Domain-authenticated control of platform resources
A method, apparatus, system, and computer program product for domain-authenticated control of platform resources. Resources under the control of the platform are managed in accordance with access control rules that are centrally managed by a directory service. Security policies are uniformly applied by requiring authorization of the user's access to platform resources including hard drives, flash memory, sensors, network controllers and power state controllers.
1. A computer-implemented method comprising:
identifying, by a computer, a resource of the computer to be accessed; and
obtaining, by the computer, access to the resource based on a policy that is stored on a server computer that is remote from the computer, wherein obtaining includes receiving a domain credential prior to loading an operating system for the computer, wherein the domain credential is authenticated using a domain controller, and wherein the authenticated domain credential is used to unlock the resource of the computer prior to loading the operating system for the computer, and wherein resource is unlocked using an unlock token, wherein the domain controller to evaluate user privileges and authorization attributes and locate unlock tokens and provides the unlock tokens for resources limited to being accessible through cryptographic tokens, wherein the domain credential comprises at least one of a credential for a user of the computer and a credential for a secure partition of the computer, wherein the domain controller to authenticate the domain credential based on an out-of-band network stack.
2. The method of claim 1 , further comprising:
using the domain credential to obtain a key to decrypt data stored on the resource; and
using the key to decrypt the data stored on the resource.
3. The method of claim 1 , wherein
identifying the resource of the computer comprises reviewing an access policy for the computer maintained by the domain controller.
4. The method of claim 1 , further comprising
establishing a secure communication session between the server and the resource to unlock the resource of the computer.
5. The method of claim 1 , further comprising providing power to the resource to unlock the resource.
6. The method of claim 1 , wherein the resource comprises at least one of an ATA device and a chipset-controlled resource.
7. A computer comprising:
circuitry to:
identify a resource of the computer to be accessed; and
obtain access to the resource based on a policy that is stored on a server that is remote from the computer, wherein to obtain includes to receive a domain credential prior to loading an operating system for the computer, wherein the domain credential is authenticated using a domain controller, and wherein the authenticated domain credential is used to unlock the resource of the computer prior to loading the operating system for the computer, and wherein resource is unlocked using an unlock token, wherein the domain controller to evaluate user privileges and authorization attributes and locate unlock tokens and provides the unlock tokens for resources limited to being accessible through cryptographic tokens, wherein the domain credential comprises at least one of a credential for a user of the computer and a credential for a secure partition of the computer, wherein the domain controller to authenticate the domain credential based on an out-of-band network stack.
8. The computer of claim 7 , wherein the circuitry is further to:
use the domain credential to obtain a key to decrypt data stored on the resource; and
use the key to decrypt the data stored on the resource.
9. The computer of claim 7 , wherein to identify the resource of the computer comprises to review an access policy for the computer maintained by the domain controller.
10. The computer of claim 7 , wherein the circuitry is further to establish a secure communication session between the domain controller and the resource to unlock the resource of the computer.
11. The computer of claim 7 , wherein the circuitry is further to provide power to the resource to unlock the resource.
12. The computer of claim 7 , wherein the resource comprises at least one of an ATA device and a chipset-controlled resource.
13. A computer program product comprising:
a non-transitory computer-readable storage medium; and
instructions in the non-transitory computer-readable storage medium, wherein the instructions, when executed in a processing system, cause the processing system to perform operations comprising:
identifying a resource of a computer to be accessed; and
obtaining access to the resource based on a policy that is stored on a server that is remote from the computer, wherein obtaining includes receiving a domain credential prior to loading an operating system for the computer, wherein the domain credential is authenticated using a domain controller, and wherein the authenticated domain credential is used to unlock the resource of the computer prior to loading the operating system for the computer, and wherein resource is unlocked using an unlock token, wherein the domain controller to evaluate user privileges and authorization attributes and locate unlock tokens and provides the unlock tokens for resources limited to being accessible through cryptographic tokens, wherein the domain credential comprises at least one of a credential for a user of the computer and a credential for a secure partition of the computer, wherein the domain controller to authenticate the domain credential based on an out-of-band network stack.