System and method for data processing system planar authentication

• US 20060020821A1
• Filed: 07/24/2004
• Published: 01/26/2006
• Est. Priority Date: 07/24/2004
• Status: Active Grant

• Current Assignee: Lenovo PC International Limited (Lenovo Group Ltd.)
• Original Assignee: International Business Machines Corporation
• Inventors: Waltermann, Rod David, Sanders, Kerry Graham, Anderson, Michael Douglas, Mandese, Ernest Nelson
• Granted Patent: US 7,490,245 B2
• Time in Patent Office: Days
• US Class Current: 713/189
• CPC Class Codes: G06F 21/57 Certifying or maintaining trusted computer platforms, e.g. secure boots or power-downs, version controls, system software checks, secure updates or assessing vulnerabilities

Abstract

A system and method for providing a system planar specific pre-load authentication that enables a supplier of system hardware and software components to detect assembly of unauthorized systems. The method includes authenticating a data processing system having a hardware inventory device that is uniquely associated with the data processing system. First, an identifier code that uniquely identifies the data processing system and an encrypted hash of the identifier code are stored in non-erasable memory within a hardware inventory device prior to the device being mounted on a system board. After mounting the hardware inventory device on the system board, software preload is authenticated by generating a hash of the identifier code, decrypting the encrypted hash of the identifier code, and comparing the decrypted identifier code hash with the generated identifier code hash to authenticate the system. The entities providing the hardware and/or software components, maintains a record of the system specific identifier codes enabling hardware inventory control tracking by comparing the number of hardware inventory devices issued to a specified system manufacturer with the number of system boards ordered by the manufacturer.

Claims

1. A method for authenticating a data processing system having a hardware inventory device that is uniquely associated with the data processing system, and method comprising:

storing an identifier code that uniquely identifies the data processing system in non-erasable memory within the hardware inventory device;

storing an encrypted hash of the identifier code in non-erasable memory within the hardware inventory device; and

responsive to initiating installation of computer software on said data processing system;

generating a hash of the identifier code;

decrypting the encrypted hash of the identifier code; and

comparing the decrypted identifier code hash with the generated identifier code hash to authenticate the system.

2. The method of claim 1, wherein said hardware inventory device is an Asset ID chip having a non-volatile and non-erasable memory, said steps of storing an identifier code and storing an encrypted hash of the identifier code further comprising storing the identifier code and the encrypted hash of the identifier code within the non-volatile and non-erasable memory of said Asset ID chip.

3. The method of claim 1, wherein the hardware inventory device stores data relating to hardware mounted onto a system planar on the data processing system, and wherein said generating, decrypting and comparing steps are included in an authentication cycle for authenticating the system planar prior to installing computer software on the data processing system, said method further comprising:

initiating an installation of the computer software onto the data processing system;

prior to completion of said installation, commencing said authentication cycle; and

completing the installation of the computer software onto the data processing system only in response to the decrypted identifier code hash matching the generated identifier code hash.

4. The method of claim 1, further comprising recording the identifier code in a hardware inventory tracking system.

5. A system for authenticating a data processing system having a hardware inventory device that is uniquely associated with the data processing system, and system comprising:

IC manufacturing processing means for storing an identifier code that uniquely identifies the data processing system in non-erasable memory within the hardware inventory device;

IC manufacturing processing means for storing an encrypted hash of the identifier code in non-erasable memory within the hardware inventory device; and

processing means for responsive to initiating installation of computer software on said data processing system for;

generating a hash of the identifier code;

decrypting the encrypted hash of the identifier code; and

comparing the decrypted identifier code hash with the generated identifier code hash to authenticate the system.

6. The system of claim 5, wherein said hardware inventory device is an Asset ID chip having a non-volatile and non-erasable memory, said IC manufacturing processing means for storing an identifier code and storing an encrypted hash of the identifier code further comprising IC manufacturing processing means for storing the identifier code and the encrypted hash of the identifier code within the non-volatile and non-erasable memory of said Asset ID chip.

7. The system of claim 5, wherein the hardware inventory device stores data relating to hardware mounted onto a system planar on the data processing system, and wherein said processing means for generating, decrypting and comparing are communicatively coupled to software installation processing means for:

initiating an installation of the computer software onto the data processing system;

prior to completion of said installation, commencing said authentication cycle; and

completing the installation of the computer software onto the data processing system only in response to the decrypted identifier code hash matching the generated identifier code hash.