Solution Recipe: Improve PC Security and Reliability with Intel Virtualization Technology

(1)

Solution Recipe: Improve PC Security and

Reliability with Intel® Virtualization Technology

30406_VT_Brochure.indd 1

30406_VT_Brochure.indd 1 6/20/06 4:01:14 PM6/20/06 4:01:14 PM

(2)

Preface

Intel has developed a series of unique Solution Recipes designed for channel members interested in providing complete solutions to their customers, backed by top-quality technology and support. A solution recipe describes how to combine Intel®-based ingredients to create new technology solutions for common business challenges.

This recipe illustrates how business productivity and PC security can be improved with Intel® Virtualization Technology (Intel® VT) — a hardware-based technology for enabling virtualization in the PC¹. When you are ready to deploy this recipe, please refer to the related Solution Deployment Guide, which includes step-by-step instructions. You can fi nd the guide by visiting: www.intel.com/go/reseller/vpro or www.intel.com/go/solutions

Common Notations and Terms

Virtualization: A virtualized computer can run multiple operating systems and applications on the same machine in independent partitions or “containers.” In other words, virtualization allows one computer to act as if it were several computers working in parallel.

Intel® Virtualization Technology (Intel® VT): This technology permits one hardware platform to function as multiple virtual platforms. It offers improved system manageability, which helps limit downtime and maintain worker productivity.

Virtual Machine Monitor (VMM): A layer of software that virtualizes a computer’s hardware resources (for example, CPU, memory, network interface) into multiple virtual machine environments.

Solution Recipe: Improve PC Security and Reliability with Intel® Virtualization Technology | Page 1

Meeting New Market Opportunities

Today’s IT professionals are facing increasingly complex challenges in the areas of PC productivity, manageability, and security. Businesses are demanding more effi cient use of their computing systems. End users can become frustrated by perceived workfl ow interruptions on the network.

Extensive use of e-mail and Web browsing exposes PCs to viruses, worms, and other malicious attacks that could put the company’s entire network at risk. The good news is that many of these concerns can be addressed with virtualization technology for PCs.

Virtualization is a proven technology that allows one computer system to function as multiple “virtual” systems. It enables multiple operating systems and application stacks to be hosted in distinctly separate areas (known as partitions) on a single computer system at the same time. Until recently, virtualization was used almost exclusively by IT professionals, mostly on the server side. But today, virtualization technology is expanding onto end-user PCs—bringing with it remarkable potential to improve basic business operations.

Intel VT is a hardware-based technology for enabling virtualization in the PC. Because of this development, leading software developers are already working on more secure, more productive solutions enabled by Intel VT. Intel’s latest PC innovation, Intel® vPro™ technology, was created to fully optimize this new, built-in virtualization capability. With the ability to create secure, dedicated partitions, you can confi gure each customer’s network to fi t their specifi c need—a clear benefi t to your customers, and a promising new source of revenue for you.

Bottom line: PCs equipped with Intel vPro technology and Intel VT can help businesses of all sizes improve productivity, manageability, and security—and it is available today.

Addressing New Market Opportunities

1 Intel® Active Management Technology (Intel® AMT) requires that the platform have an Intel® AMT-enabled chipset, network hardware and software, connection with a power source, and a network connection.

(4)

Solution Overview

Traditionally, virtualization has been purely software-based. But now, in PCs equipped with Intel vPro technology and Intel VT, many virtualization capabilities are built directly into the hardware. This simplifi es numerous computing processes for the virtualization software, resulting in more reliable and compatible virtualization solutions.

Software-only Virtualization

In software-only virtualization solutions, the Virtual Machine Monitor (VMM) controls physical server resources so that it can manage the demands of multiple “guest” operating systems. To provide that level of control, the VMM runs in the space traditionally reserved for the operating system, and guest operating systems run in the space traditionally used for applications. Because the operating systems are

Solution Recipe: Improve PC Security and Reliability with Intel® Virtualization Technology | Page 3 not designed to run in this application environment, complex software workarounds are required for them to function reliably. This creates signifi cant issues for IT managers, including:

• Potential incompatibility with legacy operating systems, which increases testing and validation requirements when consolidating legacy applications onto new servers

• Increased likelihood of software confl icts due to the complexity of the VMM application

• Additional performance overhead necessary to handle the complex software workarounds

• Dependent VMM and operating system development, so the VMM vendor must continually adapt to operating system upgrades and patches (and vice-versa)

• Synchronized upgrades and patching in IT environments, which adds to complexity, expense, and risk

(5)

Intel® Virtualization Technology (Intel® VT)

With Intel VT, your customers get hardware-based virtualization that works with compatible virtualization software. Together, they address the challenges faced by software-only solutions. Specifi cally, Intel VT offers:

• A new, privileged space for the VMM that reduces the need for VMM intervention and allows guest operating systems to run directly on hardware

• Handoffs between the VMM and guest operating systems that are supported in hardware, reducing the need for complex, compute-intensive, time-consuming software transitions

• Hardware-based memory protection, in which processor-state information for the VMM and each guest operating system is retained in dedicated address spaces, accelerating transitions and helping to ensure process integrity

• Ability to create virtual appliances, which are self-contained operating environments dedicated to a particular function, such as manageability or security

Solution Recipe: Improve PC Security and Reliability with Intel® Virtualization Technology | Page 4 On PCs with Intel vPro technology, Intel VT provides the ability to create and control numerous separate virtual machines. Each of these partitions can be isolated and controlled independently of the others, creating work areas for multiple users on one PC. Each of the partitions can also be quickly reconfi gured, allowing IT to add, delete, or transfer resources to meet changing business needs. With this technology, IT can strengthen network security, improve manageability, and boost productivity—all at the same time.

(6)

Solution Recipe: Improve PC Security and Reliability with Intel® Virtualization Technology | Page 5 Security

Businesses can isolate critical applications, such as accounting or Customer Relationship Management (CRM) software, from the rest of the system. If a vulnerable part of the system gets infected, such as the e-mail or Web browsing partition, it can be quarantined to prevent it from infecting other applications.

Manageability

Virtualization support will allow businesses to maintain full control of a portion of a PC to run security or management services in a dedicated space on the system. By housing the “management agents” in separate partitions, IT managers can monitor and manage these platforms without interrupting business operations. They can perform functions like hardware inventory management, provisioning, or diagnostics without interrupting the user.

Productivity

Creating different partitions for IT and end users allows for upgrades and patches without interrupting workfl ow. You can also run multiple operating systems and applications (for example, continue using older proprietary software, but use new offi ce software) and test upgrades to software without interrupting end users.

Suggested Uses

Desktop PCs with Intel vPro technology and Intel VT are specifi cally designed to address top IT challenges in security, productivity, and manageability at the hardware level. A typical setup may include virtual machines for key applications such as:

Isolation/containment Partition: A separate partition to isolate and contain any virus infections that try to breach the network through a PC.

Common sources include Web browsing, e-mail, and fi le sharing/downloads.

Voice Over Internet Protocol (VoIP) Partition: Create a dedicated space to host an “always on” VoIP (Internet-based phone service).

Business critical applications can be segregated to separate partitions to reduce risk

VMware* (virtual machine manager)

Intel® vPro™ technology-based PC

Web

Browser E-mail

Operating System Other Office Applications

Operating System

VoIP Software

Operating System CRM, ERP, Accounting Applications

(7)

Key Technology

Intel® VT

Hardware-based virtualization technology that reduces the workload of virtualization software. This technology is optimized for Intel® Core™2 Duo desktop processors and provides more robust virtualization capabilities.

Intel® Core™ 2 Duo Desktop Processors

Powerful Intel® Core™ 2 Duo desktop processors offer a substantial upgrade in processing capacity at reduced power-consumption levels.

VMware*

Optimized for use with Intel® Core™ 2 Duo desktop processors, VMware*

helps deliver a virtualization experience. Benefi ts include helping to secure desktop data, enabling easier remote network access and consolidating multiple desktop environments on to one PC or server.

(8)

Solution Benefi ts

Benefi ts for Intel® Channel Partner Program Members

By offering desktops with Intel vPro technology and Intel VT, you can solidify your position as a vendor who offers complete solutions, not just products. The best part about offering Intel VT is that almost any company or business function has a legitimate need for it.

Online Retail Sales

Do any of your customers carry out business online with credit cards?

They will certainly want to keep that information secure.

Human Resources

How about your company’s HR records? You don’t want everyone in the company to have access to that information, so a separate, secure, virtual partition would be a good solution.

Product Development

Companies such as software development fi rms would appreciate the ability to keep different operating system partitions, which would

allow for easy testing of their products on different platforms (for example, Microsoft Windows*, Linux*, Apple Macintosh*).

Education

Schools could take advantage of the ability to run multiple operating systems and applications, broadening their offerings to students.

New Revenue Streams

With Intel VT, you also open the possibility of creating new revenue streams by extending your service offerings to customers, such as providing remote management of virtual machines using the VMware* remote console. You can gain remote access to a customer’s virtual machine, even when remote management capability isn’t provided by the particular operating system or application. In addition, because you are able to create a dedicated service partition inside the customer’s server, you can run the service activities unnoticed and isolated from your customer’s end users.

(9)

Benefi ts for Your Customers

Desktop PCs with Intel vPro Technology and Intel VT provide simple remote management and tamper-resistant security capabilities. This means IT has more control where they need it—at the console—which delivers a number of key benefi ts:

Improved PC Security

Specifi c applications, such as e-mail or Web browsing, can be assigned to their own partition on PCs. These separate partitions create a way for IT to isolate viruses and other threats so that they don’t infect other PCs on the system. This translates to more server uptime and more productivity for end users.

End Users Isolated from Security Settings

IT functions can be placed on separate partitions from end-user applications. This limits access to key security tools, such as anti-virus and fi rewall settings, which could be turned off by end users, exposing the PCs on your network to viruses, worms, or other malicious attacks.

Fewer Service Interruptions

Automatic failover partitions provide an easy, cost-effective way to keep the system running. If an application fails, the system can automatically switch over to a parallel backup application, which limits downtime for end users.

Enhanced Manageability

Confi guration of multiple partitions allow IT to isolate end-user system management agents, which otherwise might be vulnerable to end-user tampering. Separate partitions on a PC can also help improve manageability by providing the fl exibility to migrate to newer operating systems while still making use of older operating system environments and applications.

Easier Migration to New Software

Many companies use custom software for areas such as human resources, logistics, or purchasing. When they migrate to a new operating system or offi ce application, there is no need to immediately update all of the proprietary software. Instead, proprietary software can be assigned its own partition and continue to function as usual. In addition, new operating system platforms and offi ce applications can run concurrently with old software. Then, when end users are profi cient with the new software, the old software can be removed from the system, creating more space—all of which saves both time and money.

(10)

Solution Recipe

Software Architecture

VMware* Workstation virtualization software makes the operating system and applications run in a virtual machine environment. This makes these components hardware-independent (that is, hardware platform support is no longer required by these software components).

The VMware Workstation virtual machine can be provisioned to any Intel vPro technology-based platform and it can manage multiple operating systems and applications as a single unit by encapsulating them into virtual machines.

System Architecture

The Intel vPro platforms, coupled with VMware Workstation software, are ideal for enabling small- and medium-sized businesses to consolidate multiple client platforms into one high-performance platform at a low cost. It is easy to set up the software, and built-in Intel VT helps it run effi ciently on Intel vPro platforms.

Components Necessary to Build

• Intel vPro technology-based platform with Intel VT

• Microsoft Windows XP* Pro SP2 (with Intel® PRO/1000 Network driver)

• VMware Workstation* for Microsoft Windows 5.5.1

• Guest operating system (OS)—Microsoft Windows NT* 4.0 Server, Red Hat*

Linux Desktop 4 update 2, Ubuntu* 5.10 NOTE:

The guest operating systems listed above are only a sampling of those that work with Intel® Virtualization Technology, not a complete list.

(11)

Solution Recipe: Improve PC Security and Reliability with Intel® Virtualization Technology | Page 10 Support

Solution Support

Intel has tested and verifi ed the components in this virtualization solution for PCs recipe. Please continue to use your existing Intel® Support Services (http://www.intel.com/go/Channel/Support) for information on Intel®-based hardware, including Intel® Processors, Intel® Desktop and Server Boards, and associated drivers.

For your convenience, Intel has worked with several independent software vendors, open source vendors, and application vendors to streamline technical support for this solution. For more information on the third-party hardware and software products, please download the Solution Deployment Guide (www.intel.com/go/reseller/vpro or www.intel.com/go/solutions) to obtain the specifi c list of vendors and contacts.

(12)

Intel, the Intel logo, Intel. Leap ahead. the Intel. Leap ahead. logo, Intel vPro, the vPro logo, Xeon, the Xeon logo, Intel Core and Core Inside are trademarks or registered trademarks of Intel Corporation or its subsidiaries in the United States and other countries.

*Other names and brands may be claimed as the property of others.

Intel Literature Center: 1-800-548-4725 Order Number: 313333-001US

Printed in USA/06/06/JW/KC/PDF

Information in this document is provided in connection with Intel® products. No license, express or implied, by estoppel or otherwise, to any intellectual property rights is granted by this document. Except as provided in Intel’s terms and conditions of sale for such products, Intel assumes no liability whatsoever, and Intel disclaims any express or implied warranty, relating to sale and/or use of Intel products including liability or warranties relating to fi tness for a particular purpose, merchantability, or infringement of any patent, copyright or other intellectual property right.

Solution Recipe: Improve PC Security and Reliability with Intel Virtualization Technology