Wave Systems Corp. (fka WAVXQ)

[RootOfTrust]

awk P.S.

The client-side security hardware will become programmable...there is no way around it!


The conclusion of the Wave paper:

8. Conclusion

We have introduced two distinct architectures geared toward the same goal of
achieving containment of damage to the business of content and service providers while
protecting the privacy interests of consumers who participate in the system. These
conflicting requirements are best mediated by the introduction of programmable security
coprocessors on the consumer end and a Trust Server which can directly access these
devices and so offer permissioning of providers’ applications into them while still
maintaining user privacy. Users have a legitimate right to change their personas with
respect to activities conducted over the Internet in order to restrict the amount of valuable
information that others can glean, often with no commensurate benefit to the consumer.
The Trust Server can deny the permissioning of further services to users who are
suspected of noncompliant usage of such services in the analogous way individual
providers could handle their relationships with customers who are known to them. We
have shown that a considerable degree of defense against both insider attacks and
consumer fraud can be achieved by careful protocol design and the measured use of
hardware security resources on both the consumer and server end. The first of our two
methods is characterized by a strong PKI (public-key infrastructure) flavor which leans
toward making minimal use of Trust Server involvement in the process. The second
approach is capable of handling legacy infrastructures, although it is adaptable to hybrid
approaches which can individualize coprocessors with keying material which is able to
support both peer-to-peer PKI and coprocessor-to-Application Server shared-secret based
cryptography.