Information handling system entitlement validation
Validation of entitlements to software is provided with a Trusted Platform Module (TPM) platform hierarchy private key created at manufacture of an information handling system and an associated public key. At initiation of an entitlement request, such as to install a software application, a verification signature associated with the request is verified by the TPM to ensure that the information handling system is entitled to run the software.
1. A method for managing verification of application entitlements at plural information handling systems, the method comprising:
initiating creation of a platform private key unique to each of the plural information handling systems at manufacture of the plural information handling systems;
storing the unique platform private key in trusted platform module nonvolatile memory of each associated information handling system;
retrieving a public key from each of the plural information handling systems;
storing the public key in a database in association with a unique identifier of each of the plural information handling systems;
encrypting an application verification signature for one of the plural information handling systems with the public key associated with the one of the plural information handling systems;
inserting the application verification signature into a copy of the application;
communicating the application to the one of the plural information handling systems;
extracting the application verification signature from the copy of the application before installation of the application on the one of the plural information handling systems; and
restricting the application at the one of the plural information handling systems until the trusted platform module verifies the application verification signature with the private key.
2. The method of claim 1 wherein the restricting further comprises:
decrypting the application verification signature with the private key; and
verifying the application verification signature if it includes a unique identifier of the one of the plural information handling systems.
3. The method of claim 1 further comprising:
storing an enterprise unique identifier on the one of the plural information handling systems; and
verifying the application verification signature if it includes the enterprise unique identifier.
4. The method of claim 1 wherein restricting further comprises:
determining the application verification signature is not valid; and
in response to the determining, deleting the application.
5. The method of claim 1 further comprising:
communicating the application verification signature to the one of the plural information handling systems in response to a request to activate a copy of the application stored on the one of the plural information handling systems; and
in response to the communicating, parsing the application verification signature to determine if a unique identifier included in the application verification signature matches a unique identifier stored on the one of the plural information handling systems.