DEVICE HEALTH TICKETS

• US 20190243630A1
• Filed: 02/05/2018
• Published: 08/08/2019
• Est. Priority Date: 02/05/2018
• Status: Active Grant

• Current Assignee: Microsoft Technology Licensing LLC (Microsoft Corporation)
• Original Assignee: Microsoft Technology Licensing LLC (Microsoft Corporation)
• Inventors: England, Paul
• Granted Patent: US 10,452,384 B2
• Time in Patent Office: Days
• CPC Class Codes: G06F 21/554 involving event detection and direct action
• CPC Class Codes: G06F 21/575 Secure boot
• CPC Class Codes: G06F 2221/034 Test or assess a computer or a system
• CPC Class Codes: G06F 8/65 Updates security arrangements therefor G06F21/57
• CPC Class Codes: G06F 9/4416 Network booting; Remote initial program loading [RIPL]

Abstract

Disclosed are systems that provide for secure and reliable remote management. Cryptographic health tickets provided by a management server are provided to a protected process executing on a computing device. In some examples, the health tickets reset an authenticated watchdog timer that resets the computing device if the timer expires. In some examples, the computing device may contact the management server prior to loading an operating system to receive instructions, but may omit contacting the management server if a valid health ticket is found.

Claims

1. A computing device comprising:

a hardware processor configured to execute a trusted process during a boot sequence of the computing device before a network stack is loaded by the computing device, the trusted process comprising instructions causing the computing device to perform operations comprising;

determining that a valid health ticket issued by a management server accessible over a computer network is not present on the computing device, the determining comprising;

retrieving a health ticket from a predetermined location in a non-volatile memory of the computing device; and

failing to validate a digital signature of the health ticket;

in response to determining that the valid health ticket is not on the computing device;

executing instructions to create a network stack;

requesting recovery instructions from a management server over a network;

receiving the recovery instructions; and

executing the recovery instructions.

2. The computing device of claim 1, wherein the trusted process is one of:

a bootloader or a firmware.

3. The computing device of claim 1, wherein on a second boot sequence of the computing device, the trusted process comprising instructions causing the computing device to perform the operations comprising:

determining that a valid health ticket issued by the management server is present on the computing device; and

in response to determining that the valid health ticket is present, causing the computing device to execute an operating system without the trusted process loading the network stack, requesting recovery instructions, receiving the recovery instructions, and executing the recovery instructions.

4. The computing device of claim 3, wherein the operating system comprises instructions to cause the computing device to perform operations comprising:

requesting a new health ticket from the management server over the computer network;

receiving the new health ticket from the management server; and

communicating the new health ticket to the trusted process.

8. The computing device of claim 1, wherein the recovery instructions include instructions for updating a software object on the computing device.

22. The computing device of claim 1, wherein the operations further comprise:

causing a nonce value to be provided to a management server; and

failing to validate the digital signature of the health ticket based upon a mismatch between a value in the digital signature and the nonce.

23. The computing device of claim 22, wherein the operations of causing the nonce value to be provided to the management server comprises:

providing the nonce value to an operating system, the operating system transmitting the nonce value to the management server.

24. The computing device of claim 23, wherein the operations further comprise:

generating a new nonce value at random every time the computing device boots.

29. The hardware machine-readable storage medium of claim 22, wherein the operations of causing the nonce value to be provided to the management server comprises:

providing the nonce value to an operating system, the operating system transmitting the nonce value to the management server.

30. The hardware machine-readable storage medium of claim 23, wherein the operations further comprise:

generating a new nonce value at random every time the computing device boots.

5-7. -7. (canceled)

9. A method for facilitating remote monitoring of a computing device, the method comprising:

using a hardware processor of the computing device to execute a trusted process during a boot sequence of the computing device before a network stack is loaded by the computing device, the trusted process;

determining that a valid health ticket issued by a management server accessible over a computer network is not present on the computing device, the determining comprising;

retrieving a health ticket from a predetermined location in a non-volatile memory of the computing device; and

failing to validate a digital signature of the health ticket;

in response to determining that the valid health ticket is not on the computing device;

executing instructions to create a network stack;

requesting recovery instructions from a management server over a network;

receiving the recovery instructions; and

executing the recovery instructions.

10. The method of claim 9, wherein on a second boot sequence of the computing device, the trusted process:

determining that a valid health ticket issued by the management server is present on the computing device; and

in response to determining that the valid health ticket is present, causing the computing device to execute an operating system without the trusted process loading the network stack, requesting recovery instructions, receiving the recovery instructions, and executing the recovery instructions.

11. The method of claim 10, further comprising, using an operating system on the computing device, the operating system:

requesting a new health ticket from the management server over the computer network;

receiving the new health ticket from the management server; and

communicating the new health ticket to the trusted process.

25. The method of claim 9, wherein the method further comprises:

causing a nonce value to be provided to a management server; and

failing to validate the digital signature of the health ticket based upon a mismatch between a value in the digital signature and the nonce.

26. The method of claim 25, wherein causing the nonce value to be provided to the management server comprises:

providing the nonce value to an operating system, the operating system transmitting the nonce value to the management server.

27. The method of claim 26, wherein the method further comprises:

generating a new nonce value at random every time the computing device boots.

12-14. -14. (canceled)

15. A hardware machine-readable storage medium comprising instructions for a trusted process, the instructions, when executed by a hardware processor of a computing device causing the computing device to perform operations during a boot sequence of a computing device before a network stack is loaded, the operations comprising:

determining that a valid health ticket issued by a management server accessible over a computer network is not present on the computing device, the determining comprising;

retrieving a health ticket from a predetermined location in a non-volatile memory of the computing device; and

failing to validate a digital signature of the health ticket;

in response to determining that the valid health ticket is not on the computing device;

executing instructions to create a network stack;

requesting recovery instructions from a management server over a network;

receiving the recovery instructions; and

executing the recovery instructions.

16. The hardware machine-readable storage medium of claim 15, wherein the trusted process is one of:

a bootloader or a firmware.

17. The hardware machine-readable storage medium of claim 15, wherein on a second boot sequence of the computing device, the operations comprise:

determining that a valid health ticket issued by the management server is present on the computing device; and

in response to determining that the valid health ticket is present, causing the computing device to execute an operating system without the trusted process loading the network stack, requesting recovery instructions, receiving the recovery instructions, and executing the recovery instructions.

21. The hardware machine-readable storage medium of claim 15, wherein the recovery instructions include instructions for updating a software object on the computing device.

28. The hardware machine-readable storage medium of claim 15, wherein the operations further comprise:

causing a nonce value to be provided to a management server; and

failing to validate the digital signature of the health ticket based upon a mismatch between a value in the digital signature and the nonce.

18-20. -20. (canceled)