Systems, Apparatuses, and Methods for Enforcing Security on a Platform

• US 20150264087A1
• Filed: 12/28/2012
• Published: 09/17/2015
• Est. Priority Date: 12/28/2012
• Status: Active Grant

• Current Assignee: Intel Corporation
• Original Assignee: Intel Corporation
• Inventors: Lal, Reshma, XING, Bin Cedric
• Granted Patent: US 10,171,500 B2
• Time in Patent Office: Days
• US Class Current: 1/1
• CPC Class Codes: H04L 63/08 for authentication of entities cryptographic mechanisms or cryptographic arrangements for entity authentication H04L9/32
• CPC Class Codes: H04L 63/1408 by monitoring network traffic monitoring network traffic per se H04L43/00
• CPC Class Codes: H04L 63/20 for managing network security; network security policies in general filtering policies H04L63/0227
• CPC Class Codes: H04L 67/145 avoiding end of session, e.g. keep-alive, heartbeats, resumption message or wake-up for inactive or interrupted session

Abstract

Embodiments of a system, apparatus, and method of platform security are describe. In some embodiments, a system comprises a manageability engine to detect if a software agent of the platform is removed and a software agent enclave, wherein the software agent enclave and manageability engine each include a specific session key to be used for communications between the software agent enclave and the manageability engine.

Claims

1. A system comprising:

a manageability engine to detect if a software agent of the platform is removed;

a software agent enclave, wherein the software agent enclave and manageability engine each include a specific session key to be used for communications between the software agent enclave and the manageability engine.

2. The system of claim 1, wherein the manageability engine includes an agent watchdog service to monitor an agent enclave by providing a mechanism for the agent enclave to register itself with the watchdog server and assert its presence to the watchdog service at preconfigured intervals.

3. The system of claim 2, further comprising:

a management console to register each agent enclave with the agent watchdog and specify when the agent enclave must assert its presence (from the boot time) and a schedule of how often each agent enclave asserts its presence to the watchdog.

4. The system of claim 3, further comprising:

a defense policy stored in the system that states an action to take if the agent enclave fails to assert itself to the watchdog as per the schedule.

5. The system of claim 1, wherein the ME includes a table of specific session keys and their corresponding agent enclave ID.

6. The system of claim 1, wherein the ME includes a service layer to maintain a table of ME services, agent enclaves, and their corresponding keys.

7. The system of claim 6, wherein the service layer authenticates the agent enclaves using agent enclave specific keys before forwarding the payload of the authenticated message down to a watchdog service or to other ME service that subscribes to the enclave authentication service.

8. A method comprising:

sending a heartbeat message to the manageability engine from an agent enclave using a specific session key;

determining in the manageability engine if the key used to protect the heartbeat message is valid, wherein when the key is not valid the agent enclave is deemed invalid and when the key is valid then the manageability awaits a next heartbeat message.

9. The method of claim 8, further comprising:

unsealing the specific session key associated with the agent enclave and the manageability engine.

10. The method of claim 8, wherein when the key is not valid performing one of:

restarting the agent enclave, performing recovery steps, or even shutting down the system.

11. The method of claim 8, further comprising:

booting a platform that contains the agent enclave and manageability engine.

12. The method of claim 8, further comprising:

creating a secure session between the agent enclave and manageability engine to generate the specific session key;

sealing the specific session key associated with the secure session to the agent enclave; and

storing the specific session key in the manageability engine.

13. The method of claim 12, wherein the manageability engine includes a watchdog service to watch for the heartbeat messages.

14. The method of claim 12, wherein the manageability engine includes a table of specific session keys and their corresponding agent enclave ID.

15. The method of claim 12, wherein the manageability engine includes a service layer to maintain a table of ME services, enclave (service owner) IDs, and their corresponding keys.

16. The method of claim 15, wherein the service layer authenticates the agent enclaves using agent enclave specific keys before forwarding the payload of the authenticated message down to a watchdog service or to other ME service that subscribes to the enclave authentication service.