The present invention relates in general to data processing systems, and in particular, to a method, system and computer program product for configuring functional capabilities of a computer system comprising a persistent memory and a replaceable functional unit.
Asset protection for replaceable functional units of a computer system (e.g., I/O cards) is usually done using cryptographically protected license records. The license record defines the features (e.g., card personality, number of ports, etc.) paid for by the customer. Cryptographic techniques ensure that the license record cannot be modified. The license record is bound to the card serial number to prevent duplication/re-use on multiple cards. During startup of the computer system, the first license record is validated. Then the serial number of the I/O card is compared to the serial number in the license record to determine whether they match. Finally the I/O card is configured according to the license record (e.g., the number of ports allowed, the I/O card personality, etc.).
A repair of a defective I/O card requires a new license record from the computer system manufacturer due to the replacement I/O card having a different serial number. For client accounts which do not have a connection to computer system manufacturer, thus, the new license record must be transported on media, which might cause an additional repair delay and, consequently, may cause problems with the time window reserved for the repair.
Embodiments of the present disclosure include a method, computer program product, and system for configuring the functional capabilities of a computer system. The computer system may include a persistent memory and a replaceable functional unit. The method may include transferring, in response to a repair action for the functional unit, enablement data that is stored on the functional unit to the persistent memory. The enablement data may specify one or more functional capabilities of the functional unit that are enabled. The method may further include erasing the enablement data from the functional unit after it has been transferred to the persistent storage. The method may further include obtaining a second unique identification item from a replacement unit. The method may further include obtaining new enablement data. The new enablement data may be transferred to the replacement unit.
The above summary is not intended to describe each illustrated embodiment or every implementation of the present disclosure. The aforementioned advantages represent example advantages, and therefore, not all advantages of the various embodiments are described herein. Furthermore, some embodiments of the present disclosure can exhibit none, some, or all of the advantages listed herein while remaining within the spirit and scope of the present disclosure.
The drawings included in the present disclosure are incorporated into, and form part of, the specification. They illustrate embodiments of the present disclosure and, along with the description, serve to explain the principles of the disclosure. The drawings are only illustrative of typical embodiments and do not limit the disclosure.
In the drawings, elements with the same reference numerals may be the same as, or substantially similar to, each other. The drawings are merely schematic representations and are not intended to portray specific parameters of the disclosure. Moreover, the drawings are intended to depict only example embodiments of the disclosure and therefore should not be considered as limiting the scope of the disclosure.
The illustrative embodiments described herein provide a method, system, and computer program product for configuring functional capabilities of a computer system and/or an individual unit within a computer system. The illustrative embodiments are sometimes described herein using particular technologies only as an example for the clarity of the description. The illustrative embodiments may be used for configuring functional capabilities of a computer system comprising a persistent memory and a replaceable functional unit (also referred to herein as a “unit”), wherein enablement data is stored in the unit together with a unique identification item unique for the unit (e.g., the serial number). The enablement data may specify all or a subset of the functional capabilities of the unit. In some embodiments, the enablement data may specify only the functional capabilities of the unit that are enabled. For example, an I/O card may be licensed such that only a subset of its ports are enabled (e.g., a customer may only pay for access to 4 ports, while the card itself may have 8 ports). The enabled ports may be identified by the enablement data.
In some embodiments, during a repair action, the enablement data content can be reassigned to a replacement functional unit with a different serial number based on the enablement data of the old unit. History data may be stored in the enablement data. The old enablement data may be erased from the unit being removed. The modified, and thus new, enablement data may have the same license key content as the old enablement data.
The enablement data may contain a clear text part copied from the license record, history data, and a cryptographically secured value, such as a cryptographic symmetric hash. The cryptographically secured value may be used to verify that the enablement data content has not been tampered with. The clear text may contain fields specifying assets paid for by the customer (e.g., which ports the customer has paid to enable). The history data may contain a list of history elements which is updated every time the enablement data is modified (e.g., by being associated with a new serial number). The history data may contain a timestamp and the serial number of the old unit (e.g., a unit that was replaced). In some embodiments, the first history data entry may contain the timestamp of the original license record. If the space for the history data is used up, a new license record, which may be delivered by the computer system manufacturer, may be needed to enable further changes.
Various embodiments of the present disclosure include a method for configuring functional capabilities of a computer system that includes a persistent memory and a replaceable functional unit, wherein enablement data is stored in the unit together with a unique identification item unique for the unit. The enablement data may specify all or a subset of the functional capabilities of the unit. Specified functional capabilities for functional use may be enabled in the unit, and the remaining (e.g., unspecified) functional capabilities of the unit may be disabled. The enablement data may include a cryptographically secured value, such as a hash, an encrypted value, or the like, derived from secret data and the unique identification item of the unit. The secret data may be stored in the persistent memory. The validity of the enablement data may be determined based on the correctness of its cryptographically secured value. The method may include, in response to a repair action for the unit, (i) transferring the enablement data to the persistent memory and erasing the enablement data on the unit. Further, the method may include, in response to a replacement action for the unit, (ii) obtaining a unique identification item from the replacement unit; (iii) providing new enablement data by either replacing the stored cryptographically secured value in the stored enablement data with a new cryptographically secured value derived from the secret data and the unique identification item of the replacement unit, or by generating the new enablement data; and (iv) transferring the new enablement data to the replacement unit. Generating new enablement data may mean generating enablement data comprising a cryptographically secured value, such as a hash, an encrypted value or the like, derived from new secret data and the unique identification item of the unit.
In some embodiments, the method introduces enablement data for configuring functional capabilities of a computer system. The enablement data represents a licensing record type as a personalization record for a replaceable functional unit, such as an I/O card of a computer system, which is compatible with a commonly used license record. The enablement data may be created by trusted firmware in the computer system itself, and be based on a verified/decrypted license record from the computer system manufacturer. The enablement data record may include a cryptographically secured value such as a cryptographic hash, which is derived from the secret data, such as an original encrypted license key on a license record, delivered by the computer system manufacturer. The cryptographically secured value may be created and verified by the trusted firmware. This method allows changes to the enablement data as a personalization record of the functional unit within the computer system for repair actions, e.g., without requiring a connection to the computer system manufacturer. Other uses, such as, e.g., merging of licensing records, is possible if the need arises.
Thus, in some embodiments, the method includes a module in a trusted environment of a computer system that may verify secret data from the computer system manufacturer as license keys for configuring functional capabilities of a computer system (e.g., for a replaceable functional unit, such as an I/O card). Further, the module may create enablement data as internal license keys, based on the received license keys. Further, the module may verify the enablement data and transform the enablement data in order to forward the license to a replacement unit. Further, the module may merge different enablement data as internal license keys to a combined enablement data.
Enabling the specified functional capabilities for functional use of the unit and disabling the remaining functional capabilities of the unit may be performed by the computer system, by firmware or software in the computer system, or by the replaceable unit itself
Embodiments of the present disclosure include computer program product for configuring functional capabilities of a computer system. The computer system may include a persistent memory and a replaceable functional unit, wherein enablement data may be stored in the unit together with a unique identification item unique for the unit. The enablement data may specify all or a subset of the functional capabilities of the unit. Specified functional capabilities (e.g., those in the enablement data) for functional use may be enabled in the unit, and remaining functional capabilities of the unit (e.g., those that are not in the enablement data) may be disabled. The enablement data may include a cryptographically secured value (e.g., a hash, an encrypted value, or the like). The cryptographically secured value may be derived from secret data and the unique identification item of the unit. The secret data may be stored in the persistent memory, and the validity of the enablement data may be determined based on the correctness of its cryptographically secured value.
The computer program product may include a computer readable storage medium having program instructions embodied therewith, the program instructions executable by a computer to cause the computer to perform a method. The method may include, in response to a repair action for the unit, (i) transferring the enablement data to the persistent memory and erasing the enablement data on the unit. The method may further include, in response to a replacement action for the unit, (ii) obtaining a unique identification item from the replacement unit; (iii) providing new enablement data either by replacing the stored cryptographically secured value in the stored enablement data with a new cryptographically secured value derived from the secret data and the unique identification item of the replacement unit, or by generating the new enablement data; and (iv) transferring the new enablement data to the replacement unit.
Further embodiments of the present disclosure include a data processing system for execution of a data processing program. The data processing system may include a processor, memory device, and a functional unit. The data processing system may further include computer readable program instructions for performing the various method described herein, such as the method described above.
Turning now to the figures,
The enablement data 16 may specify all or a subset of the functional capabilities of the unit 10. Specified functional capabilities for functional use may be enabled in the unit 10. The remaining functional capabilities of the unit 10 (e.g., the functional capability of the unit 10 that are not specified in the enablement data 16) may be disabled by the computer system 212, by the firmware 60, or by the unit 10 itself. The enablement data 16 may also include a cryptographically secured value 32, which may be implemented as a cryptographic hash value, and which is derived from secret data 20 (shown in
The cryptographically secured value 32 may include a cryptographic function for ensuring correctness of the enablement data 16. The secret data 20 may be stored in the persistent memory 14 of the computer system 212. The validity of the enablement data 16 may be determined based on the correctness of its cryptographically secured value 32. For example, the firmware 60 may be configured to validate the cryptographically secured value 32 in order to determine the validity of the enablement data (e.g., in order to determine whether the enablement data was tampered with to enable additional functionality that was not paid for).
As discussed herein, various embodiments of the present disclosure include a method for installation of the functional unit 10. The method may include receiving the secret data 20 (e.g., a license key). The secret data 20 may be generated in a key generation facility 48 (e.g., hardware or software module) of the computer system manufacturer 46. The secret data 20 may be stored in the persistent memory 14 of a key verification and generation facility (e.g., module) of the computer system 212. In some embodiments, the key verification and generation facility may be implemented as a firmware 60 of the computer system 212. Enablement data 16 may be generated in this firmware 60, and may be based on the secret data 20 and the unique identification item 30 of the functional unit 10, which may be obtained from the unit 10 and checked against the unique identification item value derived from the secret data 20.
The created enablement data 16 may then be transmitted to the unit 10, thus configuring the functional capabilities of the unit 10, such as, e.g., a number of enabled ports of an I/O card, or the personality of the I/O card. A service element 62 of the computer system 212 may be used for communication between the firmware 60 and the unit 10, but this service element 62 is not mandatory. In some embodiments, the firmware 60 (or any other component of the computer system 212) may communicate with the unit 10 directly, instead of going through the service element 62).
In some embodiments, modifying functional capabilities of the unit 10 may be achieved by modifying enablement data 16 based on new secret data 20 transferred to the persistent memory 14 and transferring the new enablement data 18 to the unit 10.
In
Additionally, the enablement data 16 includes history data 40 of units 10 for which the enablement data 16 has been used (e.g., at least history data 40 of the first unit 10 it is to be used or has been used for). In other words, the record history 40 may include historical enablement data for each unit (including an original unit and any replacement units) associated with the enablement data. For example, a first unit may initially be installed in a computer system, and may be associated with (e.g., include) a first enablement data. The first unit may subsequently be replaced by a second unit if, for example, the first unit becomes damaged. The first enablement data, in either a modified form (e.g., to include new functionalities) or an unmodified form, may be copied over to the second unit, as discussed herein. The history record 40 may thus include enablement data related to both the first and second units. The history data 40 may be updated upon modifying the enablement data 16. Furthermore, the history data 40 may include time stamps related to changes to the enablement data 16 (e.g., when the enablement data 16 is created and/or modified).
Additionally, the enablement data 16 may include a cryptographically secured value 32, like a hash value, which may be used to verify that the content of the enablement data 16 is correct and has not been tampered with. Accordingly, the validity of the enablement data 16 may be determined based on the correctness of the cryptographically secured value 32.
The service element 62 in the process flow of
One or more operations of the method 600 may be optionally performed, or not performed at all. For example, steps S102, S110, and S112 are optional because, in the absence of the service element, the data could also be sent directly to the firmware and to the persistent memory of the unit. In some embodiments, the method 600 may be performed by a computer system (e.g., computer system 212 shown in
The method 800 may being at step S200, where the SE may read the enablement data from the old functional unit and erase the enablement data on the unit. Then, in step S202, the new replacement unit may be installed in the computer system. Next, in step S204, the SE may send the old enablement data to the firmware, along with the old and the new unique identification items (e.g., the serial numbers of the old and replacement units, respectively). Then, in step S206, the firmware may validate the old enablement data, followed in step S208 by the firmware creating a new enablement data based on the old enablement data. The firmware may use the new unique identification item to generate the new enablement data. Next, in step S210, the firmware may send the new enablement data to the SE and then, in step S212, the SE may write the new enablement data to the persistent memory of the new unit. Afterwards, in step S214, the firmware may complete the replacement process by, for example, configuring the new functional unit as described herein.
After merging the two original enablement data 16, 18 to the new enablement data 19, the combined enablement data 19 may be transferred to the unit, thus configuring the unit with additional functional capabilities. For this purpose, the clear text sections 22, 24 may be merged to the new clear text section 23 of the combined enablement data 19. Additionally, the history data 40, 42 may be merged to the new history data 41. The combined enablement data 19 may also include a new cryptographically secured value 56 for validation of the data.
Referring now to
In data processing system 210 there is a computer system/server 212, which is operational with numerous other general purpose or special purpose computing system environments or configurations. Examples of well-known computing systems, environments, and/or configurations that may be suitable for use with computer system/server 212 include, but are not limited to, personal computer systems, server computer systems, thin clients, thick clients, handheld or laptop devices, multiprocessor systems, microprocessor-based systems, set top boxes, programmable consumer electronics, network PCs, minicomputer systems, mainframe computer systems, and distributed cloud computing environments that include any of the above systems or devices, and the like.
Computer system/server 212 may be described in the general context of computer system executable instructions, such as program modules, being executed by a computer system. Generally, program modules may include routines, programs, objects, components, logic, data structures, and so on that perform particular tasks or implement particular abstract data types. Computer system/server 212 may be practiced in distributed cloud computing environments where tasks are performed by remote processing devices that are linked through a communications network. In a distributed cloud computing environment, program modules may be located in both local and remote computer system storage media including memory storage devices.
As shown in
Bus 218 represents one or more of any of several types of bus structures, including a memory bus or memory controller, a peripheral bus, an accelerated graphics port, and a processor or local bus using any of a variety of bus architectures. By way of example, and not limitation, such architectures include Industry Standard Architecture (ISA) bus, Micro Channel Architecture (MCA) bus, Enhanced ISA (EISA) bus, Video Electronics Standards Association (VESA) local bus, and Peripheral Component Interconnect (PCI) bus.
Computer system/server 212 typically includes a variety of computer system readable media. Such media may be any available media that is accessible by computer system/server 212, and it includes both volatile and non-volatile media, removable and non-removable media.
System memory 228 can include computer system readable media in the form of volatile memory, such as random access memory (RAM) 230 and/or cache memory 232. Computer system/server 212 may further include other removable/non-removable, volatile/non-volatile computer system storage media. By way of example only, storage system 234 can be provided for reading from and writing to a non-removable, non-volatile magnetic media (not shown and typically called a “hard drive”). Although not shown, a magnetic disk drive for reading from and writing to a removable, non-volatile magnetic disk (e.g., a “floppy disk”), and an optical disk drive for reading from or writing to a removable, non-volatile optical disk such as a CD-ROM, DVD-ROM or other optical media can be provided. In such instances, each can be connected to bus 218 by one or more data media interfaces. As will be further depicted and described below, memory 228 may include at least one program product having a set (e.g., at least one) of program modules that are configured to carry out the functions of embodiments of the invention.
Program/utility 240, having a set (at least one) of program modules 242, may be stored in memory 228 by way of example, and not limitation, as well as an Operating System, one or more application programs, other program modules, and program data. Each of the Operating System, one or more application programs, other program modules, and program data or some combination thereof, may include an implementation of a networking environment. Program modules 242 generally carry out the functions and/or methodologies of embodiments of the invention as described herein.
Computer system/server 212 may also communicate with one or more external devices 214 such as a keyboard, a pointing device, a display 224, etc.; one or more devices that enable a user to interact with computer system/server 212; and/or any devices (e.g., network card, modem, etc.) that enable computer system/server 212 to communicate with one or more other computing devices. Such communication can occur via Input/Output (I/O) interfaces 222. Still yet, computer system/server 212 can communicate with one or more networks such as a local area network (LAN), a general wide area network (WAN), and/or a public network (e.g., the Internet) via network adapter 220. As depicted, network adapter 220 communicates with the other components of computer system/server 212 via bus 218. It should be understood that although not shown, other hardware and/or software components could be used in conjunction with computer system/server 212. Examples, include, but are not limited to: microcode, device drivers, redundant processing units, external disk drive arrays, RAID systems, tape drives, and data archival storage systems, etc.
The present invention may be a system, a method, and/or a computer program product. The computer program product may include a computer readable storage medium (or media) having computer readable program instructions thereon for causing a processor to carry out aspects of the present invention.
The computer readable storage medium can be a tangible device that can retain and store instructions for use by an instruction execution device. The computer readable storage medium may be, for example, but is not limited to, an electronic storage device, a magnetic storage device, an optical storage device, an electromagnetic storage device, a semiconductor storage device, or any suitable combination of the foregoing. A non-exhaustive list of more specific examples of the computer readable storage medium includes the following: a portable computer diskette, a hard disk, a random access memory (RAM), a read-only memory (ROM), an erasable programmable read-only memory (EPROM or Flash memory), a static random access memory (SRAM), a portable compact disc read-only memory (CD-ROM), a digital versatile disk (DVD), a memory stick, a floppy disk, a mechanically encoded device such as punch-cards or raised structures in a groove having instructions recorded thereon, and any suitable combination of the foregoing. A computer readable storage medium, as used herein, is not to be construed as being transitory signals per se, such as radio waves or other freely propagating electromagnetic waves, electromagnetic waves propagating through a waveguide or other transmission media (e.g., light pulses passing through a fiber-optic cable), or electrical signals transmitted through a wire.
Computer readable program instructions described herein can be downloaded to respective computing/processing devices from a computer readable storage medium or to an external computer or external storage device via a network, for example, the Internet, a local area network, a wide area network and/or a wireless network. The network may comprise copper transmission cables, optical transmission fibers, wireless transmission, routers, firewalls, switches, gateway computers and/or edge servers. A network adapter card or network interface in each computing/processing device receives computer readable program instructions from the network and forwards the computer readable program instructions for storage in a computer readable storage medium within the respective computing/processing device.
Computer readable program instructions for carrying out operations of the present invention may be assembler instructions, instruction-set-architecture (ISA) instructions, machine instructions, machine dependent instructions, microcode, Firmware instructions, state-setting data, or either source code or object code written in any combination of one or more programming languages, including an object oriented programming language such as Smalltalk, C++or the like, and conventional procedural programming languages, such as the “C” programming language or similar programming languages. The computer readable program instructions may execute entirely on the user's computer, partly on the user's computer, as a stand-alone software package, partly on the user's computer and partly on a remote computer or entirely on the remote computer or server. In the latter scenario, the remote computer may be connected to the user's computer through any type of network, including a local area network (LAN) or a wide area network (WAN), or the connection may be made to an external computer (for example, through the Internet using an Internet Service Provider). In some embodiments, electronic circuitry including, for example, programmable logic circuitry, field-programmable gate arrays (FPGA), or programmable logic arrays (PLA) may execute the computer readable program instructions by utilizing state information of the computer readable program instructions to personalize the electronic circuitry, in order to perform aspects of the present invention.
Aspects of the present invention are described herein with reference to flowchart illustrations and/or block diagrams of methods, apparatus (systems), and computer program products according to embodiments of the invention. It will be understood that each block of the flowchart illustrations and/or block diagrams, and combinations of blocks in the flowchart illustrations and/or block diagrams, can be implemented by computer readable program instructions.
These computer readable program instructions may be provided to a processor of a general purpose computer, special purpose computer, or other programmable data processing apparatus to produce a machine, such that the instructions, which execute via the processor of the computer or other programmable data processing apparatus, create means for implementing the functions/acts specified in the flowchart and/or block diagram block or blocks. These computer readable program instructions may also be stored in a computer readable storage medium that can direct a computer, a programmable data processing apparatus, and/or other devices to function in a particular manner, such that the computer readable storage medium having instructions stored therein comprises an article of manufacture including instructions which implement aspects of the function/act specified in the flowchart and/or block diagram block or blocks.
The computer readable program instructions may also be loaded onto a computer, other programmable data processing apparatus, or other device to cause a series of operational steps to be performed on the computer, other programmable apparatus or other device to produce a computer implemented process, such that the instructions which execute on the computer, other programmable apparatus, or other device implement the functions/acts specified in the flowchart and/or block diagram block or blocks.
The flowchart and block diagrams in the Figures illustrate the architecture, functionality, and operation of possible implementations of systems, methods, and computer program products according to various embodiments of the present invention. In this regard, each block in the flowchart or block diagrams may represent a module, segment, or portion of instructions, which comprises one or more executable instructions for implementing the specified logical function(s). In some alternative implementations, the functions noted in the block may occur out of the order noted in the figures. For example, two blocks shown in succession may, in fact, be executed substantially concurrently, or the blocks may sometimes be executed in the reverse order, depending upon the functionality involved. It will also be noted that each block of the block diagrams and/or flowchart illustration, and combinations of blocks in the block diagrams and/or flowchart illustration, can be implemented by special purpose hardware-based systems that perform the specified functions or acts or carry out combinations of special purpose hardware and computer instructions.
The descriptions of the various embodiments of the present invention have been presented for purposes of illustration, but are not intended to be exhaustive or limited to the embodiments disclosed. Many modifications and variations will be apparent to those of ordinary skill in the art without departing from the scope and spirit of the described embodiments. The terminology used herein was chosen to best explain the principles of the embodiments, the practical application or technical improvement over technologies found in the marketplace, or to enable others of ordinary skill in the art to understand the embodiments disclosed herein.
Number | Date | Country | |
---|---|---|---|
Parent | 15211347 | Jul 2016 | US |
Child | 15265052 | US |