CONFIGURING FUNCTIONAL CAPABILITIES OF A COMPUTER SYSTEM

• US 20180018286A1
• Filed: 09/14/2016
• Published: 01/18/2018
• Est. Priority Date: 07/15/2016
• Status: Active Application

• Current Assignee: International Business Machines Corporation
• Original Assignee: International Business Machines Corporation
• Inventors: Axnix, Christine, Hardt, Franz, Kraemer, Marco, Lang, Jakob C.
• Granted Patent: US 10,282,311 B2
• Time in Patent Office: Days
• CPC Class Codes: G06F 12/1408 by using cryptography for digital transmission H04L9/00
• CPC Class Codes: G06F 21/00 Security arrangements for protecting computers, components thereof, programs or data against unauthorised activity
• CPC Class Codes: G06F 21/10 Protecting distributed programs or content, e.g. vending or licensing of copyrighted material protection in video systems or pay television H04N7/16 ; Digital rights management [DRM]
• CPC Class Codes: G06F 21/602 Providing cryptographic facilities or services
• CPC Class Codes: G06F 2212/1052 Security improvement
• CPC Class Codes: G06F 9/4401 Bootstrapping security arrangements therefor G06F21/57
• CPC Class Codes: G06F 9/4411 Configuring for operating with peripheral devices; Loading of device drivers
• CPC Class Codes: H04L 63/061 for key exchange, e.g. in peer-to-peer networks cryptographic mechanisms or cryptographic arrangements for key agreement H04L9/0838
• CPC Class Codes: H04L 63/0807 using tickets, e.g. Kerberos cryptographic mechanisms or cryptographic arrangements for entity authentication using tickets or tokens H04L9/3213
• CPC Class Codes: H04L 63/123 received data contents, e.g. message integrity
• CPC Class Codes: H04L 9/0891 Revocation or update of secret information, e.g. encryption key update or rekeying
• CPC Class Codes: H04L 9/0894 Escrow, recovery or storing of secret information, e.g. secret key escrow or cryptographic key storage
• CPC Class Codes: H04L 9/3236 using cryptographic hash functions
• CPC Class Codes: H04L 9/3242 involving keyed hash functions, e.g. message authentication codes [MACs], CBC-MAC or HMAC

Abstract

Provided is a method for configuring the functional capabilities of a computer system. The computer system may include a persistent memory and a replaceable functional unit. The method may include transferring, in response to a repair action for the functional unit, enablement data that is stored on the functional unit to the persistent memory. The enablement data may specify one or more functional capabilities of the functional unit that are enabled. The method may further include erasing the enablement data from the functional unit after it has been transferred to the persistent storage. The method may further include obtaining a second unique identification item from a replacement unit. The method may further include obtaining new enablement data. The new enablement data may be transferred to the replacement unit.

Claims

1. A method for configuring functional capabilities of a computer system that comprises a persistent memory and a replaceable functional unit, the method comprising:

transferring enablement data stored on the functional unit to the persistent memory, the enablement data specifying one or more functional capabilities of the functional unit, the one or more functional capabilities being enabled in the functional unit;

erasing, after transferring the enablement data to the persistent memory, the enablement data from the functional unit;

obtaining, in response to a replacement action for the functional unit, a second unique identification item from a replacement unit;

obtaining new enablement data; and

transferring the new enablement data to the replacement unit.

2. The method of claim 1, wherein the transferring the enablement data stored on the functional unit to the persistent memory is in response to a repair action for the functional unit, wherein the one or more functional capabilities are a subset of all the functional capabilities of the unit, and wherein functional capabilities of the unit that are not in the enablement data are disabled.

3. The method of claim 1, wherein the enablement data and a first unique identification number for the functional unit are stored in the functional unit, and wherein the enablement data comprises a cryptographically secured value derived from secret data and the first unique identification item, the secret data being stored in the persistent memory, and wherein the validity of the enablement data is determined based on the correctness of the cryptographically secured value.

4. The method of claim 3, wherein the obtaining new enablement data comprises either replacing the cryptographically secured value in the enablement data with a new cryptographically secured value derived from the secret data and the second unique identification item, or by generating the new enablement data.

5. The method according to claim 3, wherein the cryptographically secured value is implemented as a hash value.

6. The method according to claim 3, wherein the cryptographically secured value includes a cryptographic function for ensuring correctness of the enablement data.

7. The method according to claim 3, the method further comprising:

modifying the one or more functional capabilities of the functional unit by modifying the enablement data based on new secret data transferred to the persistent memory; and

transferring the modified enablement data to the unit.

8. The method according to claim 3, wherein the enablement data includes history data of one or more functional units associated with the enablement data, wherein the history data is updated upon modifying the enablement data.

9. The method according to claim 8, wherein the history data further comprises time stamps corresponding to a creation or modification of the enablement data.

10. The method according to claim 3, further comprising:

merging at least two enablement data records to generate a combined enablement data record to add functional capabilities to the functional unit; and

transferring the combined enablement data to the functional unit, wherein the combined enablement data record includes at least one enabled functional capability that is not in the one or more functional capabilities.

11. The method according to claim 3, wherein the functional unit is implemented as a token, the token being enabled for licensing by the enablement data.

12. The method according to claim 11, the method further comprising:

obtaining, by the token and in response to the replacement action, the second unique identification item from a replacement token;

obtaining new enablement data by either replacing the cryptographically secured value in the enablement data with a new cryptographically secured value derived from the secret data and the unique identification item of the replacement token, or by generating new enablement data;

transferring the new enablement data to the replacement token; and

the token disabling itself

13. The method according to claim 3, wherein the method is implemented in a firmware of the computer system, the firmware having access to the persistent memory.

14. The method according to claim 13, wherein the firmware is configured to validate the cryptographically secured value.

15. The method according to claim 13, wherein the computer system includes a service element, and wherein the firmware communicates with the functional unit using the service element.

16. The method of claim 3, wherein the method further comprises:

determining, by the computer system, a first set of functional capabilities of the functional unit, the first set of functional capabilities including all functional capabilities the functional unit is capable of performing;

determining, using the enablement data, the one or more specified functional capabilities;

enabling, by the computer system, the one or more specified functional capabilities; and

disabling, by the computer system, a second set of functional capabilities, the second set of functional capabilities include functional capabilities that are in the first set but are not specified in the enablement data.

17. The method of claim 3, the method further comprising:

enabling, by the functional unit, the one or more specified functional capabilities; and

disabling, by the functional unit, the remaining functional capabilities of the functional unit.