Remote configuration of computing platforms
View Patent ↗An embodiment of the invention relates to a computing platform ( 10 ) having an attribute ( 241 ) that is configurable by a remote system ( 350 ), the computing platform ( 10 ) storing a first verifier ( 332 ) for verifying that a message is from a trusted remote source ( 360 ) and being operable to: acquire a second verifier ( 331 ) from a trusted remote source ( 360 ), including by verifying the second verifier ( 331 ) using the first verifier ( 332 ), the second verifier ( 331 ) being usable for verifying that a message is from a remote configuration system ( 350 ) that is trustable to configure the attribute ( 241 ); acquire a configuration setting (I) from the remote configuration system, including by verifying the configuration setting (I) using the second verifier ( 331 ); and configure the attribute ( 241 ) according to the configuration setting (I).
1. A computing platform having an attribute that is configurable by a remote system, the computing platform storing a first verifier for verifying that a message is from a trusted remote source and being operable to: acquire a second verifier from a trusted remote source, including by verifying the second verifier using the first verifier, the second verifier being usable for verifying that a message is from a remote configuration system that is trustable to configure the attribute; acquire a configuration setting from the remote configuration system, including by verifying the configuration setting using the second verifier; and configure the attribute according to the configuration setting.
2. A computing platform according to claim 1 , operable to acquire the second verifier from the remote configuration system acting as an intermediary between the computing platform and the trusted remote source.
3. A computing platform according to claim 1 , operable to acquire the second verifier from a trusted remote system of the trusted remote source.
4. A computing platform according to claim 3 , wherein the computing platform is arranged to receive from the remote configuration system endpoint information of the trusted remote source in order to enable acquisition of the second verifier.
5. A computing platform according to claim 1 , wherein the attribute is a trust attribute of the computing platform.
6. A computing platform according to claim 1 , comprising a trusted component and wherein the attribute determines an operating state of the trusted component.
7. A computing platform according to claim 6 , wherein the trusted component is a trusted platform module (TPM).
8. A computing platform according to claim 1 , comprising a trusted boot process, which is operable to permit acquisition of the second verifier.
9. A computing platform according to claim 8 , wherein the trusted boot process is operable to provide an operator interface, for selectively permitting acquisition of the second verifier.
10. A computing platform according to claim 8 , wherein the trusted boot process is operable to provide an operator interface, for selectively permitting acquisition of the attribute.
11. A computing platform according to claim 1 , comprising a trusted boot process, which is operable to perform the acquisition of the second verifier.
12. A computing platform according to claim 1 , comprising a System Management function, which is operable to perform the acquisition of the second verifier.
13. A computing platform according to claim 1 , wherein the first verifier comprises a signature verification key, for verifying message signatures that are generated using a signing key of the trusted remote source.
14. A computing platform according to claim 1 , wherein the second verifier comprises a signature verification key, for verifying message signatures that are generated using a signing key of the remote configuration system.
15. A computing platform according to claim 1 , comprising a trusted boot process, which is operable to permit acquisition of the attribute.
16. A computing platform according to claim 1 , comprising a trusted boot process, which is operable to perform the acquisition of the attribute.
17. A computing platform according to claim 1 , comprising a System Management function, which is operable to perform the acquisition of the attribute.
18. A method of configuring an attribute of a computing platform, including:
a. receiving a signature verification key and a signature of the signature verification key generated using a signing key of a trusted remote source;
b. verifying, using a pre-installed signature verification key of a trusted remote source, that the received signature was generated by a signing key of a trusted remote source and accepting that the received signature verification key belongs to a trustable remote configuration system;
c. receiving a configuration setting and a signature of the configuration setting;
d. verifying, using the received signature verification key, that the signature was generated by a signing key of a trustable remote configuration system; and
e. configuring an attribute of the computing platform using the received configuration setting.