Apparatus and method capable of secure wireless configuration and provisioning

• US 20060091196A1
• Filed: 10/28/2004
• Published: 05/04/2006
• Est. Priority Date: 10/28/2004
• Status: Active Grant

• Current Assignee: UNM Rainforest Innovations (f/k/a STC.UNM) (The University of New Mexico)
• Original Assignee: Intel Corporation
• Inventors: Durham, David M., Durham, Lenitra M., Hahn, Scott D.
• Granted Patent: US 7,330,118 B2
• Time in Patent Office: Days
• US Class Current: 235/375
• CPC Class Codes: G06F 21/575 Secure boot
• CPC Class Codes: H04L 63/0823 using certificates cryptographic mechanisms or cryptographic arrangements for entity authentication involving certificates H04L9/3263

Abstract

An embodiment of the present invention provides an apparatus, comprising an RFID tag interfaced with the apparatus, the RFID tag enables wireless provisioning and configuration of the apparatus and may be a passive read/write RFID tag. The apparatus may be, in one embodiment, a platform such as a client or server and the passive RFID tag may be interfaced with the platform such that the tag'"'"'s EEPROM can also be read from or written to by the platform using a wired serial connection. The apparatus may further comprise a host processor with an operating system (OS) and an embedded microcontroller, the embedded microcontroller may have access to dynamic and non-volatile memory capable of operating independently of the host processor and OS and with direct access to a network interface, wherein the RFID tag may be read from or written to by either a RFID reader or the platform via a direct connection to the embedded processor.

Claims

1. An apparatus, comprising:

an RFID tag interfaced with said apparatus, said RFID tag enables wireless provisioning and configuration of said apparatus.

2. The apparatus of claim 1, wherein said RFID tag is a passive read/write RFID tag.

3. The apparatus of claim 2, wherein said apparatus is a platform, such as a client or server.

4. The apparatus of claim 3, further comprising a wired serial connection to the RFID tag such that the tag'"'"'s EEPROM can be read or written to from the platform.

5. The apparatus of claim 4, further comprising a host processor with an operating system (OS) and an embedded microcontroller, said embedded microcontroller with access to dynamic and non-volatile memory capable of operating independently of said host processor and OS and with direct access to a network interface, wherein said RFID tag is read from or written to by either a RFID reader or said platform via a direct serial connection to said embedded processor.

6. The apparatus of claim 5, wherein said RFID tag is capable of being switched into a serial read only mode after an RFID reader has set the contents of the RFID tag, where the contents of the RFID tag'"'"'s EEPROM may only be read back via said direct connection to said platform embedded processor and not the RFID reader.

7. The apparatus of claim 3, further comprising an internal system bus interface that allows said platform to talk directly to said RFID tag.

8. The apparatus of claim 7, wherein said RFID tag contains both an external passive RF interface as well as an internal system bus interface that allows the device to talk directly to the tag.

9. The apparatus of claim 5, wherein said apparatus is capable of storing information independently of the state of said host processor OS.

10. The apparatus of claim 7, wherein said RFID tag is capable of being configured to accept commands only through said system bus interface or via the system bus interface and the RF interface.

11. The apparatus of claim 6, wherein to allow for device configuration, said RFID reader is used to write security keys as well as a Preboot Execution Environment (PXE) server address to the RFID tag.

12. The apparatus of claim 11, wherein after an initial writing said reader then locks said RFID tag from receiving any further RF interface commands, thereby restricting access to RFID tag information to the platform itself.

13. The apparatus of claim 11, wherein during a preboot, said platform accesses said RFID tag information using said direct serial bus interface to the integrated RFID tag and copies it to memory on said platform.

14. The apparatus of claim 13, wherein said platform is capable of contacting the PXE server to obtain the required boot image.

15. The apparatus of claim 14, wherein once said platform has been configured, security keys are erased from said RFID tag and an RF interface is opened to allow other information to be written to the RFID tag from said platform and made available to external RFID readers thereby allowing for identification of said platform, its location, and its current configuration wirelessly.

16. A method of wirelessly provisioning and configuring an apparatus, comprising:

interfacing an RFID tag with said apparatus, said RFID tag enabling wireless provisioning and configuration of said apparatus.

17. The method of claim 16, wherein said interfacing of an RFID tag is interfacing an RFID tag that is a passive read/write RFID tag.

18. The method of claim 17, wherein said apparatus is a platform, such as a client or server.

19. The method of claim 18, further comprising associating a RFID tag'"'"'s EEPROM with said platform such that said RFID tag'"'"'s EEPROM can be read or written to the platform using a wired serial connection.

20. The method of claim 19, further comprising embedding a microcontroller in a host processor with an operating system (OS), said embedded microcontroller with access to dynamic and non-volatile memory capable of operating independently of said host processor and OS and with direct access to a network interface, wherein said RFID tag is read from or written to by either a RFID reader or said platform via a direct connection to said embedded processor.

21. The method of claim 20, further comprising switching said RFID tag into a serial read only mode after an RFID reader has set the contents of the RFID tag, where the contents of said RFID tag'"'"'s EEPROM can only be read back via said direct connection to said platform embedded processor and not the RFID reader.

22. The method of claim 19, further comprising interfacing an internal system bus that allows said platform to talk directly to said RFID tag.

23. The method of claim 21, further comprising interfacing an external passive RF interface and an internal system bus interface that allows a platform to talk directly to the tag.

24. The method of claim 19, further comprising storing information independently of the state of said host processor OS.

25. The method of claim 21, further comprising configuring said RFID tag to accept commands only through said system bus interface or via the system bus interface and the RF interface.

26. The method of claim 20, further comprising using said RFID reader to write security keys as well as a Preboot Execution Environment (PXE) server address to the RFID tag to allow for device configuration.

27. The method of claim 26, further comprising locking said RFID tag from receiving any further RF interface commands after an initial writing by said reader thereby restricting access to RFID tag information to the platform itself.

28. The method of claim 26, further comprising accessing by said platform, during a preboot, RFID tag information using said direct serial bus interface to the integrated RFID tag and copying it to memory on said platform.

29. The method of claim 28, further comprising contacting, by said platform, a PXE server to obtain the required boot image.

30. The method of claim 29, further comprising erasing said security keys from said RFID tag and opening an RF interface to allow other information to be written to the RFID tag from said platform and making it available to external RFID readers thereby allowing for identification of said platform, its location, and its current configuration wirelessly.

31. An article comprising a storage medium having stored thereon instructions, that, when executed by a computing platform, results in wirelessly provisioning and configuring an apparatus by interfacing an RFID tag with said apparatus, said RFID tag enabling wireless provisioning and configuration of said apparatus.

32. The article of claim 31, wherein said interfacing an RFID tag is interfacing an RFID tag that is a passive read/write RFID tag.

33. The article of claim 32, wherein said apparatus is a platform, such as a client or server.

34. The article of claim 33, wherein said article further comprises controlling the associating of said RFID tag'"'"'s EEPROM with said platform such that said RFID tag'"'"'s EEPROM can also be read from or written to the platform using a wired serial connection.

35. The article of claim 34, wherein said article controls an embedded microcontroller in a host processor with an operating system (OS), said embedded microcontroller with access to dynamic and non-volatile memory capable of operating independently of said host processor and OS and with direct access to a network interface, wherein said RFID tag is read from or written to by either a RFID reader or said platform via a direct connection to said embedded processor.

36. The article of claim 35, wherein said article further controls switching said RFID tag into a serial read only mode after an RFID reader has set the contents of the RFID tag, where the contents of said RFID tag'"'"'s EEPROM can only be read back via said direct connection to said platform embedded processor and not the RFID reader.

37. An apparatus, comprising:

an RFID tag interfaced with said apparatus, said RFID tag enables wireless provisioning and configuration of said apparatus; and

an embedded processor having direct access to said RFID tag.

38. The apparatus of claims 37, wherein said embedded processor having direct access to said RFID tag provides enhanced security when dealing with contents of said RFID tag.

39. The apparatus of claim 38, wherein said contents include secret keys provisioned via said RF interface to the RFID tag which may be retrieved by the embedded processor which is capable of operating on said secret keys and performs cryptographic functions on behalf of a local client/server or with remote systems over a network without disclosing said secret keys.

40. The apparatus of claim 39, wherein said secret keys are kept private by the embedded processor thereby providing enhanced identity, data integrity, encryption/decryption, and authentication services.

41. The apparatus of claim 37, wherein said embedded processor draws minimal power and therefore remains on and connected while a local client/server host processor is in a sleep state or powered off.