Method and system for enterprise network single-sign-on by a manageability engine

• US 20100169640A1
• Filed: 12/30/2008
• Published: 07/01/2010
• Est. Priority Date: 12/30/2008
• Status: Active Grant

• Current Assignee: Intel Corporation
• Original Assignee: Intel Corporation
• Inventors: Smith, Ned, Goel, Purushottam
• Granted Patent: US 8,856,512 B2
• Time in Patent Office: Days
• US Class Current: 713/155
• CPC Class Codes: G06F 21/31 User authentication
• CPC Class Codes: G06F 21/33 using certificates
• CPC Class Codes: G06F 21/335 for accessing specific resources, e.g. using Kerberos tickets
• CPC Class Codes: G06F 21/41 where a single sign-on provides access to a plurality of computers
• CPC Class Codes: G06F 21/575 Secure boot
• CPC Class Codes: G06F 21/72 in cryptographic circuits
• CPC Class Codes: G06F 21/80 in storage media based on magnetic or optical technology, e.g. disks with sectors preventing unauthorised reproduction or copying of disc-type recordable media G11B20/00
• CPC Class Codes: G06F 2221/034 Test or assess a computer or a system
• CPC Class Codes: G06F 2221/2103 Challenge-response
• CPC Class Codes: G09G 2358/00 Arrangements for display data security
• CPC Class Codes: H04L 63/0807 using tickets, e.g. Kerberos cryptographic mechanisms or cryptographic arrangements for entity authentication using tickets or tokens H04L9/3213
• CPC Class Codes: H04L 63/0815 providing single-sign-on or federations
• CPC Class Codes: H04L 9/0822 using key encryption key
• CPC Class Codes: H04L 9/083 involving central third party, e.g. key distribution center [KDC] or trusted third party [TTP]
• CPC Class Codes: H04L 9/3213 using tickets or tokens, e.g. Kerberos network architectures or network communication protocols for entities authentication using tickets in a packet data network H04L63/0807

Abstract

A manageability engine (ME) receives an authentication response from a user during pre-boot authentication and registers the user with a key distribution center (KDC), indicating that the user has successfully authenticated to the PC. The KDC supplies the ME with single-sign-on credentials in the form of a Key Encryption Key (KEK). The KEK may later be used by the PC to obtain a credential used to establish secure access to Enterprise servers.

Claims

1. A secure access method using a manageability engine comprising:

receiving an authentication response from a user during a pre-boot operation;

employing a protocol to register with a key distribution center (KDC); and

receiving single-sign-on credentials in the form of a key encryption key (KEK), wherein the KEK is later used to obtain a credential used to establish secure access to Enterprise servers.

2. The method of claim 1, wherein the protocol comprises a Kerberos protocol and the KDC comprises a Kerberos KDC.

3. The method of claim 1, wherein registering with the KDC indicates that the user has successfully authenticated with a personal computer.

4. The method of claim 1, wherein the protocol comprises Kerberos, SAML, Card Space, Liberty Alliance, Public Key, or any other identity management infrastructure.

5. A manageability engine (ME) secure access method comprising:

receiving user authentication credentials from a pre-boot authentication module (PBAM);

requesting a key encryption key (KEK) from an Enterprise;

receiving the KEK if the user is authenticated by the Enterprise and securely storing the KEK;

enabling a BIOS to proceed with booting of an operating system (OS);

receiving a request for the KEK from a shim used to intercept an OS login process;

retrieving the KEK from secure storage; and

sending the KEK to the OS, wherein the shim, upon receipt of the KEK suppresses the OS login prompt and completes booting of the OS;

wherein when the OS requires access to the Enterprise server, the OS retrieves the KEK from the ME to obtain a ticket specific to the Enterprise server.

6. The method of claim 5, wherein a user authenticates to the PBAM through a BIOS.

7. The method of claim 5, wherein the PBAM provides an authentication challenge to a user to authenticate the user, the authentication challenge requiring the user to enter the user authentication credentials.

8. The method of claim 5, wherein the user authentication comprises a user identification and a user password.

9. The method of claim 5, wherein requesting a key encryption key (KEK) from an Enterprise comprises opening a connection to an Enterprise network and requesting the KEK from an Enterprise Key Distribution Center (KDC).

10. The method of claim 9, wherein the KDC verifies that the user is a known entity with the Enterprise network by querying a directory using the user authentication credentials to verify the authenticity of the user.

11. The method of claim 5, wherein when the KEK is securely stored, the KEK is under the control of the manageability engine and has the authority granted to obtain a service specific ticket to Enterprise servers.

12. The method of claim 5, wherein when the KEK is securely stored, the user is logged on to the ME using Enterprise single-sign-on credentials.

13. The method of claim 5, wherein loading the OS invokes a user authentication module to authenticate the user to the OS.

14. The method of claim 5, wherein suppressing the user login prompt enables the user authentication to only request a single-sign-on.

15. An article comprising:

a storage medium having a plurality of machine accessible instructions, wherein when the instructions are executed by a processor, the instructions provide for receiving an authentication response from a user during a pre-boot operation;

employing a protocol to register with a key distribution center (KDC); and

receiving single-sign-on credentials in the form of a key encryption key (KEK), wherein the KEK is later used to obtain a credential used to establish secure access to Enterprise servers.

16. The article of claim 15, wherein the protocol comprises a Kerberos protocol and the KDC comprises a Kerberos KDC.

17. The article of claim 15, wherein registering with the KDC indicates that the user has successfully authenticated with a personal computer.

18. The article of claim 15, wherein the protocol comprises Kerberos, SAML, Card Space, Liberty Alliance, Public Key, or any other identity management infrastructure.

19. An article comprising:

a storage medium having a plurality of machine accessible instructions, wherein when the instructions are executed by a processor, the instructions provide for receiving user authentication credentials from a pre-boot authentication module (PBAM);

requesting a key encryption key (KEK) from an Enterprise;

receiving the KEK if the user is authenticated by the Enterprise and securely storing the KEK;

enabling a BIOS to proceed with booting of an operating system (OS);

receiving a request for the KEK from a shim used to intercept an OS login process;

retrieving the KEK from secure storage; and

sending the KEK to the OS, wherein the shim, upon receipt of the KEK suppresses the OS login prompt and completes booting of the OS;

wherein when the OS requires access to the Enterprise server, the OS retrieves the KEK from the ME to obtain a ticket specific to the Enterprise server.

20. The article of claim 19, wherein a user authenticates to the PBAM through a BIOS.

21. The article of claim 19, wherein the PBAM provides an authentication challenge to a user to authenticate the user, the authentication challenge requiring the user to enter the user authentication credentials.

22. The article of claim 19, wherein the user authentication comprises a user identification and a user password.

23. The article of claim 19, wherein instructions for requesting a key encryption key (KEK) from an Enterprise comprises instructions for opening a connection to an Enterprise network and requesting the KEK from an Enterprise Key Distribution Center (KDC).

24. The article of claim 23, wherein the KDC verifies that the user is a known entity with the Enterprise network by querying a directory using the user authentication credentials to verify the authenticity of the user.

25. The article of claim 19, wherein when the KEK is securely stored, the KEK is under the control of the manageability engine and has the authority granted to obtain a service specific ticket to Enterprise servers.

26. The article of claim 19, wherein when the KEK is securely stored, the user is logged on to the ME using Enterprise single-sign-on credentials.

27. The article of claim 19, wherein loading the OS invokes a user authentication module to authenticate the user to the OS.

28. The article of claim 19, wherein suppressing the user login prompt enables the user authentication to only request a single-sign-on.