Replies to post #24709 on Wave Systems Corp. (fka WAVXQ)

[Doma]

Barge.........A Full TAN?

Barge Wave doesn't just provide Attestation to
TPM's,if that were true we would be in trouble.
Care to comment on my TCG TAN v FULL TAN post..?

Doma.


A Full TAN V's a TCG TAN.......?



TCG TAN........Today
1.Endorsement Key,Key loading server.
2.Attestation Credential Manager server.
3.Key Migration Manager server.

Full TAN........LaGrande/NGSCB
1,2,3
4.Device server
5.Trustlet Development server
6.Trustlet certification server.


For fun i have subsituted TPM where appropriate......below



While the Device Server controls trustlet installation, the TAN's Trustlet Development Server (TDS) provides the means for EMBASSY®Trust Assurance NetworkConnecting Security
securely publishing a trustlet to one or more Device Servers.Publishing a trustlet authorizes it for installation and subsequent execution on authorized TPM devices. The TDS is the application service provider's interface to the TAN and guarantees that trustlets are created within the security boundaries of the EMBASSY Trust System (ETS). Through the TDS, application service providers may also upgrade their trustlets to newer versions. If a trustlet is ever compromised or is no longer valid, the TDS allows an application service provider to revoke its permissions. The application service provider's identity is always authenticated and cryptographic measures ensure that only the original publisher can take action on a specific trustlet. Certifiable Trust For an extra degree of security, authorized agents certify trustlets via the TAN's Trustlet Certification Server (TCS). A certification agent is a trusted entity that uses the TCS to evaluate trustlets against pre-defined security criteria. Trustlet certification creates anaudit trail and gives the end-user further confidence that the trustlet is trustworthy.Hierarchy of Trust Public key cryptography (PKI) is used to protect all TAN servers,TPM devices, and certification agent keys. EMBASSY Certificate Authorities are the entities that are authorized by the EMBASSY PKI Root Key to give permission to hierarchically lowerentities into the EMBASSY Trust System. "Real" Time Applications and services that must verify the precise date and timeof events need an uncontestable time source. The TAN's Device Server offers trusted time services and ensures that TPM devices have accurate local time according to their timesynchronization schedule. Personalized for Privacy The TAN allows for personalization of trustlets during service installation by injecting secret information or keys into the trustlet data structure. This feature allows an application service provider to communicate only with authorized trustlets and maintain a history of transactions while not compromising the end user's anonymity and privacy.

Managed Security To activate the managed security environment, TPM devices register with the TAN's Device Server. System administrators mayset policies and permissions for TAN users and services, generate reports for tracking of attestable billable events, and create device groups having exclusive authorities. Additionally, technical support personnel may view the state and history of individual TPM devices, and contain threats by revoking trustlets or disabling devices. These integrated functions help enterprises contain costs by making technical support and system administration as efficient as possible.Field Upgradeable Through the relationship with the Device Server, certified EMBASSY software and firmware upgrades can be securely downloaded and installed on target devices. Application service providers can also use this feature for secure distribution of trustlets and trustlet upgrades.As the market for trustworthy PC services expands, the EMBASSY Trust Assurance Network is a powerful management tool for complex security needs.





Public Reply / Private Reply / Keep / Mark Last Read Replies (2) / Next 10 / Previous / Next

[go-kitesurf]

barge,

I believe the space that Steven calls "Utah" is attestation. I could be wrong, and I identify with the fact that there are other business models Wave will be involved in, but I believe this is the major business model Steven identifies as Wave's primary revenue source.

What I'm talking about regarding "transactions" is that if I'm sitting at home, and one day I decided to link my electric bill, my rent, my phone bill, etc. (lets say 5 bills) to my bank account, for this to be trusted, certain things need to take place:

At the time I "sign up"
I believe when I sign up the on-line bill payment service will have to be installed and verified as "trusted" on a "trusted PC platform". My "platform" will also have to be verified as "my" "platform" by a "third party" (Wave and the Bank, or the phone co. or whoever I'm transacting with).

Let's say I download the service to install. What guarantee is there that it installed properly, was not tampered with, that I "am" who I say I "am", that I am paying "my" bills, etc etc etc

I believe there will be a nominal "setup" fee just like there is for Cable, DishTV, or any service today.

At each purchase
One of my services that I paid $1 to setup was Blockbuster online. I wish to download a movie to watch tonight with the lady, and we're going to kick back with some chips-ahoy and some brews. So I download the new comedy "How Clinton Got to Office With a Broken Zipper" (LOL). I will probably wind up paying $0.05 as part of the "rental" fee that is transparent to me ($2.50 is the total, with $2.45 going to block buster to pay movie rights and their costs and $0.05 going to attest both platforms - "mine" and "BB"). The $0.05 is charged without my knowing it. Someone has to store the keys that tell Blockbuster I can watch this movie as many times as I like for 3 days. Or that if I "rented to own" I could pay my $2.50 and that would go toward ownership up to $15 for the movie. If I ever hit $15 worth of renting that movie, I could access it from Blockbuster anytime over the next 50 years. There are three platforms at play here: mine, Blockbuster's and a "Trusted Third Party" (Wave). The TTP has to verify for me that it is BB I am dealing with, and the TTP has to verify with BB that it is ME that THEY are dealing with.

So who's going to do that without any fees? That business model without revenues would collapse the company. Or, as Microsoft says:

Because multiple parties can independently evaluate and certify NGSCB-enabled systems, users will be able to obtain verification of their system’s operation from organizations that they trust. Additionally, this environment will form the basis for a strong business incentive to preserve and enhance privacy and security and offers the opportunity for affinity programs that allow customers to identify NGSCB-enabled systems.

I believe one of these affinity programs is what Wave aims to be. The MAIN affinity program. Of course I could be wrong.

[svenm]

Barge, I'm presently stuck on a dialup connection so I'll try to make this short and sweet. First, I do think we have a difference of opinion here. I think that GKS's post #24710 is a very good description of the primary revenue model that Wave is presently trying to capitalize on. With serious deployment it will prove to be very lucrative, in my opinion. I can't explain why Wave appears to be "given" this space, but I have to assume that SKS has swapped something to some very important players in order to have this first-mover advantage. When he states that Wave has dozens of NDA's I believe that some of these involve deals that assures Wave of this place at the table for the foreseeable future. If Wave executes well I'm not sure how easy it will be for other companies, regardless of their size, to move into that space. If that were the case we may never know what that leverage was. I only know that today SKS puts great emphasis on that area.
Having said that, I don't think that is a case of "either attestation or the use of the EMBASSY platform." I just think that the attestation role is far more visible and tangible for the time being. We don't know what amount (if any) of Wave IP will be used in either LeGrande or NGSCB technology. If it will be used it is obviously with the consent of Wave and presumably Wave will receive something in return. That may be support of Wave as the main Privacy Certifying Authority or it may be some other roles as well. I suppose that all depends on the strength of Wave's IP and its management's ability to leverage that strength. Presently I just don't think we have that information and therefore I discount those other business models until they become more apparent, which hopefully they will in the not-too-distant-future.
All JMHO,
Svenm

[svenm]

Barge, I'm presently stuck on a dialup connection so I'll try to make this short and sweet. First, I do think we have a difference of opinion here. I think that GKS's post #24710 is a very good description of the primary revenue model that Wave is presently trying to capitalize on. With serious deployment it will prove to be very lucrative, in my opinion. I can't explain why Wave appears to be "given" this space, but I have to assume that SKS has swapped something to some very important players in order to have this first-mover advantage. When he states that Wave has dozens of NDA's I believe that some of these involve deals that assures Wave of this place at the table for the foreseeable future. If Wave executes well I'm not sure how easy it will be for other companies, regardless of their size, to move into that space. If that were the case we may never know what that leverage was. I only know that today SKS puts great emphasis on that area.
Having said that, I don't think that is a case of "either attestation or the use of the EMBASSY platform." I just think that the attestation role is far more visible and tangible for the time being. We don't know what amount (if any) of Wave IP will be used in either LeGrande or NGSCB technology. If it will be used it is obviously with the consent of Wave and presumably Wave will receive something in return. That may be support of Wave as the main Privacy Certifying Authority or it may be some other roles as well. I suppose that all depends on the strength of Wave's IP and its management's ability to leverage that strength. Presently I just don't think we have that information and therefore I discount those other business models until they become more apparent, which hopefully they will in the not-too-distant-future.
All JMHO,
Svenm