What is the “nexus” component of NGSCB?
The nexus is a new Windows-based component that will be introduced as part of NGSCB. The nexus is essentially the kernel of an isolated software stack that runs alongside the existing OS software stack. The nexus provides a limited set of APIs and services for applications, including sealed storage and attestation functions. One can think of the nexus as residing in the kernel mode space of the parallel execution environment and nexus computing agents (NCAs, the special processes that the nexus commissions) as residing in the user mode space. NGSCB is being designed so that a Windows-based PC with the requisite hardware will be able to run different nexuses, although only one nexus at a time will be able to run on a machine. Anyone can write a nexus (licensing issues will be involved and licensing terms have not yet been announced). The user always has the ultimate authority over what nexuses are allowed to run.
