SYSTEM AND METHOD FOR REGISTERING A PERSONAL COMPUTING DEVICE TO A SERVICE PROCESSOR

• US 20130136263A1
• Filed: 11/30/2011
• Published: 05/30/2013
• Est. Priority Date: 11/29/2011
• Status: Active Grant

• Current Assignee: American Megatrends International, LLC
• Original Assignee: American Megatrends Incorporated
• Inventors: Maity, Sanjoy
• Granted Patent: US 8,532,302 B2
• Time in Patent Office: Days
• US Class Current: 380/278
• CPC Class Codes: G06F 21/35 communicating wirelessly
• CPC Class Codes: G06F 21/36 by graphic or iconic representation
• CPC Class Codes: H04L 2463/121 Timestamp cryptographic mechanisms or cryptographic arrangements involving time stamps H04L9/3297
• CPC Class Codes: H04L 63/08 for authentication of entities cryptographic mechanisms or cryptographic arrangements for entity authentication H04L9/32
• CPC Class Codes: H04L 63/0853 using an additional device, e.g. smartcard, SIM or a different communication terminal cryptographic mechanisms or cryptographic arrangements for entity authentication involving additional secure or trusted devices H04L9/3234
• CPC Class Codes: H04L 63/0876 based on the identity of the terminal or configuration, e.g. MAC address, hardware or software configuration or device fingerprint
• CPC Class Codes: H04L 9/32 including means for verifying the identity or authority of a user of the system or for message authentication, e.g. authorization, entity authentication, data integrity or data verification, non-repudiation, key authentication or verification of credentials
• CPC Class Codes: H04W 12/71 Hardware identity
• CPC Class Codes: H04W 12/77 Graphical identity

Abstract

In one aspect, a system for registering a personal computing device to a service processor is disclosed. In one embodiment, the system includes a computer-executable first registration module that is executable to perform functions that include providing a device identifier associated with a personal computing device to a service processor over a communications link. The system also includes a computer-executable second registration module that is executable to perform functions that include receiving the device identifier over the communications link and retrieving stored user access data associated with a particular authorized user of the personal computing device who has remote access to the service processor via a management computer. The second registration module is further executable to generate a cryptographic key based on the device identifier and configuration data associated with firmware of the service processor, and to provide the cryptographic key to the personal computing device over the communications link.

Claims

1. A system for registering a personal computing device to a service processor, comprising:

(a) a computer-executable first registration module that is stored on a personal computing device and configured to, when executed by one or more processors, perform functions that include providing a device identifier associated with the personal computing device to a service processor over a communications link; and

(b) a computer-executable second registration module that is stored on the service processor and configured to, when executed by one or more processors, perform functions including;

(i) receiving the device identifier over the communications link;

(ii) retrieving stored user access data associated with a particular user of the personal computing device who has authorization to remotely access the service processor via a management computer that is separate from the personal computing device;

(iii) generating a cryptographic key based on the device identifier and configuration data associated with firmware of the service processor; and

(iv) providing the cryptographic key to the personal computing device over the communications link.

2. The system of claim 1, further comprising a computer-executable management access module that is stored on the service processor and operatively coupled to the second registration module, the management access module configured to, when executed by one or more processors, perform functions that include:

(a) retrieving the device identifier associated with the personal computing device;

(b) retrieving the cryptographic key corresponding to the device identifier; and

(c) generating an encrypted code based on the cryptographic key.

3. The system of claim 2, wherein the management access module is further executable to cause the management computer to display a visual representation of the encrypted code to the authorized user.

4. The system of claim 3, wherein the user access data corresponds to a first set of login information which, when received from the authorized user of the management computer, causes the management computer to display the visual representation of the encrypted code in response.

5. The system of claim 4, wherein the displayed visual representation of the encrypted code is configured such as to, when recognized by the personal computing device, cause the personal computing device to display a second set of login information to the authorized user which, when received from the authorized user of the management computer, enables the authorized user to access the service processor in response.

6. The system of claim 5, wherein the first set of login data comprises at least one of a username and password associated with the authorized user.

7. The system of claim 6, wherein the second set of login information as displayed on the personal computing device comprises a personal identification number (PIN) associated with the authorized user.

8. The system of claim 1, wherein the encrypted code is generated based on, in part, the current time of day.

9. The system of claim 1, wherein the visual representation of the encrypted code is displayed as a QR code or barcode.

10. The system of claim 1, wherein the service processor is configured as a baseboard management controller (BMC) that is operative to perform remote management functions for at least one target computer that is separate from the management computer and personal computing device.

11. The system of claim 1, wherein the communications link between the personal computing device and the service processor comprises at least one of a USB connection, local area network (LAN) connection, wireless area network (WAN) connection, and Internet connection.

12. A computer-implemented method for registering a personal computing device to a service processor, comprising the steps of:

(a) causing one or more processors to execute a first registration module that is stored on a personal computing device to perform functions that include providing a device identifier associated with the personal computing device to a service processor over a communications link; and

(b) causing one or more processors to execute a second registration module on the service processor to perform functions that include;

(i) receiving the device identifier over the communications link;

(ii) retrieving stored user access data associated with a particular user of the personal computing device who has authorization to remotely access the service processor via a management computer that is separate from the personal computing device;

(iii) generating a cryptographic key based on the device identifier and configuration data associated with firmware of the service processor; and

(iv) providing the cryptographic key to the personal computing device over the communications link.

13. The method of claim 12, further comprising the step of causing one or more processors to a execute a management access module that is stored on the service processor and operatively coupled to the second registration module to perform functions that include:

(a) retrieving the device identifier associated with the personal computing device;

(b) retrieving the cryptographic key corresponding to the device identifier; and

(c) generating an encrypted code based on the cryptographic key.

14. The method of claim 13, further comprising the step of causing the management computer to display a visual representation of the encrypted code to the authorized user.

15. The method of claim 14, wherein the user access data corresponds to a first set of login information which, when received from the authorized user of the management computer, causes the management computer to display the visual representation of the encrypted code in response.

16. The method of claim 15, wherein the displayed visual representation of the encrypted code is configured such as to, when recognized by the personal computing device, cause the personal computing device to display a second set of login information to the authorized user which, when received from the authorized user the management computer, enables the authorized user to remotely access the service processor in response.

17. The method of claim 12, further comprising the step of causing the first registration module to receive the cryptographic key from the second registration module over the communications link and securely store the cryptographic key on the personal computing device.

18. The method of claim 12, further comprising the step of securely storing the cryptographic key, device identifier, and user access data on the service processor.

19. The method of claim 12, wherein the personal computing device corresponds to a portable wireless communications device.

20. The method of claim 19, wherein the device identifier corresponds to the predetermined international mobile equipment identity (IMEI) of the personal computing device.

21. A computer-implemented method for registering a personal computing device to a service processor, comprising the steps of:

(a) installing a computer-executable first registration module on a personal computing device, the first registration module configured to, when executed by one or more processors, cause the personal computing device to perform functions that include providing a device identifier associated with the personal computing device to a service processor over a communications link;

(b) installing a computer-executable second registration module on the service processor, the second registration module configured to, when executed by one or more processors, cause the service processor to perform functions that include;

(i) receiving the device identifier over the communications link;

(ii) retrieving stored user access data associated with a particular user of the personal computing device who has authorization to remotely access the service processor via a management computer that is separate from the personal computing device;

(iii) generating a cryptographic key based on the device identifier and configuration data associated with firmware of the service processor; and

(iv) providing the cryptographic key to the personal computing device over the communications link; and

(c) causing one or more processors to execute the first registration module and second registration module.

22. The method of claim 21, further comprising the step of installing a computer-executable management access module on the service processor that is operatively coupled to the second registration module, the management access module configured to, when executed by one or more processors, cause the service processor to perform functions that include:

(a) retrieving the device identifier associated with the personal computing device;

(b) retrieving the cryptographic key corresponding to the device identifier; and

(c) generating an encrypted code based on the cryptographic key.

23. The method of claim 22, further comprising the step of causing the management computer to display a visual representation of the encrypted code to the authorized user.

24. The method of claim 23, wherein the user access data corresponds to a first set of login information which, when received from the authorized user of the management computer, causes the management computer to display the visual representation of the encrypted code in response.

25. The method of claim 24, wherein the displayed visual representation of the encrypted code are configured such as to, when recognized by the personal computing device, cause the personal computing device to provide a second set of login information to the authorized user which, when received from the authorized user of the management computer, enables the authorized user to remotely access the service processor in response.