Hardware restriction

Last updated

A hardware restriction (sometimes called hardware DRM) [1] is content protection enforced by electronic components. The hardware restriction scheme may complement a digital rights management system implemented in software. Some examples of hardware restriction information appliances are video game consoles, smartphones, [2] tablet computers, Macintosh computers [3] and personal computers that implement secure boot.


Instances of hardware restriction

Upgradeable processors

Some Intel processors are sold with some features "locked", that can later be unlocked after payment. [4] [5]

Note that this is not unique to Intel. Some models of IBM's System/370 mainframe computer had additional hardware included, that if the customer paid the additional charge, IBM would send out a service engineer to enable it, typically by cutting a resistor in the machine.

Trusted execution environment

Vendor exploits its privileged position as a maker of devices and embeds into the device unextractable private key coupled to the public key in an own database and a hash of own public key. Vendor also adds a privileged mode to the device which can protect the data processed in it (including program code) from OS and hardware via encryption of memory. Vendor adds an additional privileged mode allowing software run in that mode to control access of other software to that mode and secrets stored in it and restricts this mode only to software signed by own public key. Vendor implements software controlling access to that mode only to parties signed business agreement to the vendor and controlling access to the data by creating a proof that the software is untampered using the fact that the key embedded into the hardware cannot be accessed with reasonable cost for anyone except the vendor. Then a vendor sells access to usage of this mode in devices of consumers to parties interested in deprivation of device owners of ownership. These parties implement own software as 2 (or more) modules and ship it to users' machines. Generic module loads a trusted module and calls for trusted privileged vendor software to activate the protection and create the cryptographic proof that developer's software is in the state it intend to be, not replaced by some another software. The generic module sends this proof over the network to its developer, the developer checks the proof. Sometimes this can be done using vendor's internet service. Then the developer either sends the data he wants to prevent computer owners to have access to. Hardware vendor itself can have access to the data by issuing a modified version of privileged software controlling access, enabling it to create fake proofs, or if the verifications of the proof are done using internet service, modifying the service to falsely claim that a proof is valid. Data in TEEs can also be accessed exploiting various side channels or by reverse engineering a specific chip and extracting the key from it, if it is possible, but costs a lot. So the data processed this way should have low enough value, such as malware and proprietary content. Since some vendors disable TEEs if system firmware is tampered (sometimes permanently damaging a chip by blowing a e-fuse), using TEE proofs can be used by software and service vendors to prevent reverse engineering their software and/or accessing their services from a tampered device even if the software itself doesn't use TEE for storing any secrets.

Intel Insider

Intel Insider, a technology that provides a "protected path" for digital content, [6] can be considered a form of DRM. [7] [8] [9]

Verified/trusted/secure boot

Some devices implement a feature called "verified boot", "trusted boot" or "secure boot", which will only allow signed software to run on the device, usually from the device manufacturer. This is considered a restriction unless users either have the ability to disable it or have the ability to sign the software.

Android devices

Many modern Android devices, such as Huawei's [10] and Nokia's, [11] come with the bootloader locked.

Apple devices

Apple's iOS devices (iPhone, iPad, iPod Touch, and Apple TV) require signatures for firmware installation, intended to verify that only the latest official firmware can be installed on those devices. Official firmware allows third-party software to be installed only from the App Store.

Macs equipped with a T2 security chip also are equipped with secure boot, ensuring that only trusted versions of Apple's macOS and Microsoft's Windows operating systems that support secure boot can start.


If a device only runs software approved by the hardware vendor, and only a certain version of a free software program is allowed to run on the device, the user cannot exercise the rights they theoretically have, because they cannot install modified versions.


Another case of trusted boot is the One Laptop per Child XO laptop which will only boot from software signed by a private cryptographic key known only to the OLPC non-profit organisation and the respective deployment authorities such as Education Ministries. Laptops distributed directly by the OLPC organisation provide a way to disable the restrictions, by requesting a "developer key" unique to that laptop, over the Internet, waiting 24 hours to receive it, installing it, and running the firmware command "disable-security". However some deployments such as Uruguay [12] deny requests for such keys. The stated goal is to deter mass theft of laptops from children or via distribution channels, by making the laptops refuse to boot, making it hard to reprogram them so they will boot and delaying the issuance of developer keys to allow time to check whether a key-requesting laptop had been stolen.

Secure boot

Certified Windows 8 hardware requires secure boot. Soon after the feature was announced in September 2011, it caused widespread fear it would lock-out alternative operating systems. [13] [14] [15] [16] In January 2012, Microsoft confirmed it would require hardware manufacturers to enable secure boot on Windows 8 devices, and that x86/64 devices must provide the option to turn it off while ARM-based devices must not provide the option to turn it off. [17] According to Glyn Moody, at ComputerWorld, this "approach seems to be making it hard if not impossible to install Linux on hardware systems certified for Windows 8". [17]

Solaris Verified Boot

Oracle Solaris 11.2 has a Verified Boot feature, which checks the signatures of the boot block and kernel modules. By default it is disabled. If enabled, it can be set to "warning" mode where only a warning message is logged on signature failures or to "enforce" mode where the module is not loaded. The Solaris elfsign(1) command inserts a signature into kernel modules. All kernel modules distributed by Oracle have a signature. Third-party kernel modules are allowed, providing the public key certificate is installed in firmware (to establish a root of trust). [18]

See also

Related Research Articles

BIOS Firmware

In computing, BIOS is firmware used to perform hardware initialization during the booting process, and to provide runtime services for operating systems and programs. The BIOS firmware comes pre-installed on a personal computer's system board, and it is the first software to run when powered on. The name originates from the Basic Input/Output System used in the CP/M operating system in 1975. The BIOS originally proprietary to the IBM PC has been reverse engineered by some companies looking to create compatible systems. The interface of that original system serves as a de facto standard.

In computing, a device driver is a computer program that operates or controls a particular type of device that is attached to a computer or automaton. A driver provides a software interface to hardware devices, enabling operating systems and other computer programs to access hardware functions without needing to know precise details about the hardware being used.

Open Firmware Standard for computer bootstrap code

Open Firmware is a standard defining the interfaces of a computer firmware system, formerly endorsed by the Institute of Electrical and Electronics Engineers (IEEE). It originated at Sun Microsystems, where it was known as OpenBoot, and has been used by vendors including Sun, Apple, IBM and ARM. Open Firmware allows the system to load platform-independent drivers directly from a PCI device, improving compatibility.

A rootkit is a collection of computer software, typically malicious, designed to enable access to a computer or an area of its software that is not otherwise allowed and often masks its existence or the existence of other software. The term rootkit is a compound of "root" and the word "kit". The term "rootkit" has negative connotations through its association with malware.

Privilege escalation Gaining control of computer privileges beyond what is normally granted

Privilege escalation is the act of exploiting a bug, design flaw or configuration oversight in an operating system, or software application to gain elevated access to resources that are normally protected from an application or user. The result is that an application with more privileges than intended by the application developer or system administrator can perform unauthorized actions.

Unified Extensible Firmware Interface Specification that defines a software interface between an operating system and platform firmware

The Unified Extensible Firmware Interface (UEFI) is a specification that defines a software interface between an operating system and platform firmware. UEFI replaces the legacy Basic Input/Output System (BIOS) firmware interface originally present in all IBM PC-compatible personal computers, with most UEFI firmware implementations providing support for legacy BIOS services. UEFI can support remote diagnostics and repair of computers, even with no operating system installed.


coreboot, formerly known as LinuxBIOS, is a software project aimed at replacing proprietary firmware found in most computers with a lightweight firmware designed to perform only the minimum number of tasks necessary to load and run a modern 32-bit or 64-bit operating system.

Hackintosh Project to run the Mac OS x on non-Apple computers

A Hackintosh is a computer that runs Apple's Macintosh operating system macOS on computer hardware not authorized for the purpose by Apple. "Hackintoshing" began as a result of Apple's 2005 transition to Intel processors, away from PowerPC. Since 2005, Mac computers use the same x86-64 computer architecture as many other desktop PCs, laptops, notebooks and servers, meaning that in principle, the code making up macOS systems and software can be run on alternative platforms with minimal compatibility issues. Benefits cited for "Hackintoshing" can include cost, ease of repair and piecemeal upgrade, and freedom to use customized choices of components that are not available in the branded Apple products. macOS can also be run on several non-Apple virtualization platforms, although such systems are not usually described as Hackintoshes. Hackintosh laptops are sometimes referred to as "Hackbooks". In recent years, Hackintosh has started to become widely spread on AMD Processors, thanks to the website AMD OS X. The popularity is due to the introduction of the powerful AMD Ryzen and Threadripper CPU's.

Trusted Platform Module

Trusted Platform Module is an international standard for a secure cryptoprocessor, a dedicated microcontroller designed to secure hardware through integrated cryptographic keys.

In computing, initrd is a scheme for loading a temporary root file system into memory, which may be used as part of the Linux startup process. initrd and initramfs refer to two different methods of achieving this. Both are commonly used to make preparations before the real root file system can be mounted.

Apple–Intel architecture Unofficial name used for Macintosh models that use Intel x86 processors

The Apple–Intel architecture, or Mactel, is an unofficial name used for Apple Macintosh personal computers developed and manufactured by Apple Inc. that use Intel x86 processors, rather than the PowerPC and Motorola 68000 ("68k") series processors used in their predecessors or the ARM processors used in their successors. With the change in architecture, a change in firmware became necessary; Apple selected the Intel-designed Extensible Firmware Interface (EFI) as its comparable component to the Open Firmware used on its PowerPC architectures, and as the firmware-based replacement for the PC BIOS from Intel. With the change in processor architecture to x86, Macs gained the ability to boot into x86-native operating systems, while Intel VT-x brought near-native virtualization with Mac OS X as the host OS.

Intel vPro technology is an umbrella marketing term used by Intel for a large collection of computer hardware technologies, including VT-x, VT-d, Trusted Execution Technology (TXT), and Intel Active Management Technology (AMT). When the vPro brand was launched, it was identified primarily with AMT, thus some journalists still consider AMT to be the essence of vPro.

Live USB USB flash drive or a USB external hard disk drive containing a full operating system that can be booted

A live USB is a USB flash drive or external hard disk drive containing a full operating system that can be booted. They are the evolutionary next step after live CDs, but with the added benefit of writable storage, allowing customizations to the booted operating system. Live USBs can be used in embedded systems for system administration, data recovery, or test driving, and can persistently save settings and install software packages on the USB device.

A proprietary device driver is a closed-source device driver published only in binary code. In the context of free and open-source software, a closed-source device driver is referred to as a blob or binary blob. The term usually refers to a closed-source kernel module loaded into the kernel of an open-source operating system, and is sometimes also applied to code running outside the kernel, such as system firmware images, microcode updates, or userland programs. The term blob was first used in database management systems to describe a collection of binary data stored as a single entity.

Intel Active Management Technology

Intel Active Management Technology (AMT) is hardware and firmware for remote out-of-band management of select business computers, running on the Intel Management Engine, a separate microprocessor not exposed to the user, in order to monitor, maintain, update, upgrade, and repair them. Out-of-band (OOB) or hardware-based management is different from software-based management and software management agents.

Pre-boot authentication (PBA) or power-on authentication (POA) serves as an extension of the BIOS, UEFI or boot firmware and guarantees a secure, tamper-proof environment external to the operating system as a trusted authentication layer. The PBA prevents anything being read from the hard disk such as the operating system until the user has confirmed they have the correct password or other credentials including multi-factor authentication.

Rooting (Android) Modification of Android devices to gain root access

Rooting is the process of allowing users of the Android mobile operating system to attain privileged control over various Android subsystems. As Android is based on a modified version of the Linux kernel, rooting an Android device gives similar access to administrative (superuser) permissions as on Linux or any other Unix-like operating system such as FreeBSD or macOS.

A trusted execution environment (TEE) is a secure area of a main processor. It guarantees code and data loaded inside to be protected with respect to confidentiality and integrity. A TEE as an isolated execution environment provides security features such as isolated execution, integrity of applications executing with the TEE, along with confidentiality of their assets. In general terms, the TEE offers an execution space that provides a higher level of security for trusted applications running on the device than a rich operating system (OS) and more functionality than a 'secure element' (SE).

Intel Management Engine Firmware and software that runs on all modern Intel CPUs at a higher level than user-facing operating system

The Intel Management Engine (ME), also known as the Intel Manageability Engine, is an autonomous subsystem that has been incorporated in virtually all of Intel's processor chipsets since 2008. It is located in the Platform Controller Hub of modern Intel motherboards.

Custom firmware, also known as aftermarket firmware, is an unofficial new or modified version of firmware created by third parties on devices such as video game consoles and various embedded device types to provide new features or to unlock hidden functionality. In the video game console community, the term is often written as custom firmware or simply CFW, referring to an altered version of the original system software inside a video game console such as the PlayStation Portable, PlayStation 3, PlayStation Vita and Nintendo 3DS.


  1. http://www.hpl.hp.com/techreports//2003/HPL-2003-110.pdf Archived 2015-09-24 at the Wayback Machine HP Laboratories
  2. Stross, Randall. "Want an iPhone? Beware the iHandcuffs". nytimes.com. Archived from the original on 2016-11-01. Retrieved 2017-02-22.
  3. "Apple brings HDCP to a new aluminum MacBook near you". arstechnica.com.
  4. "Intel wants to charge $50 to unlock stuff your CPU can already do". engadget.com. Archived from the original on 2017-07-21. Retrieved 2017-08-29.
  5. "Intel + DRM: a crippled processor that you have to pay extra to unlock / Boing Boing". boingboing.net. Archived from the original on 2011-08-25. Retrieved 2011-07-12.
  6. Shah, Agam. "Intel: Sandy Bridge's Insider is not DRM". computerworld.com. Archived from the original on 2011-12-04. Retrieved 2011-07-12.
  7. "Intel Claims DRM'd Chip Is Not DRM, It's Just Copy Protection". techdirt.com. Archived from the original on 2011-12-25. Retrieved 2011-07-12.
  8. "Is Intel Insider Code for DRM in Sandy Bridge?". pcmag.com. Archived from the original on 2017-02-10. Retrieved 2017-08-29.
  9. "Intel's Sandy Bridge sucks up to Hollywood with DRM - TheINQUIRER". theinquirer.net. Archived from the original on 2011-06-15. Retrieved 2011-07-12.
  10. "Huawei will stop providing bootloader unlocking for all new devices". xda-developers. 2018-05-24. Retrieved 2020-03-20.
  11. "August security update on Nokia phones blocks bootloader unlock methods". xda-developers. 2018-08-22. Retrieved 2020-03-20.
  12. "[Sugar-devel] Is Project Ceibal violating the GNU General Public License?". lists.sugarlabs.org. Archived from the original on 2016-03-03. Retrieved 2016-09-24.
  13. Hacking; Security; Cybercrime; Vulnerability; Malware; Lacoon, Check Point snaps up mobile security outfit; users, Fake Pirate Bay site pushes banking Trojan to WordPress; Lebanon, Mystery 'Explosive' cyber-spy campaign traced back to. "Windows 8 secure boot would 'exclude' Linux". Archived from the original on 2016-07-11. Retrieved 2016-09-24.
  14. "Windows 8 secure boot could complicate Linux installs". arstechnica.com. Archived from the original on 2012-05-01. Retrieved 2017-06-14.
  15. "Windows 8 secure boot to block Linux". ZDNet. Archived from the original on 2011-09-23. Retrieved 2011-09-28.
  16. Staff, OSNews. "Windows 8 Requires Secure Boot, May Hinder Other Software". www.osnews.com. Archived from the original on 2016-09-27. Retrieved 2016-09-24.
  17. 1 2 Is Microsoft Blocking Linux Booting on ARM Hardware? - Open Enterprise Archived 2012-03-09 at the Wayback Machine
  18. Anderson, Dan. "Solaris Verified Boot". oracle.com. Archived from the original on 2014-05-02. Retrieved 2014-05-01.