Changing the Landscape of PC Security
By Jonathan Schwartz
Sun's a few weeks away from shipping a PC desktop - returning to our
roots as a desktop company. Just as we listened carefully to the needs
of workstation users before upending that market some twenty years ago,
we've listened very carefully to the PC marketplace. We've spoken to
1,000s of customers in developing our plan. And with this week's
unveiling, we're prepared to deliver on that plan, and change the way
the world thinks about PCs - and thinks about the number one issue
worrying customers: PC security.
Before we talk about PCs, take a moment to think about your cellphone.
The United States is famous for having a less mature wireless
infrastructure
than either our European or Asian counterparts. But one thing holds true
across the planet: users don't make prank calls on mobile phones. Why?
Because they're authenticated. And what comes along with that
authentication? Commerce. Coupling authentication with convenience,
wireless carriers around the world did $6 Billion (yes, Billion) in
sales of musical ring tones. That's extraordinary.
Alternatively, where is it that most users do things you're ashamed to
tell
others about? Or steal music? Or write viruses? On a Windows PC, of
course. Why? Argue all you want about bad security models or weak
architectures - I'd claim it's a far simpler reason. Windows is an
unauthenticated platform. It's anonymous. And anonymity breeds mischief,
whether it's viruses, identity theft, or stolen music.
So how is Sun going to learn from the cellphone world in creating its PC
desktop? We're going to build in authentication from the start. The same
exact authentication technology the mobile phone and wireless carriers
have come to rely upon. It's called JavaCard, and you can find it in the
back of your cellphone.
Try it - pop the battery out of your phone, the odds are good you'll see
a SIM card, and that's a JavaCard. Dell now ships them with their
notebooks and PCs. You'll begin to see them more broadly across the
entire PC landscape.
And Sun's going to build in support for JavaCard authentication into Mad
Hatter. Mad Hatter will be secured by JavaCard, allowing users to filter
email by level of authentication. Guess what happens when you elect to
receive email from only users strongly authenticated with a JavaCard?
Spam disappears. So do viruses if the content's been strongly
authenticated.
But where are the JavaCards? Well, the US Government has already
deployed 5
million to the Department of Defense; they're called "CAC's" (Common
Access Cards). Visa has already deployed them in their Visa smartcard
program. The GSM community has obviously deployed them in 100s of
millions of cellphones. And the nations of Taiwan, Brazil, Belgium and
Thailand have all announced their JavaCard deployments. It's a little
known secret - but this is the most widely adopted standard for strong
authentication the network's ever seen. And we're going to integrate it
in Mad Hatter.
But what about Windows?
Over the past few months, since announcing Dell and Hewlett Packard at
our
JavaOne conference, we've been working away at signing up now over 60%
of the world's PC manufacturers to ship our Java runtime in their
Windows PCs.
Sun will be providing JavaCard support in the Java runtime payload we
deliver to the PC OEMs - effectively providing a neutral, non-Microsoft
controlled authentication mechanism, based on the same technology used
by Visa, the US Government, Taiwan, Brazil, the GSM Association, you
name it.
Plausible?
You bet.
Practical, even.
And this is only the beginning.
The world needs a more secure PC - running Mad Hatter, or running
Windows. Once again, JavaCard, as with Java, will ensure the portability
of that technology across platforms. Like we've always said, "Write
Once, Run Anywhere."
We're back.
Jonathan Schwartz is executive vice president of software at Sun
Microsystems.
 Back to top
| 
