SECURELY PROVIDING SESSION KEY INFORMATION FOR USER CONSENT TO REMOTE MANAGEMENT OF A COMPUTER DEVICE

• US 20110252153A1
• Filed: 04/09/2010
• Published: 10/13/2011
• Est. Priority Date: 04/09/2010
• Status: Abandoned Application

• Current Assignee: Intel Corporation
• Original Assignee: Intel Corporation
• Inventors: Vlodavsky, Zvi
• Application Number:
  US12/757,862
• Publication Number:
  US 20110252153A1
• Time in Patent Office: Days
• US Class Current: 709/229
• CPC Class Codes: G06F 21/305 by remotely controlling device operation
• CPC Class Codes: H04L 41/28 Restricting access to network management systems or functions, e.g. using authorisation function to access network configuration
• CPC Class Codes: H04L 63/061 for key exchange, e.g. in peer-to-peer networks cryptographic mechanisms or cryptographic arrangements for key agreement H04L9/0838
• CPC Class Codes: H04L 63/123 received data contents, e.g. message integrity
• CPC Class Codes: H04L 63/18 using different networks or channels, e.g. using out of band channels cryptographic mechanisms or cryptographic arrangements for key distribution involving distinctive intermediate devices or communication paths H04L9/0827; cryptographic mechanisms or cryptographic arrangements for authentication using a plurality of channels H04L9/3215
• CPC Class Codes: H04L 67/125 involving control of end-device applications over a network

Abstract

Embodiments of the invention are generally directed to systems, methods, and apparatuses for providing information used in verifying user consent to a remote management session. In some embodiments, a session key is provided by a management engine of a computer device in response to an indication that a session is needed to remotely mange operations of the computer device. In some embodiments, information based on the session key is displayed in a secure sprite, where the integrity of information is protected at least in part by the isolation of the management engine from other resources of the computer device.

Claims

1. A method comprising:

detecting a need for a remote management session;

in response to the detecting, a management engine determining a session key to be used in verifying a consent to an establishing of the remote management session; and

based on the determining the session key, providing first session key information for representation in a secure sprite of a display.

2. The method of claim 1, further comprising:

receiving second session key information from a remote management system; and

comparing the received second session key information with the session key to verify the consent to the establishing of the remote management session.

3. The method of claim 1, wherein the remote management session is to manage a computer device including a first operating system, the method further comprising:

the management engine storing information based on the session key in a protected memory which is not directly accessible by the first operating system.

4. The method of claim 1, wherein the remote management session is to manage a computer device including a first operating system and a virtual machine isolated from the first operating system, the virtual machine including the management engine.

5. The method of claim 1, wherein the management engine resides on a dedicated chipset.

6. The method of claim 1, further comprising:

representing the first session key information in the secure sprite of the display.

7. The method of claim 6, wherein one or more other resources of a computer device provide graphics information for elements of the display other than the secure sprite, and wherein the one or more other resources of the computer device are external to the management engine.

8. An apparatus for providing user consent information, the apparatus comprising:

a management engine including;

a session controller to detect a need for a remote management session;

a session key generator coupled to the session controller to determine, in response to detecting the need for the remote management session, a session key to be used in verifying a consent to an establishing of the remote management session; and

a sprite engine coupled to the session key generator to provide first session key information based on the determined session key, the first session key information for representation in a secure sprite of a display.

9. The apparatus of claim 8, wherein the session controller further to receive second session key information from a remote management system, the apparatus further comprising:

an authenticator to compare the received second session key information with the session key to verify the consent to the establishing of the remote management session.

10. The apparatus of claim 8, further comprising a protected memory, wherein the display is to display graphical information provided by a first operating system, the session key generator further to store in the protected memory information based on the session key, wherein the protected memory is isolated from access by the first operating system.

11. The apparatus of claim 8, wherein the management engine resides on a dedicated chipset.

12. The apparatus of claim 8, wherein the remote management session is to manage a computer device and wherein a user of the computer device indicating consent to the remote management session does not require the user to provide input to the computer device.

13. The apparatus of claim 8, wherein one or more other resources of a computer device provide graphics information for elements of the display other than the secure sprite, and wherein the one or more other resources of the computer device are external to the management engine.

14. A computer readable storage medium having stored thereon, which when executed by one or more processing units cause the one or more processing units to perform a method comprising:

detecting a need for a remote management session;

in response to the detecting, a management engine determining a session key to be used in verifying a consent to an establishing of the remote management session; and

based on the determining the session key, providing first session key information for representation in a secure sprite of a display.

15. The computer readable storage medium of claim 14, the method further comprising:

receiving second session key information from a remote management system; and

comparing the received second session key information with the session key to verify the consent to the establishing of the remote management session.

16. The computer readable storage medium of claim 14, the method further comprising:

the management engine storing in a protected memory information based on the session key.

17. The computer readable storage medium of claim 16, wherein the remote management session is to manage a computer device including a first operating system, and wherein the protected memory is not directly accessible by the first operating system.

18. The computer readable storage medium of claim 14, wherein the management engine resides on a dedicated chipset.

19. The computer readable storage medium of claim 14, the method further comprising:

representing the first session key information in the secure sprite of the display.

20. The computer readable storage medium of claim 19, wherein one or more other resources of a computer device provide graphics information for elements of the display other than the secure sprite, and wherein the one or more other resources of the computer device are external to the management engine.