Method and apparatus for dynamic provisioning of an access control policy in a controller hub
A method and apparatus for dynamic provisioning of an access control policy in an input/output (I/O) controller hub are described. In one embodiment, the method includes the establishment of a control channel during evaluation stages of a network access request. In one embodiment, the control channel enables resource enumeration of a hardware platform while disabling data read/write processing of the hardware platform. Once resource enumeration is completed, conditional control settings for each enumerated platform resource are sent to a network policy decision point. Once transmitted, if the conditional control settings identify the hardware platform as having a non-compliant configuration, conditional control settings for at least one enumerated resource of the hardware platform are modified according to a received access control policy to provide compliance of the hardware platform configuration to enable network access. Other embodiments are described and claimed.
1. Client platform hardware, comprising:
a central processing unit (CPU) coupled to a memory controller hub (MCH), the MCH coupled to an input/output (I/O) controller hub (ICH), the MCH and ICH, when viewed as a whole, being integrated with access control circuitry and trusted platform circuitry, said MCH having a first interface to said CPU, said MCH having a second interface to a main memory, and said ICH having a plurality of I/O interfaces to engage in communication with a plurality of I/O devices;
said access control circuitry comprising logic to: i) establish an out-of-band control channel with an I/O device, wherein, while the control channel is established, the I/O device is disabled from performing reads and writes of the client platform hardware, wherein the control channel collects platform configuration status information from the I/O device, and wherein the access control circuitry collects enablement/disablement platform configuration status information from each of the plurality of I/O devices; ii) issue a network connection request to a policy decision point remotely coupled to said client platform hardware through a network; iii) receive in response to said policy decision point having received said network connection request, a request from said policy decision point asking for platform configuration status information; iv) respond to the request from said policy decision point by providing the requested platform configuration status information, the platform configuration status information identifying each I/O device and its respective enabled/disabled status; v) receive an access control policy sent by said policy decision point in response to said policy decision point having received said platform configuration status information, said access control policy indicating desired enabled/disabled status for each of said I/O devices; and vi) enabling or disabling said I/O devices in accordance with said policy decision point;
said trusted platform circuitry to encrypt said platform configuration status information prior to its being sent to said policy decision point, said trusted platform circuitry further comprising flash memory that stores one or more of the following for the encryption: a) keys; b) hash values; c) signatures; and d) certificates.
2. The semiconductor chip circuitry of claim 1 wherein said access control circuitry further comprises logic to establish respective control channels with said I/O interfaces and receive respective status information from said I/O interfaces.
3. The semiconductor chip circuitry of claim 2 wherein said I/O interfaces are disabled from general purpose reads and writes while said respective status information is being obtained by said access control circuitry.
4. The semiconductor chip circuitry of claim 2 wherein said respective control channels include one or more of:
a) a low pin count control channel;
b) a USB control channel;
c) a PCI control channel;
d) a PCIe control channel.
5. The semiconductor chip circuitry of claim 1 wherein said access control circuitry further comprises logic to prepare and send said configuration information to said policy decision point.
6. The semiconductor chip circuitry of claim 5 wherein said trusted platform circuitry further comprises processor logic circuitry coupled to said flash memory.
7. A computing system, comprising:
a main memory;
a central processing unit (CPU) coupled to a memory controller hub (MCH), the MCH coupled to an input/output (I/O) controller hub (ICH), the MCH and ICH, when viewed as a whole, being integrated with access control circuitry and trusted platform circuitry, said MCH having a first interface to said CPU, said MCH having a second interface to said main memory, and said ICH having a plurality of I/O interfaces to engage in communication with a plurality of I/O devices;
said access control circuitry comprising logic to: i) establish an out-of-band control channel with an I/O device, wherein, while the control channel is established, the I/O device is disabled from performing reads and writes of the client platform hardware, wherein the control channel collects platform configuration status information from the I/O device, and wherein the access control circuitry collects enablement/disablement platform configuration status information from each of the plurality of I/O devices; ii) issue a network connection request to a policy decision point remotely coupled to said client platform hardware through a network; iii) receive in response to said policy decision point having received said network connection request, a request from said policy decision point asking for platform configuration status information; iv) respond to the request from said policy decision point by providing the requested platform configuration status information, the platform configuration status information identifying each I/O device and its respective enabled/disabled status; v) receive an access control policy sent by said policy decision point in response to said policy decision point having received said platform configuration status information, said access control policy indicating desired enabled/disabled status for each of said I/O devices; and vi) enabling or disabling said I/O devices in accordance with said policy decision point;
said trusted platform circuitry to encrypt said platform configuration status information prior to its being sent to said policy decision point, said trusted platform circuitry further comprising flash memory that stores one or more of the following for the encryption: a) keys; b) hash values; c) signatures; and d) certificates.
8. The computing system of claim 7 wherein said access control circuitry further comprises logic to establish respective control channels with said I/O interfaces and receive respective status information from said I/O interfaces.
9. The computing system of claim 8 wherein said I/O interfaces are disabled from general purpose reads and writes while said respective status information is being obtained by said access control circuitry.
10. The computing system of claim 7 wherein said respective control channels include one or more of:
a) a low pin count control channel;
b) a USB control channel;
c) a PCI control channel;
d) a PCIe control channel.
11. The computing system of claim 7 wherein said access control circuitry further comprises logic to prepare and send said configuration information to said policy decision point.
12. The computing system of claim 11 wherein said trusted platform circuitry further comprises processor logic circuitry coupled to said flash memory.