asp. 

Then you might like to go on and read some industry comments.

We’d suggest you might want to look at Steve Levy’s column on Palladium in Newsweek, available at http://www.msnbc.com/news/770511.asp

and The Register’s very different opinions at http://www.theregister.co.uk/content/4/25940.html and http://www.theregister.co.uk/content/3/25892.html.

We’ve also written a bit about Palladium, prior to the Microsoft Q&A surfacing, at http://amywohl.weblogger.com/discuss/msgReader$87?mode=topic&y=2002&m=6&d=29 and  http://amywohl.weblogger.com/discuss/msgReader$88?mode=topic&y=2002&m=6&d=29.

Your comments on Palladium are invited.

(back to top)