Protocol for authenticating functionality in a peripheral device
View Patent ↗A protocol provides authentication of peripheral devices by a computing device to which the peripheral device connects. Computing devices include a verifier with a public key that authenticates multiple associated private keys. Private keys are embedded on peripheral devices. When the verifier is able to authenticate a connected peripheral, particular functionality is enabled that may not be enabled for peripherals that do not authenticate.
1. An apparatus, comprising:
a storage device to embed on a hardware platform of a computing device, the storage device to store a public key, where the public key authenticates multiple different corresponding private keys; and
hardware components to receive a signed message from a peripheral of the computing device, the signed message signed with a private key of the peripheral;
authenticate the signed message with the public key, including identifying the peripheral based on the authenticating;
identify characteristics of the peripheral and features available for the peripheral to provide functionality to the hardware platform, including determining to authorize the peripheral including providing an interface with bus number, device number, and function (BDF) that permits use of at least a restricted subset of available features when authenticating the signed message and identifying characteristics of the peripheral are unsuccessful and including providing an interface with the BDF that permits use of all available features when authenticating the signed message and identifying the peripheral are successful; and
authorize the peripheral for the determined features based on the identifying.
2. The apparatus of claim 1 , wherein the hardware logic comprises:
hardware resources separate from a host central processing unit of the computing device.
3. The apparatus of claim 2 , wherein the hardware resources comprise:
hardware resources of a manageability engine of the computing device.
4. The apparatus of claim 1 , wherein the hardware logic to receive the signed message further comprises:
to receive the signed message in response to detecting the peripheral.
5. The apparatus of claim 4 , wherein the hardware logic to receive the signed message in response to detecting the peripheral further comprises:
to receive the signed message in response to detecting an insertion of the peripheral into a peripheral bus of the computing device.
6. The apparatus of claim 4 , wherein the hardware logic to receive the signed message in response to detecting the peripheral further comprises:
to receive the signed message in response to detecting the peripheral in an enumeration process that enumerates connected peripherals.
7. The apparatus of claim 4 , wherein the hardware logic to receive the signed message in response to detecting the peripheral further comprises:
to receive the signed message in response to a protocol authentication request.
8. The apparatus of claim 1 , wherein the hardware logic to receive the signed message further comprises:
to receive the signed message over a control path of a bus to which the peripheral is connected.
9. The apparatus of claim 8 , wherein the hardware logic to receive the signed message over the control path comprises:
to receive the signed message over a control path of a universal serial bus (USB), a serial advanced technology attachment (SATA) bus, or a Firewire bus.
10. A hardware platform system comprising:
a chipset including a storage device to store a public key, where the public key authenticates multiple different corresponding private keys; and
hardware components to receive a signed message from a peripheral device over a bus, the signed message signed with a private key of the peripheral device;
authenticate the signed message with the public key, including identifying the peripheral based on the authenticating;
identify characteristics of the peripheral and features available for the peripheral to provide functionality to the hardware platform, including determining to authorize the peripheral including providing an interface with bus number, device number, and function (BDF) that permits use of at least a restricted subset of available features when authenticating the signed message and identifying characteristics of the peripheral are unsuccessful and including providing an interface with the BDF that permits use of all available features when authenticating the signed message and identifying the peripheral are successful; and
authorize the peripheral device for the identified functionality based on the identifying; and
a basic input/output system (BIOS) to initialize the bus at a boot time of the hardware platform system.
11. The system of claim 10 , wherein the hardware logic comprises:
hardware resources of a manageability engine separate from a host central processing unit of the computing device.
12. The system of claim 10 , wherein the hardware logic to receive the signed message further comprises:
to receive the signed message in response to detecting a peripheral device connection.
13. The apparatus of claim 1 , wherein the hardware logic is to determine to enable features for the peripheral that provide one or more of additional functionality, improved peripheral performance, or improved power efficiency.
14. The apparatus of claim 1 , wherein the hardware logic is to determine to enable features based on feature identified by values incorporated into a hash of the signed message.
15. The apparatus of claim 14 , wherein the hardware logic is to determine to enable features based on BDF (bus number, device number, function) interface access control values included in the signed message.
16. The apparatus of claim 14 , wherein the hardware logic is to determine to enable features based on identifying features from a zero-knowledge proof of the signed message.
17. A method for a computing device, comprising:
receiving a signed message at hardware logic of a hardware platform of the computing device from a peripheral of the computing device, the signed message signed with a private key of the peripheral, where the private key is one of multiple private keys that correspond to a public key stored in a storage device embedded on the hardware platform;
authenticating the signed message with the public key, including identifying the peripheral based on the authenticating;
identify characteristics of the peripheral and features available for the peripheral to provide functionality to the hardware platform, including determining to authorize the peripheral including providing an interface with bus number, device number, and function (BDF) that permits use of at least a restricted subset of available features when authenticating the signed message and identifying characteristics of the peripheral are unsuccessful and including providing an interface with the BDF that permits use of all available features when authenticating the signed message and identifying the peripheral are successful; and
authorizing the peripheral for the determined features based on the identifying.
18. The method of claim 17 , wherein receiving the signed message further comprises receiving the signed message in response to detecting the peripheral.
19. The method of claim 17 , wherein receiving the signed message further comprises receiving the signed message over a control path of a bus to which the peripheral is connected.
20. The method of claim 17 , wherein determining to enable features comprises determining to enable features for the peripheral that provide one or more of additional functionality, improved peripheral performance, or improved power efficiency.
21. The method of claim 17 , wherein determining to enable features comprises determining to enable features based on features identified by values incorporated into a hash of the signed message.
22. The method of claim 21 , wherein determining to enable features based on features identified by values incorporated into the hash further comprises determining to enable features based on BDF (bus number, device number, function) interface access control values included in the signed message, or based on a zero-knowledge proof of the signed message.