The Register Home Page

back to article Europe built sovereign clouds to escape US control. Then forgot about the processors

Can digital sovereignty exist on American silicon? Europe is pouring more than €2 billion into sovereign cloud initiatives designed to reduce exposure to US legal reach. The EU's IPCEI-CIS program funds infrastructure development. France qualifies operators under SecNumCloud, a framework with nearly 1,200 technical …

  1. williamyf Silver badge

    If Europe wants fully European X-86-64 chips for cloud that they can completely control, the only way forward is to outright buy VIA Technologies to gain access to the Centaur's X-86-64 license (and related IP to jumpstart the effort), and invest a shit-ton of money to bring those chips on par with Intel's and AMD server offerings (right now, they perform as midrange desktops and laptops).

    ¿Wanna go to ARM? You still have the same problem. You have ARM's TrustZone, or, if you go to other vendors, you have ARM's SecureCore, QualComm's SPU or Google's Titan M2. You will have to design your Chip froms scratch if you want those out, or those in, but under your full control, oh, and the IP is British/Japan controlled.

    ¿Wanna go MIPS? The IP is America controlled (again), the only of-the-shelf server chips are chinese (Loongson), and also have OmniShield, and Chips by Broadcom and cavium (for appliances) have an Isolated microcontroler built "on chip" without a fancy name. Or, you can license the IP from GloFo, and design your own.

    ¿And RISC-V? While a nice architecture (is a close relative of MIPS, after all), is still not ready for primetime at the cloud and server land... No doubt someday it will be ready for server/datacenter/cloud (after all, MIPS was/is), but not today, not in the short or even medium term.

    Your best Bet would be something in the OpenPower Architecture, or the OpenSparc architecture, as, while those architectures do have controllers similar to the CSME and PSP, they DO NOT treat them like black Boxes.

    At some point, unless you want to make the chips yourself, you will have to trust someone, because everyone has a management engine. Is a necesity both in desktop (to store passwords of clueless users) and Cloud (to store stuff that one tenant does not want the other tenants or even the cloud operator to know).

    The trick is to decide who do you trust more. ¿The American Intel and AMD? ¿The Chinese MIPS server Chips (LoongSon)? ¿The British Server Chips (ARM AGI CPU)? ¿The more open but american controlled OpenPower and OpenSparc Ready Made Chips?

    If none of them, then get cracking, find a best of breed Fully European µprocessor design dream team, License some IP, and get cracking on your own µProcessors.... Good luck with that.

    1. Henry Wertz 1 Gold badge

      ARM

      An excellent assessment. Not sure the ARM situation is quite that hopeless, though, ARM is reconfigurable and I think one could just build one without SecuCore or TrustZone (admiteddly you then still have the issue that you are having to fab your own chips.)

      1. martinusher Silver badge

        Re: ARM

        >you are having to fab your own chips.

        America doesn't fab chips but acts as if it has a monopoly on fabs through its extra-territorial control over European and Japanese manufacturers. Its possible that if the Europeans grew a pair and told the US that they'd facilitate overseas fabs (read that as "Chinese") unless the US got a bit less controlling then there should be room for compromise. Semiconductor design and fabrication is a global enterprise, it long ceased to be a US monopoly. It might even benefit the US long term because its primarily relying on its leadership from decades ago and not really putting in the work for newer architectures, relying on its bureaucracy and financial muscle (and compliant / subservient governments) to maintain its position. This is going to last precisely as long as it takes the Chinese to overhaul us (which they will do -- its not a matter of 'if' but 'when').

    2. Dan 55 Silver badge

      There's that saying about not letting perfect be the enemy of good.

      Intel CPUs can have the HAP bit set so that ME becomes inoperative after boot. All that really has to be done is for EU government, infrastructure, academic, and cloud service provider buyers to only buy PC hardware with ME disabled and have a way of testing that it is really disabled. Maybe the the free market will provide (Dell can already supply some servers with the HAP bit set, other suppliers make disabling ME a BIOS option) or maybe it will need some law, but it's not an impossible task. It's just ensuring that a specific piece of software is used in the EU and it's been done before for browser choice screens on PCs and mobiles, Windows 10 security updates, and so on.

      1. andy the pessimist Bronze badge

        This method is generally usrd to diagnose/fix design defects. Not for the faint of heart.

        Remove the thick oxide protecting the die. Use a laser to cut tracks. FIB can be used to deposit moderate resistivity tracks.

        You could wire HAP to gnd or vdd.

        The lifetime after this process isn't good. You will find out what is possible. Is the device supposef to operate with no IME?

        Generally only done in a failure analysis lab.

      2. Anonymous Coward
        Anonymous Coward

        Hap does not disable the me, it should disable some of the me services, but the me it self is needed for basic host functionality

      3. Stuart Castle

        The problem with that is in a data Center, you may need something like ME to manage a machine even if it is running. Bear in mind a data Center may have hundreds if not thousand of servers, so it might not be viable to have a human visit every single machine.

        1. rg287 Silver badge

          The problem with that is in a data Center, you may need something like ME to manage a machine even if it is running. Bear in mind a data Center may have hundreds if not thousand of servers, so it might not be viable to have a human visit every single machine.

          In a data centre, that's the point of out-of-band management like iDRAC and iLO, which can perform reboots, provide remote console and poke around the hardware including power control - but has it's own NIC and sits on an out-of-band network which (in a DC) should probably be air-gapped from the internet.

          IME/PSP is of more use in client devices where it can integrate with vPro Fleet Services and MS InTune.

          ME/PSP can provide IP KVM and other niceties, but in a data centre, you arguably don't need them (except that these days they do more than just management, and are integrated with pre-boot integrity/TPM type roles, so Intel/AMD would have to rearchitect elements of their chips to do away with them entirely). It would make the sovereignty issue cleaner if Xeon/Epyc chips just came without, with management done via a discrete OOB board on it's own network.

    3. Groo The Wanderer - A Canuck Silver badge

      I think a lot of people are going to be in shock as to just how quickly RISC-V swamps the market; they're making a lot faster progress to faster/better processors than you seem to realize. Are they "equivalent" to Intel/AMD/Arm? No, and they don't have to be, because they cost a fraction of the price and thanks to multi-chip servers being the norm nowadays, you just gang up a shitload of them on the problem at hand.

      Plus if you want to design a system with your own security infrastructure, you can do that with the spec blueprints for RISC-V processors that are out there and have your own custom silicon produced. You can't really do that with any of the other CPU architectures without paying someone through the nose.

      1. williamyf Silver badge

        «You can't really do that with any of the other CPU architectures without paying someone through the nose.»

        Just a small correction: OpenPower and OpenSparc do not charge money for the IP.

        ARM and MIPS do charge money for their IP

        X86-64 is a closed club with only 3 members, and 2 satellite players inducted by two of the members. Buying the satellites will do you no good, so you need to buy One of the Three main ones, the cheapest being VIA technologies

        1. Groo The Wanderer - A Canuck Silver badge

          I didn't even realize OpenPower and OpenSparc were still around. I thought, much like the RedHat acquisition, IBM had subsumed the Power architecture into the gaping corporate maw...

          OpenSparc I can see being viable, save for the fact that it seems to be a dying architecture that is losing support rather than gaining it.

      2. KSM-AZ

        Risc-V will not be dramatically less expensive than the competition.

        Not happening. In fact Risc-V is currently more expensive not less. Somehow you think the cost of a chip is primarily around the IP of the instruction set. This is silly because if it were true AMD or ARM would be dramatically less expensive ("A Fraction of the price") than INTEL, but it's not. It costs money to Fab chips. The cost of the IP inside is a relatively low percentage of the overall cost.

    4. elsergiovolador Silver badge

      Architecture is the trivial part. A working ISA and a reference microarchitecture is something a competent group of postgraduates can produce in twelve to eighteen months. RISC-V has demonstrated this several times over. The hard problem starts the moment you want that design realised in silicon that runs at multi-GHz, hits competitive perf/watt, and yields at acceptable rates. That is a 15-to-25 year industrial project, not an engineering project, and nobody in the European policy class is treating it as such.

      Look at the actual supply chain. ASML ships the lithography, Zeiss does the optics, Trumpf does the lasers, so the EU owns the most jealously guarded link in the chain. Then count what has to arrive at the fab loading dock alongside the scanner: photoresists from JSR, TOK, Shin-Etsu (Japan, near-monopoly at EUV-grade); ABF substrates from Ajinomoto (single-sourced, Japan); silicon wafers split between Japan, Taiwan and Korea, with Siltronic in Germany as a partial European foothold; deposition and etch tools from Applied Materials, Lam, TEL; metrology from KLA; test from Advantest and Teradyne; EDA from Synopsys, Cadence and Siemens EDA (the last is nominally German but the engineering and tool chain sit in Texas). High-purity gases and specialty chemicals are one area where BASF, Merck, Linde and Air Liquide are genuinely strong. Almost everything else in the bill of materials is American or Japanese, with Korea and Taiwan filling in the rest. You cannot build a 5nm-class fab on European soil today without permission from at least three foreign governments, and that permission is conditional on each of those governments not having a worse week geopolitically than you do.

      The TSMC Hsinchu and Tainan clusters did not happen by accident, and neither did Silicon Valley before them. Geographic co-location of fabs, gas plants, chemical suppliers, mask shops, packaging houses and test floors compresses iteration loops from weeks to hours, lets tacit process knowledge diffuse through job mobility, and means engineers can physically walk over to a supplier to diagnose a yield excursion. The EU response so far has been to drop individual fabs into politically convenient locations: Intel Magdeburg (now stalled), ESMC Dresden, a smattering of STMicro and GF capacity in Crolles. That is a press-release strategy, not an industrial one. The correct unit of planning is a semiconductor city: a designated region with multiple fabs, on-site gas separation, chemical synthesis, wafer reclaim, mask writing, packaging and test, with housing and a couple of polytechnics tuned to feed it. Build two or three of them in different member states, not one, so process knowledge competes and diffuses, and so a single fire or flood does not take out the continent (see the 2021 Renesas fire and the Texas freeze for what single-site dependency actually costs). Different states can take different segments of the chain before sustainability: Germany already leads on chemicals and optics, the Netherlands on lithography, Belgium on research via IMEC, France on materials and on the STMicro design base, Italy and Ireland on packaging and assembly. The Chips Act spreads €43bn like jam across a slice of bread, when what it needs is to be poured into two or three industrial clusters and left there for thirty years.

      Yield is the other thing the policy papers do not mention. A new process node typically starts at 30 to 50 per cent yield and takes two to four years of relentless line-side engineering to reach the 80 to 90 per cent needed for economic production. That learning is institutional, embedded in thousands of process engineers, equipment technicians and integration leads, and it does not transfer in a PowerPoint. TSMC's lead over everyone else comes from yield engineering culture accumulated since 1987, not from any single piece of kit on the floor. Replicating that is the actual problem. Buying ASML tools is the easy bit.

      In the meantime, a sovereign architecture absolutely can run, today, on FPGA fabric. Xilinx and Altera silicon is still American, so this does not close the underlying gap, but it decouples "who designs and audits the chip" from "who fabricates it" while the latter is being built. Performance will be five to ten times off an ASIC at the same node, worse for memory-heavy workloads, but for sovereignty-critical use cases (HSMs, root-of-trust controllers, regulator-grade compute, certain classified workloads) that gap is tolerable. It also gives you a working software stack, verification flow and toolchain that ports onto your own silicon the day it ships, which is the asset an ISA-only programme cannot produce on its own.

      The reason none of this gets discussed properly is that it is a 15 to 25 year programme requiring co-ordinated industrial policy across a dozen member states, sustained capital allocation through six or seven political cycles, and public acceptance that the continent will not be competitive on leading-edge logic for at least a decade after starting. That is unsellable in a five-year electoral window, so instead we get "European RISC-V initiative" launches and call it strategic autonomy. Picking an ISA is the part of the problem you do when you have run out of useful things to argue about.

      1. Groo The Wanderer - A Canuck Silver badge

        Things seem to be getting a little unsettled between China and Taiwan now that Trump got involved in the situation. Can he not even pay a state trade visit without causing problems in the world?

        Trump has as much as said they won't abide by their promise to protect Taiwan, so that entire fab region is now at China's mercy.

    5. Sunset

      Re: ARM, that's a bad comparison; Trustzone is an architectural feature for creating secure enclaves, but as long as you're running your own firmware in your own system, you control what runs in that enclave. That's not true of an Intel processor, where the ME secure firmware is entirely proprietary to Intel itself, unmodifiable, and largely undocumented - and, due to enforced digital signature requirements, cannot be replaced.

    6. Tubz

      Agree, buy an x licence or just dump it an go all in on open RISC-V, GlobalFoundries has the experience to lead the way.

      While your at, what the support chips etc and the gpu (Imagination Technologies PowerVR buy it back from Chinese), should Europe not control the whole platform ?

  2. Phil Koenig

    VPN?

    Why not just tunnel all user level traffic through a strong VPN using pinned certs and then set your gateways/VPN endpoints to flag/reject any traffic that is not part of that VPN?

    The management engine may be able to adopt IP's and MAC's in use on the user network ports but that doesn't mean that they can also magically insert their traffic into your encrypted VPN traffic unless they've already infiltrated/corrupted your OS as well..

    1. james 68

      Re: VPN?

      Latency springs to mind, though if the choice is security or waiting a few fractions of a second for data I would choose the latency, large scale providers may see things differently. Add to that the VPN itself must run on some brand of presumably compromised silicon and I guess the point may be moot.

      1. Phil Koenig

        Re: VPN?

        Oh certainly there would be some performance hit.

        But it just didn't seem like such an impossible thing to solve as the article implies.

        Perhaps cloud providers can offer this sort of thing with a bit of a premium as their "anti-3-letter-agency package"... ;-)

    2. Paul Crawford Silver badge

      Re: VPN?

      Maybe better still, have your own separate NIC that is on open/trusted silicon?

      That way the ME has to pass via the OS, or call the NIC separately, and a bit of OS stack logging & NIC output monitoring (even just something simple like a hash/CRC of all traffic between certain check points) could be done on a few examples to see if such non-OS activity was really taking place.

    3. Anonymous Coward
      Anonymous Coward

      Re: VPN?

      You're overlooking the giants in the corners.

      Who made your switches and can you trust them?

      Who made your firewalls and can you trust them?

      If the same team creates a hack for Intel's ME and also creates a hack for Cisco's One ASIC, how are you going to determine that either hack happened? You can monitor the physical connections with an implant, but you can't trust it either because it will have been similarly hacked.

      It this possible? Yes.

      Is this likely? Maybe.

      Is there anything you can do about it? Yes. Start from a blank paper and don't hire any experts, create them yourself. This will not be fast; nor will it be easy; nor will it be cheap.

      Personally, I cannot think of solution to this issue that won't get you, at best, tried for warcrimes, or more likely, nuked, because if you do it right, no current or former government (every goverment) intelligence agency employees will be left alive, and their computers etc. disolved in acid.

      Posting anonymously for the hell of it because one of the jokes I used to tell, many decades ago, was:

      Do you know how to apply for a job at the NSA?

      Call your grandmother and ask her for an application.

      Also, Aurélien Francillon sounds like someone who's continued employment requires him to not understand.

      1. Doctor Syntax Silver badge

        Re: VPN?

        ""Who made your switches and can you trust them?

        Who made your firewalls and can you trust them?"

        Siemens, maybe.

        1. razorfishsl

          Re: VPN?

          it's not down to who made the {insert badge name here}, it's who made the chips.

      2. Groo The Wanderer - A Canuck Silver badge

        Re: VPN?

        Trust? Who said anything about trusting your providers?

        Any government with a significant tech footprint and a government penchant for surveillance and monitoring is likely to have mandated backdoored products en masse under their nation's "national security" framework, prohibiting the vendors from mentioning it.

        Everyone is overlooking the "Five Eyes" agreement, though, which sees NSA-style monitoring hardware at the partner nation's telco and ISP connection points that feed into the 5-eyes shared surveillance network. Conveniently enough, there is nothing to prevent the US from telling Canada about a "Canadian of concern" and providing a security dossier that CISA itself is forbidden from collecting (not allowed to surveil citizens without an existing warrant, which requires more than annoying politicians.)

        The same goes with Canada providing the US with a dossier on some US citizen whose communications stray across the border. What a shock, then, that there are so many crossing points for internet traffic, and so many cross-border providers of various technologies. Even when dealing with a Canadian owned and operated ISP, they had contracted out their email provisioning to an American firm, so all my email automatically crossed the surveillance border, as did any other Canadian citizen in Saskatchewan using SaskTel as their ISP.

        No, the question isn't "if they can/are monitoring", the question is are you a threat? No matter how loud mouthed I and much of the public may be, we're no threat to anything but our own blood pressure. :)

    4. Sitaram Chamarty

      Re: VPN?

      Everything I have ever read on this topic indicates that even a common TLS offload/load balancer setup will make it very difficult. Assumptions:

      (1) The external facing systems (load balancers) don't have local secrets, other than required for TLS offload. (2) The internal system is the one "at risk", but it has network restrictions -- it can only talk to the front-end systems, on a specific port, and plain text (no TLS, because otherwise what's the point of TLS offload?)

      All this is fairly typical -- nothing new here. But in the context of this article, it raises the bar enormously. Specifically, the ME in the "at risk" system would have to send *instructions* (not just *data*) to the ME in one of the front-ends, *asking it to relay on its behalf, and specifying the destination*.

      And remember the traffic between these systems is expected to be in plain text, so this will be discovered pretty quick.

      1. Anonymous Coward
        Anonymous Coward

        Re: VPN?

        Every intelligent load balancer has the certificates and keys for every web service for which its providing services. If your load balancer gets hacked, your certificates can no longer be trusted and having them reissued is the first thing you should do after reflashing your load balancers.

        Why would you expect a hacked ME to send clear text transmissions?

        1. Havin_it

          Re: VPN?

          I believe what was meant was that in this setup, the client device is only allowed to do plaintext comms with the edge device, so if their MEs start chatting, the use of encryption will make it stick out like a sore thumb.

    5. Lipdorn

      Re: VPN?

      "...unless they've already infiltrated/corrupted your OS as well...'

      That is the point is it not? The ME is has lower level access than the OS. Presumably, that means it has full access to any secure enclave on the processor it self. Thus, it can see any encryption, authentication keys and use that to verify its own traffic.

      Though I suppose they'll need more information on one's specific setup to be able to breach that.

    6. BenjaminEdelman

      Re: VPN?

      You could audit VPN traffic by controlling and monitoring the VPN server. That probably wouldn't be of much use, according to the article "A laptop that appears off, in a bag, can associate with a hostile network the user has no knowledge of." That might be a conventional WiFi network, it might be an Unlicensed National Information Infrastructure band one (U-NII-1) network. Check your spectrum analyzer, U-NII-1 is everywhere.

      1. Phil Koenig

        Re: VPN?

        That might be a conventional WiFi network, it might be an Unlicensed National Information Infrastructure band one (U-NII-1) network. Check your spectrum analyzer, U-NII-1 is everywhere.

        Most of the BMC's I've used are pretty weak in terms of computing power, so I'd wager that their ability to capture and analyze a significant amount of data is pretty weak.(If they indeed have a way to silently bridge into the primary CPU/memory/NICs etc. Which already seems a little far-fetched considering the analysis they would have to do to even figure out what to transmit. They're certainly not going to just bridge the entire data stream of multiple 10G+ ports over some random public wireless link, along with who-knows-how-many-other similiarly trojaned servers in each data center)

        But beyond that, do you really think it's realistic that 1) the NSA is going to demand that a radio is installed alongside the traditional BMC/ME on every single server sold, 2) with an antenna strong enough to find/transmit signal in an environment with 1000's of very powerful computers nearby (which in the USA have relaxed RF emission environments already because the equipment is considered "commercial" rather than "residential") and 3) if the RF hash environment isn't enough, you're already inside a thick metal enclosure trapped with the emissions of your particular 42U rack neighborhood?

        The scenario where there is "cooperation" between a trojaned server and a datacenter full of trojaned network components verges on science fiction. It's not like it's the Mossad modifying a few devices to target a particular nuclear research facility in Iran that they have very detailed technical knowledge of - the assumption is that all these trojaned pieces of hardware are basically getting shipped all over the world and somehow *magically* they will find a trojaned "partner" network device to complete the hack is just a little bit too far-fetched to me.

        Especially considering the fact that eventually someone with a packet-sniffer etc will figure out what is going on here (after all, we're talking about trojaning 100's of thousands if not millions of devices that are being shipped all over the world), and then you have the scandal-of-scandals on your hands, which will literally destroy the reputation of any company who allowed that stuff to be embedded in their products, literally eviscerating the domestic server/network hardware industry.

  3. Anonymous Coward
    Anonymous Coward

    Didn't get past the headings, sorry…

    The EU is putting time, effort and money into sovereign sillicon. Barcelona BSC - for one - is taping out at the moment.

    https://www.eetimes.com/barcelona-bsc-celebrates-tape-out-of-cinco-ranch-chips/

    1. andyprough

      Re: Didn't get past the headings, sorry…

      Barcelona BSC - partially funded by Intel and manufactured by Intel, according to the article you linked. Maybe you should have gotten past the headings?

      1. Anonymous Coward
        Anonymous Coward

        Re: Didn't get past the headings, sorry…

        EU design based on an open standard ISA.

        The EU hasn't "forgotten" about the sovereignty of the processor. Does the EU need a fab that can produce 3nm chips? That's another question.

  4. rgjnk
    Flame

    That's a lot of words

    Amazing amount of guesswork though.

    None of this is stuff that can't be mitigated, usually fairly easily. It's in the same realm as other threats that have existed forever.

    Also - and this might gave escaped some - the security implementation on government sovereign bit barns involves some of same people who do nation state security on other things (or sell the tech to the nation states) so they have some clue about management engines and other potential issues, and how to mitigate them.

    Maybe it's just not that obvious to people from a more commercial or academic background how things have been done, at least if they weren't the ones involved.

    Obviously this is a hot topic to someone as it's the second massively long story I've seen on here about sovereign clouds and the other was high on opinion and short on fact too.

    1. Glen 1

      Re: That's a lot of words

      Yeah, the amount of repetition in the first few paragraphs is giving AI vibes - or at least someone padding to hit a word count.

      Maybe I've become too cynical.

  5. TeeCee Gold badge
    Facepalm

    ...promising "immunity from extraterritorial laws."

    While still trying to screw American companies for not censoring their output to European standards, in defiance of their first amendment rights?

    This all looks like a monumentally expensive excuse for the Pot to call the Kettle black.

    1. Paul Crawford Silver badge

      screw American companies companies operating in the EU for not censoring their output to European standards

      Do you see how your comment does not make any sense?

      1. Doctor Syntax Silver badge

        "Do you see how your comment does not make any sense?"

        Given that OP hasn't actually got as far as reading and understanding what it's about, probably "no".

    2. This post has been deleted by its author

    3. Sitaram Chamarty

      1st amendment?

      That "first amendment" you speak of, prevents the **US government** from censoring you. Why would it have any effect outside the US?

      1. FirstTangoInParis Silver badge

        Re: 1st amendment?

        Perhaps you’ve not noticed that the current US administration seems to regard the entire US legal system as something of an interesting plaything rather than how they should govern?

    4. Anonymous Coward
      Anonymous Coward

      Oh for fuck sake. At least try to not be so ignorant

  6. andyprough

    This is rich irony

    After years of laughing at Richard Stallman and the Free Software Foundation for using their ancient, crusty pre-IME Thinkpads and screaming about the dangers of IME and PSP, suddenly NOW the world is going to wake up to the dangers?

    Excuse me while I chuckle. And if you want a modern machine where you can disable IME with the flip of a Coreboot setting, get a laptop from NovaCustom in the Netherlands. It's all I use, and they work incredibly well. You're welcome.

    1. Anonymous Coward
      Anonymous Coward

      Re: This is rich irony

      Do they also make all of the other devices on your network at home, including your ISP's modem, and pedestal and central office hardware?

      See my post about getting nuked, above.

    2. Valheru

      Re: This is rich irony

      Well Said Andy,

      In an even wider view, the timing is hilarious as American Defense companies are flush with a multi-year backlog of EU orders for "European Military mission systems" in the Billions of euros. I wonder how secure from American influence these solutions will be...

  7. NewThought

    Intel And AMD Must Provide A Kill Switch

    Looks simple: enact a law forcing suppliers who sell to "Sovereign Clouds" to provide a kill switch for built-in hardware subsystems, such as Intel’s Management Engine (ME) and AMD’s Platform Security Processor (PSP).

    1. Anonymous Coward
      Anonymous Coward

      Re: Intel And AMD Must Provide A Kill Switch

      Perhaps spending a little more time thinking about what you just said. The companies that can't tell you they're embedding NSA tech in your chips is going to trusted to disable the tech that you do know about? You're naive.

  8. M.V. Lipvig Silver badge

    Interesting...

    So the phone call is coming from inside the house. Yup, you want true sovereignity, you've gotta dig your own sand.

  9. Anonymous Coward
    Anonymous Coward

    I am Recalling ...

    ... that Dell made a business-class laptop -- one of the Latitudes? I don't remember the model number -- that I had to evaluate at work.

    .

    It had an interesting feature: a CPU, separate from the main CPU, which had both low power consumption and low computational speed.

    The concept was that an executive could press a button which would boot the little CPU, which would boot extremely-quickly, and had just enough power to let the user surf the web or check their email.

    I never could get the little CPU to visibly-boot, even though I had applied all Dell's updates; none of the multiple Dell techs I spoke with could get this feature to work.

    I now wonder: did this feature try (and fail) to use the IME CPU to execute a web browser and email client?

    1. Martin an gof Silver badge

      Re: I am Recalling ...

      I remember that. As I recall, it booted into an entirely separate OS, somewhat like a TV set top box. Was probably based around an early ARM, might even have used a customised RiscOS (didn't Pace use RO for STBs?) which'd be why I remenber.

      M.

    2. jn5250

      Re: I am Recalling ...

      My suggestion would have been to install a dual-boot Linux instance. The person would not have had time to get coffee before mail/web was ready.

    3. Anonymous Coward
      Anonymous Coward

      Re: I am Recalling ...

      It wasn't one of the ones on Cathode Ray Dude's "Quick Start" series, was it? Some of those are incredibly cursed.

  10. _wojtek

    sufficient stepping stone. some maximalist seems to think that with a snap of the fingers you can have EU- everything which is just pure la-la-land...

    same with software stack...

    same with military equipment and cooperation - there is still a need to maintain certain stuff wile building up local alternatives.

  11. captain veg Silver badge

    isn't

    Isn't Intel's ME based on Minix? Who's to say that Andy Tanenbaum hadn't already splipped in a back door for the Dutch government? Might go some way to explaining the otherwise baffling popularity of the Python programming language.

    -A.

    1. williamyf Silver badge

      Re: isn't

      Correct, the ME is a separate 486 variant running Minix.

      The difference between the 486 in the ME and the 486s of yore is that the 486 in the ME has every single 32 bit instruction that came after retrofited. MMX, PAE, PSE-36, CMOV, FCMOV, FCOMI/FCOMIP/FUCOMI/FUCOMIP, RDPMC, UD2 ...SSE, etc ... the works. Every single new 32 bit Instruction introduced in the P5, P6, netburst and core, is present in this 486.

      ¿Why a 486? Last intel Processor that was NOT scalar. This helps a lot with predictability and race conditions, which is a desirable feature in a management engine.

      And unlike AMD, which has to pay ARM royalties for each PSP, Intel has to pay U$D 0,oo for the ME.

  12. ErikOnTech

    MEs use CPU- or chipset-integrated interfaces. How many datacenter / IaaS systems rely on these?

    While I suppose it’s theoretically possible for an ME to access a NIC over PCIe, could you imagine cramming the necessary drivers into processor firmware?

    And of all of the datacenter-class servers you’ve seen, how many even use the CPU- or chipset-integrated network interfaces? In many cases these don't even get plugged in, except maybe for management. It's pretty straightforward to spot unexpected traffic on a management network, and management networks should be heavily isolated from the Internet anyway. All the "real work" gets done on much higher-capacity NICs.

    This is more of a threat for end-user systems and low-end SMB gear, which doesn’t really apply to the IaaS stuff targeted by these policies. Yes, there are plenty of other ways to abuse Ring -3 (some fun Defcon talks on this exist), but that's generic to any CPU that has that sort of feature.

  13. Anonymous Coward
    Anonymous Coward

    Phoning Home

    Quote: ".....Intel Management Engine and AMD Platform Security Processor....."

    Quote: "...Network isolation, monitoring, and threat modeling are the walls...."

    Suppose either of these hardware items are "phoning home".

    Presumably fixes are available:

    (1) Network isolation, or....

    (2) Switch off power to the hardware

    Surely the key is KNOWING PHONING HOME IS GOING ON!

    Plus....identifying the destination location of the phoning......

    (3) ....and maybe doing some counterfeit phoning home of your own!

  14. BenjaminEdelman

    The NSA has access to backdoors in most processors

    There's no smoking gun in this article, it does make a compelling case for a conspiracy theory. Nearly all processors have backdoors that are used by intelligence agencies to control and exfiltrate data from targeted computers and phones. This isn't discussed often enough.

  15. awomanmanhasaname

    I don't see why anyone should bother

    Ultimately you have your threat model.

    And having your data legally available to a foreign government is a different threat from having it hackable.

    1. ttlanhil

      Re: I don't see why anyone should bother

      a) the foreign govt can say it's legal, but that doesn't mean it's legal under the laws of where it happens (international stuff with laws can be problematic like that)

      b) any vulnerability that can be exploited by a major nation state today might be exploited by a minor one tomorrow, and a major criminal gang the day after

      c) even if you accept all of the premises - you have to know it's a potential attack vector in order to do your assessment

      1. awomanmanhasaname

        Re: I don't see why anyone should bother

        If I have a private cloud built out of Huawei components sitting in my basement, it's a different threat from having my processes run in Huawei's cloud physically and legally in Europe, different again when Huawei is managing the cloud for another company (Deutsche Telekom) in Europe, Different again when it's Huawei's Cloud in China/Hong Kong.

        If I decide to Host the Falun Gong website, it's also legally different. See 4Chan vs UK regulators for a recent example.

  16. jn5250

    Only hard/firmware?

    A couple of years ago, I read (maybe here) a similar discussion about compilers: Can we trust that the resulting code does what we ask it to do - and nothing but?

    I am not that worried about my cat(!) videos but that also sounded like a serious low level attack surface.

    1. Caver_Dave Silver badge
      Boffin

      Re: Only hard/firmware?

      I work in certifiable systems. Yes, we check that the compiler really does produce what is expected. We look for 'dead code' (undocumented in requirements) at the byte level. We have to prove that there is nothing unexpected in binary object.

    2. T. F. M. Reader Silver badge

      Re: Only hard/firmware?

      I suspect that "a couple of years ago" you might have read something that mentioned Ken Thompson's Turing Award lecture, "Reflections on Trusting Trust", from forty and a couple of years ago (yes, 1984).

  17. Anonymous Coward
    Anonymous Coward

    Maybe TSMC is an option

    If Trump does decide to ditch support for Taiwan , maybe a good opportunity for Europe to back Taiwan - I guess this is mostly not going to happen because Europe are not as "gung-ho" like the current redneck US government and more likely to think of the impact of going against the Chinese.

    The only issue is TSMC don't design the chips and just manufactures them fora number of US comapanies, not sure how this would pan out if the Chinese did take Taiwan since they would be the first to take/grab/copy all their patents by US companies using any means feasbile.

    1. IGotOut Silver badge

      Re: Maybe TSMC is an option

      Europe is never going to militarily back Taiwan. Taking on China would be a monumentally dumb idea, given it's the opposite side of the world and there is a war currently raging in its own backyard.

  18. David Hicklin Silver badge

    Is it really that big a deal?

    Are someone really going to use this 32 bit CPU to go through your GB/TB or even PB of data ? Feels a little over hyped to me.

    As the article says they use certain firewall ports, so just close them off externally (which you should be doing anyway).

    Now having someone like Micro$lop (other Cloud Act implicated operating systems are also available) hand over some of your *cloud* based data is another matter entirely and that is what you need to move away from.

    1. SuperG
      Pirate

      Re: Is it really that big a deal?

      You would think it's being hyped - and then you see the US government doing silly things like restricting the sale of GPU chips to China to the "dumbed-down" models. (And China taking a pass on buying them.)

      The irony everyone is pointing out is quite simple. So much, so that when the US restricts technology sales to a nation like China under the guise of "national security" it's more of a "guilty Freudian slip of the tongue" than anything. This is basically pointing out that the US happens to verily engage in the self same skullduggery they are accusing everyone else of.

      The gist in this article is that the Europeans shouldn't trust the US, technologically - which is absolutely correct.

  19. Anonymous Coward
    Anonymous Coward

    Remarkably good article

    Being superficially familiar with the subject matter, in particular SecNumCloud compliance requirements, I have found this article to be a thoroughly researched, well written, and informative piece.

    Thank you.

  20. Anonymous Coward
    Anonymous Coward

    "Sovereign Clouds"

    So if devices are "phoning home"...................................................

    ........................just make sure your firewall settings are blocking some IP addresses.

    What am I missing here?

  21. abufrejoval

    Intel has made and sold bespoke Xeons to China to solve that issue

    It's been a while and I am a little lazy to search, but I distinctly remember a talk on one of the HotChip conferences where a Chinese team presented how they had Intel design them private Xeon variants that replaced parts that had compromising potential.

    And that included, interestingly enough, cryptographic algorithm implementations.

    So as long as we're not at a stage, where Trump and his ilk is likely to block that move, there is a chance you can get CPUs done by any one of those makers of CPUs, that will have Pluton and the other management bits replaced with something some Europeans have botched, because it turns out than many of those less scrutinized bits tend to have more than average flaws.

    I hear hyperscalers do something similar, too.

    In other words: you don't need to re-invent the CPU part, just to get the management or service processor secured.

    And then there are other nations sitting in the same boat with their own distinct and potentially hostile ideologies.

    Perhaps we shouldn't seek direct collaboration with the Russians until their imperial ambitions are done for, Persia, another pass, China not sure, India seems like a better choice, and quite keen on RISC-V as well.

    When the UAE was still rich enough to afford pretty near all of Cerebras, they would have been good to talk to, etc.

    Seeking sovereignty is so crucial and critical everyone not doing it in government service or contract should forfeit pay.

    But wasting money on the wrong parts, may be even worse. Especially when you have to come begging for the foundry to make those chips anyway.

  22. Anonymous Coward
    Anonymous Coward

    I'll be Captain Obvious here. Without your own CPUs what is the point? That would be like buying a car without a motor

  23. redwine

    Euro-Office

    Let alone forking a Russian project and then having large companies fund huge resource to the fork.

    This isn't forking a project to take feature sets or development strategy in a different direction; this is just taking someone else's project and then trouncing their original!

POST COMMENT House rules

Not a member of The Register? Create a new account here.

  • Enter your comment

  • Add an icon

Anonymous cowards cannot choose their icon