================================================================================
Intel(R) SW Solution for Transparent Computing 1910 Pre-production Release

RELEASE NOTES

April 09, 2020
================================================================================

================================================================================
                                   DISCLAIMER
================================================================================
These release notes as well as the software described in it is furnished under
license and may only be used or copied in accordance with the terms of the
license. The information in this manual is furnished for informational use only,
is subject to change without notice, and should not be construed as a
commitment by Intel Corporation. Intel Corporation assumes no responsibility
or liability for any errors or inaccuracies that may appear in this document or
any software that may be provided in association with this document. Except as
permitted by such license, no part of this document may be reproduced, stored
in a retrieval system, or transmitted in any form or by any means without the
express written consent of Intel Corporation.

================================================================================
                                ADDITIONAL DISCLAIMER
================================================================================
This release is provided with a full release level test.
Other notifications please refer to the "Other notes"section.

================================================================================
RELEASE NOTES CONTENTS
================================================================================

A. OVERVIEW
B. FILES LIST
C. TARGET OPERATING SYSTEM
D. HOW TO DEPLOY TRANSPARENT COMPUTING
E. NEW FEATURES AND/OR FIXES
F. KNOWN ISSUES
G.  INTENDED AUDIENCE   
H.  CUSTOMER SUPPORT   
I.  OTHER NOTES   

================================================================================
A.  OVERVIEW
================================================================================
Transparent Computing (TC) can be thought as a special kind of cloud computing 
that regards storage as a service. TC logically splits the software stack from 
the underlying hardware platform, and separates the computing unit from storage 
for the purpose of making the same software run on different hardware and 
different software run on the same hardware. 
The Intel(R) Software Solution for Transparent Computing is specifically 
designed and implemented for client computing markets like education, enterprise 
and government with Intel Desktop Platforms and wired network environment. A lot 
of optimization have been done compared with previous releases, such as 
performance, scalability, reliability, manageability and usability. 

================================================================================
B.  FILES LIST
================================================================================

1. "ReleaseNotes.txt"
    (this file)

2. TC_1910_Preproduction_Installer.tar.gz
   which contains user manuals, the image export tool, and the installation 
   packages of server and client

================================================================================
C.  TARGET OPERATING SYSTEM
================================================================================
  
- Windows* 7 (32 & 64 bit)
- Windows* 10 (32 & 64 bit)
- Ubuntu* 14.04 (32 bit)
- Android* 4.4-R3 (32 bit)

================================================================================
D.  HOW TO DEPLOY TRANSPARENT COMPUTING 
================================================================================
0. Complete the installation package

   Unzip file "TC_1910_preproduction_Installer.tar.gz" and follow steps of user manuals in 
   "TC_1910_Release/docs" directory.
   
1. Prerequisites before Installation

   Hardware

   a. Server side:
  One server machine with Linux* installed. CentOS 7.4 (X86_64) is recommended;
  Hard disk:    SATA 1 TB or above, RAID recommended;
  Memory:       4 GB or above, 16 GB recommended;
  CPU:          Intel® Xeon™ processor recommended;
  Network Card: 1000Base-TX or 1000Base-FX.

   b. Client side:
  Desktop PC with Intel platform;
  Memory:2GB or above, 4GB memory recommended;
  CPU: Intel® Pentium™, Celeon™, Core™ i3/i5/i7 processor recommended;
  Network Card: 1000Base-TX or 1000Base-FX.

   c. Other equipment:
  One network switch with 1000Base-TX, 1000Base-FX;
  Network cable.

   Notes: 

   a. For software prerequisites on server side, dnsmasq and tftp is 
      required for client to get IP address and download the boot loader; a 
      database, such as MySQL, is needed for server to support multi-clients.

   b. For the local cache enabled solution, please refer to the user manual 
      on how to deploy it.

   c. Please don't use TC under WAN condition

   d. Recommend user enabling standard MYSQL master-slave backup mechanism by default

2. Generate TC installation package

   Please refer to the "TC Development Guide" document in the release package.

3. How to Install Transparent Computing

   Server side: Please refer to the "TC Installation & Configuration Guide"
                document in the release package.

   Client side: Please refer to the "TC OS Images Creation Guide" document in
                the release package.

4. How to Run Transparent Computing

   Please refer to the "TC Installation & Configuration Guide" document in the
   release package.  


================================================================================
E.  NEW FEATURES AND/OR FIXES
================================================================================
Coffee Lake platform
1. fixed USB and PS2 keyboard abnormal when user enter import tool menu.
2. fixed communication issue between client and server when user enter export
   tool menu
3. fixed image import to external HDD fail issue when user do export image to 
   external HDD.
4. fixed speed slow issue when user export image to external HDD.

Skylake Platfrom
1. Support WAN access TC sevices issue under NAT environment.
2. Support Windows Active Directory.
3. Support user personal configuration auto upload.
4. Support specific group auto access specific image.
5. fixed client register info miss issue.
6. fixed access failure info when client was disable.
7. Add Client personal configuration auto upload info in user status menu
8. Add Group-Wake button in TC server menu, same as group restart, 
   group shut down.
9. Add Double Confirm button when admin do operations like "restart" "Shut down"
   "initialization".
10. Update remind info "operation finish" to "no update" when user click update
    and there is no actually update package.
11. Update password policy same between password lenth under web and password
    length under TC
12. Update speed limiation info same between server and TC client, TC client
    show speed limitation when server set speed limitation, otherwise, no need
    to show speed.
13. Update policy that guest and admin can not use under offline mode.
14. Add client name info query button in client side.
15. Update system IP sync as IP in TC system
16. Add restore point description info once system finish image restore
17. Fixed UUID modify issue when IT admin re-register image
18. Remove server IP info in TC menu to increase server security.
19. Remove shut donw button in client OS on the WIndows Auto download update to avoid miss operation
20. fix USB disk recognize issue after TC driver install.
21. fix language issue when client install TC system. remove limitation on language of TC install.
22. fix IP info access issue in non-Chinese environment after client enter OS. 
23. add feature of pull-down update package in client side
24. add feature of Windows Active Directory Support.
25. fixed progress bar issue with real percentage when user upload personal configuration data
26. fix compatability issue with IE8 and 360 browser.
27. add "whole client" column in the drop-down list of group wake up.
28. fixed "_" and "-" character support in Client register name
29. Add personalization data Auto-upload support
30. Add personalization data manual upload support
31. Update remind info to no image update when there is no image update.
32. Remove Update cancel when system do image restore update.add remind info that update can not be cancel
33. add remind info to user that need to delete previous image compare to the image that user want to delete
34. fixed blue screen issue when personlized user using different version Win10



================================================================================
F.  KNOWN ISSUES
================================================================================
Reference 1: 
Title:
Windows* 10 BurnInTest result failed because of disk error

Description:
The root cause turned out to be that the disk is full.

Implication:
To avoid the disk space full error when running OS, the size of the first 
partition (/dev/sda1) of cache device should be more than double size of the 
deployed OS image.

Affected O/S:
Windows 10.



Reference 3:
Title:
Weak error handling mechanisms for TC system backup feature

Description:
Some exceptions are not well covered for TC system backup feature. For example,
powering off or rebooting the backup server during the process of TC system
backup will definitely lead to operation failure, however, no error messages
are provided on Web pages to draw one's attention.

Implication:
Incomplete information for the user.

Affected O/S:
N/A

Reference 6: 
Title:
The data size that transfered is large than actual size when backup data,
 due to personalized sparse files

Description:
The root cause turned out to be sparse files.

Implication:
When backup server that contains personal user data, it may takes longer 
time.

Affected O/S:
CentOS 7.4


Reference 8: 
Title:
Some error message/feature request not implemented on client UI 

Description:
When client in WAN launch image with WAN service/TC service turned off, the 
error message is not accurate. And the UI is in Chinese by default, don't 
support change language between English and Chinese. Client UI don't check 
firmware version, after change server IP on client UI.

Implication:
When login fail on client UI, please check the WAN service/TC service status.
User can manually reboot client to launch firmware update operation.

Affected O/S:
CentOS 7.4


Reference 9: 
Title:
Some displays/operation on web console image list are not friendly 

Description:
When mouse hover on image list, it don't shows link selection. And the name 
of image don't support Chinese. Don't support exporting image UUID to csv

Implication:
Don't use Chinese as image name. And just click the link of image list, 
ignore the link selection.

Affected O/S:
CentOS 7.4



Reference 13: 
Title:
Remote desktop may shows black color backgroup when TC client running windows7/10 image.

Description:
When control TC client running windows7/10 image with remote desktop, it may display black color backgroup.

Implication:
It can be fixed by manually set background on "Remote Desktop" software.

Affected O/S:
Windows 7/10

Reference 14: 
Title:
Personal user fail to migrate personal data between Windows image of Chinese simplified/traditional language.

Description:
Blue screen may occurs when migrate personal data between Windows image of Chinese simplified/traditional language.

Implication:
Don't migrate personal data between Windows image of Chinese simplified/traditional language.

Affected O/S:
CentOS 7.4


Reference 15: 
Title:
Some special characters in description may cause user group register failure.

Description:
Some special characters in description may cause user group register failure(e.g.: ~!@#$%^&*()_+{}WEFWEFWEF{}|:"<>?[]\;',./).

Implication:
Don't use special characters in description (e.g.: ~!@#$%^&*()_+{}WEFWEFWEF{}|:"<>?[]\;',./).

Affected O/S:
CentOS 7.4

Reference 16: 
Title:
The client can be controlled to restart/shutdown when initializing client.

Description:
When client is init.

Implication:
When initlizing client, client can be reboot/shutdown via web console.

Affected O/S:
CentOS 7.4


Reference 18: 
Title:
TC client need to download image file every time when it launch OS image

Description:
TC client need to download image file every time when TC client launch OS image.

Implication:
known as limitation on TC 1910 SDL version.

Affected O/S:
All supported OS


Reference 19: 
Title:
Web console don't show success message after user modified user password completed

Description:
Web console don't show success message after user completed user password moodify

Implication:
known as limitation on TC 1910 SDL version.

Affected O/S:
All supported OS

Reference 20: 
Title:
Some of the low priority MySQL configuration don't match security requirement

Description:
MySQL configuration with different priority may impact security requirement, current find on some of low priority configuration.

Implication:
known as limitation on TC 1910 SDL version.

Affected O/S:
All supported OS

Reference 21: 
Title:
Client UI sometimes display abnormally when running with UEFI mode

Description:
Client UI sometimes display abnormally when running with UEFI mode

Implication:
known as limitation on TC 1910 SDL version.

Affected O/S:
All supported OS

Reference 22: 
Title:
Web console may display abnormal error message when delete all image sync peer

Description:
Web console may display abnormal error message when delete all image sync peer

Implication:
known as limitation on TC 1910 SDL version.

Affected O/S:
All supported OS

Reference 23: 
Title:
Web console may display abnormal error message when delete admin user

Description:
Web console may display abnormal error message when user delete admin user

Implication:
known as an issue on TC 1910 SDL version.

Affected O/S:
All supported OS

Reference 24: 
Title:
WAN service currently don't work on TC 1910 SDL version

Description:
WAN service currently don't work on TC 1910 SDL version

Implication:
known as limitation on TC 1910 SDL version.

Affected O/S:
All supported OS

Reference 25: 
Title:
more than 100 users one time register may cause failure and timeout 

Description:
User should limit the number(suggest register less than 100 users once a time) of batch user register, it may cause failure and timeout

Implication:
known as limitation on TC 1910 SDL version.

Affected O/S:
All supported OS

Reference 26: 
Title:
admin user's password change may cause fail to open setting UI with default password when client network is down

Description:
admin user's password change may cause fail to open setting UI with default password when client network is down

Implication:
known as limitation on TC 1910 SDL version.

Affected O/S:
All supported OS

Reference 27: 
Title:
Client fail to auto login and launch image, after change client name on web console

Description:
TC Client fail to auto login and launch image, after user changed client name on web console

Implication:
known as limitation on TC 1910 SDL version.

Affected O/S:
All supported OS


Reference 28: 
Title:
Windows OS sometimes shows that the drive is being scanned and repaired, after downloading the image in uefi mode and entering the system

Description:
Windows OS sometimes shows that the drive is being scanned and repaired, after downloading the image in uefi mode and entering the system

Implication:
known as limitation on TC 1910 SDL version.

Affected O/S:
All supported OS

Reference 29: 
Title:
Client can not lock/unlock screen when running windows image

Description:
Client cann ot lock or unlock screen whtn client is runing windows image, this is supported on previous version but known issue on TC 1910 SDL version

Implication:
known as limitation on TC 1910 SDL version.

Affected O/S:
All supported OS


Reference 30: 
Title:
Client did not support Auto upload personal user data to server on TC 1910 SDL version

Description:
Client did not support Auto upload personal user data to server on TC 1910 SDL version, this is supported on previous version but known issue on TC 1910 SDL version

Implication:
known as limitation on TC 1910 SDL version.

Affected O/S:
All supported OS


Reference 31: 
Title:
Personal and admin user can’t upload user data to server on TC 1910 SDL version

Description:
Personal and admin user can’t upload user data to server on TC 1910 SDL version, this is supported on previous version but known issue on TC 1910 SDL version

Implication:
known as limitation on TC 1910 SDL version.

Affected O/S:
All supported OS


Reference 32: 
Title:
Update image point and image restore point did not support on SDL version

Description:
Update image point and image restore point did not support on SDL version, this is supported on previous version but known issue on TC 1910 SDL version

Implication:
known as limitation on TC 1910 SDL version.

Affected O/S:
All supported OS


Reference 33: 
Title:
Client can not save personal and admin user data on local disk on TC 1910 SDL version

Description:
Client can not save personal and admin user data on local disk on TC 1910 SDL version, this is supported on previous version but known issue on TC 1910 SDL version

Implication:
known as limitation on TC 1910 SDL version.

Affected O/S:
All supported OS


Reference 34: 
Title:
client did not support Disable/enable USB key on client or change client resolution from web console

Description:
client did not support Disable/enable USB key on client or change client resolution from web console, this is supported on previous version but known issue on TC 1910 SDL version

Implication:
known as limitation on TC 1910 SDL version.

Affected O/S:
All supported OS


Reference 35: 
Title:
TC1910 SDL release did not support Disk management(clean/deep clean) 

Description:
TC1910 SDL release did not support Disk management(clean/deep clean), this is supported on previous version but known issue on TC 1910 SDL version

Implication:
known as limitation on TC 1910 SDL version.

Affected O/S:
All supported OS


Reference 36: 
Title:
TC1910 SDL release did not support to Remember ID/offline mode/guest user on client UI 

Description:
TC1910 SDL release did not support to Remember ID/offline mode/guest user on client UI, this is supported on previous version but known issue on TC 1910 SDL version 

Implication:
known as limitation on TC 1910 SDL version.

Affected O/S:
All supported OS


Also please refer to user manual chapter 6-7 and related build documentation for security related recommendations. 

===============================================================================
G.  INTENDED AUDIENCE   
===============================================================================

OEM/ODM software developers, test and validation engineers, system integrators.

===============================================================================
H.  CUSTOMER SUPPORT   
===============================================================================

For technical support and answering questions, please contact Field Application Engineer (FAE) or equivalent support team. 

===============================================================================
I.  OTHER NOTES   
===============================================================================
1.  Virus scanned by McAfee Endpoint Security 10.6, no virus detected.

2.  Chrome only for web console

3.  Administrator should turn off the "remember password" feature of browser to
    low down the security risk.

4. Security Alert and Mitigation Suggestion of TC1910 Preproduction release 
Based on SDL Process Feedback

This documentation intends to provide some potential security risks in TC1910 
preproduction release based on SDL process, especially SAFE review feedback, together 
with technical assessment of the current design and implementation. 
The following risks are related to current design and implementation, mainly 
network communication protocols between TC server and TC client, service provided 
in both TC server and TC client, as well as system level security risks. 
The following list of risks does not stand for all risks in TC1910 preproduction 
release – we just try best to provide the alert list as maximal of our knowledge 
but does not guarantee all risks are included. 
Mitigation suggestion is provided together with each potential risk. Please apply 
them together with real situations and safety criteria flexibly. 

1, WOL (Wake-on-LAN) magic packet
WOL mechanism is used by TC server to remote power-on or wake-up specific TC client. 
WOL is assumed to be used ONLY in secure controlled network, which means the network 
connectivity, quality and information leakage risk are under control. 
The risk of WOL mechanism is the packet content and correspondent information in the 
payload, e.g., MAC address of specific TC client, could be sniffed by malicious network 
agent in the office network. 
Mitigation suggestion: avoid using WOL on unsecure network environment. Alternatively, 
an USB-thumb based bare-metal initialization tool is provides to replace PXE if necessary. 

6, Control & status service
Control & status agent or service is exposed at TC client, which will be used by TC server 
to control the client like reboot or shutdown, or fetch run-time status of the client device. 
The exposed service could be potentially attacked by malicious network agent. 
The content or payload of control & status service is transferred via TCP connection without 
encryption, so it’s possible for malicious external agent to sniff the content. Also the packet 
with control commands could be sniffed, copied and reproduced by malicious agent, which may 
be used to ILLEGALLY control the TC clients as fake TC server like reboot or shutdown the client.  
Mitigation suggestion: use control & status service in secure network environment. Make sure 
only authenticated TC server could control and collect information from different TC clients. 

7, PXE boot mechanism 
PXE boot mechanism is used to load the initial pre-boot payload for TC client bare-metal 
and initialize the client devices. PXE is the standard pre-boot initialization protocol 
and the spec could be found here http://www.pix.net/software/pxeboot/archive/pxespec.pdf. 
PXE is totally unsecure regarding: 
•	PXE content is plain-text based 
•	PXE does not have authentication for client and server communications
So the potential attack could be: 
•	TC client could be redirected to a faked PXE server to download a malicious payload 
	and be controlled, 
•	PXE transfer is plain-text w/o encryption, so possibly the payload could be stolen 
	by agents, also PXE procedure could leak IP address and DNS information. 
Mitigation suggestion: ONLY use PXE in secure network environment. Make sure only authenticated 
users or devices could access the TC system. 


9, TC pre-boot payload
TC pre-boot payload system is actually an embedded OS system acting as BIOS payload, which 
by default has a TTY/shell to configure the system for debugging purpose. However, limited 
by current design the payload TTY/shell is not disabled and simply protected by a hard-coded 
password, which would be illegally accessed potentially, and cause information leak or client 
system misfunction. 
Mitigation suggestion: make sure the network environment is secure while deploying OS images 
or update pre-boot payload. Strictly protect default payload login password. 

10, Database / MySQL
MySQL is used as TC server system database for configuration and user information storage, 
e.g., user list, device list, OS images.
The database system is at TC server and will potentially be accessed by either local or remote
 attackers. This will cause information leak like user list. 
Mitigation suggestion: set up user name and password for database access. Limit the database 
service only at local – database cannot be access from remote. Keep underlying OS safe by: 
on-time upgrade of latest kernel, set up role-based access to different files, etc. 

11, TC server host operation system
TC server is actually a Linux server box, and CentOS is used as TC server OS which could 
potentially illegally accessed by privilege escalation or admin password brute force attacked. 
The defect of Linux kernel or distribution could cause TC server illegally accessed by malicious 
system administrators, which will cause information leak (user list, device list, image 
information, authentication data, OS images, database system, etc) or system mis-configuration. 
Mitigation suggestion: protect system administrator password; role-based access for different 
types of files and data; on-time upgrade latest Linux kernel and apply latest security patches; 
close unnecessary network services at TC server. 


14, Generic IO attack
Generic IO attack like DoS to exposed service in both TC server and TC clients. 
Mitigation suggestion: set up rate limit control in firewall or network security gateway; 
limit the inbounding rate to a specific target from a specific source host. 

15, WAN environment risks
Although we provide a simple WAN access mechanism for remote TC client access to TC environment 
in internal network, please keep in mind that TC client is not suggested to be used in WAN environment 
without any protection; TC server should not be used in WAN environment without any protection. 
The protection of external network, especially public network, relies on network security infrastructure 
like firewall, intrusion detection system, and related software management solutions. 
Compared with LAN environment w/o firewall or other network protection, WAN environment will obviously 
have more risk.
Mitigation suggestion: use firewall or intrusion detection mechanism to protect the network safety; 
apply suitable network security policy in these network security equipment; take effective administrative 
regulations to all users and system administrators; try to use VPN as much as possible; for remote access 
of TC client in WAN environment, VPN is strongly preferred in connection between client and server.  

16, Leakage of personal data in OS images caused by image file theft
The image and personal data are stored or cached at both TC server and TC client. However, TC server box 
or client system are potentially having the risk of being attacked by privilege escalation so image files
 even personal data in the images could be stolen. Also physical damage or stolen of hard drive devices 
could also lead to sensitive data loss. 
Mitigation suggestion: physically protect the hard disk in both server and client hardware; use OS level 
disk encryption mechanism like BitLocker to encrypt the whole image; data cache refresh and wipe-off 
in each reboot and shutdown.

17, Server system administrator password loss
TC server is a Linux (CentOS) box, which is protected by password. 
If the administrator or user password is lost, the whole TC server system is in risk. 
Even only general user (non-privileged user) password is lost, experienced attackers could use privilege 
escalation, inter-process memory dump or other method to get privilege authentication and further break 
into the system as root. This will cause high risks for both data security and TC system service disruption. 
Mitigation suggestion: physically protect password, especially privileged users’ password; on-time upgrade 
latest Linux kernel to minimize the known security issues; regularly change password; do not use simple 
string as password; 

18, risk of client device clone 
TC client is connected to TC system via device ID, which is currently the MAC address of network adapter. 
It’s protected by authentication service at server side, which is potentially in risk if client MAC 
address is a fake one.  
Mitigation suggestion: physically make sure the connecting client device is validated, 
and off-line check especially in WAN environment.  

* Other names and brands may be claimed as the property of others.
  
[END OF RELEASE NOTES]