Prevention of unauthorized resource updates

• US 10,528,708 B2
• Filed: 12/16/2016
• Issued: 01/07/2020
• Est. Priority Date: 12/16/2016
• Status: Active Grant

• Current Assignee: International Business Machines Corporation
• Original Assignee: International Business Machines Corporation
• Inventors: Allen, Michael J., Boisvert, Brent J., Bomar, Michael S., Eggleston, John D., Manso, Ruben O., Valentine, Brian D.
• Primary Examiner(s): Leung, Robert B
• Assistant Examiner(s): De Jesus Lassala, Carlos M
• Application Number:
  US15/381,625
• Publication Number:
  US 20180173857A1
• Time in Patent Office: 1,117 Days
• CPC Class Codes: G06F 21/10 Protecting distributed programs or content, e.g. vending or licensing of copyrighted material protection in video systems or pay television H04N7/16 ; Digital rights management [DRM]
• CPC Class Codes: G06F 21/602 Providing cryptographic facilities or services
• CPC Class Codes: G06F 8/65 Updates security arrangements therefor G06F21/57
• CPC Class Codes: H04L 63/0428 wherein the data content is protected, e.g. by encrypting or encapsulating the payload
• CPC Class Codes: H04L 63/068 using time-dependent keys, e.g. periodically changing keys cryptographic mechanisms or cryptographic arrangements for controlling usage of secret information H04L9/088
• CPC Class Codes: H04L 63/0876 based on the identity of the terminal or configuration, e.g. MAC address, hardware or software configuration or device fingerprint
• CPC Class Codes: H04L 63/10 for controlling access to devices or network resources

Abstract

Embodiments include method, systems and computer program products for preventing unauthorized resource updates. In some embodiments, it may be determined that a mainframe computer is not within a service period. A control file may be obtained and decrypted. Using the decrypted control file, the mainframe computer may be determined to be authorized. An available resource update file may be selected based on a determination that the mainframe computer is authorized. An update to a resource of the mainframe computer may be facilitated based on the available resource update file.

Claims

1. A computer-implemented method for preventing unauthorized resource updates, the method comprising:

obtaining an indication of available resource update files for mainframe computers;

obtaining an authorized serial number;

generating a control file comprising the indication of available resource update files for the mainframe computers and the authorized serial number;

encrypting the control file using an encryption key;

storing the encrypted control file and available resource update files to a read-only memory;

determining, by a processor, that a mainframe computer is not within a service period;

obtaining the encrypted control file of a resource update package, wherein the resource update package comprises the encrypted control file and the available resource update files;

decrypting the encrypted control file;

determining, using the decrypted control file, that the mainframe computer is authorized;

selecting an available resource update file based on a determination that the mainframe computer is authorized; and

facilitating an update to a resource of the mainframe computer based on the available resource update file.

2. The computer-implemented method of claim 1, wherein the encrypted control file and the available resource update files are stored on a universal serial bus (USB) flash drive.

3. The computer-implemented method of claim 1, wherein the encrypted control file and the available resource update files are available on a file transfer protocol (FTP) site.

4. The computer-implemented method of claim 1, wherein decrypting the encrypted control file further comprises:

obtaining the encryption key from a driver associated with the mainframe computer, wherein the driver comprises the encryption key; and

decrypting the encrypted control file using the encryption key from the driver to access the authorized serial number and the indication of available resource update files.

5. The computer-implemented method of claim 1, wherein determining that the mainframe computer is authorized further comprises:

determining that a serial number associated with the mainframe computer and the authorized serial number match.

6. The computer-implemented method of claim 1, wherein determining that the mainframe computer is not within the service period further comprises:

identifying an expiration date associated with the service period for the mainframe computer; and

determining that a current date is after the expiration date associated with the service period for the mainframe computer.

7. A computer program product comprising a non-transitory storage medium readable by a processing circuit and storing instructions for execution by the processing circuit for performing a method comprising:

obtaining an indication of available resource update files for mainframe computers;

obtaining an authorized serial number;

generating a control file comprising the indication of available resource update files for the mainframe computers and the authorized serial number;

encrypting the control file using an encryption key; and

storing the encrypted control file and available resource update files to a read-only memory;

determining that a mainframe computer is not within a service period;

obtaining the encrypted control file of a resource update package, wherein the resource update package comprises the encrypted control file and the available resource update files;

decrypting the encrypted control file;

determining, using the decrypted control file, that the mainframe computer is authorized;

selecting an available resource update file based on a determination that the mainframe computer is authorized; and

facilitating an update to a resource of the mainframe computer based on the available resource update file.

8. The computer program product of claim 7, wherein the encrypted control file and the available resource update files are stored on a universal serial bus (USB) flash drive.

9. The computer program product of claim 7, wherein the encrypted control file and the available resource update files are available on a file transfer protocol (FTP) site.

10. The computer program product of claim 7, wherein decrypting the encrypted control file further comprises:

obtaining the encryption key from a driver associated with the mainframe computer, wherein the driver comprises the encryption key; and

decrypting the encrypted control file using the encryption key from the driver to access the authorized serial number and the indication of available resource update files.

11. The computer program product of claim 7, wherein determining that the mainframe computer is authorized further comprises:

determining that a serial number associated with the mainframe computer and the authorized serial number match.

12. The computer program product of claim 7, wherein determining that the mainframe computer is not within the service period further comprises:

identifying an expiration date associated with the service period for the mainframe computer; and

determining that a current date is after the expiration date associated with the service period for the mainframe computer.

13. A system, comprising:

a hardware processor in communication with one or more types of memory, the processor configured to;

obtain an indication of available resource update files for mainframe computers;

obtain an authorized serial number;

generate a control file comprising the indication of available resource update files for mainframe computers and the authorized serial number;

encrypt the control file using an encryption key;

store the encrypted control file and available resource update files to a read-only memory;

determine that a mainframe computer is not within a service period;

obtain the encrypted control file of a resource update package, wherein the resource update package comprises the encrypted control file and the available resource update files;

decrypt the encrypted control file;

determine, using the decrypted control file, that the mainframe computer is authorized;

select an available resource update file based on a determination that the mainframe computer is authorized; and

facilitate an update to a resource of the mainframe computer based on the available resource update package.

14. The system of claim 13, wherein the encrypted control file and the available resource update files are stored on a universal serial bus (USB) flash drive.

15. The system of claim 13, wherein the encrypted control file and the available resource update files are available on a file transfer protocol (FTP) site.

16. The system of claim 13, wherein, to decrypt the control file, the processor is further configured to:

obtain the encryption key from a driver associated with the mainframe computer, wherein the driver comprises the encryption key; and

decrypt the encrypted control file using the encryption key from the driver to access the authorized serial number and the indication of available resource update files.

17. The system of claim 13, wherein, to determine that the mainframe computer is authorized, the processor is further configured to:

determine that a serial number associated with the mainframe computer and the authorized serial number match.