US 11,909,882 B2Granted

Systems and methods to cryptographically verify an identity of an information handling system

AssigneeDell Products L.P.

InventorsCharles D. Robison, Nicholas D. Grobelny, Amy C. Nelson

Life of this patent

Estimating the term…

Loading patent…

Abstract

Various embodiments of systems and methods are provided to bind a system identifier that uniquely identifies an information handling system (IHS) to the system platform, so that the identity of the IHS can be cryptographically verified. More specifically, the present disclosure provides methods to bind a unique system identifier to an IHS platform, and methods to cryptographically verify the identity of the IHS using the unique system identifier and a plurality of keys generated and stored with a Trusted Platform Module (TPM) of the IHS. Systems are provided herein to perform such methods. As such, the systems and methods disclosed herein enable system identity to be irrefutably verified, thereby preventing theft and misuse of system identity.

Claims14

Dependent claims

A system, comprising:

a plurality of information handling systems (IHSs), each having:
a processing device;
a computer readable storage device configured to store a verification application and a unique system identifier that uniquely identifies the IHS;
and
a trusted platform module (TPM) configured to store a private Endorsement Key (EK), an EK certificate containing a public EK, a public signing key and a private signing key;
and
a first remote system comprising a first computer readable medium configured to store an entitlement database for the plurality of IHSs, wherein for each IHS, the entitlement database associates the unique system identifier specified for the IHS with the EK certificate and the public signing key stored within the TPM of the IHS;
and
a second remote system coupled, via a network, to the first remote system and to the plurality of IHSs, wherein the second remote system comprises a second computer readable medium configured to store verification software and a processing device, and wherein upon receiving a verification request from a first IHS to verify an identity of the first IHS, the processing device of the second remote system is configured to execute the verification software to communicate with the first remote system and the first IHS to cryptographically verify the identity of the first IHS;
wherein upon receiving the verification request from the first IHS to verify an identity of the first IHS, the processing device of the second remote system is configured to execute the verification software to:
receive a unique system identifier specified for the first IHS along with the verification request, and
retrieve the EK certificate and the public signing key associated with the unique system identifier from the entitlement database stored within the first computer readable medium of the first remote system;
wherein the processing device of the second remote system is further configured to execute the verification software to:
generate a nonce,
encrypt the nonce with a public EK obtained from the EK certificate;
and
transmit the encrypted nonce to the first IHS;
and
wherein the processing device of the first IHS is configured to execute the verification application to:
send the verification request and the unique system identifier specified for the first IHS to the second remote system,
receive the encrypted nonce from the second remote system,
decrypt the encrypted nonce using the private EK stored within the TPM of the first IHS,
sign the nonce and the unique system identifier using the private signing key stored within the TPM of the first IHS, and
transmit a signed message containing the nonce and the unique system identifier to the second remote system.

21 more elements

A method performed by an information handling system (IHS) to verify an identity of the IHS, the method comprising:

generating and storing a plurality of keys within a trusted platform module (TPM) of the IHS, wherein the plurality of keys includes a public signing key and a private signing key;
sending a verification request to verify the identity of the IHS, along with a unique system identifier specified for the IHS, to a remote system;
and
communicating with the remote system to cryptographically verify the identity of the IHS, wherein said communicating comprises:
receiving an encrypted nonce from the remote system;
decrypting the encrypted nonce using a private Endorsement Key (EK) stored within the TPM;
signing the nonce and the unique system identifier using the private signing key stored within the TPM;
transmitting a signed message containing the nonce and the unique system identifier to the remote system;
and
receiving a verification response from the remote system.

7 more elements

A method performed by a remote system to verify an identity of an information handling system (IHS), the method comprising:

receiving a verification request to verify the identity of the IHS, along with a unique system identifier specified for the IHS;
using the unique system identifier to retrieve an Endorsement Key (EK) certificate and a public signing key associated with the unique system identifier from an entitlement database stored within another remote system;
and
communicating with the IHS over a network to cryptographically verify the identity of the IHS, wherein said communicating comprises:
generating a nonce;
encrypting the nonce with a public EK obtained from the EK certificate;
and
transmitting the encrypted nonce to the IHS;
wherein said communicating further comprises:
receiving a signed message containing the nonce and the unique system identifier, wherein the signed message is generated by a trusted platform module (TPM) of the IHS using a private signing key stored within the TPM,
using the public signing key retrieved from the entitlement database to verify the nonce and the unique system identifier contained within the signed message, and
transmitting a verification response to the IHS.

9 more elements

Dependencies are inferred from the claim text.

Facts

Application: 16/777,415Filed 30 Jan 2020
Published: US 2021/0243030 A15 Aug 2021
Granted: 20 Feb 2024
Term ends: Not estimatedThe source records don’t support an estimate.

Classification10 codes

H04L 9/3234
Including means for verifying the identity or authority of a user of the system or for message authentication, e.g. authorization, entity…:…
H04L 63/0823
For authentication of entities: using certificates
H04L 9/0877
Generation of secret information including derivation or calculation of cryptographic keys or passwords: using additional device, e.g. trusted…
H04L 9/0897
Escrow, recovery or storing of secret information, e.g. secret key escrow or cryptographic key storage: involving additional devices, e.g. trusted…

Family

US 2021/0243030 A1Pre-grant publication · published 5 Aug 2021
US 11,909,882 B2This patent

From the US filing history. Foreign family members aren’t listed.

Timeline

Citations

Open elsewhere

Building an agent or pulling many patents? Use the API or MCP server instead of scraping pages. Get an API key