# US 10,311,224 B1 · Digitally sealing equipment for authentication of components > Agents: this data is available as JSON from the patentgrep API and MCP server — see https://patentgrep.com/llms.txt - Number: US 10,311,224 B1 - Document ID: US10311224B1 - Status: Granted - Kind: B1 - Application number: 15/467,896 - Filed: 2017-03-23 - Granted: 2019-06-04 - Earliest claimed: 2017-03-23 - Assignees: Amazon Technologies, Inc. - Applicants: Amazon Technologies, Inc. - Inventors: Munif M. Farhan; Jaime Ismael Rangel Martinez - Web page: https://patentgrep.com/patent/US10311224B1 ## CPC - H04L 9/3236: {using cryptographic hash functions} - G06F 21/57: Certifying or maintaining trusted computer platforms, e.g. secure boots or power-downs, version controls, system software checks, secure updates or assessing vulnerabilities - H04L 9/0866: {involving user or device identifiers, e.g. serial number, physical or biometrical information, DNA, hand-signature or measurable physical characteristics} - H04L 9/0897: {involving additional devices, e.g. trusted platform module [TPM], smartcard or USB} - H04L 9/3226: {using a predetermined code, e.g. password, passphrase or PIN (network architectures or network communication protocols for supporting authentication of entities using passwords in a packet data network H04L63/083)} - H04L: TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION (arrangements common to telegraphic and telephonic communication H04M) - G06F: ELECTRIC DIGITAL DATA PROCESSING (computer systems based on specific computational models G06N) ## Abstract A digital seal of a current configuration of a rack can be generated to authenticate that rack components within the rack remain unchanged during transport. At a manufacturing site, an agent can be executed so as to capture a plurality of device identifiers, which indicate what hardware or software components are present in the rack. A digital seal representing a current configuration of the rack can be generated using the device identifiers and stored at a secure location within the rack. When the rack is transported from one location to another, the digital seal of the rack travels with the rack. At a data center, the rack can be re-tested and a new measurement can be captured. The stored digital seal can be compared to the new measurement to ensure that the rack components have not been compromised during shipping. ## Claims ### Claim 1 A method of authenticating rack components, comprising: reading device identifiers for hardware components within a rack; generating a digital seal representing a configuration of the rack using the device identifiers, wherein the digital seal includes a unique identifier that is a combination of the device identifiers; storing the digital seal in non-volatile storage within the rack during shipment of the rack; after shipment of the rack, re-reading the device identifiers and generating a current measurement; and authenticating the components within the rack by verifying that the digital seal matches the current measurement. ### Claim 2 (depends on 1) The method of claim 1, wherein the unique identifier is a concatenation of the device identifiers and wherein the device identifiers include serial numbers of the plurality of the components, or wherein the device identifiers are cryptographic values associated with the serial numbers of the plurality of components. ### Claim 3 (depends on 1) The method of claim 1, wherein the plurality of components include: a processor, memory, storage devices, network devices, management cards, bus adapters, add-in cards, or power supplies. ### Claim 4 (depends on 1) The method of claim 1, further including interrogating the plurality of components in the rack to determine the device identifiers including: a type of component, a vendor of the component, a model number of the component or a version number of the component. ### Claim 5 A method, comprising: interrogating rack hardware components within a rack to obtain identifiers associated therewith; generating, using a processor coupled to or in the rack, a digital seal of a current configuration of the rack using the obtained identifiers; storing the digital seal using the processor within a Trusted Platform Module (TPM), the processor and the TPM being separate components within the rack; and validating the rack by generating a digital measurement using the identifiers and comparing the digital measurement to the digital seal. ### Claim 6 (depends on 5) The method of claim 5, further including validating the rack at a later time by generating a digital measurement by using the identifiers and comparing the digital measurement to the digital seal. ### Claim 7 (depends on 6) The method of claim 6, wherein the digital seal matches the digital measurement if a configuration of the rack is unaltered between the generating of the digital seal and the generating of the digital measurement. ### Claim 8 (depends on 5) The method of claim 5, wherein rack components are electronic devices and include: server computers, switches, power units, PCI devices or networking devices. ### Claim 9 (depends on 5) The method of claim 5, wherein the interrogating of the rack components includes obtaining a vendor, a model, a serial number of the rack components, or a release version of software. ### Claim 10 (depends on 5) The method of claim 5, further including reading a policy document that controls a frequency to authenticate the rack and to control actions to be taken if the authentication is invalid. ### Claim 11 (depends on 5) The method of claim 5, wherein storing the digital seal includes storing a value within non-volatile memory within one of the rack components. ### Claim 12 (depends on 5) The method of claim 5, further including detecting that a rack component was added, removed, or swapped for another rack component by determining that the digital seal does not match a re-calculated digital measurement. ### Claim 13 (depends on 5) The method of claim 5, wherein the digital seal is generated using: a cryptographic function or a checksum. ### Claim 14 A system, comprising: a rack of components including a server computer, the server computers including a motherboard having a processor; and an agent for execution on the rack of components to determine hardware components included in the rack of components after shipment of the rack of components, the agent for generating a first unique identifier for the determined components and for storing the unique identifier within the rack of components, wherein the first unique identifier is a concatenation of identifiers of the hardware components, and is configured to re-determine the hardware components included in the rack of components to generate a second unique identifier and to authenticate the rack of components by determining whether the second unique identifier and the first unique identifier match. ### Claim 15 (depends on 14) The system of claim 14, wherein the first unique identifier is associated with a configuration of the rack of components. ### Claim 16 (depends on 14) The system of claim 14, wherein the first unique identifier is obtained by reading identifiers of the components and using the identifiers of the components in a hash algorithm. ### Claim 17 (depends on 14) The system of claim 14, wherein the components include processors, network components, storage components, memory, add-in cards, or versions of software. ### Claim 18 (depends on 14) The system of claim 14, wherein the first unique identifier is stored with the rack of components in a trusted platform module.