Establishing computing trust with a staging area

• US 7,305,561 B2
• Filed: 05/25/2004
• Issued: 12/04/2007
• Est. Priority Date: 04/30/2004
• Status: Expired due to Fees

• Current Assignee: Microsoft Technology Licensing LLC (Microsoft Corporation)
• Original Assignee: Microsoft Corporation
• Inventors: Hunt, Galen C., Simon, Jeff
• Primary Examiner(s): Peeso; Thomas R.
• Application Number:
  US10/853,939
• Publication Number:
  US 20050246770A1
• Time in Patent Office: 1,288 Days
• Field of Search: 713/182, 713/189, 713/193
• US Class Current: 713/182
• CPC Class Codes: H04L 2209/56 Financial cryptography, e.g. electronic payment or e-cash
• CPC Class Codes: H04L 2209/60 Digital content management, e.g. content distribution
• CPC Class Codes: H04L 61/5014 using dynamic host configuration protocol [DHCP] or bootstrap protocol [BOOTP]
• CPC Class Codes: H04L 63/0823 using certificates cryptographic mechanisms or cryptographic arrangements for entity authentication involving certificates H04L9/3263
• CPC Class Codes: H04L 9/3263 involving certificates, e.g. public key certificate [PKC] or attribute certificate [AC]; Public key infrastructure [PKI] arrangements network architectures or network communication protocols for supporting authentication of entities using certificates in a packet data network H04L63/0823
• CPC Class Codes: H04L 9/3273 for mutual authentication network architectures or network communication protocols for achieving mutual authentication in a packet data network H04L63/0869

Abstract

A technique is provided for admitting to a staging area a computing device. Information related to a persistent identity that is located in the computing device at the staging area is ascertained. The computing device can be substantially authenticated to a protected production network based on the information related to the persistent identity acquired in the staging area.

Claims

1. A method, comprising

admitting to a staging area a computing device;

ascertaining information related to a persistent identity that is located in the computing device at the staging area, wherein the computing device can be substantially authenticated to a protected production network based on the information related to the persistent identity acquired in the staging area.

2. The method of claim 1, wherein the persistent identity is established in the staging area after the computing device is admitted to the staging area.

3. The method of claim 1, wherein the persistent identity is established in the staging area before the computing device is admitted to the staging area.

4. The method of claim 1, wherein the staging area is physically-protected from untrusted agents.

5. The method of claim 1, wherein an authentication of the computing device with respect to a security domain relies on maintaining key information as the information within the computing device as the computing device is transferring from the staging area to the protected production network.

6. The method of claim 1, wherein the staging area signs a certificate that includes a public key of a security domain that is associated with the staging area, and returns the certificate to the computing device wherein the computing device uses the certificate for the authentication to the protected production network.

7. The method of claim 1, wherein the admitting the computing device to the staging area comprises inserting the computing device with an unconfigured secure identity processing area (SIPA) into the staging area, and wherein the ascertaining the information related to the persistent identity further comprises generating a public key and a private key in the computing device.

8. The method of claim 1, wherein the admitting the computing device to the staging area further comprises inserting the computing device with an unconfigured secure identity processing area (SIPA) into the staging area;

and

wherein the ascertaining the information related to the persistent identity further comprises powering up the computing device wherein the computing device interfaces with the security domain so the security domain generates a public key, wherein the security domain generates a certificate that contains the public key, further wherein a copy of the certificate is provided to the staging area, and wherein the staging area transfers a copy of the certificate to the SIPA in the computing device.

9. The method of claim 1, further comprising generating and maintaining a private key within the persistent identity.

10. The method of claim 1, wherein the staging area establishes a trust relationship between the computing device and a security domain.

11. The method of claim 10, wherein the trust relationship relies on a trusted individual that admits the computing device to the staging area.

12. The method of claim 1, wherein the computing device includes a secure identity processing area (SIPA), and wherein the SIPA does not contain any key information when the computing device is admitted to the staging area.

13. The method of claim 1, wherein the computing device includes a secure identity processing area (SIPA), and wherein the SIPA does contain key information when the computing device is admitted to the staging area.

14. The method of claim 1, wherein the providing the persistent identity in the computing device establishes a key pair within the SIPA.

15. A method, comprising:

admitting to a staging area a computing device; and

providing a persistent identity in the computing device at the staging area, wherein the computing device can be authenticated to a protected production network based on the persistent identity acquired in the staging area.

16. The method of claim 15, wherein the staging area is physically-protected from untrusted agents.

17. The method of claim 15, wherein an authentication of the computing device with respect to a security domain that is included in the protected production network relies on maintaining key information within the computing device as the computing device is transferred from the staging area to a production network.

18. The method of claim 15, wherein the admitting the computing device to the staging area comprises inserting the computing device with an unconfigured secure identity processing area (SIPA) into the staging area, and wherein the providing the persistent identity further comprises establishing a public key and a private key in the computing device.

19. The method of claim 15, wherein the admitting the computing device to a staging area further comprises inserting the computing device with an unconfigured secure identity processing area (SIPA) into the staging area;

and

wherein the providing the persistent identity further comprises establishing a public key in the computing device, wherein a security domain generates a certificate that contains the public key, further wherein a copy of the certificate is transferred to the staging area, and wherein the staging area transfers a copy of the certificate to the SIPA in the computing device.

20. The method of claim 15, further comprising generating and maintaining a private key within the persistent identity.

21. The method of claim 15, in which the staging area establishes a trust relationship between the computing device and a security domain.

22. The method of claim 21, in which the trust relationship relies on a trusted individual that brings only computing device to be trusted into the staging area.

23. The method of claim 21, wherein the computing device includes a secure identity processing area (SIPA), and wherein the SEPA does not contain any key information when the computing device is admitted to the staging area.

24. A method, comprising:

ascertaining information related to a persistent identity within a computing device from a staging area, wherein the computing device uses the information to authenticate itself with respect to a security domain.

25. The method of claim 24, wherein the information related to the persistent identity is ascertained by the computing device before the computing device is admitted to the staging area.

26. The method of claim 24, wherein the information related to the persistent identity is ascertained by the computing device after the computing device is admitted to the staging area.

27. The method of claim 24, wherein the staging area is physically-protected.

28. The method of claim 24, wherein an authentication of the computing device with respect to the security domain relies on maintaining the key information within the computing device as the computing device is transferred from the staging area to a production network.

29. The method of claim 24, wherein the staging area is in communication with the security domain, and wherein the persistent identity is subsequently used to authenticate the computing device with respect to the security domain.

30. The method of claim 24, wherein the staging area signs a certificate received from a security domain, and returns the certificate to the computing device.

31. The method of claim 24, wherein the ascertaining the information related to the persistent identity further comprises:

inserting the computing device with an unconfigured secure identity processing area (SIPA) into the staging area, wherein the computing device contacts a certificate authority to receive a public key and a private key.

32. The method of claim 24, wherein the ascertaining the persistent identity further comprises:

inserting the computing device with an unconfigured secure identity processing area (SIPA) into the physically-protected staging area, wherein the computing device contacts a certificate authority to generate a certificate including a public key;

receiving a copy of the certificate at the physically-protected staging area; and

transferring a copy of the certificate from the staging area to the SIPA.

33. The method of claim 24, in which the staging area establishes a trust relationship between the computing device and a security domain.

34. The method of claim 33, in which the trust relationship is based on the identity of a trusted individual that brings the computing device into the physically-protected staging area.

35. The method of claim 33, in which the trust relationship is verified at some time after the computing device is admitted to the physically-protected staging area.

36. The method of claim 34, wherein the establishing the persistent identity in the computing device provides key information within the SIPA.

37. An apparatus, comprising:

an admitting portion that admits to a staging area a computing device; and

an ascertaining portion that ascertains information related to a persistent identity at the staging area, wherein the computing device can be substantially authenticated to a protected production network based the information ascertained in the staging area.

38. The apparatus of claim 37, wherein the persistent identity is established in the computing device prior to the computing device being admitted to the staging area.

39. The apparatus of claim 37, wherein the persistent identity is established in the computing device following the computing device being admitted to the staging area.

40. The apparatus of claim 37, wherein the staging area is in communication with a security domain, and wherein the persistent identity can subsequently be relied on to authenticate the computing device with respect to the security domain.

41. An apparatus, comprising:

a staging area that admits a computing device, wherein the computing device contains a persistent identity for at least some of the time that the computing device is admitted to the staging area;

a production network that authenticates the computing device with respect to a security domain using the persistent identity.

42. The apparatus of claim 41, wherein the authentication of the computing device with respect to the security domain relies on maintaining the key information within the computing device as the computing device is transferred from the staging area to the production network.

43. The apparatus of claim 41, wherein the staging area is physically-protected.