Hardware management interface

• US 9,015,793 B2
• Filed: 12/21/2012
• Issued: 04/21/2015
• Est. Priority Date: 12/21/2012
• Status: Active Grant

• Current Assignee: McAfee, LLC
• Original Assignee: McAfee, Inc. (McAfee, LLC)
• Inventors: Von Bokern, Vincent Edward, Goel, Purushottam, Schrecker, Sven
• Primary Examiner(s): Hailu, Teshome
• Assistant Examiner(s): LE, THANH H
• Application Number:
  US13/725,722
• Publication Number:
  US 20140181891A1
• Time in Patent Office: 851 Days
• Field of Search: 726/1
• US Class Current: 726/1
• CPC Class Codes: H04L 63/0876 based on the identity of the terminal or configuration, e.g. MAC address, hardware or software configuration or device fingerprint
• CPC Class Codes: H04L 63/102 Entity profiles
• CPC Class Codes: H04L 63/20 for managing network security; network security policies in general filtering policies H04L63/0227

Abstract

A management controller of a computing device is identified on a network and queried for attributes of the computing device. The management controller is securely implemented in hardware of the computing device and is independent of a central processing unit (CPU) of the computing device. Data is received from the management controller that identifies one or more attributes of the computing device. A security policy of the network is implemented for the computing device based on the one or more attributes.

Claims

1. At least one non-transitory machine accessible storage medium having instructions stored thereon, the instructions when executed on a machine, cause the machine to:

identify a first management controller of a first computing device on a network, wherein the first management controller is to be implemented in hardware of the first computing device and is outside control of a central processing unit (CPU) of the first computing device;

query the first management controller for attributes of the first computing device;

receive, from the first management controller, data identifying one or more attributes of the first computing device; and

implement a security policy of the network on the first computing device based on the one or more attributes.

2. The storage medium of claim 1, wherein implementing the security policy causes access to at least some resources of a domain by the first computing device to be limited according to the security policy.

3. The storage medium of claim 1, wherein the security policy is a policy of an enterprise computing system.

4. The storage medium of claim 1, further comprising identifying a first device driver for the first computing device, wherein the security policy is implemented through communication with the first computing device using the first device driver.

5. The storage medium of claim 1, further comprising causing an agent to be installed on the first computing device.

6. The storage medium of claim 5, wherein the agent is installed through the first management controller.

7. The storage medium of claim 5, wherein the agent is dissolvable.

8. The storage medium of claim 5, wherein the agent is installed on an operating system of the first computing device.

9. The storage medium of claim 5, wherein the security policy is implemented using the installed agent.

10. The storage medium of claim 5, further comprising obtaining data describing additional attributes of the first computing device using the installed agent.

11. The storage medium of claim 5, further comprising determining whether an agent is installed on the first computing device.

12. The storage medium of claim 1, wherein the attributes include a model identifier of the first computing device.

13. The storage medium of claim 1, wherein the attributes include a manufacturer of the first computing device.

14. The storage medium of claim 1, wherein the attributes include hardware attributes of the first computing device.

15. The storage medium of claim 1, wherein the attributes include software attributes of the first computing device.

16. A method comprising:

identifying a first management controller of a first computing device on a network, wherein the first management controller is implemented in hardware of the first computing device and is outside control of a CPU of the first computing device;

querying the first management controller for attributes of the first computing device;

receiving, from the first management controller, data identifying one or more attributes of the first computing device; and

implementing a security policy of the network on the first computing device based on the one or more attributes.

17. The method of claim 16, further comprising identifying a first device driver for the first computing device, wherein the security policy is implemented through communication with the first computing device using the first device driver.

18. The method of claim 17, further comprising identifying one or more capabilities of the first computing device based on the first device driver.

19. The method of claim 16, further comprising authenticating the first computing device based on an identifier derived from secure data embedded in hardware of the first computing device.

20. The method of claim 19, wherein the secure data is stored in secure memory of the first management controller.

21. The method of claim 19, further comprising sending authentication data to the first management controller to mutually authenticate at the first management controller.

22. The method of claim 19, wherein the identifier is unique to a pairing of the first computing device and a particular domain.

23. The method of claim 16, further comprising:

identifying a second management controller of a second computing device on the network, the second management controller implemented in hardware of the second computing device and independent of a CPU of the second computing device;

querying the second management controller for attributes of the second computing device;

receiving, from the second management controller, data identifying one or more attributes of the second computing device; and

implementing another security policy of the network on the second computing device based on the one or more attributes of the second computing device.

24. The method of claim 23, wherein the attributes of the first computing device are different from the attributes of the second computing device and the security policy applied to the first computing device is different from the security policy applied to the second computing device.

25. The method of claim 23, wherein the first computing device is of a type different from the second computing device.

26. The method of claim 16, wherein the attributes include one or more of a model, manufacture, software functionality, and hardware functionality of the first computing device.

27. A system comprising:

at least one processor device;

at least one memory element; and

a management system adapted when executed by the at least one processor device to;

identify a first management controller of a first computing device on a network, wherein the first management controller is to be implemented in hardware of the first computing device and is outside control of a CPU of the first computing device;

query the first management controller for attributes of the first computing device;

receive, from the first management controller, data identifying one or more attributes of the first computing device; and

implement a security policy of the network on the first computing device based on the one or more attributes.