Methods and systems for secure gated file deployment associated with provisioning

• US 8,413,259 B2
• Filed: 02/26/2009
• Issued: 04/02/2013
• Est. Priority Date: 02/26/2009
• Status: Active Grant

• Current Assignee: Red Hat, Inc. (International Business Machines Corporation)
• Original Assignee: Red Hat, Inc. (International Business Machines Corporation)
• Inventors: DeHaan, Michael Paul, Likins, Adrian Karstan, Vidal, Seth Kelby
• Primary Examiner(s): Zand, Kambiz
• Assistant Examiner(s): GUIRGUIS, MICHAEL M
• Application Number:
  US12/393,754
• Publication Number:
  US 20100218243A1
• Time in Patent Office: 1,496 Days
• Field of Search: 726/7, 726/5, 726/29
• US Class Current: 726/29
• CPC Class Codes: G06F 21/33 using certificates
• CPC Class Codes: G06F 21/51 at application loading time, e.g. accepting, rejecting, starting or inhibiting executable software based on integrity or source reliability
• CPC Class Codes: G06F 21/57 Certifying or maintaining trusted computer platforms, e.g. secure boots or power-downs, version controls, system software checks, secure updates or assessing vulnerabilities
• CPC Class Codes: G06F 2221/2145 Inheriting rights or properties, e.g., propagation of permissions or restrictions within a hierarchy
• CPC Class Codes: H04L 9/3263 involving certificates, e.g. public key certificate [PKC] or attribute certificate [AC]; Public key infrastructure [PKI] arrangements network architectures or network communication protocols for supporting authentication of entities using certificates in a packet data network H04L63/0823

Abstract

A software provisioning server can be configured to communicate with a certificate authority to evaluate security credential requests received from one or more target machines prior to a software installation. The certificate authority can issue certificates to the one or more target machines and notify an administrator and the software provisioning server of the issued certificates. The software provisioning server can manage the software installation to the one or more target machines based on the issued certificates and other specifications.

Claims

1. A method comprising:

receiving, by a processor, a security credential from a target machine to be provisioned with a software installation from a provisioning server, wherein the security credential is received from the target machine prior to the target machine receiving the software installation;

prior to performing the software installation, evaluating, by the processor, the security credential from the target machine to determine whether the target machine is to receive the software installation from the provisioning server; and

generating, by the processor, an action for the software installation on the target machine based on a result of the evaluating.

2. The method of claim 1, wherein the action comprises a notification that the target machine will not receive the software installation if the evaluating the security credential fails.

3. The method of claim 1, wherein the action comprises a providing of the software installation to the target machine if the evaluating the security credential succeeds.

4. The method of claim 3, wherein the provisioning server is configured to specify files within the software installation to provide to the target machine.

5. The method of claim 1, further comprising:

receiving, at a certificate authority, the security credential from the target machine.

6. The method of claim 1, wherein the evaluating the security credential comprises:

issuing a certificate for the target machine.

7. The method of claim 1, further comprising:

determining, by a security administrator, whether the security credential is approved.

8. The method of claim 1, further comprising:

blocking the target machine from receiving the software installation based on the results of the evaluation.

9. The method of claim 1, further comprising:

unblocking the target machine to allow access to the software installation based on the results of the evaluation.

10. A system comprising:

an interface to a target machine; and

a processor in communication with the interface and configured to perform the steps of;

receiving a security credential from the target machine to be provisioned with a software installation from a provisioning server, wherein the security credential is received from the target machine prior to the target machine receiving the software installation;

prior to performing the software installation, evaluating the security credential from the target machine to determine whether the target machine is to receive the software installation from the provisioning server; and

generating an action for the software installation on the target machine based on a result of the evaluating.

11. The system of claim 10, wherein the action comprises a notification that the target machine will not receive the software installation if the evaluating the security credential fails.

12. The system of claim 10, wherein the action comprises a providing of the software installation to the target machine if the evaluating the security credential succeeds.

13. The system of claim 10, wherein the security credential is a certificate signing request.

14. The system of claim 10, wherein the processor is further configured to perform the step of:

receiving, at a certificate authority, the security credential from the target machine.

15. The system of claim 10, wherein the evaluating the security credential comprises:

issuing a certificate for the target machine.

16. The system of claim 10, wherein the processor is further configured to perform the step of:

determining, by a security administrator, whether the security credential is approved.

17. The system of claim 10, wherein the processor is further configured to perform the step of:

blocking the target machine from receiving the software installation.

18. The system of claim 10, wherein the target machine is configured to block from receiving the software installation.

19. The system of claim 10, wherein the processor is further configured to perform the step of:

unblocking the target machine to allow access to the software installation.

20. The system of claim 10, wherein a certificate authority comprises the processor, and wherein a location of the certificate authority is one or more of:

the provisioning server, the target machine, or outside of the provisioning server and the target machine.