Remote configuration of computing platforms
View Patent ↗An embodiment of the invention relates to a computing platform having an attribute that is configurable by a remote system, the computing platform storing a first verifier for verifying that a message is from a trusted remote source and being operable to: acquire a second verifier from a trusted remote source, including by verifying the second verifier using the first verifier, the second verifier being usable for verifying that a message is from a remote configuration system that is trustable to configure the attribute; acquire a configuration setting from the remote configuration system, including by verifying the configuration setting using the second verifier; and configure the attribute according to the configuration setting.
1. A computing platform storing a verifier for verifying messages from a remote computer system and being operable to:
generate an Attestation Identity Key (AIK) key pair;
send to the remote computer system a message comprising a public key portion of the AIK key pair and evidence that the public key portion of the AIK key pair originates from the computing platform;
store an AIK certificate, which is received from the remote system and is associated with the AIK key pair; and
undertake trustable communications with the remote computer system to encrypt the signature verification key using a verified encryption key and impart the signature verification key in encrypted form to the remote computer system.
2. A computing platform according to claim 1 , wherein the evidence comprises a signature of the public key portion of the AIK key pair generated using a signing key of the computing platform, the computing platform operable to generate a respective signing key/signature verification key pair.
3. A computing platform according to claim 1 , wherein the trustable communications includes verifiably receiving the encryption key.
4. A computing platform according to claim 3 , wherein the encryption key is verified using a second verifier, which is received from a trusted remote source.
5. A computing platform according to claim 1 , comprising a trusted boot process, which is operable to acquire the AIK certificate.
6. A computing platform according to claim 1 , comprising a System Management function, which is operable to acquire the AIK certificate.
7. A computing platform comprising a Trusted Platform Module (TPM), storing a verifier for verifying messages from a remote computer system, and being operable to:
generate an Attestation Identity Key (AIK) key pair;
send to the remote computer system a message comprising a public key portion of the AIK key pair and evidence that the public key portion of the AIK key pair originates from the computing platform; and
store an AIK certificate, which is received from the remote system and is associated with the AIK key pair,
wherein the AIK key pair is stored in an opaque blob, and
wherein the TPM is adapted to load the opaque blob and release to the computing platform at least the public key part of the AIK key pair, to be sent to the remote computer system.
8. A computing platform comprising a trusted boot process, which is operable to permit enrollment of the computing platform into a Public Key Infrastructure (PKI) infrastructure including by acquiring the AIK certificate, storing a verifier for verifying messages from a remote computer system, and being operable to:
generate an Attestation Identity Key (AIK) key pair;
send to the remote computer system a message comprising a public key portion of the AIK key pair and evidence that the public key portion of the AIK key pair originates from the computing platform; and
store an AIK certificate, which is received from the remote system and is associated with the AIK key pair,
wherein the trusted boot process is operable to provide an operator interface, for selectively permitting enrolment into the PKI infrastructure including by obtaining the AIK certificate using either a signed public key portion of the AIK key pair or an endorsement key of the computing platform.