Hardware restriction

The neutrality of this article is disputed. Please do not remove this message until conditions to do so are met. (January 2022) (Learn how and when to remove this template message)

|

Short description: Copy protection enforced by hardware

A hardware restriction (sometimes called hardware DRM)[1] is low-level protection enforced by electronic components. The hardware restriction scheme may protect against physical or malware attacks or complement a digital rights management system implemented in software. Some examples of hardware restriction information appliances are video game consoles, smartphones,[2] tablet computers, Macintosh computers[3] and personal computers that implement secure boot.

## Contents

* 1 Instances of hardware restriction
* 1.1 Upgradeable processors
* 1.2 Trusted execution environment
* 1.3 Intel Insider
* 1.4 Verified/trusted boot
* 1.5 Android devices
* 1.6 Apple devices
* 1.7 TiVo
* 1.8 OLPC
* 1.9 Secure boot
* 1.10 Solaris Verified Boot
* 2 See also
* 3 References
* 4 External links

## Instances of hardware restriction

### Upgradeable processors

Some Intel processors are sold with some features "locked", that can later be unlocked after payment.[4][5]

Note that this is not unique to Intel. Some models of IBM's System/370 mainframe computer had additional hardware included, that if the customer paid the additional charge, IBM would send out a service engineer to enable it, typically by cutting a resistor in the machine.

### Trusted execution environment

This section may be in need of reorganization to comply with Wikipedia's layout guidelines. Please help by editing the article to make improvements to the overall structure. (March 2021) (Learn how and when to remove this template message)

|

Main article: Trusted execution environment

Vendor exploits its privileged position as a maker of devices and embeds into the device unextractable private key coupled to the public key in an own database and a hash of own public key. Vendor also adds a privileged mode to the device which can protect the data processed in it (including program code) from OS and hardware via encryption of memory. Vendor adds an additional privileged mode allowing software run in that mode to control access of other software to that mode and secrets stored in it and restricts this mode only to software signed by own public key. Vendor implements software controlling access to that mode only to parties signed business agreement to the vendor and controlling access to the data by creating a proof that the software is untampered using the fact that the key embedded into the hardware cannot be accessed with reasonable cost for anyone except the vendor. Then a vendor sells access to usage of this mode in devices of consumers to parties interested in deprivation of device owners of ownership. These parties implement own software as 2 (or more) modules and ship it to users' machines. Generic module loads a trusted module and calls for trusted privileged vendor software to activate the protection and create the cryptographic proof that developer's software is in the state it intends to be, not replaced by some other software. The generic module sends this proof over the network to its developer, who checks the proof. Sometimes this can be done using vendor's internet service. Then the developer either sends the data he wants to prevent computer owners to have access to. Hardware vendor itself can have access to the data by issuing a modified version of privileged software controlling access, enabling it to create fake proofs, or if the verifications of the proof are done using internet service, modifying the service to falsely claim that a proof is valid. Data in TEEs can also be accessed exploiting various side channels or by reverse engineering a specific chip and extracting the key from it, if it is possible, but costs a lot. So the data processed this way should have low enough value, such as malware and proprietary content. Since some vendors disable TEEs if system firmware is tampered (sometimes permanently damaging a chip by blowing a e-fuse), using TEE proofs can be used by software and service vendors to prevent reverse engineering their software and/or accessing their services from a tampered device even if the software itself doesn't use TEE for storing any secrets.

### Intel Insider

Intel Insider, a technology that provides a "protected path" for digital content,[6] can be considered a form of DRM.[7][8][9]

### Verified/trusted boot

Some devices implement a feature called "verified boot", "trusted boot" or "secure boot", which will only allow signed software to run on the device, usually from the device manufacturer. This is considered a restriction unless users either have the ability to disable it or have the ability to sign the software.

### Android devices

Many modern Android devices, such as Huawei[10] and Nokia[11] phones come with the bootloader locked.

### Apple devices

Apple's iOS devices (iPhone, iPad, iPod Touch, and Apple TV) require signatures for firmware installation, intended to verify that only the latest official firmware can be installed on those devices. Official firmware allows third-party software to be installed only from the App Store.

Macs equipped with a T2 security chip also are equipped with secure boot, ensuring that only trusted versions of Apple's macOS and Microsoft's Windows operating systems that support secure boot can start.

### TiVo

Main article: Tivoization

If a device only runs software approved by the hardware vendor, and only a certain version of a free software program is allowed to run on the device, the user cannot exercise the rights they theoretically have, because they cannot install modified versions.

### OLPC

Another case of trusted boot is the One Laptop per Child XO laptop which will only boot from software signed by a private cryptographic key known only to the OLPC non-profit organisation and the respective deployment authorities such as Education Ministries. Laptops distributed directly by the OLPC organisation provide a way to disable the restrictions, by requesting a "developer key" unique to that laptop, over the Internet, waiting 24 hours to receive it, installing it, and running the firmware command "disable-security". However some deployments such as Uruguay[12] deny requests for such keys. The stated goal is to deter mass theft of laptops from children or via distribution channels, by making the laptops refuse to boot, making it hard to reprogram them so they will boot and delaying the issuance of developer keys to allow time to check whether a key-requesting laptop had been stolen.

###  Secure boot

Certified Windows 8 hardware requires secure boot. Soon after the feature was announced in September 2011, it caused widespread fear it would lock-out alternative operating systems.[13][14][15][16] In January 2012, Microsoft confirmed it would require hardware manufacturers to enable secure boot on Windows 8 devices, and that x86/64 devices must provide the option to turn it off while ARM-based devices must not provide the option to turn it off.[17] According to Glyn Moody, at ComputerWorld, this "approach seems to be making it hard if not impossible to install Linux on hardware systems certified for Windows 8".[17] Reality has shown that on x86_64 platforms, Secure Boot being available has not hindered installing Linux and most distributions support it in order to harden the system against attacks.[18][19][20][21]

### Solaris Verified Boot

Oracle Solaris 11.2 has a Verified Boot feature, which checks the signatures of the boot block and kernel modules. By default it is disabled. If enabled, it can be set to "warning" mode where only a warning message is logged on signature failures or to "enforce" mode where the module is not loaded. The Solaris elfsign(1) command inserts a signature into kernel modules. All kernel modules distributed by Oracle have a signature. Third-party kernel modules are allowed, providing the public key certificate is installed in firmware (to establish a root of trust).[22]

## See also

* Free hardware
* Homebrew (video games)
* Vendor lock-in
* Crippleware
* Planned obsolescence

## References

1. ↑ http://www.hpl.hp.com/techreports//2003/HPL-2003-110.pdf HP Laboratories
2. ↑ Stross, Randall (14 January 2007). "Want an iPhone? Beware the iHandcuffs". The New York Times. https://www.nytimes.com/2007/01/14/business/yourmoney/14digi.html.
3. ↑ "Apple brings HDCP to a new aluminum MacBook near you". 17 November 2008. https://arstechnica.com/apple/news/2008/11/apple-brings-hdcp-to-a-new-aluminum-macbook-near-you.html.
4. ↑ "Intel wants to charge $50 to unlock stuff your CPU can already do". https://www.engadget.com/2010/09/18/intel-wants-to-charge-50-to-unlock-stuff-your-cpu-can-already-d/.
5. ↑ "Intel + DRM: a crippled processor that you have to pay extra to unlock / Boing Boing". 18 September 2010. http://boingboing.net/2010/09/19/intel-drm-a-crippled.html.
6. ↑ Shah, Agam (6 January 2011). "Intel: Sandy Bridge's Insider is not DRM". http://www.computerworld.com/s/article/9203799/Intel_Sandy_Bridge_s_Insider_is_not_DRM.
7. ↑ "Intel Claims DRM'd Chip Is Not DRM, It's Just Copy Protection". http://www.techdirt.com/articles/20110107/10153912573/intel-claims-drmd-chip-is-not-drm-its-just-copy-protection.shtml.
8. ↑ "Is Intel Insider Code for DRM in Sandy Bridge?". https://www.pcmag.com/article2/0,2817,2375215,00.asp.
9. ↑ "Intel's Sandy Bridge sucks up to Hollywood with DRM - TheINQUIRER". http://www.theinquirer.net/inquirer/news/1934536/intels-sandy-bridge-sucks-hollywood-drm.
10. ↑ "Huawei will stop providing bootloader unlocking for all new devices" (in en-US). 2018-05-24. https://www.xda-developers.com/huawei-stop-providing-bootloader-unlock-codes/.
11. ↑ "August security update on Nokia phones blocks bootloader unlock methods" (in en-US). 2018-08-22. https://www.xda-developers.com/august-security-update-on-nokia-phones-blocks-the-only-bootloader-unlock-method/.
12. ↑ "[Sugar-devel Is Project Ceibal violating the GNU General Public License?"]. http://lists.sugarlabs.org/archive/sugar-devel/2009-August/018478.html.
13. ↑ Hacking; Security; Cybercrime; Vulnerability; Malware; Lacoon, Check Point snaps up mobile security outfit; users, Fake Pirate Bay site pushes banking Trojan to WordPress; Lebanon, Mystery 'Explosive' cyber-spy campaign traced back to. "Windows 8 secure boot would 'exclude' Linux". https://www.theregister.co.uk/2011/09/21/secure_boot_firmware_linux_exclusion_fears/.
14. ↑ "Windows 8 secure boot could complicate Linux installs". 21 September 2011. https://arstechnica.com/business/news/2011/09/windows-8-secure-boot-will-complicate-linux-installs.ars.
15. ↑ "Windows 8 secure boot to block Linux". http://www.zdnet.com.au/windows-8-secure-boot-to-block-linux-339322781.htm.
16. ↑ Staff, OSNews. "Windows 8 Requires Secure Boot, May Hinder Other Software". http://www.osnews.com/story/25180.
17. ↑ 17.0 17.1 Is Microsoft Blocking Linux Booting on ARM Hardware? - Open Enterprise
18. ↑ HowTos/UEFI - CentOS Wiki
19. ↑ Larabel, Michael (30 April 2018). "Debian Making Progress on UEFI SecureBoot Support in 2018". Phoronix Media. https://www.phoronix.com/scan.php?page=news_item&px=Debian-UEFI-SecureBoot-2018.
20. ↑ "Unified Extensible Firmware Interface/Secure Boot". https://wiki.archlinux.org/title/Unified_Extensible_Firmware_Interface/Secure_Boot.
21. ↑ "SecureBoot". FreeBSD. https://wiki.freebsd.org/SecureBoot.
22. ↑ Anderson, Dan. "Solaris Verified Boot". https://blogs.oracle.com/DanX/entry/verified_boot.

## External links

* An Introduction to Tivoization by The Linux Information Project (LINFO)

* v
* t
* e

Free and open-source software

General|

* Alternative terms for free software
* Comparison of open-source and closed-source software
* Comparison of source-code-hosting facilities
* Free software
* Free software project directories
* Gratis versus libre
* Long-term support
* Open-source software
* Open-source software development
* Outline

Software
packages|

* Audio
* Bioinformatics
* Codecs
* Collaboration
* Configuration management
* Device drivers
* Graphics
* Wireless
* Geophysics
* Health
* Mathematics
* Operating systems
* Programming languages
* Routing
* Statistics
* Television
* Video games
* Web applications
* Content management systems
* E-commerce
* Word processors
* Android apps
* iOS apps
* Commercial
* Trademarked
* Formerly proprietary

Community|

* Free software movement
* History
* Open-source-software movement
* Organizations
* Events

Licenses|

* AFL
* Apache
* APSL
* Artistic
* Beerware
* Boost
* BSD
* CC0
* CDDL
* EPL
* Free Software Foundation
* GNU GPL
* GNU LGPL
* ISC
* MIT
* MPL
* Ms-PL/RL
* Python
* Python Software Foundation License
* Sleepycat
* Unlicense
* WTFPL
* zlib

| Types and
standards|

* Comparison of free and open-source software licenses
* Contributor License Agreement
* Copyleft
* Debian Free Software Guidelines
* Definition of Free Cultural Works
* Free license
* The Free Software Definition
* The Open Source Definition
* Open-source license
* Permissive software license
* Public domain
* Viral license

|

Challenges|

* Digital rights management
* Firmware security
* Hardware restrictions
* License proliferation
* Mozilla software rebranding
* Proprietary device drivers
* Proprietary firmware
* Proprietary software
* SCO/Linux controversies
* Secure boot
* Software patents
* Software security
* Trusted Computing

Related topics|

* Forking
* GNU Manifesto
* Microsoft Open Specification Promise
* Open-core model
* Open-source hardware
* Shared Source Initiative
* Source-available software
* The Cathedral and the Bazaar
* Revolution OS

*   * Category
* Commons
* WikiProject
* Book

0.00

(0 votes)

|

Retrieved from "https://handwiki.org/wiki/index.php?title=Social:Hardware_restriction&oldid=1025345"
*[v]: View this template
*[t]: Discuss this template
*[e]: Edit this template