Generating license files in an information handling system
A method, an information handling system (IHS) and a license file generating system for generating a license file. The method includes receiving, via a processor of a first information handling system (IHS), a plurality of input parameters associated with a product and generating license data at least partially based on the input parameters. The license data is transmitted to a hardware security module (HSM). The method further includes triggering the HSM to retrieve a certificate containing allowable use data. The allowable use data at least partially identifies a permitted installation of a license for the product. The HSM is triggered to embed a signer identifier within the certificate and the HSM is triggered to sign the certificate. The method further includes receiving a signed certificate from the HSM and generating a license file including the license data and the signed certificate. The license file is transmitted to a second IHS.
1. A method for generating a license file, the method comprising:
receiving, via a processor of a first information handling system (IHS), a plurality of input parameters associated with a product;
generating license data at least partially based on the input parameters;
transmitting the license data to a hardware security module (HSM);
triggering the HSM to retrieve a certificate containing allowable use data, the allowable use data including a subject organizational unit and a subject title, the subject organizational unit being one of an OEM IHS and a sub-contractor IHS, and the allowable use data at least partially identifying a permitted installation of a license for the product and utilized to determine if the license can be installed on a target IHS;
triggering the HSM to embed a signer identifier within the certificate, the signer identifier being a name of the first IHS;
triggering the HSM to sign the certificate using using a private key, the private key being generated along with a corresponding public key that is embedded in the certificate;
receiving the signed certificate from the HSM;
generating a license file including the license data and the signed certificate, wherein the signed certificate comprises the allowable use data and the public key; and
transmitting the license file to a second IHS wherein:
the second IHS uses the allowable use data and the signer identifier to determine if installation of the license is permitted on the second IHS;
the public key allows contents of the license file to be verified as generated from a sender with access to the private key, and is therefore a trusted entity; and
in response to determining that installation of the license is permitted on the second IHS, the second IHS initiating installation of the license on the second IHS.
2. The method of claim 1 , further comprising:
during a provisioning process:
triggering a root HSM, via a root processor of a root IHS, to retrieve the allowable use data;
triggering the root HSM to embed the allowable use data into the certificate;
receiving the certificate containing the embedded allowable use data; and
transmitting the certificate including the embedded allowable use data to the first IHS.
3. The method of claim 1 , wherein the allowable use data being embedded within the certificate enables a license to remain a same for several customers or target IHSs, while permitted users of the license are identified by the allowable use data and the signer identifier.
4. The method of claim 3 , wherein the second IHS using the allowable use data and the signer identifier to determine if installation of the license is permitted on the second IHS, further comprises:
receiving, via a controller of the second IHS, the license file from the first IHS;
calculating a first hash of the license file;
decrypting an encrypted second hash from the certificate using a public key;
determining if the first hash and the second hash match; and
in response to the first hash and the second hash matching:
retrieving the allowable use data and the signer identifier from the certificate; and
determining if installation of the license is permitted on the second IHS based on the allowable use data and the signer identifier.
5. The method of claim 4 further comprising:
in response to determining that installation of the license is not permitted on the second IHS, preventing installation of the license on the second IHS.
6. The method of claim 1 , further comprising:
retrieving a first executable file and a first template file;
executing the first executable file;
retrieving the input parameters by calling code from a plurality of command lines of the first executable file, the first template file describing a format of the command lines, the format including a specification of a placement in the command lines of values for a plurality of variables contained in the first template file;
parsing the first template file;
replacing the variables contained in the template file with the values of the input parameters; and
generating the license data at least partially based on the input parameters.
7. An information handling system (IHS) comprising:
a processor of a first IHS communicatively coupled to a first memory device and to a hardware security module (HSM), the processor having software executing thereon for generating a license file, wherein the software configures the processor to:
receive a plurality of input parameters associated with a product;
generate license data at least partially based on the input parameters;
transmit the license data to a hardware security module (HSM);
trigger the HSM to retrieve a certificate containing allowable use data, the allowable use data including a subject organizational unit and a subject title, the subject organizational unit being one of an OEM IHS and a sub-contractor IHS, and the allowable use data at least partially identifying a permitted installation of a license for the product and utilized to determine if the license can be installed on a target IHS;
trigger the HSM to embed a signer identifier within the certificate, the signer identifier being a name of the first IHS;
trigger the HSM to sign the certificate using a private key, the private key being generated along with a corresponding public key that is embedded in the certificate;
receive the signed certificate from the HSM;
generate a license file including the license data and the signed certificate, wherein the signed certificate comprises the allowable use data and the public key; and
transmit the license file to a second IHS wherein:
the second IHS uses the allowable use data and the signer identifier to determine if installation of the license is permitted on the second IHS;
the public key allows contents of the license file to be verified as generated from a sender with access to the private key, and is therefore a trusted entity; and
in response to determining that installation of the license is permitted on the second IHS, the second IHS initiates installation of the license on the second IHS.
8. The information handling system of claim 7 , wherein during a provisioning process a root processor of a root IHS:
triggers a root HSM to retrieve the allowable use data;
triggers the root HSM to embed the allowable use data into the certificate;
receives the certificate containing the embedded allowable use data; and
transmits the certificate including the embedded allowable use data to the first IHS.
9. The information handling system method of claim 7 , wherein embedding the allowable use data within the certificate enables a license to remain a same for several customers or target IHSs while permitted users of the license are identified by the allowable use data and the signer identifier.
10. The information handling system of claim 9 , wherein the second IHS includes a controller communicatively coupled to a second memory device, the controller having firmware executing thereon, wherein the firmware configures the controller to:
receive the license file from the first IHS;
calculate a first hash of the license file;
decrypt an encrypted second hash from the certificate using a public key;
determine if the first hash and the second hash match; and
in response to the first hash and the second hash matching:
retrieve the allowable use data and the signer identifier from the certificate; and
determine if installation of the license is permitted on the second IHS based on the allowable use data and the signer identifier.
11. The information handling system of claim 10 , wherein the firmware further configures the controller to:
in response to determining that installation of the license is not permitted on the second IHS, prevent installation of the license on the second IHS.
12. The information handling system of claim 7 , wherein the software further configures the processor to:
retrieve a first executable file and a first template file;
execute the first executable file;
retrieve the input parameters by calling code from a plurality of command lines of the first executable file, the first template file describing a format of the command lines, the format including a specification of a placement in the command lines of values for a plurality of variables contained in the first template file;
parse the first template file;
replace the variables contained in the template file with the values of the input parameters; and
generate the license data at least partially based on the input parameters.
13. A license file generation system comprising:
a processor of a first information handling system (IHS) communicatively coupled to a first memory device and to a hardware security module (HSM), the processor having software executing thereon for generating a license file, wherein the software configures the processor to:
receive a plurality of input parameters associated with a product;
generate license data at least partially based on the input parameters;
transmit the license data to a hardware security module (HSM);
trigger the HSM to retrieve a certificate containing allowable use data, the allowable use data including a subject organizational unit and a subject title, the subject organizational unit being one of an OEM IHS and a sub-contractor IHS, and the allowable use data at least partially identifying a permitted installation of a license for the product and utilized to determine if the license can be installed on a target IHS;
trigger the HSM to embed a signer identifier within the certificate, the signer identifier being a name of the first IHS;
trigger the HSM to sign the certificate using a private key, the private key being generated along with a corresponding public key that is embedded in the certificate;
receive the signed certificate from the HSM;
generate a license file including the license data and the signed certificate, wherein the signed certificate comprises the allowable use data and the public key; and
transmit the license file to a second IHS, wherein:
the second IHS uses the allowable use data and the signer identifier to determine if installation of the license is permitted on the second IHS;
the public key allows contents of the license file to be verified as generated from a sender with access to the private key, and is therefore a trusted entity; and
in response to determining that installation of the license is permitted on the second IHS, the second IHS initiates installation of the license on the second IHS.
14. The license file generation system of claim 13 , wherein during a provisioning process, a root processor of a root IHS:
triggers a root HSM to retrieve the allowable use data;
triggers the root HSM to embed the allowable use data into the certificate;
receives the certificate containing the embedded allowable use data; and
transmits the certificate including the embedded allowable use data to the first IHS.
15. The license file generation system of claim 13 , wherein embedding the allowable use data within the certificate enables a license to remain a same for several customers or target IHS s while permitted users of the license are identified by the allowable use data and the signer identifier.
16. The license file generation system of claim 15 , wherein the second IHS includes a controller communicatively coupled to a second memory device, the controller having firmware executing thereon, wherein the firmware configures the controller to:
receive the license file from the first IHS;
calculate a first hash of the license file;
decrypt an encrypted second hash from the certificate using a public key;
determine if the first hash and the second hash match; and
in response to the first hash and the second hash matching:
retrieve the allowable use data and the signer identifier from the certificate; and
determine if installation of the license is permitted on the second IHS based on the allowable use data and the signer identifier.
17. The license file generation information handling system of claim 16 , wherein the firmware further configures the controller to:
in response to determining that installation of the license is not permitted on the second IHS, prevent installation of the license on the second IHS.
18. The license file generation information handling system of claim 16 , wherein the firmware further configures the controller to:
retrieve a first executable file and a first template file;
execute the first executable file;
retrieve the input parameters by calling code from a plurality of command lines of the first executable file, the first template file describing a format of the command lines, the format including a specification of a placement in the command lines of values for a plurality of variables contained in the first template file;
parse the first template file;
replace the variables contained in the template file with the values of the input parameters; and
generate the license data at least partially based on the input parameters.