METHODS AND SYSTEMS FOR SECURE GATE FILE DEPLOYMENT ASSOCIATED WITH PROVISIONING

• US 20100218243A1
• Filed: 02/26/2009
• Published: 08/26/2010
• Est. Priority Date: 02/26/2009
• Status: Active Grant

• Current Assignee: Red Hat, Inc. (International Business Machines Corporation)
• Original Assignee: Red Hat, Inc. (International Business Machines Corporation)
• Inventors: Likins, Adrian Karstan, Vidal, Seth Kelby, DeHaan, Michael Paul
• Granted Patent: US 8,413,259 B2
• Time in Patent Office: Days
• US Class Current: 726/7
• CPC Class Codes: G06F 21/33 using certificates
• CPC Class Codes: G06F 21/51 at application loading time, e.g. accepting, rejecting, starting or inhibiting executable software based on integrity or source reliability
• CPC Class Codes: G06F 21/57 Certifying or maintaining trusted computer platforms, e.g. secure boots or power-downs, version controls, system software checks, secure updates or assessing vulnerabilities
• CPC Class Codes: G06F 2221/2145 Inheriting rights or properties, e.g., propagation of permissions or restrictions within a hierarchy
• CPC Class Codes: H04L 9/3263 involving certificates, e.g. public key certificate [PKC] or attribute certificate [AC]; Public key infrastructure [PKI] arrangements network architectures or network communication protocols for supporting authentication of entities using certificates in a packet data network H04L63/0823

Abstract

A software provisioning server can be configured to communicate with a certificate authority to evaluate security credential requests received from one or more target machines prior to a software installation. The certificate authority can issue certificates to the one or more target machines and notify an administrator and the software provisioning server of the issued certificates. The software provisioning server can manage the software installation to the one or more target machines based on the issued certificates and other specifications.

Claims

1. A method of managing a secure software provisioning process, comprising:

initiating a software installation from at least one provisioning server to at least one target machine;

evaluating a security credential of the at least one target machine for the software installation prior to the software installation; and

generating an action for the software installation based on a result of the evaluating.

2. The method of claim 1, wherein the action comprises a notification that the at least one target machine will not receive the software installation if the evaluating the security credential fails.

3. The method of claim 1, wherein the action comprises a providing of the software installation to the at least one target machine if the evaluating the security credential succeeds.

4. The method of claim 3, wherein the at least one provisioning server is configured to specify files within the software installation to provide to the at least one target machine.

5. The method of claim 1, further comprising:

receiving, at a certificate authority, the security credential from the at least one target machine.

6. The method of claim 1, wherein the evaluating the security credential comprises:

issuing a certificate for the at least one target machine.

7. The method of claim 1, further comprising:

determining, by a security administrator, whether the security credential is approved.

8. The method of claim 1, further comprising:

blocking the at least one target machine from receiving the software installation based on the results of the evaluation.

9. The method of claim 1, further comprising:

unblocking the at least one target machine to allow access to the software installation based on the results of the evaluation.

10. A system for managing a secure software provisioning process, comprising:

an interface to at least one target machine; and

a processor in communication with the interface and configured to perform the steps of;

initiating a software installation from at least one provisioning server to the at least one target machine;

evaluating a security credential of the at least one target machine for the software installation prior to the software installation; and

generating an action for the software installation based on a result of the evaluating.

11. The system of claim 10, wherein the action comprises a notification that the at least one target machine will not receive the software installation if the evaluating the security credential fails.

12. The system of claim 10, wherein the action comprises a providing of the software installation to the at least one target machine if the evaluating the security credential succeeds.

13. The system of claim 10, wherein the security credential is a certificate signing request.

14. The system of claim 10, wherein the processor is further configured to perform the step of:

receiving, at a certificate authority, the security credential from the at least one target machine.

15. The system of claim 10, wherein the evaluating the security credential comprises:

issuing a certificate for the at least one target machine.

16. The system of claim 10, wherein the processor is further configured to perform the step of:

determining, by a security administrator, whether the security credential is approved.

17. The system of claim 10, wherein the processor is further configured to perform the step of:

blocking the at least one target machine from receiving the software installation.

18. The system of claim 10, wherein the at least one target machine is configured to block from receiving the software installation.

19. The system of claim 10, wherein the processor is further configured to perform the step of:

unblocking the at least one target machine to allow access to the software installation.

20. A software installation stored as data and generated by the method of:

initiating the software installation from at least one provisioning server to at least one target machine;

evaluating a security credential of the at least one target machine for the software installation prior to the software installation; and

generating an action for the software installation based on a result of the evaluating.