# US 10,482,254 B2 · Domain-authenticated control of platform resources > Agents: this data is available as JSON from the patentgrep API and MCP server — see https://patentgrep.com/llms.txt - Number: US 10,482,254 B2 - Document ID: US10482254B2 - Status: Granted - Kind: B2 - Application number: 12/836,156 - Filed: 2010-07-14 - Published: 2012-01-19 - Granted: 2019-11-19 - Earliest claimed: 2010-07-14 - Assignees: Intel Corporation - Applicants: Ned M. Smith; Steven L. Grobman; Craig T. Owen - Inventors: Ned M. Smith; Steven L. Grobman; Craig T. Owen - Web page: https://patentgrep.com/patent/US10482254B2 ## CPC - G06F 21/575: {Secure boot} - G06F 9/4401: Bootstrapping (security arrangements therefor G06F21/57) - G06F 9/45558: {Hypervisor-specific management and integration aspects} - G06F 21/53: by executing in a restricted environment, e.g. sandbox or secure virtual machine - G06F 21/74: operating in dual or compartmented mode, i.e. at least one secure mode - G06F 21/88: Detecting or preventing theft or loss - G06F 2009/45587: {Isolation or security of virtual machine instances} - G06F 2221/2105: Dual mode as a secondary aspect - G06F 2221/2141: Access rights, e.g. capability lists, access control lists, access tables, access matrices - G06F 2221/2145: Inheriting rights or properties, e.g., propagation of permissions or restrictions within a hierarchy - G06F 2221/2147: Locking files - G06F 2221/2149: Restricted operating environment - H04L 63/061: {for key exchange, e.g. in peer-to-peer networks (cryptographic mechanisms or cryptographic arrangements for key agreement H04L9/0838)} - H04L 63/102: {Entity profiles} - G06F: ELECTRIC DIGITAL DATA PROCESSING (computer systems based on specific computational models G06N) - H04L: TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION (arrangements common to telegraphic and telephonic communication H04M) ## Abstract A method, apparatus, system, and computer program product for domain-authenticated control of platform resources. Resources under the control of the platform are managed in accordance with access control rules that are centrally managed by a directory service. Security policies are uniformly applied by requiring authorization of the user's access to platform resources including hard drives, flash memory, sensors, network controllers and power state controllers. ## Claims ### Claim 1 A computer-implemented method comprising: obtaining a domain credential for a platform prior to loading an operating system for the platform; authenticating, prior to loading the operating system for the platform, the domain credential with a domain controller remote from the platform; establishing, prior to loading the operating system for the platform, a secure channel between the platform and the remote domain controller to receive an access control policy for the platform; receiving, prior to loading the operating system for the platform, the access control policy via the secure channel in response to authenticating the domain credential with the domain controller, wherein the access control policy comprises a resource identifier corresponding to a local resource of the platform that the domain credential has authority to access and firmware measurement data usable to verify the identity of the resource; identifying, prior to loading the operating system for the platform, the local resource of the platform that the domain credential has authority to access based on the resource identifier of the access control policy and the firmware measurement data; and using the domain credential to unlock the local resource of the platform prior to loading the operating system for the platform. ### Claim 2 (depends on 1) The method of claim 1, wherein the domain credential comprises at least one of a credential for a user of the platform and a credential for a secure partition of the platform. ### Claim 3 (depends on 1) The method of claim 1 further comprising: using the domain credential to obtain a key to decrypt data stored on the local resource; and using the key to decrypt the data stored on the local resource. ### Claim 4 (depends on 1) The method of claim 1, wherein the access control policy for the platform is maintained by the domain controller; and wherein identifying the local resource of the platform that the domain credential has authority to access comprises reviewing the received access control policy for the platform. ### Claim 5 (depends on 1) The method of claim 1, wherein unlocking the local resource of the platform comprises establishing a secure communication session between the remote domain controller and the local resource. ### Claim 6 (depends on 1) The method of claim 1, wherein unlocking the local resource comprises providing power to the local resource. ### Claim 7 (depends on 1) The method of claim 1 further comprising: obtaining an unlock token from the domain controller, wherein unlocking the local resource comprises using the unlock token to unlock the local resource. ### Claim 8 (depends on 1) The method of claim 1, wherein the local resource comprises at least one of an ATA device and a chipset-controlled resource. ### Claim 9 A system comprising: at least one processor; and a memory coupled to the at least one processor, the memory comprising instructions for performing the following: obtaining a domain credential for a platform prior to loading an operating system for the platform; authenticating, prior to loading the operating system for the platform, the domain credential with a domain controller remote from the platform; establishing, prior to loading the operating system for the platform, a secure channel between the platform and the remote domain controller to receive an access control policy for the platform; receiving, prior to loading the operating system for the platform, the access control policy via the secure channel in response to authenticating the domain credential with the domain controller, wherein the access control policy comprises a resource identifier corresponding to a local resource of the platform that the domain credential has authority to access and firmware measurement data usable to verify the identity of the resource; identifying, prior to loading the operating system for the platform, the local resource of the platform that the domain credential has authority to access based on the resource identifier of the access control policy and the firmware measurement data; and using the domain credential to unlock the local resource of the platform prior to loading the operating system for the platform. ### Claim 10 (depends on 9) The system of claim 9, wherein the domain credential comprises at least one of a credential for a user of the platform and a credential for a secure partition of the platform. ### Claim 11 (depends on 9) The system of claim 9, wherein the instructions further comprise instructions for performing the following: using the domain credential to obtain a key to decrypt data stored on the local resource; and using the key to decrypt the data stored on the local resource. ### Claim 12 (depends on 9) The system of claim 9, wherein the access control policy for the platform is maintained by the domain controller; and wherein identifying the local resource of the platform that the domain credential has authority to access comprises reviewing the received access control policy for the platform. ### Claim 13 (depends on 9) The system of claim 9, wherein unlocking the local resource of the platform comprises establishing a secure communication session between the remote domain controller and the local resource. ### Claim 14 (depends on 9) The system of claim 9, wherein unlocking the local resource comprises providing power to the local resource. ### Claim 15 (depends on 9) The system of claim 9, wherein the instructions further comprise instructions for performing the following: obtaining an unlock token from the domain controller, wherein unlocking the local resource comprises using the unlock token to unlock the local resource. ### Claim 16 (depends on 9) The system of claim 9, wherein the local resource comprises at least one of an ATA device and a chipset-controlled resource. ### Claim 17 A computer program product comprising: a computer-readable storage medium; and instructions in the computer-readable storage medium, wherein the instructions, when executed in a processing system, cause the processing system to perform operations comprising: obtaining a domain credential for a platform prior to loading an operating system for the platform; authenticating, prior to loading the operating system for the platform, the domain credential with a domain controller remote from the platform; establishing, prior to loading the operating system for the platform, a secure channel between the platform and the remote domain controller to receive an access control policy for the platform; receiving, prior to loading the operating system for the platform, the access control policy via the secure channel in response to authenticating the domain credential with the domain controller, wherein the access control policy comprises a resource identifier corresponding to a local resource of the platform that the domain credential has authority to access and firmware measurement data usable to verify the identity of the resource; identifying, prior to loading the operating system for the platform, the local resource of the platform that the domain credential has authority to access based on the resource identifier of the access control policy and the firmware measurement data; and using the domain credential to unlock the local resource of the platform prior to loading the operating system for the platform. ### Claim 18 (depends on 17) The computer program product of claim 17, wherein the domain credential comprises at least one of a credential for a user of the platform and a credential for a secure partition of the platform. ### Claim 19 (depends on 17) The computer program product of claim 17, wherein the instructions further cause the processing system to perform operations comprising: using the domain credential to obtain a key to decrypt data stored on the local resource; and using the key to decrypt the data stored on the local resource. ### Claim 20 (depends on 17) The computer program product of claim 17, wherein the access control policy for the platform is maintained by the domain controller; and wherein identifying the local resource of the platform that the domain credential has authority to access comprises reviewing the received access control policy for the platform. ### Claim 21 (depends on 17) The computer program product of claim 17, wherein unlocking the local resource of the platform comprises establishing a secure communication session between the remote domain controller and the local resource. ### Claim 22 (depends on 17) The computer program product of claim 17, wherein unlocking the local resource comprises providing power to the local resource. ### Claim 23 (depends on 17) The computer program product of claim 17, wherein the instructions further cause the processing system to perform operations comprising: obtaining an unlock token from the domain controller, wherein unlocking the local resource comprises using the unlock token to unlock the local resource. ### Claim 24 (depends on 17) The computer program product of claim 17, wherein the local resource comprises at least one of an ATA device and a chipset-controlled resource. ### Claim 25 A computer-implemented method comprising: receiving a domain credential for a platform at a domain controller remote from the platform prior to loading an operating system for the platform; authenticating, prior to loading the operating system for the platform, the domain credential; establishing, prior to loading the operating system for the platform, a secure channel between the platform and the domain controller to provide an access control policy to the platform; and providing, prior to loading the operating system for the platform, the access control policy, via the secure channel, to the platform in response to authenticating the domain credential, wherein the access policy comprises a resource identifier for identifying a local resource of the platform that the domain credential has authority to access, firmware measurement data usable to verify the identity of the resource and a token to unlock the local resource. ### Claim 26 (depends on 25) The method of claim 25, wherein the domain credential comprises at least one of a credential for a user of the platform and a credential for a secure partition of the platform. ### Claim 27 (depends on 25) The method of claim 25, wherein the local resource comprises at least one of an ATA device and a chipset-controlled resource.