Controlling the configuration of computer systems

Patent metadata

Field	Value
Publication number	US-9940146-B2
Application number	US-201514731109-A
Country	US
Kind code	B2
Filing date	Jun 4, 2015
Priority date	Jan 10, 2014
Publication date	Apr 10, 2018
Grant date	Apr 10, 2018

Abstract

Embodiments relate to controlling configuration of a computer system comprising one or more exchangeable components. The exchangeable components comprising identification means to store an identifier. A pair of a private key and a public key are generated for each accepted manufacturer of the exchangeable components and a pair of a private key and a public key for the computer system; assigning an identifier for each exchangeable component available for attachment to the system; receiving configuration data comprising a list of encrypted identity records comprising identifiers of the components together with signatures over the data generated with the private key of the respective component manufacturer for each component expected to be attached to the system; and receiving a configuration record. The configuration data of the expected components from the received configuration record is compared with the configuration data of the components attached to the system.

First claim

What is claimed is:

1. A method for controlling configuration of a computer system, comprising one or more exchangeable components, the exchangeable components to store an identifier and provide the identifier to the computer system when being attached to it, the method comprising:
generating a pair of a private key and a public key for each accepted manufacturer of the exchangeable components and a pair of a private key and a public key for the computer system;
assigning an identifier for each exchangeable component available for attachment to the computer system and storing the identifier together with a signature over the identifier generated with the private key of the component manufacturer, the identifier as well as the signature being encrypted with the public key of the computer system;
receiving configuration data comprising a list of encrypted identity records comprising identifiers of the components together with signatures over data generated with the private key of the respective component manufacturer for each component expected to be attached to the respective computer system, and decrypting the configuration data with the private key stored on the computer system and storing the received configuration data together with the signature;
receiving a configuration record comprising the configuration data on a computer system; and
in response to an attachment of the component to the computer system, sensing the configuration data of the components currently attached to the computer system, and comparing the configuration data of the exchangeable components from the received record with the configuration data of the components currently attached to the computer system, and reporting any mismatches, wherein the comparison uses the stored identifier, and verifying the signature using the public key of the component manufacturer stored in firmware of the computer system.

2. The method according to claim 1 , wherein a world-wide unique number is used as the identifier for each exchangeable component.

3. The method according to claim 2 , wherein an asynchronous process is used for encryption/decryption and signing of the identifier comprising the private key and the public key of the computer system in conjunction with signatures from each accepted manufacturer of the exchangeable components.

4. The method according to claim 3 , further comprising creating the signature for validating the identifier of the component using the private key of the component manufacturer for creating the signature of the manufacturer and/or encrypting with the public key of the computer system.

5. The method according to claim 4 , further comprising decrypting the identifier with the private key of the computer system and validating the signature on the computer system using the public key of the component manufacturer.

6. The method according to claim 2 , further comprising creating an identity record, comprising:
requesting the exchangeable component by a component order;
creating an identity record comprising the world-wide unique number and optional identification data of the computer system and a customer of the computer system; and
signing the identity record with the signature using the private key.

7. The method according to claim 6 , wherein information from the component order comprising a system ID of the computer system is stored in the identity record.

8. The method according to claim 6 , further comprising attaching a component to the computer, comprising:
reading the identity record;
retrieving a system ID;
decrypting with the private key of the computer system and validating the signature of the identity record with the public key of the manufacturer;
importing the configuration data into a configuration database.

9. The method according to claim 8 , wherein the identity record is managed by a central order system controlling configuration for the computer system.

10. The method according to claim 9 , comprising the step of enabling components which are already attached but not enabled to the computer system.

11. The method according to claim 10 , further comprising ensuring the attachment of authorized and functional components.

Assignees

• IBM

Inventors

• Bieswanger Andreas
• Bolte Dirk
• Mayer Carl
• Pohl Thomas
• Troester Martin

Classifications

• G06F9/44505 Primary

  Configuring for program initiating, e.g. using registry, configuration files · CPC title

• G06F21/73 Primary

  by creating or determining hardware identification, e.g. serial numbers · CPC title

• G06F21/44 Primary

  Program or device authentication · CPC title

• G06F8/665

  Physics · mapped topic

• G06F8/654

  using techniques specially adapted for alterable solid state memories, e.g. for EEPROM or flash memories · CPC title