Dynamic Platform Reconfiguration By Multi-Tenant Service Providers

• US 20120303952A1
• Filed: 05/26/2011
• Published: 11/29/2012
• Est. Priority Date: 05/26/2011
• Status: Active Grant

• Current Assignee: Intel Corporation
• Original Assignee: Intel Corporation
• Inventors: Smith, Ned M., Bakshi, Sanjay, Sugumar, Suresh
• Granted Patent: US 8,918,641 B2
• Time in Patent Office: Days
• US Class Current: 713/158
• CPC Class Codes: G06F 21/44 Program or device authentication
• CPC Class Codes: G06F 21/629 to features or functions of an application
• CPC Class Codes: H04L 63/0823 using certificates cryptographic mechanisms or cryptographic arrangements for entity authentication involving certificates H04L9/3263
• CPC Class Codes: H04L 63/0876 based on the identity of the terminal or configuration, e.g. MAC address, hardware or software configuration or device fingerprint
• CPC Class Codes: H04L 63/10 for controlling access to devices or network resources

Abstract

A manageability engine or adjunct processor on a computer platform may receive a request for activation and use of features embedded within that platform from a service provider authorized by the manageability engine'"'"'s manufacturer. The manageability engine may initiate a request for authority through the service provider to a permit server. The permit server may provide, through the service provider, proof of the service provider'"'"'s authority, together with a certificate identifying the service provider. Then the manageability engine may enable activation of the features on the platform coupled to the manageability engine, but only by the one particular service provider who has been authorized.

Claims

1. A method comprising:

receiving a request at a manageability engine from a service provider'"'"'s server to activate a feature of a platform coupled to said manageability engine;

in response to said request, requesting in a secure fashion proof of the service provider'"'"'s authority to modify the platform including a certificate from a permit server that this service provider is authorized by a manufacturer of the manageability engine to use the platform feature; and

checking the certificate to prevent another service provider from using the feature.

2. The method of claim 1 including checking whether the service provider'"'"'s authority has been revoked.

3. The method of claim 1 where requesting proof includes generating an unactivated key in said manageability engine.

4. The method of claim 1 where requesting proof includes using a signed key incorporated into the manageability engine by the manufacturer.

5. The method of claim 1 including requesting proof using a cryptographic scheme enabling remote authentication of hardware devices, while preserving the privacy of the device owner, and using an embedded private key within said manageability engine to indicate that the service provider is certified by the manufacturer of the manageability engine.

6. The method of claim 1 wherein requesting proof includes providing proof that the manageability engine is legitimate.

7. The method of claim 1 wherein requesting includes supplying a certificate signing request to a service provider including signed attributes attesting to the legitimacy of the manageability engine'"'"'s key.

8. The method of claim 1 including said manageability engine, in response to said request, receiving a permit and activating a key to enable the service provider to use the feature.

9. The method of claim 1 including, in response to said request, receiving in said manageability engine a service provider'"'"'s public key or one-time password seed via a secure channel.

10. The method of claim 9 including storing in said manageability engine a different public key or seed for each of at least two service providers and using said key or seed to identify a service provider that requests reactivation of said feature.

11. A non-transitory computer readable medium storing instructions to enable a processor to:

send a request for verification of a service provider'"'"'s authority to use a feature of a platform coupled to said processor;

verify that the service provider is authorized by the manufacturer of the processor to use the feature; and

activate the feature only for the use of that service provider.

12. The medium of claim 11 further storing instructions to receive a request at said processor from a service provider'"'"'s server to activate a feature of the platform coupled to said processor.

13. The medium of claim 11 further storing instructions to use a signed key incorporated into said processor by the processor manufacturer.

14. The medium of claim 11 further storing instructions to use a cryptographic scheme enabling remote authentication of hardware devices, while preserving the privacy of the platform owner, and using an embedded private key within said processor to indicate that the service provider is certified by the manufacturer of the processor.

15. The medium of claim 11 further storing instructions to provide proof that the processor is legitimate.

16. The medium of claim 11 further storing instructions to supply a certificate signing request to a service provider, including signed attributes attesting to the legitimacy of the processor'"'"'s key.

17. The medium of claim 11 further storing instructions to receive a permit and activate a key to enable the service provider to use the feature.

18. The medium of claim 11 further storing instructions to receive, in said processor, a service provider'"'"'s public key or one-time password seed via a secure channel.

19. The medium of claim 18 further storing instructions to store, in said processor, a different public key or seed for each of at least two service providers and use each key or seed to identify a service provider that requests reactivation of said feature.

20. The medium of claim 11 further storing instructions to decide whether the service provider'"'"'s authorization has been revoked.

21. An apparatus comprising:

a processor to store a signed key provided by the processor manufacturer, receive a request to activate a feature of a platform coupled to said processor and, in response to said request, automatically request, over a secure channel, proof of a service provider'"'"'s authority to modify the platform; and

a storage coupled to said processor.

22. The apparatus of claim 21 wherein said processor is a manageability engine.

23. The apparatus of claim 21, said processor to check a certificate from the service provider to determine whether the service provider is authorized by the manufacturer of the processor to use the platform feature and to determine whether the service provider is the same service provider that previously activated said feature.

24. The apparatus of claim 23, said processor to check whether the service provider'"'"'s authority has been revoked.

25. The apparatus of claim 23, said processor to request proof from the service provider using a cryptographic scheme enabling remote authentication of hardware devices, while preserving the privacy of the device owner, said processor to use an embedded private key within the manageability engine to indicate that the service provider is certified by the manufacturer of the processor, said embedded private key embedded at the time of manufacture.

26. The apparatus of claim 21, said processor to provide proof that it is authentic.

27. The apparatus of claim 21, said processor to supply a certificate signing request to a service provider, including signed attributes attesting to the legitimacy of the processor'"'"'s key.

28. The apparatus of claim 21, said processor to receive a permit and activate a key to enable the service provider to use the feature.

29. The apparatus of claim 21, said processor to receive a service provider'"'"'s public key or one-time password seed via a secure channel.

30. The apparatus of claim 29, said processor to store, in a manageability engine, a different public key or seed for each of at least two service providers and use said key or seed to identify the service provider that requests reactivation of said feature.