The present invention relates to embedded systems communication. More particularly the present invention relates to a method and apparatus for secured embedded device communication.
Most active management technology (AMT) usage devices (which may be included in for example a “notebook” or laptop computer) depend on network connectivity. If an AMT device does not have a usable Internet connection, then the notebook computer cannot be effectively managed by an information technology (IT) administrator or a manageability service provider (MSP). If the host operating system (OS) is running, the manageability engine or management engine (ME, such as, for example, Intel Management Engine™) can use the host network stack to access the network; if not (e.g., the notebook computer is in power state S3, S4 or S5, or the host OS is corrupted), the network stack of the ME itself can be used to establish a connection. If the notebook computer is connected to a corporate network or other networks like home networks, the host network stack or network stack of the ME can be used, depending on the state of the host OS. This is also applicable when the notebook is located for example at home.
A “hotspot” generally refers to a venue or area that offers access (usually wireless access) to a publicly accessible network, typically either local area network (LAN) or wireless local area network (WLAN), typically free or commercial (e.g., requiring payment). Other types of hotspots are known. A commercial hotspot may require an account to be set up with the provider. The user may need to log in to the hotspot with pre-established credentials in order to gain full Internet connectivity.
If the host OS is running and there are no networking problems, the notebook computer may be reachable for manageability purposes by performing hotspot login on the host OS, typically requiring user intervention.
However, if the host OS is not running, the ME may be unable to interact with the user, since it cannot display messages or ask for run-time input (such as credentials from the user). It must therefore be able to connect to the hotspot network without any user interaction.
Furthermore, embedded devices with communication stacks (such as for example Intel AMT™, Intel ME™) need to communicate over secure protocols, such as, for example, hypertext transfer protocol over secure socket later (HTTPS), transport layer security (TLS) or other cryptographic protocols, for many functions. These protocols require the devices to store a large set of root certificates to validate the server certificate presented. However, embedded devices typically do not have enough storage capacity and it is difficult (and sometimes impossible) for them to store all the root certificates for certification authorities (CA) generally stored in a typical browser. This severely limits the servers such devices can securely communicate with because of the inability to verify the certificate chains in absence of root certificates. In addition, even these root certificates can expire and may have to be changed, which is hard to accomplish on an embedded device.
The subject matter disclosed in this application is particularly pointed out and distinctly claimed in the concluding portion of the specification. Embodiments of the invention, however, both as to organization and method of operation, together with objects, features and advantages thereof, may best be understood by reference to the following detailed description when read with the accompanied drawings (like components are denoted by like reference numerals) in which:
In the following detailed description, specific details are set forth in order to provide a thorough understanding of the invention. However it will be understood by those of ordinary skill in the art that the present invention may be practiced without these specific details. In other instances, well-known methods, procedures, components and circuits have not been described in detail so as not to obscure embodiments of the present invention.
Manageability is heralded as an important vector for mobile devices. Original equipment manufacturers (OEM) desire parity in manageability across different network connections due to a large number of mobile workers using wireless connections. According to embodiments of the present invention, parity may be obtained by allowing an AMT client to connect to hotspots or other public or private networks when the host OS is not running, is not functional or is in a sleep state without requiring user interaction.
According to embodiments of the present invention the ability for an AMT device to connect to hotspot networks or other networks in the absence of the host OS and user interaction may be achieved. The credentials that may be required for authenticating to the LAN or WLAN hotspot may be provided to the embedded device via an out-of-band (OOB) channel by an external server.
Reference is now made to
When an AMT device of a portable computing device such as a notebook computer 20 (with embedded device 33, and ME 35) has to authenticate to a publicly accessible network such as a WLAN public hotspot network 18, or other suitable network, and the host OS 37 is non-functional, the AMT enabled notebook computer 20 may need to obtain credentials (and perhaps other information about the network connection required for logon) from for example credential server 10. A credential server typically holds logon information of verified users. The AMT enabled notebook computer 20 may already have an existing Internet Protocol (IP) connection via for example a wireless wide area network (WWAN) base station 16, but if WWAN connection 22 is expensive (e.g., the user fees in monetary terms are too high) to transfer large amounts of data to the AMT enabled notebook computer 20 (such as, for example, patches), it may be desired to use the WLAN 24 connection instead. If a WWAN connection 22 is available, the AMT enabled notebook computer 20 may utilize the WWAN connection 22 to contact the credential server 10; the AMT enabled notebook computer 20 may then provide information through link 26 (through, for example, the Internet 12) about the surrounding WLAN networks. The credential server 10 may identifies the most applicable service set identifier (SSID) from this list, and sends this via the link 26 along with the credentials to use. The AMT enabled notebook computer 20 can then use this information to connect to the hotspot 18 (using WLAN connection 24), and then proceed with regular manageability tasks over this less-expensive, perhaps even free, link 28.
While, throughout the specification, an AMT enabled notebook computer is used as an example, other computing devices having wireless capability may be used with embodiments of the invention.
Obtaining logon credentials in the manner described above, or according to other embodiments of the present invention may be necessitated because the ME, being an embedded environment in notebook computer 20, may not have sufficient storage to maintain the entire list of WLAN profiles and credentials that are supported for a particular user account. Obtaining WLAN profiles and credentials only when needed circumvents the storage limitations that embedded devices face.
If a WWAN connection (or other connection such as, for example, WiMAX) is unavailable, the AMT enabled notebook computer could use another mechanism over the WLAN connection 24 (at hotspot 18) itself to obtain this information. For example, if the AMT enabled notebook computer 20 has already previously connected to the hotspot 18 network, the AMT enabled notebook computer may be confined to a server with closed set or exclusive set of information services provided for users such as, for example, walled garden 14 until it has authenticated itself with the right credentials. While in walled garden 14, the AMT enabled notebook computer may use a technique such as domain name service (DNS) query overloading to contact the credential server 10 and obtain the appropriate information. It can then supply these obtained credentials to the hotspot 18 and thereby log in.
A hotspot client requiring on-the-go (OTG) manageability may benefit from embodiments of the invention. The client might need to obtain credentials for a public hotspot logon when the host OS is not functional. This may allow AMT to log on using the ME's network stack when the host is not running (e.g., is down) and without requiring user interaction.
It may be assumed that in some embodiments that a user account for the hotspot network has already been setup, or can be dynamically setup by the credential server 10 and the credentials for the user account may be stored or provided by a credential server that may be accessible on the Internet. It may also be assumed that in this scenario an AMT enabled notebook computer may need to connect to a public WLAN hotspot. Similarly, connection to a public LAN hotspot may be implemented.
In some embodiments, a computing device such as for example a portable wireless-capable computer may include a host operating system (e.g., controlling general functionality) and, for example an ME. The ME may be separate from and not share secure information with the main OS. If OS is not operating or is dormant, then the ME may obtain from for example a credential server via a first network connection, logon information for a secured network. The ME may then connect to the secure network through a connection such as a secured connection using the logon information. If the OS is operating the OS may provide the logon information to the ME.
In operation 30, it may be determined whether there is a need for connecting to a hotspot or other network. If not, the process may stop in operation 44. If there is a need, in operation 32 it may be determined whether the host OS is running or otherwise executing. If it is determined that the host OS is running, then in operation 34 the host OS may be used for verification and connection. If it is determined that the host OS is not running, then in operation 36 it may be determined whether a WWAN connection is available. If it is determined that WWAN connection is available, then in operation 38 information is obtained from the credential server and connecting to the WLAN hotspot (operation 42) may be performed. If it is determined that there is no WWAN connection available logon, then in operation 40 information is obtained over out-of-band link, and then a connection to the WLAN hotspot (operation 42) may be achieved.
In addition, according to embodiments of the present invention, a trusted remote server may be used to perform the validation and allow a computing device such as the AMT enabled notebook computer to communicate with a server whose certificate chain cannot be locally verified. For example, on Intel platforms, this may be useful in cases where the host OS is down, and the host cannot be used for storage or validation. This may be implemented for example in a ME based hotspot connectivity in Hx which may require a random hotspot provider certificate to be verified before logon can proceed, and in theft deterrence technology (TDT) server communication.
Due to limited storage an AMT enabled notebook computer may not store all certificate authority root certificates needed for verification of the third party server certificate. It may send this certificate (operation 56) to the trusted certificate verification server 11. A certificate verification server typically holds certificate verification information relating to servers. The certificate verification server 11 may verify the certificate chain (operation 58), and then may sign the certificate belonging to the third party server 68 with its own private key (e.g., CVS-priv, operation 60) and may send it back (operation 62) to the AMT enabled notebook computer 20. The AMT enabled notebook computer (typically the ME) may use the pre-provisioned CVS-pub to perform the verification of this signature 64. If the verification succeeds, the embedded engine may continue secure connection establishment (operation 66) with the third party server 68.
In some scenarios, the connection to the CVS may be bandwidth limited. This is the case, for example, if out-of-band short message service (SMS) connection over WWAN is used for connection initiation. In this case, it may be impractical to carry out the actions shown in
Embodiments of the invention may include an article such as a computer or processor readable medium, or a computer or processor storage medium, such as for example a memory, a disk drive, or a USB flash memory, encoding, including or storing instructions which when executed by a processor or controller, carry out methods disclosed herein.
According to embodiments of the present invention a device such as an AMT enabled notebook computer such as, for example, Intel ME/AMT™ may communicate securely with a typical server on the Internet without requiring a large amount of space needed for locally storing certification authority (CA) root certificates.
According to embodiments of the present invention problems associated with pushing revocations and expirations for certificate authority root certificates to the AMT enabled notebook computer may be eliminated or reduced.
While the invention has been described with respect to a limited number of embodiments, it will be appreciated that many variations, modifications and other applications of the invention may be made. Embodiments of the present invention may include other apparatuses for performing the operations herein. The appended claims are intended to cover all such modifications and changes.