Domain-authenticated control of platform resources

1. A computer-implemented method comprising:

obtaining a domain credential for a platform prior to loading an operating system for the platform;

authenticating, prior to loading the operating system for the platform, the domain credential with a domain controller remote from the platform;

establishing, prior to loading the operating system for the platform, a secure channel between the platform and the remote domain controller to receive an access control policy for the platform;

receiving, prior to loading the operating system for the platform, the access control policy via the secure channel in response to authenticating the domain credential with the domain controller, wherein the access control policy comprises a resource identifier corresponding to a local resource of the platform that the domain credential has authority to access and firmware measurement data usable to verify the identity of the resource;

identifying, prior to loading the operating system for the platform, the local resource of the platform that the domain credential has authority to access based on the resource identifier of the access control policy and the firmware measurement data; and

using the domain credential to unlock the local resource of the platform prior to loading the operating system for the platform.

2. The method of claim 1 , wherein the domain credential comprises at least one of a credential for a user of the platform and a credential for a secure partition of the platform.

3. The method of claim 1 further comprising:

using the domain credential to obtain a key to decrypt data stored on the local resource; and

using the key to decrypt the data stored on the local resource.

4. The method of claim 1 , wherein the access control policy for the platform is maintained by the domain controller; and

wherein identifying the local resource of the platform that the domain credential has authority to access comprises reviewing the received access control policy for the platform.

5. The method of claim 1 , wherein unlocking the local resource of the platform comprises establishing a secure communication session between the remote domain controller and the local resource.

6. The method of claim 1 , wherein unlocking the local resource comprises providing power to the local resource.

7. The method of claim 1 further comprising:

obtaining an unlock token from the domain controller, wherein unlocking the local resource comprises using the unlock token to unlock the local resource.

8. The method of claim 1 , wherein the local resource comprises at least one of an ATA device and a chipset-controlled resource.

9. A system comprising:

at least one processor; and

a memory coupled to the at least one processor, the memory comprising instructions for performing the following:

obtaining a domain credential for a platform prior to loading an operating system for the platform;

authenticating, prior to loading the operating system for the platform, the domain credential with a domain controller remote from the platform;

establishing, prior to loading the operating system for the platform, a secure channel between the platform and the remote domain controller to receive an access control policy for the platform;

receiving, prior to loading the operating system for the platform, the access control policy via the secure channel in response to authenticating the domain credential with the domain controller, wherein the access control policy comprises a resource identifier corresponding to a local resource of the platform that the domain credential has authority to access and firmware measurement data usable to verify the identity of the resource;

identifying, prior to loading the operating system for the platform, the local resource of the platform that the domain credential has authority to access based on the resource identifier of the access control policy and the firmware measurement data; and

using the domain credential to unlock the local resource of the platform prior to loading the operating system for the platform.

10. The system of claim 9 , wherein the domain credential comprises at least one of a credential for a user of the platform and a credential for a secure partition of the platform.

11. The system of claim 9 , wherein the instructions further comprise instructions for performing the following:

using the domain credential to obtain a key to decrypt data stored on the local resource; and

using the key to decrypt the data stored on the local resource.

12. The system of claim 9 , wherein the access control policy for the platform is maintained by the domain controller; and

wherein identifying the local resource of the platform that the domain credential has authority to access comprises reviewing the received access control policy for the platform.

13. The system of claim 9 , wherein unlocking the local resource of the platform comprises establishing a secure communication session between the remote domain controller and the local resource.

14. The system of claim 9 , wherein unlocking the local resource comprises providing power to the local resource.

15. The system of claim 9 , wherein the instructions further comprise instructions for performing the following:

obtaining an unlock token from the domain controller, wherein unlocking the local resource comprises using the unlock token to unlock the local resource.

16. The system of claim 9 , wherein the local resource comprises at least one of an ATA device and a chipset-controlled resource.

17. A computer program product comprising:

a computer-readable storage medium; and

instructions in the computer-readable storage medium, wherein the instructions, when executed in a processing system, cause the processing system to perform operations comprising:

obtaining a domain credential for a platform prior to loading an operating system for the platform;

authenticating, prior to loading the operating system for the platform, the domain credential with a domain controller remote from the platform;

establishing, prior to loading the operating system for the platform, a secure channel between the platform and the remote domain controller to receive an access control policy for the platform;

receiving, prior to loading the operating system for the platform, the access control policy via the secure channel in response to authenticating the domain credential with the domain controller, wherein the access control policy comprises a resource identifier corresponding to a local resource of the platform that the domain credential has authority to access and firmware measurement data usable to verify the identity of the resource;

identifying, prior to loading the operating system for the platform, the local resource of the platform that the domain credential has authority to access based on the resource identifier of the access control policy and the firmware measurement data; and

using the domain credential to unlock the local resource of the platform prior to loading the operating system for the platform.

18. The computer program product of claim 17 , wherein the domain credential comprises at least one of a credential for a user of the platform and a credential for a secure partition of the platform.

19. The computer program product of claim 17 , wherein the instructions further cause the processing system to perform operations comprising:

using the domain credential to obtain a key to decrypt data stored on the local resource; and

using the key to decrypt the data stored on the local resource.

20. The computer program product of claim 17 , wherein the access control policy for the platform is maintained by the domain controller; and

wherein identifying the local resource of the platform that the domain credential has authority to access comprises reviewing the received access control policy for the platform.

21. The computer program product of claim 17 , wherein unlocking the local resource of the platform comprises establishing a secure communication session between the remote domain controller and the local resource.

22. The computer program product of claim 17 , wherein unlocking the local resource comprises providing power to the local resource.

23. The computer program product of claim 17 , wherein the instructions further cause the processing system to perform operations comprising:

obtaining an unlock token from the domain controller, wherein unlocking the local resource comprises using the unlock token to unlock the local resource.

24. The computer program product of claim 17 , wherein the local resource comprises at least one of an ATA device and a chipset-controlled resource.

25. A computer-implemented method comprising:

receiving a domain credential for a platform at a domain controller remote from the platform prior to loading an operating system for the platform;

authenticating, prior to loading the operating system for the platform, the domain credential;

establishing, prior to loading the operating system for the platform, a secure channel between the platform and the domain controller to provide an access control policy to the platform; and

providing, prior to loading the operating system for the platform, the access control policy, via the secure channel, to the platform in response to authenticating the domain credential, wherein the access policy comprises a resource identifier for identifying a local resource of the platform that the domain credential has authority to access, firmware measurement data usable to verify the identity of the resource and a token to unlock the local resource.

26. The method of claim 25 , wherein the domain credential comprises at least one of a credential for a user of the platform and a credential for a secure partition of the platform.

27. The method of claim 25 , wherein the local resource comprises at least one of an ATA device and a chipset-controlled resource.