Configuring functional capabilities of a computer system

• US 10,169,252 B2
• Filed: 07/15/2016
• Issued: 01/01/2019
• Est. Priority Date: 07/15/2016
• Status: Active Grant

• Current Assignee: International Business Machines Corporation
• Original Assignee: International Business Machines Corporation
• Inventors: Axnix, Christine, Hardt, Franz, Kraemer, Marco, Lang, Jakob C.
• Primary Examiner(s): Abbaszadeh, Jaweed A
• Assistant Examiner(s): Derose, Volvick
• Application Number:
  US15/211,347
• Publication Number:
  US 20180018180A1
• Time in Patent Office: 900 Days
• Field of Search: 713 1
• CPC Class Codes: G06F 12/1408 by using cryptography for digital transmission H04L9/00
• CPC Class Codes: G06F 21/00 Security arrangements for protecting computers, components thereof, programs or data against unauthorised activity
• CPC Class Codes: G06F 21/10 Protecting distributed programs or content, e.g. vending or licensing of copyrighted material protection in video systems or pay television H04N7/16 ; Digital rights management [DRM]
• CPC Class Codes: G06F 21/602 Providing cryptographic facilities or services
• CPC Class Codes: G06F 2212/1052 Security improvement
• CPC Class Codes: G06F 9/4401 Bootstrapping security arrangements therefor G06F21/57
• CPC Class Codes: G06F 9/4411 Configuring for operating with peripheral devices; Loading of device drivers
• CPC Class Codes: H04L 63/061 for key exchange, e.g. in peer-to-peer networks cryptographic mechanisms or cryptographic arrangements for key agreement H04L9/0838
• CPC Class Codes: H04L 63/0807 using tickets, e.g. Kerberos cryptographic mechanisms or cryptographic arrangements for entity authentication using tickets or tokens H04L9/3213
• CPC Class Codes: H04L 63/123 received data contents, e.g. message integrity
• CPC Class Codes: H04L 9/0891 Revocation or update of secret information, e.g. encryption key update or rekeying
• CPC Class Codes: H04L 9/0894 Escrow, recovery or storing of secret information, e.g. secret key escrow or cryptographic key storage
• CPC Class Codes: H04L 9/3236 using cryptographic hash functions
• CPC Class Codes: H04L 9/3242 involving keyed hash functions, e.g. message authentication codes [MACs], CBC-MAC or HMAC

Abstract

Provided is a method for configuring the functional capabilities of a computer system. The computer system may include a persistent memory and a replaceable functional unit. The method may include transferring, in response to a repair action for the functional unit, enablement data that is stored on the functional unit to the persistent memory. The enablement data may specify one or more functional capabilities of the functional unit that are enabled. The method may further include erasing the enablement data from the functional unit after it has been transferred to the persistent storage. The method may further include obtaining a second unique identification item from a replacement unit. The method may further include obtaining new enablement data. The new enablement data may be transferred to the replacement unit.

Claims

1. A computer program product for configuring functional capabilities of a computer system comprising two or more persistent memories and two or more replaceable functional units, the computer program product comprising a computer readable storage medium having program instructions embodied therewith, the program instructions executable by a processor to cause the processor to perform a method comprising:

transferring, in response to a repair action for a first functional unit, first enablement data stored on the first functional unit to a servicer, wherein the first enablement data stored on the first functional unit is in a first persistent memory of the first functional unit, wherein the first enablement data is associated with a first unique identification number that corresponds to the first functional unit, the first enablement data specifying one or more functional capabilities of the first functional unit, and wherein the one or more functional capabilities are enabled in the first functional unit;

erasing, after transferring the first enablement data in the first persistent memory to the servicer, the first enablement data from the first persistent memory;

obtaining, by the servicer, in response to a replacement action for the first functional unit, a second unique identification number that corresponds to a second functional unit;

transferring, from the servicer, the first unique identification number and the second unique identification number to a trusted environment in the computer system;

transforming, in the trusted environment, the first enablement data to second enablement data by replacing the first unique identification number with the second unique identification number; and

transferring the second enablement data to the second functional unit, wherein the second enablement data is stored in a second persistent memory of the second functional unit, wherein the second enablement data specifies one or more functional capabilities of the second functional unit, and wherein the one or more functional capabilities of the second functional unit are the same as the one or more functional capabilities of the first functional unit.

2. The computer program product of claim 1, wherein the one or more functional capabilities of the first functional unit are a subset of all the functional capabilities of the first functional unit, wherein functional capabilities of the first functional unit that are not in the first enablement data are disabled, wherein the first enablement data comprises a cryptographically secured value derived from secret data and the first unique identification number, the secret data being stored in the first persistent memory, wherein the secret data is a license key that is specific to the first functional unit, and wherein the validity of the first enablement data is determined based on the correctness of the cryptographically secured value.

3. The computer program product of claim 2, wherein the first functional unit is an Input/Output (I/O) card having a set of ports, wherein the disabled functional capabilities of the first functional unit that are not in the first enablement data include one or more ports of the set of ports, and wherein the one or more ports are disabled by restricting data flow to the one or more ports in the first functional unit.

4. The computer program product of claim 3, wherein restricting data flow to the one or more ports in the first functional unit comprises:

identifying, from the first enablement data, that the first functional unit is the I/O card;

determining which of the one or more ports the I/O card is not authorized to use; and

blocking the one or more ports not authorized for use from interacting with the I/O card.

5. The computer program product of claim 4, wherein determining which of the one or more ports the I/O card is not authorized to use comprises:

accessing, from the first enablement data, a license record, wherein the license record indicates which of the one or more ports the I/O card is not authorized to use.

6. The computer program product of claim 3, wherein erasing the first enablement data from the first functional unit comprises:

removing, permanently, the first enablement data from the first persistent memory.

7. A data processing system comprising:

a memory; and

a processor in communication with the memory, the processor being configured to perform a method comprising;

transferring, in response to a repair action for a first functional unit, first enablement data stored on the first functional unit to a servicer, wherein the first enablement data stored on the first functional unit is in a first persistent memory of the first functional unit, wherein the first enablement data is associated with a first unique identification number that corresponds to the first functional unit, the first enablement data specifying one or more functional capabilities of the first functional unit, and wherein the one or more functional capabilities are enabled in the first functional unit;

erasing, after transferring the first enablement data in the first persistent memory to the servicer, the first enablement data from the first persistent memory;

obtaining, by the servicer, in response to a replacement action for the first functional unit, a second unique identification number that corresponds to a second functional unit;

transferring, from the servicer, the first unique identification number and the second unique identification number to a trusted environment in the computer system;

transforming, in the trusted environment, the first enablement data to second enablement data by replacing the first unique identification number with the second unique identification number; and

transferring the second enablement data to the second functional unit, wherein the second enablement data is stored in a second persistent memory of the second functional unit, wherein the second enablement data specifies one or more functional capabilities of the second functional unit, and wherein the one or more functional capabilities of the second functional unit are the same as the one or more functional capabilities of the first functional unit.

8. The data processing system of claim 7, wherein the one or more functional capabilities of the first functional unit are a subset of all the functional capabilities of the first functional unit, wherein functional capabilities of the first functional unit that are not in the first enablement data are disabled.

9. The data processing system of claim 8, wherein the first functional unit is an Input/Output (I/O) card having a set of ports, wherein the disabled functional capabilities of the first functional unit that are not in the first enablement data include one or more ports of the set of ports, and wherein the one or more ports are disabled by restricting data flow to the one or more ports in the first functional unit.

10. The data processing system of claim 9, wherein erasing the first enablement data from the first functional unit comprises:

removing, permanently, the first enablement data from the first persistent memory.

11. The data processing system of claim 9, wherein restricting data flow to the one or more ports in the first functional unit comprises:

identifying, from the first enablement data, that the first functional unit is the I/O card;

determining which of the one or more ports the I/O card is not authorized to use; and

blocking the one or more ports not authorized for use from interacting with the I/O card.

12. The data processing system of claim 11, wherein determining which of the one or more ports the I/O card is not authorized to use comprises:

accessing, from the first enablement data, a license record, wherein the license record indicates which of the one or more ports the I/O card is not authorized to use.

13. The data processing system of claim 8, wherein the first enablement data comprises a cryptographically secured value derived from secret data and the first unique identification number, the secret data being stored in the first persistent memory, wherein the secret data is a license key that is specific to the first functional unit, and wherein the validity of the first enablement data is determined based on the correctness of the cryptographically secured value.