amt avtivemanagementtechnology bios drift foonetic foonetic/#xkcd hardware iamt intel management sheepbat sysadmin vpro

My tags:

From Wikipedia, the free encyclopedia

Intel Active Management Technology (AMT) is hardware-based technology for remotely managing and securing PCs out-of-band.^{[1][2][3][4][5]} Currently, Intel AMT is available in desktop PCs with Intel Core 2 processor with vPro technology and available in laptop PCs with Centrino or Centrino 2 platform with vPro technology.^[1][6]

Contents 1 Overview of Intel AMT 1.1 Hardware-based management and software-based management 1.2 DHCP, BOOTP, WOL vs Intel AMT hardware-based management 2 Intel AMT features 2.1 Hardware-based AMT features in laptop and desktop PCs 2.2 Additional AMT features in laptop PCs 2.3 Intel vPro platform features 3 Using Intel AMT 4 OOB Communication with AMT 4.1 AMT OOB Communication for Wired vs. Wireless PCs 4.2 AMT OOB Secure Communication Outside the Corporate Firewall 4.2.1 How It Works 5 Intel AMT Security Measures 5.1 Using AMT in a Secure Network Environment 5.1.1 Intel AMT in a Secured Network Environment: How It Works 5.1.2 Security Postures Supported by Intel AMT Versions 5.2 Intel AMT Security Technologies and Methodologies 6 Versions 7 Management Engine firmware modules 8 Provisioning and Integration of Intel AMT 8.1 Intel vPro PCs Can Be Sold with AMT Enabled or Disabled 8.2 Disabling and Reenabling Intel AMT 8.2.1 Disabling Intel AMT 8.2.2 Reenabling Intel AMT 8.3 Setup and Integration Tools 9 See also 10 References 11 External links

[edit] Overview of Intel AMT

Intel AMT is hardware and firmware technology that builds certain functionalities into business PCs in order to make the PCs easier and less expensive for businesses to monitor, maintain, update, upgrade, and repair.^[1] Intel AMT is part of the Intel Management Engine, which is built into PCs with Intel vPro technology.^[2] Intel AMT is designed into a secondary processor located on the motherboard.

AMT is not intended to be used by itself; it is intended to be used with a software management application.^[1] It gives a management application (and thus, the sys-admin who uses it) better access to the PC down the wire, in order to remotely and securely do tasks that are difficult or sometimes impossible when working on a PC that does not have remote functionalities built into it.^[1][3][7][8]

[edit] Hardware-based management and software-based management

Hardware-based management is different from software-based management and software management agents.^[1][2] Hardware-based management works at a different level than software applications, uses a communication channel (through the TCP/IP stack) that is different from software-based communication (which is through the software stack in the OS). Hardware-based management does not depend on the presence of an OS or locally installed management agent.

[edit] DHCP, BOOTP, WOL vs Intel AMT hardware-based management

Hardware-based management has been available in the past, but it has been limited to auto-configuration using DHCP or BOOTP for dynamic IP allocation and diskless workstations, as well as Wake On LAN (WOL) for remotely powering on systems.^[9]

The Intel AMT features give sys-admins access to remote-management and security features in a more secure environment (TLS-secured communication, for example, and strong encryption).^[2]

[edit] Intel AMT features

Intel AMT includes hardware-based remote management features, security features, power-management features, and remote-configuration features.^[1][10] The features allow an IT tech to access an AMT PC when traditional techniques and methods to manage the PC are not available.^[7]

Access to the Intel AMT features relies on a hardware-based OOB communication channel.^[1] Because the channel operates below the OS level, the channel is independent of the state of the OS (present, missing, corrupted, down). The communication channel is also independent of the PC’s power state, the presence of a management agent, and the state of many hardware components (such as hard disk drives and memory).

Along with the communication channel, most AMT features are available OOB, regardless of PC power state.^[1] Other features are available after the PC is powered up (such as console redirection via serial over LAN (SOL), agent presence checking, and network traffic filtering).^[1] Because AMT has a remote power-up feature, a sys-admin can combine the OOB communication with the remote power-up feature and access PCs that were powered off at the start of the maintenance or service cycle.

Hardware-based features can be combined with scripting to automate maintenance and service.^[1]

[edit] Hardware-based AMT features in laptop and desktop PCs

Hardware-based AMT features include:

• Encrypted, remote communication channel for network traffic between the IT console and Intel AMT.^[1][2]
• Ability for a wired PC (physically connected to the network) outside the company’s firewall on an open LAN to establish a secure communication tunnel (via AMT) back to the IT console.^[1][2] Examples of an open LAN include a wired laptop at home or at an SMB site that does not have a proxy server.
• Remote power up / power down / power cycle through encrypted WOL.^[1][2]
• Remote boot, via integrated device electronics redirect (IDE-R).^[1][2]
• Console redirection, via serial over LAN (SOL).^[1]
• Hardware-based filters for monitoring packet headers in inbound and outbound network traffic for known threats (based on programmable timers), and for monitoring known / unknown threats based on time-based heuristics. Laptops and desktop PCs have filters to monitor packet headers. Desktop PCs have packet-header filters and time-based filters.^[1][2][11]
• Isolation circuitry (previously and unofficially called “circuit breaker” by Intel) to port-block, rate-limit, or fully isolate a PC that might be compromised or infected.^[1][2][11]
• Agent presence checking, via hardware-based, policy-based programmable timers. A “miss” generates an event; you can specify that the event generate an alert.^[1][2][11]
• OOB alerting.^[1][2]
• Persistent event log, stored in protected memory (not on the hard drive).^[1][2]
• Access (preboot) the PC’s universal unique identifier (UUID).^[1][2]
• Access (preboot) hardware asset information, such as a component’s manufacturer and model, which is updated every time the system goes through power-on self-test (POST).^[1][2]
• Access (preboot) to third-party data store (TPDS), a protected memory area that software vendors can use, in which to version information, .DAT files, and other information.^[1][2]
• Remote configuration options, including certificate-based zero-touch remote configuration, USB key configuration (light-touch), and manual configuration.^[1][2][12]

[edit] Additional AMT features in laptop PCs

Laptops with AMT also include wireless technologies:

• Support for IEEE 802.11 a/g/|n wireless protocols^{[1][6][13][14]}
• Cisco-compatible extensions for Voice over WLAN^{[1][6][13][14]}

[edit] Intel vPro platform features

Intel AMT is security and management technology that is built into PCs with Intel vPro technology.^[1][9] PCs with Intel vPro include many other “platform” (general PC features) technologies and features:

• Support for IEEE 802.1x, Cisco Self Defending Network (SDN), and Microsoft Network Access Protection (NAP).^[1][15][16]
• Gigabit network connection or network wireless connection (on laptops).^[1][6]
• Intel Trusted Execution Technology (Intel TXT) and an industry-standard Trusted Platform Module (TPM) version 1.2.^[1][17]
• Intel Virtualization Technology (Intel VT).^{[1][17][18][19][20]}
• 64-bit processors that are optimized for multi-tasking and multithreading.^[1]
• 64-bit integrated graphics to provide enough performance that the PC does not need a discrete (separate) graphics card even for graphics-intensive OSs such as Microsoft Windows Vista.^[1][21][22]
• Industry standards, such as ASF, XML, SOAP, TLS, HTTP authentication, Kerberos (Microsoft Active Directory), DASH (based on draft 1.0 specifications), and WS-MAN.^[1]
• Quiet System Technology (QST), formerly called advanced fan speed control (AFSC).
• Architecture, package design, and technologies for power coordination and better thermals, in order to operate at very low voltages, use power more efficiently, and help meet Energy Star requirements.^[1]

[edit] Using Intel AMT

Almost all AMT features are available even if PC power is off, the OS is crashed, the software agent is missing, or hardware (such as a hard drive or memory) has failed.^[1][2] The console-redirection feature (SOL), agent presence checking, and network traffic filters are available after the PC is powered up.^[1][2]

Intel AMT supports these management tasks:

• Remotely power up, power down, power cycle, and power reset the computer.^[1]
• Remote boot the PC by remotely redirecting the PC’s boot process, causing it to boot from a different image, such as a network share, bootable CD-ROM or DVD, remediation drive, or other boot device.^[1][7] This feature supports remote booting a PC that has a corrupted or missing OS.
• Remotely redirect the system’s I/O via console redirection through serial over LAN (SOL).^[1] This feature supports remote troubleshooting, remote repair, software upgrades, and similar processes.
• Access and change BIOS settings remotely.^[1] This feature is available even if PC power is off, the OS is down, or hardware has failed. This feature is designed to allow remote updates and corrections of configuration settings. This feature supports full BIOS updates, not just changes to specific settings.
• Detect suspicious network traffic.^[1][11] In laptop and desktop PCs, this feature allows a sys-admin to define the events that might indicate an inbound or outbound threat in a network packet header. In desktop PCs, this feature also supports detection of known and/or unknown threats (including slow- and fast-moving computer worms) in network traffic via time-based, heuristics-based filters. Network traffic is checked before it reaches the OS, so it is also checked before the OS and software applications load, and after they shut down (a traditionally vulnerable period for PCs).
• Block or rate-limit network traffic to and from systems suspected of being infected or compromised by computer viruses, computer worms, or other threats.^[1][11] This feature uses Intel AMT hardware-based isolation circuitry that can be triggered manually (remotely, by the sys-admin) or automatically, based on IT policy (a specific event).
• Manage hardware packet filters in the on-board network adapter.^[1][11]
• Automatically send OOB communication to the IT console when a critical software agent misses its assigned check in with the programmable, policy-based hardware-based timer.^[1][11] A "miss" indicates a potential problem. This feature can be combined with OOB alerting so that the IT console is notified only when a potential problem occurs (helps keep the network from being flooded by unnecessary "positive" event notifications).
• Receive PET events out-of-band from the AMT subsystem (for example, events indicating that the OS is hung or crashed, or that a password attack has been attempted).^[1] You can alert on an event (such as falling out of compliance, in combination with agent presence checking) or on a threshold (such as reaching a particular fan speed).
• Access a persistent event log, stored in protected memory.^[1] The event log is available OOB, even if the OS is down or the hardware has already failed.
• Discover an AMT system independently of the PC's power state or OS state.^[1] Discovery (preboot access to the UUID) is available if the system is powered down, its OS is compromised or down, hardware (such as a hard drive or memory) has failed, or management agents are missing.
• Perform a software inventory or access information about software on the PC.^[1] This feature allows a third-party software vendor to store software asset or version information for local applications in the Intel AMT protected memory. (This is the protected third party data store, which is different from the protected AMT memory for hardware component information and other system information). The third-party data store can be accessed OOB by the sys-admin. For example, an antivirus program could store version information in the protected memory that is available for third-party data. A computer script could use this feature to identify PCs that need to be updated.
• Perform a hardware inventory by uploading the remote PC’s hardware asset list (platform, baseboard management controller, BIOS, processor, memory, disks, portable batteries, field replaceable units, and other information).^[1] Hardware asset information is updated every time the system runs through power-on self-test (POST).

[edit] OOB Communication with AMT

Intel AMT is part of the Intel Management Engine. All access to the Intel AMT features is through the Intel Management Engine in the PC’s hardware and firmware.^[1] AMT communication depends on the state of the Management Engine, not the state of the PC’s OS.

As part of the Intel Management Engine, the AMT OOB communication channel is based on the TCP/IP firmware stack designed into system hardware.^[1] Because it is based on the TCP/IP stack, remote communication with AMT occurs via the network data path before communication is passed to the OS.

[edit] AMT OOB Communication for Wired vs. Wireless PCs

Intel AMT supports wired and wireless networks.^{[1][13][6][23]} For wireless notebooks on battery power, OOB communication is available when the system is awake and connected to the corporate network, even if the OS is down. OOB communication is also available for wireless or wired notebooks connected to the corporate network over a host OS-based virtual private network (VPN) when notebooks are awake and working properly.

[edit] AMT OOB Secure Communication Outside the Corporate Firewall

AMT version 4.0 and higher can establish a secure communication tunnel between a wired PC and an IT console outside the corporate firewall.^[1][24] In this scheme, a management presence server (Intel calls this a “vPro-enabled gateway”) authenticates the PC, opens a secure TLS tunnel between the IT console and the PC, and mediates communication.^[1][25] The scheme is intended to help the user or PC itself request maintenance or service when at satellite offices or similar places where there is no on-site proxy server or management appliance.

Technology that secures communications outside a corporate firewall is relatively new. It also requires that an infrastructure be in place, including support from IT consoles and firewalls.

[edit] How It Works

An AMT PC stores system configuration information in protected memory. For PCs version 4.0 and higher, this information can include the name(s) of appropriate “whitelist” management servers for the company. When a user tries to initiate a remote session between the wired PC and a company server from an open LAN, AMT sends the stored information to a management presence server (MPS) in the “demilitarized zone” ("DMZ") that exists between the corporate firewall and client (the user PC's) firewalls. The MPS uses that information to help authenticate the PC. The MPS then mediates communication between the laptop and the company’s management servers.^[1]

Because communication is authenticated, a secure communication tunnel can then be opened using TLS encryption. Once secure communications are established between the IT console and Intel AMT on the user's PC, a sys-admin can use the typical AMT features to remotely diagnose, repair, maintain, or update the PC.^[1]

[edit] Intel AMT Security Measures

Because AMT allows access to the PC below the OS level, security for the AMT features is a key concern.

Security for communications between Intel AMT and the provisioning service and/or management console can be established in different ways depending on the network environment. Security can be established via certificates and keys (TLS public key infrastructure, or TLS-PKI), pre-shared keys (TLS-PSK), or administrator password.^[1][2]

Security technologies that protect access to the AMT features are built into the hardware and firmware. As with other hardware-based features of AMT, the security technologies are active even if the PC is powered off, the OS is crashed, software agents are missing, or hardware (such as a hard drive or memory) has failed.^[1][2][17]

[edit] Using AMT in a Secure Network Environment

Because in-band remote management does not usually occur over a secured network communication channel, businesses have typically had to choose between having a secure network or allowing IT to use remote management applications without secure communications to maintain and service PCs.^[1]

Modern security technologies and hardware designs allow remote management even in more secure environments. For example, Intel AMT supports IEEE 802.1x, Preboot Execution Environment (PXE), Cisco SDN, and Microsoft NAP.^[1]

All AMT features are available in a secure network environment. With Intel AMT in the secure network environment:

• The network can verify the security posture of an AMT-enabled PC and authenticate the PC before the OS loads and before the PC is allowed access to the network.
• PXE boot can be used while maintaining network security. In other words, an IT admin can use an existing PXE infrastructure in an IEEE 802.1x, Cisco SDN, or Microsoft NAP network

[edit] Intel AMT in a Secured Network Environment: How It Works

Intel AMT can embed network security credentials in the hardware, via the Intel AMT Embedded Trust Agent and an AMT posture plug-in.^[1][2] The plug-in collects security posture information, such as firmware configuration and security parameters from third-party software (such as antivirus software and antispyware), BIOS, and protected memory. The plug-in and trust agent can store the security profile(s) in AMT’s protected, nonvolatile memory, which is not on the hard disk drive.

Because AMT has an out-of-band communication channel, AMT can present the PC’s security posture to the network even if the PC’s OS or security software is compromised. Since AMT presents the posture out-of-band, the network can also authenticate the PC out-of-band, before the OS or applications load and before they try to access the network. If the security posture is not correct, a sys-admin can push an update OOB (via Intel AMT) or reinstall critical security software before letting the PC access the network.

[edit] Security Postures Supported by Intel AMT Versions

Support for different security postures depends on the AMT release:

• Support for IEEE 802.1x and Cisco SDN requires AMT version 2.6 or higher for laptops, and AMT version 3.0 or higher for desktop PCs.^[1][15][16]
• Support for Microsoft NAP requires AMT version 4.0 or higher.^[1]
• Support for PXE boot with full network security requires AMT version 3.2 or higher for desktop PCs.^[1]

[edit] Intel AMT Security Technologies and Methodologies

AMT includes several security schemes, technologies, and methodologies to secure access to the AMT features during deployment and during remote management.^[1][2][17] AMT security technologies and methodologies include:

• Transport Layer Security, including pre-shared key TLS (TLS-PSK)
• HTTP authentication
• Single sign-on to Intel AMT with Microsoft Windows domain authentication, based on Microsoft Active Directory and Kerberos
• Digitally signed firmware
• Pseudo-random number generator (PRNG) which generates session keys
• Protected memory (not on the hard disk drive) for critical system data, such as the UUID, hardware asset information, and BIOS configuration settings
• Access control lists

As with other aspects of Intel AMT, the security technologies and methodologies are built into the chipset.

[edit] Versions

Intel AMT versions can be updated in software to the next minor version. New major releases of Intel AMT are built into a new chipset, and are updated through new hardware.^[2]

[edit] Management Engine firmware modules

• Active Management Technology (AMT)
• Alert Standard Format (ASF)
• Quiet System Technology (QST), formerly Advanced Fan Speed Control (AFSC)
• Trusted Platform Module (TPM)

[edit] Provisioning and Integration of Intel AMT

AMT supports certificate-based remote provisioning (full remote deployment), USB key-based provisioning (“one-touch” provisioning), and manual provisioning.^[1] An OEM can also pre-provision AMT.^[12]

The current version of AMT supports remote deployment on both laptop and desktop PCs. (Remote deployment was one of the key features missing from earlier versions of AMT and which delayed acceptance of AMT in the market.)^[7] Remote deployment lets a sys-admin deploy PCs without “touching” the systems physically.^[1] It also allows a sys-admin to delay deployments and put PCs into use for a period of time before making AMT features available to the IT console.^[26]

[edit] Intel vPro PCs Can Be Sold with AMT Enabled or Disabled

PCs with Intel AMT can be sold with AMT enabled or disabled. The OEM determines whether to ship AMT with the capabilities ready for setup (enabled) or disabled. Your setup and configuration process will vary, depending on the OEM build.^[12]

Intel AMT includes a Privacy Icon application that notifies the system's user if AMT is enabled. It is up to the OEM to decide whether they want to display the icon or not.

[edit] Disabling and Reenabling Intel AMT

Intel AMT supports different methods for disabling the management and security technology, as well as different methods for reenabling the technology.^{[1][26][27][28]}

[edit] Disabling Intel AMT

AMT can be partially unprovisioned using the AMT security credentials to erase configuration settings, or fully unprovisioned by erasing all configuration settings, security credentials, and operational and networking settings; or by resetting a specific jumper on the motherboard.^[29]

A partial unprovisioning leaves the PC in the setup state. In this state, the PC can self-initiate its automated, remote configuration process. A full unprovisioning erases the configuration profile as well as the security credentials and operational / networking settings required to communicate with the Intel Management Engine. A full unprovisioning returns Intel AMT to its factory default state..

[edit] Reenabling Intel AMT

Once AMT is disabled, in order to enable AMT again, an authorized sys-admin can reestablish the security credentials required to perform remote configuration by either:

• Using the remote configuration process (full automated, remote config via certificates and keys).^[1]
• Physically accessing the PC to restore security credentials, either by USB key or by entering the credentials and MEBx parameters manually.^[1]

[edit] Setup and Integration Tools

Setup and integration of Intel AMT is supported by a setup and configuration service (for automated setup), an AMT Webserver tool (included with Intel AMT), and AMT Commander, an unsupported and freeware application available from the Intel Web site.

[edit] See also

• Relationships between Intel vPro, Intel AMT, Intel Centrino 2, and Intel Core 2
• Intel AMT versions
• Intel vPro
• Intel Core 2
• Intel Centrino 2
• Host Embedded Controller Interface (HECI)
• Alert Standard Format (ASF)
• Distributed Management Task Force (DMTF)
• Intelligent Platform Management Interface (IPMI)
• Baseboard management controller (BMC)
• Trusted Platform Module (TPM)
• Northbridge (computing) (NB)
• Southbridge (computing) (SB)
• I/O Controller Hub (ICH)
• Out-of-band management
• Lights out management
• HP Integrated Lights-Out (HP/Compaq specific)

[edit] References

[edit] External links

• Intel Active Management Technology
• Intel Manageability Developer Community
• Intel vPro Expert Center
• Intel AMT Open Source Drivers and Tools
• Intel 82573E Gigabit Ethernet Controller (Tekoa)
• ARC4 Processor
• AMT videos (select the desktop channel)
• Free Intel AMT Client - Radmin Viewer 3.3