Platform trust extension
View Patent ↗A system and method of providing a platform trust extension for an information handling system is disclosed herein. The platform trust extension receives a notification that an application is selected for installation or execution on an information handling system. The identify of the application or the source of the application is identified based upon a signature of the application. The platform trust extension determines whether the application or the source of the application is semi-trusted based upon the signature of the application. If the application is semi-trusted, the platform trust extension permits the application to run at an additional trust level.
1. An information handling system comprising:
one or more processors; and
a memory coupled to the processors comprising instructions executable by the processors, the processors being operable when executing the instructions to:
present a list of one or more applications installed at the information handling system;
present a list of one or more applications available to be installed at the information handling system;
present an application source associated with each of the list of one or more applications installed and the list of one or more applications available to be installed;
enumerate one or more semi-trusted keys used to sign each of the list of one or more applications installed and the list of one or more applications available to be installed;
present a key source associated with each of the one or more semi-trusted keys; and
by a platform trust extension:
defining an additional trust level, wherein the additional trust level is granted a subset of permissions granted to the platform trust extension;
maintaining the one or more semi-trusted keys;
receiving a notification that at least one application from the list of one or more applications available to be installed or the list of one or more applications installed is selected for installation or execution on the information handling system;
identifying the at least one application or the application source of the at least one application based, at least in part, on a signature of the at least one application;
determining whether the at least one application or the application source of the at least one application is semi-trusted based at least in part upon the signature of the at least one application, wherein at least one of the one or more semi-trusted keys is used to sign the at least one application;
setting the at least one application to run at the additional trust level if the at least one application or the application source of the at least one application and the at least one of the one or more semi-trusted keys are semi-trusted; and
adding the one or more semi-trusted keys to a data store associated with the platform trust extension.
2. The information handling system of claim 1 , wherein determining whether the at least one application or the application source is semi-trusted comprises comparing the identity of the at least one application or the application source against a list of semi-trusted applications or semi-trusted sources of applications, wherein finding a match indicates that the at least one application or the application source is semi-trusted.
3. The information handling system of claim 2 , wherein the list of semi-trusted applications or semi-trusted sources of applications is received from a user of the information handling system.
4. The information handling system of claim 2 , wherein the list of semi-trusted applications or semi-trusted sources of applications is received from an organization that owns or controls the information handling system.
5. The information handling system of claim 1 , wherein determining whether the at least one application is semi-trusted comprises comparing the at least one of the one or more semi-trusted keys used to sign the at least one application to a key associated with a platform trust extension provider, wherein finding a match indicates that the at least one application is semi-trusted.
6. The information handling system of claim 1 , wherein determining whether the at least one application is semi-trusted comprises comparing the at least one of the one or more semi-trusted keys used to sign the at least one application to a list of semi-trusted keys received from a provider of the platform trust extension, wherein finding a match indicates that the application is semi-trusted.
7. The information handling system of claim 6 , wherein the list of semi-trusted keys is a file stored on the information handling system.
8. The information handling system of claim 6 , wherein the list of semi-trusted keys is received from a cloud service.
9. One or more computer-readable non-transitory storage media embodying logic that is operable when executed to:
present a list of one or more applications installed at the information handling system;
present a list of one or more applications available to be installed at the information handling system;
present an application source associated with each of the list of one or more applications installed and the list of one or more applications available to be installed;
enumerate one or more semi-trusted keys used to sign each of the list of one or more applications installed and the list of one or more applications available to be installed;
present a key source associated with each of the one or more semi-trusted keys; and
by a platform trust extension:
defining an additional trust level, wherein the additional trust level is granted a subset of permissions granted to the platform trust extension;
maintaining the one or more semi-trusted keys;
receiving a notification that at least one application from the list of one or more applications available to be installed or the list of one or more applications installed is selected for installation or execution on an information handling system;
identifying the at least one application or the application source of the at least one application based, at least in part, on a signature of the at least one application;
determining whether the at least one application or the application source of the at least one application is semi-trusted based at least in part upon the signature of the at least one application, wherein at least one of the one or more semi-trusted keys is used to sign the at least one application;
setting the at least one application to run at the additional trust level if the at least one application or the application source of the at least one application and the at least one of the one or more semi-trusted keys are semi-trusted; and
adding the one or more semi-trusted keys to a data store associated with the platform trust extension.
10. The one or more computer-readable non-transitory storage media of claim 9 , wherein determining whether the at least one application or the application source is semi-trusted comprises comparing the identity of the at least one application or the application source against a list of semi-trusted applications or semi-trusted sources of applications, wherein finding a match indicates that the at least one application or the application source is semi-trusted.
11. The one or more computer-readable non-transitory storage media of claim 10 , wherein the list of semi-trusted applications or semi-trusted sources of applications is received from a user of the information handling system.
12. The one or more computer-readable non-transitory storage media of claim 10 , wherein the list of semi-trusted applications or semi-trusted sources of applications is received from an organization that owns or controls the information handling system.
13. The one or more computer-readable non-transitory storage media of claim 9 , wherein determining whether the at least one application is semi-trusted comprises comparing the at least one of the one or more semi-trusted keys used to sign the at least one application to a key associated with a platform trust extension provider, wherein finding a match indicates that the at least one application is semi-trusted.
14. The one or more computer-readable non-transitory storage media of claim 9 , wherein determining whether the at least one application is semi-trusted comprises comparing the at least one of the one or more semi-trusted keys used to sign the at least one application to a list of semi-trusted keys received from a provider of the platform trust extension, wherein finding a match indicates that the application is semi-trusted.
15. The one or more computer-readable non-transitory storage media of claim 14 , wherein the list of semi-trusted keys is a file stored on the information handling system.
16. The one or more computer-readable non-transitory storage media of claim 14 , wherein the list of semi-trusted keys is received from a cloud service.
17. A method of providing platform trust extension comprising:
presenting a list of one or more applications installed at the information handling system;
presenting a list of one or more applications available to be installed at the information handling system;
presenting an application source associated with each of the list of one or more applications installed and the list of one or more applications available to be installed;
enumerating one or more semi-trusted keys used to sign each of the list of one or more applications installed and the list of one or more applications available to be installed;
presenting a key source associated with each of the one or more semi-trusted keys; and
by a platform trust extension:
defining an additional trust level, wherein the additional trust level is granted a subset of permissions granted to the platform trust extension;
maintaining the one or more semi-trusted keys;
receiving a notification that at least one application from the list of one or more applications available to be installed or the list of one or more applications installed is selected for installation or execution on an information handling system;
identifying the at least one application or the application source of the at least one application based, at least in part, upon on a signature of the at least one application;
determining whether the at least one application or the application source of the at least one application is semi-trusted based at least in part upon the signature of the at least one application, wherein at least one of the one or more semi-trusted keys is used to sign the at least one application; and
setting the at least one application to run at the additional trust level if the at least one application or the application source of the at least one application and the at least one of the one or more semi-trusted keys are semi-trusted; and
adding the one or more semi-trusted keys to a data store associated with the platform trust extension.
18. The method of claim 17 , wherein the step of determining whether the at least one application or the application source of the application is semi-trusted comprises:
comparing the identity of the at least one application or the application source against a list of semi-trusted applications or semi-trusted sources of applications, wherein finding a match indicates that the at least one application or the application source is semi-trusted.
19. The method of claim 17 , wherein the step determining whether the application is semi-trusted comprises:
comparing the at least one of the one or more semi-trusted keys used to sign the at least one application to a key associated with a platform trust extension provider, wherein finding a match indicates that the at least one application is semi-trusted.
20. The method of claim 17 , wherein the step of determining whether the at least one application is semi-trusted comprises:
comparing the at least one of the one or more semi-trusted keys used to sign the at least one application to a list of semi-trusted keys received from a provider of the platform trust extension, wherein finding a match indicates that the application is semi-trusted.