Controlling the configuration of computer systems

A computer program product comprising a computer usable memory including a computer readable program, wherein the computer readable program when executed on a computer system causes the computer system to execute program code for controlling configuration of a computer system comprising at least one exchangeable component, the program code executable by a processor to:

• generate a first pair of a first private key and a first public key for each accepted manufacturer of the exchangeable components and a second pair of a second private key and a second public key for the computer system;
• assign an identifier for each exchangeable component available for attachment to the controlled computer system and store the identifier together with a signature over the identifier generated with the first private key, the identifier and the signature being encrypted with the second public key;
• receive configuration data comprising a list of encrypted identity records comprising identifiers of the components together with signatures over the data generated with the first private key of each component expected to be attached to the respective computer system, and decrypt data with the second private key stored on the computer system and store the received configuration data together with the signature generated from the first private key of each expected component in a configuration database;
• receive a configuration record from the configuration database comprising configuration data on a controlled computer system and compare the configuration data of each expected component from the received configuration record with the configuration data of the components currently attached to the computer system, and reporting any mismatches, wherein the comparison uses the stored identifier, and wherein a signature is verified using the first public key stored in a secure area in computer system firmware;
• create the signature for validating the identifier of the component using the first private key for creating the signature of the manufacturer and/or encrypting with the second public key;
• requesting the exchangeable component by a component order;
• providing the world-wide unique number as an identifier for the component;
• creating an identity record comprising the world-wide unique number and optional identification data of the computer system and a customer of the computer system;
• signing the identity record with the signature using the private key;
• reading the identity record;
• retrieving a system ID;
• decrypting with the private key of the computer system and validating the signature of the identity record with the first public key;
• importing the configuration data into the configuration database;
• connecting the component to the computer system;
• sensing the component configuration data currently attached by the computer system;
• and
• comparing the exchangeable component configuration data from the received configuration record with the configuration data of the components currently attached to the computer system.