Device provisioning service
AssigneeIntel Corporation
InventorsErnie F. Brickell, Geoffrey H. Cooper
Life of this patent
Estimating the term…
Abstract
A computing device is provisioned to be remotely managed by a current owner. The device has an initial cryptographic basis of trust, and an owner identifier that facilitates establishment of communication with the current owner of the device. The ownership may change one or more times while the device may remain inoperative. Later, the device receives a transfer-of-ownership indication, which it verifies against the initial basis of trust to establish a new current owner. The device may then communicate with a device management service of the new current owner based on the transfer-of-ownership indication.
Claims19
A computing device provisionable to be remotely managed by a current owner, the device comprising:
- execution hardware including at least one processor core and a data store;
- a provisioning interface operative via the execution hardware, wherein the provisioning interface is configured with an initial cryptographic basis of trust, and with an owner identifier that facilitates establishment of communication with the current owner of the device, and wherein the provisioning interface is configured to receive and verify a transfer-of-ownership indication against the initial basis of trust to establish a new current owner, wherein the transfer-of-ownership indication includes an ownership proxy data structure, wherein the ownership proxy data structure includes a chain of ownership comprising public keys of a first owner and any subsequent owners, wherein each public key of a subsequent owner is signed by a preceding owner, and the public key of the first owner is signed by the initial basis of trust, and wherein a current ownership public key is verifiable using the initial basis of trust, and wherein the public key of the first owner is signed by every subsequent owner;
- and
- a manager agent operative via the execution hardware to communicate with a device management service of the new current owner of the device based on the transfer-of-ownership indication.
A system for remotely managing a computing device, the system comprising:
- execution hardware including at least one processor core and a data store;
- a client engine operative via the execution hardware, the client engine being configured to exercise dominion over the computing device in response to a first transfer of ownership, the first transfer of ownership establishing the system as being a new owner of the computing device based on an initial cryptographic basis of trust verifiable by the computing device, wherein the first transfer-of-ownership indication includes an ownership proxy data structure, wherein the ownership proxy data structure includes a chain of ownership comprising public keys of a first owner and any subsequent owners, wherein each public key of a subsequent owner is signed by a preceding owner, and the public key of the first owner is signed by the initial basis of trust, and wherein a current ownership public key is verifiable using the initial cryptographic basis of trust, and wherein the public key of the first owner is signed by every subsequent owner;
- and
- a device management engine to manage a configuration setting of the computing device when the system is designated as a current owner of the computing device.
At least one non-transitory machine-readable medium comprising instructions for provisioning a computing device to be remotely managed by a current owner, wherein the instructions, when executed on a machine, cause the machine to perform:
- storing an initial cryptographic basis of trust, and an owner identifier that facilitates establishment of communication with the current owner of the device;
- receiving a transfer-of-ownership indication;
- verifying the transfer-of-ownership indication against the initial basis of trust to establish a new current owner, wherein the transfer-of-ownership indication includes an ownership proxy data structure, wherein the ownership proxy data structure includes a chain of ownership comprising public keys of a first owner and any subsequent owners, wherein each public key of a subsequent owner is signed by a preceding owner, and the public key of the first owner is signed by the initial basis of trust, and wherein a current ownership public key is verifiable using the initial basis of trust, and wherein the public key of the first owner is signed by every subsequent owner;
- and
- communicating with a device management service of the new current owner of the device based on the transfer-of-ownership indication.
Dependencies are inferred from the claim text.