Self-locating computing devices, systems, and methods

• US 10,306,420 B2
• Filed: 06/03/2015
• Issued: 05/28/2019
• Est. Priority Date: 06/03/2015
• Status: Active Grant

• Current Assignee: Intel Corporation
• Original Assignee: Intel Corporation
• Inventors: Zhou, Shen, Sheng, Zhijie, Rangarajan, Thanunathan, Huang, Junjie
• Primary Examiner(s): Bhattacharya, Sam
• Application Number:
  US15/564,708
• Publication Number:
  US 20180077537A1
• Time in Patent Office: 1,455 Days
• Field of Search: 455 411, 4554561, 4554563, 34053913, 3405721
• CPC Class Codes: G06F 21/44 Program or device authentication
• CPC Class Codes: G06F 21/554 involving event detection and direct action
• CPC Class Codes: G06F 21/57 Certifying or maintaining trusted computer platforms, e.g. secure boots or power-downs, version controls, system software checks, secure updates or assessing vulnerabilities
• CPC Class Codes: G06F 21/575 Secure boot
• CPC Class Codes: G06F 2221/2111 Location-sensitive, e.g. geographical location, GPS
• CPC Class Codes: G06F 9/45533 Hypervisors; Virtual machine monitors
• CPC Class Codes: H04W 4/33 for indoor environments, e.g. buildings
• CPC Class Codes: H04W 4/50 Service provisioning or reconfiguring
• CPC Class Codes: H04W 4/80 Services using short range communication, e.g. near-field communication [NFC], radio-frequency identification [RFID] or low energy communication

Abstract

Embodiments of self-locating computing devices, systems, and methods are described. In some embodiments, a computing device may include a Wireless Credential Exchange Module (WCEM) to detect one or more location tags and a management engine, coupled to the WCEM, to retrieve information of the one or more location tags from the WCEM, and to provide an asset management server with an identifier of the computing device and the information of the one or more location tags or location information of the computing device. Other embodiments may be described and/or claimed.

Claims

1. A self-locating apparatus for computing, comprising:

one or more processors to execute instructions;

a Wireless Credential Exchange Module (WCEM), coupled to the one or more processors, to detect a location tag;

a management engine, coupled to the WCEM, to query and receive information of the location tag from the WCEM, to provide an external asset management server with an identifier of the apparatus and information of the location tag or a location information of the apparatus determined based at least in part on the information of the location tag, to facilitate creation of a root of trust using a combination of the identifier of the apparatus and the information of the location tag or the location information of the apparatus, and to use the root of trust during boot time or runtime to self-locate the apparatus and ensure the apparatus is in a location.

2. The apparatus according to claim 1, wherein the apparatus is part of a server or part of a server rack.

3. The apparatus according to claim 1, wherein the WCEM is to determine whether the location tag is a nearest one among a plurality of location tags to the apparatus, and wherein the management engine is to determine the location information of the apparatus based at least in part on zone information associated with the location tag.

4. The apparatus according to claim 1, wherein the WCEM is to detect at least two location tags including the location tag, and the management engine is to determine the location information of the apparatus based at least in part on respective angles of signals from the at least two location tags.

5. The apparatus according to claim 1, wherein the WCEM is to detect at least four location tags including the location tag, and the management engine is to determine the location information of the apparatus based at least in part on relative signal strength intensity (RSSI) or time difference of arrival (TDOA) of signals from the at least four location tags.

6. The apparatus according to claim 1, further comprising:

a baseboard management controller (BMC), coupled to the management engine, to provide the identifier of the apparatus to the management engine.

7. The apparatus according to claim 1, wherein the WCEM is part of an onboard chip coupled to the management engine via a platform controller hub, wherein the WCEM comprises an onboard battery, and the WCEM is configured to detect the location tag using power from the onboard battery.

8. The apparatus according to claim 1, wherein the management engine is to periodically query and receive the information of the location tag from the WCEM based on a predetermined interval, communicate with the asset management server using an Intelligent Platform Management Interface (IPMI) or a Data Center Manageability Interface (DCMI), and use the root of trust to interrupt a trusted execution path (TEP) or a measured launch flow (MLF) of the apparatus if the information of the location tag or the location information of the apparatus indicates the apparatus is not in the location.

9. The apparatus according to claim 1, further comprising:

a Trusted Platform Module (TPM), coupled to the management engine, to store the information of the location tag and at least one Launch Control Policy (LCP) with a trusted version of the information of the location tag.

10. The apparatus according to claim 9, wherein the TPM is to facilitate a creation of the root of trust for a measured launch flow of the apparatus using the combination of the information of the location tag and the identifier of the apparatus, wherein the identifier of the apparatus comprises a chipset key of the apparatus.

11. The apparatus according to claim 10, wherein the TPM is to facilitate an authentication of the information of the location tag based on the LCP during the measured launch flow.

12. A method for computing, comprising:

sensing and selecting, by a computing device, one or more location tags;

determining, by the computing device, a location of the computing device based at least in part on information of the one or more location tags;

providing, by the computing device, an identifier of the computing device and the location of the computing device or the information of the one or more location tags to an asset management server to self-locate the computing device;

storing the location information of the one or more location tags in a root of trust; and

using the root of trust to authenticate a trusted execution path (TEP) or measured launch flow (MLF) of the computing device.

13. The method of claim 12, further comprising:

selecting, by the computing device, the identifier from a plurality of identification information or platform data from a plurality of platform data;

wherein the sensing is periodically conducted based at least in part on a predetermined time interval, wherein the providing comprises providing platform data bundled with the identifier and the location to the asset management server.

14. The method of claim 13, wherein the plurality of identification information comprises system asset identifiers, firmware revision information, Basic Input/Output System (BIOS) revision information, rework identifiers, manufacturer information, or operating system (OS) licensing information;

wherein platform data comprises networking information, device errors, hang conditions, or power down conditions.

15. The method of claim 12, wherein the providing further comprises providing the location of the computing device to the asset management server using an Intelligent Platform Management Interface (IPMI) or a Data Center Manageability Interface (DCMI).

16. The method of claim 12, wherein the determining further comprises determining the location of the computing device based at least in part on zone information associated with a location tag of the one or more location tags;

wherein the determining further comprises determining the location of the computing device based at least in part on respective angles of signals from the one or more location tags;

or wherein the determining further comprises determining the location of the computing device based at least in part on relative signal strength intensity (RSSI) or time difference of arrival (TDOA) of signals from the one or more location tags.

17. At least one non-transitory computer readable storage medium, comprising:

a plurality of instructions configured to cause an apparatus, in response to execution of the instructions by the apparatus, to practice the method of claim 12.

18. A method for computing, comprising:

interrupting, by a computing device, a measured launch flow;

sensing and selecting, by the computing device, one or more location tags external to the computing device;

determining, by the computing device, a location of the computing device based at least in part on information of the one or more location tags;

authenticating, by the computing device, the location of the computing device or the information of the one or more location tags, to self-locate the computing device, based on a trusted version of the location of the computing device or information of at least one location tag of the one or more location tags; and

resuming, by a computing device, the measured launch flow upon a successful authentication.

19. The method of claim 18, further comprising:

aborting the measured launch flow upon a failed authentication;

storing the information of the at least one location tag in a platform configuration register (PCR) of a Trusted Platform Module (TPM) of the computing device; and

creating a root of trust for the measured launch flow using a combination of the information of the at least one location tag and a chipset key of the computing device.

20. The method of claim 18, wherein authenticating comprises separately authenticating a signature of a chipset of the computing device and the information of the at least one location tag of the one or more location tags;

or wherein authenticating comprises authenticating using a hash value based on a combination of a signature of a chipset of the computing device and the information of the at least one location tag of the one or more location tags.

21. The method of claim 18, wherein the measured launch flow comprises a system boot sequence, wherein authenticating comprises at least one of authenticating after launching an authenticated code module (ACM) of the computing device, but before launching a BIOS of the computing device at the system boot sequence;

wherein authenticating comprises authenticating after launching a BIOS of the computing device, but before launching a Measured Launch Environment (MLE) of the computing device at the system boot sequence;

or wherein authenticating comprises authenticating after launching a Measured Launch Environment (MLE) of the computing device, but before launching an operating system (OS) or a virtual machine manager (VMM) of the computing device at the system boot sequence.

22. The method of claim 18, wherein authenticating comprises authenticating based on the trusted version of the location of the computing device stored in a non-volatile memory of a Trusted Platform Module (TPM) of the computing device;

or wherein authenticating comprises authenticating based on the trusted version of the location of the computing device stored in a Launch Control Policy (LCP) of the computing device.

23. The method of claim 18, wherein authenticating comprises authenticating based on the trusted version of the location of the computing device stored in a Launch Control Policy (LCP) provisioned by a trusted pool manager server (TPMS).

24. The method of claim 18, wherein resuming comprises binding a virtual machine to the computing device based on the location of the computing device or the information of the one or more location tags.

25. At least one non-transitory computer readable storage medium, comprising:

a plurality of instructions configured to cause an apparatus, in response to execution of the instructions by the apparatus, to practice the method of claim 18.