System and method for providing a system management command

• US 9,143,328 B2
• Filed: 05/16/2008
• Issued: 09/22/2015
• Est. Priority Date: 05/16/2008
• Status: Active Grant

• Current Assignee: Hewlett-Packard Development Company, L.P. (HP Inc.)
• Original Assignee: Hewlett-Packard Development Company, L.P. (HP Inc.)
• Inventors: Wang, Lan, Ali, Valiuddin Y., Mondshine, James L.
• Primary Examiner(s): Kim, Jung
• Assistant Examiner(s): Alata, Ayoub
• Application Number:
  US12/992,856
• Publication Number:
  US 20110066839A1
• Time in Patent Office: 2,685 Days
• Field of Search: 713 1- 2, 713/100, 726 4- 7, 726/9, 726 17- 20
• US Class Current: 1/1
• CPC Class Codes: G06F 21/31 User authentication
• CPC Class Codes: G06F 21/57 Certifying or maintaining trusted computer platforms, e.g. secure boots or power-downs, version controls, system software checks, secure updates or assessing vulnerabilities
• CPC Class Codes: G06F 21/572 Secure firmware programming, e.g. of basic input output system [BIOS]
• CPC Class Codes: G06F 21/575 Secure boot
• CPC Class Codes: G06F 9/4401 Bootstrapping security arrangements therefor G06F21/57
• CPC Class Codes: G06F 9/4408 Boot device selection
• CPC Class Codes: H04L 9/321 involving a third party or a trusted authority
• CPC Class Codes: H04L 9/3234 involving additional secure or trusted devices, e.g. TPM, smartcard, USB or software token network architectures or network communication protocols for supporting authentication of entities using an additional device in a packet data network H04L63/0853

Abstract

Exemplary embodiments of the present invention disclosed herein relate to a method of providing a system management command. The method comprises receiving from an authorized requestor information identifying the electronic device and a request to issue a system management command to the electronic device. The method additionally comprises providing, in response to the request, a system management command, information identifying a source of the command as a trusted source and the information identifying the electronic device. Also disclosed are an electronic device and a computer system according to the invention.

Claims

1. A method of providing a system management command, the method comprising:

receiving, at a trusted server from a first electronic device, information identifying a second electronic device and a request to issue a system management command to the second electronic device;

authenticating, at the trusted server, an identity of a user of the first electronic device; and

in response to the request, providing, from the trusted server to the second electronic device, a system management command, information identifying the trusted server as a trusted source, information identifying the first electronic device, and the information identifying the second electronic device.

2. The method recited in claim 1, wherein the system management command comprises a request to reset a security-restricted component of the second electronic device.

3. The method recited in claim 2, wherein the at least one security-restricted component comprises a system board.

4. The method recited in claim 1, wherein the system management command comprises a request to perform a system boot without password authentication.

5. The method recited in claim 1, wherein the system management command comprises a request to flash a region of a system basic input-output system (BIOS).

6. The method recited in claim 1, comprising delivering the system management command, the information identifying the source of the command and the information identifying the second electronic device to the authorized requestor.

7. The method recited in claim 1, comprising executing the system management command based on an evaluation of the information identifying the source of the command and the information identifying the second electronic device.

8. The method recited in claim 1, wherein the information identifying the source of the command as a trusted source comprises a private encryption key signature of the system management command, wherein the private encryption key used to sign the system management command corresponds to one of a plurality of public encryption keys that the second electronic device has access to, and wherein a first set of one or more of the plurality of public encryption keys has a different permission level than a second set of one or more of the plurality of public encryption keys to facilitate a hierarchical command permission control scheme.

9. An electronic device, comprising:

a component that is adapted to accept a security credential; and

a system management command processor that is adapted to perform a system management command on the component that would otherwise require the security credential upon receipt, from a trusted server, of;

the system management command,

information identifying the trusted server as a trusted source,

information identifying a second electronic device, and

information identifying the electronic device,

the system management command being provided by the trusted server in response to a request from the second electronic device and authentication of an identity of a user of the second electronic device.

10. The electronic device recited in claim 9, wherein the system management command comprises a request to reset the component.

11. The electronic device recited in claim 10, wherein the component comprises a system board.

12. The electronic device recited in claim 9, wherein the system management command comprises a request to perform a system boot without password authentication.

13. The electronic device recited in claim 9, wherein the system management command comprises a request to flash a region of a system basic input-output system (BIOS).

14. The electronic device recited in claim 9, wherein the system management command, the information identifying the source of the command and the information identifying the electronic device are received by the electronic device from the trusted source.

15. The electronic device recited in claim 9, wherein the information identifying the source of the command as a trusted source comprises a private encryption key signature of the system management command,

wherein the private encryption key used to sign the system management command corresponds to one of a plurality of public encryption keys that the electronic device has access to, and wherein a first set of one or more of the plurality of public encryption keys has a different permission level than a second set of one or more of the plurality of public encryption keys to facilitate a hierarchical command permission control scheme.

16. A computer system, comprising:

a security component that is adapted to accept a security credential; and

a system basic input-output system (BIOS) that is adapted to perform a system management command that would otherwise require providing the security credential on the security component upon receipt, from a trusted server, of;

a system management command,

information identifying the trusted server as a trusted source,

information identifying a second electronic device, and

information identifying the computer system,

the system management command being provided by the trusted server in response to a request from the second electronic device and authentication of an identity of a user of the second electronic device.

17. The computer system recited in claim 16, wherein the system management command, the information identifying the source of the system management command and the information identifying the computer system are received by the computer system from the trusted source.

18. The computer system recited in claim 16, wherein the system management command, the information identifying the source of the system management command and the information identifying the computer system are received by the computer system from the authorized requestor.