Controlling the configuration of computer systems

Patent metadata

Field	Value
Publication number	US-9542206-B2
Application number	US-201514593009-A
Country	US
Kind code	B2
Filing date	Jan 9, 2015
Priority date	Jan 10, 2014
Publication date	Jan 10, 2017
Grant date	Jan 10, 2017

Abstract

Embodiments relate to controlling configuration of a computer system comprising one or more exchangeable components. The exchangeable components comprising identification means to store an identifier. A pair of a private key and a public key are generated for each accepted manufacturer of the exchangeable components and a pair of a private key and a public key for the computer system; assigning an identifier for each exchangeable component available for attachment to the system; receiving configuration data comprising a list of encrypted identity records comprising identifiers of the components together with signatures over the data generated with the private key of the respective component manufacturer for each component expected to be attached to the system; and receiving a configuration record. The configuration data of the expected components from the received configuration record is compared with the configuration data of the components attached to the system.

First claim

What is claimed is:

1. A computer program product comprising a computer usable memory including a computer readable program, wherein the computer readable program when executed on a computer system causes the computer system to execute program code for controlling configuration of a computer system comprising at least one exchangeable component, the program code executable by a processor to:
generate a first pair of a first private key and a first public key for each accepted manufacturer of the exchangeable components and a second pair of a second private key and a second public key for the computer system;
assign an identifier for each exchangeable component available for attachment to the controlled computer system and store the identifier together with a signature over the identifier generated with the first private key, the identifier and the signature being encrypted with the second public key;
receive configuration data comprising a list of encrypted identity records comprising identifiers of the components together with signatures over the data generated with the first private key of each component expected to be attached to the respective computer system, and decrypt data with the second private key stored on the computer system and store the received configuration data together with the signature generated from the first private key of each expected component in a configuration database;
receive a configuration record from the configuration database comprising configuration data on a controlled computer system and compare the configuration data of each expected component from the received configuration record with the configuration data of the components currently attached to the computer system, and reporting any mismatches, wherein the comparison uses the stored identifier, and wherein a signature is verified using the first public key stored in a secure area in computer system firmware;
create the signature for validating the identifier of the component using the first private key for creating the signature of the manufacturer and/or encrypting with the second public key;
requesting the exchangeable component by a component order;
providing the world-wide unique number as an identifier for the component;
creating an identity record comprising the world-wide unique number and optional identification data of the computer system and a customer of the computer system;
signing the identity record with the signature using the private key;
reading the identity record;
retrieving a system ID;
decrypting with the private key of the computer system and validating the signature of the identity record with the first public key;
importing the configuration data into the configuration database;
connecting the component to the computer system;
sensing the component configuration data currently attached by the computer system; and
comparing the exchangeable component configuration data from the received configuration record with the configuration data of the components currently attached to the computer system.

2. The computer program product of claim 1 , further comprising program code to enable components which are already attached but not enabled to the computer system.

3. The computer program product of claim 2 , further comprising program code to ensure the attachment of authorized and functional components.

4. The computer program product of claim 1 , further comprising program code to decrypt the identifier with the second private key and validate the signature on the computer system using the first public key.

Assignees

• IBM

Inventors

• Bieswanger Andreas
• Bolte Dirk
• Mayer Carl
• Pohl Thomas
• Troester Martin

Classifications

• G06F8/654

  using techniques specially adapted for alterable solid state memories, e.g. for EEPROM or flash memories · CPC title

• G06F21/44 Primary

  Program or device authentication · CPC title

• G06F21/73 Primary

  by creating or determining hardware identification, e.g. serial numbers · CPC title

• G06F9/44505 Primary

  Configuring for program initiating, e.g. using registry, configuration files · CPC title

• G06Q30/018

  Certifying business or products · CPC title