Patent ID: 8856512
Filing Date: 2014-10-07
Classification: G06F,G09G,H04L

Abstract:
1. A method for using an out-of-band (OOB) manageability engine (ME) having an OOB processor separate from a main processor of a computer platform to securely access an Enterprise server comprising: receiving, with the OOB processor of the ME, user authentication credentials from a pre-boot authentication module (PBAM) executed by a BIOS of the computer platform; requesting, with the OOB processor of the ME, via a dedicated OOB interface, independent of the main processor, between the ME and a network controller of the computer platform, a key encryption key (KEK) from a key distribution center (KDC); receiving, with the OOB processor of the ME and independent of the main processor, via the dedicated OOB interface, the KEK from the KDC if the user authentication credentials are authenticated by the KDC; securely storing the KEK using the OOB processor of the ME; enabling, with the OOB processor of the ME, the BIOS to proceed with booting of an operating system (OS); wrapping an OS credential manager with a shim, wherein the OS credential manager is configured to authenticate a user to the OS; intercepting an OS login process by the shim wrapping the OS credential manager; receiving, with the OOB processor of the ME, a request for the KEK from the shim used to intercept the OS login process; retrieving, with the OOB processor of the ME, the KEK from secure storage; and sending, with the OOB processor of the ME, the KEK to the OS, wherein the shim, upon receipt of the KEK suppresses an OS login prompt and completes booting of the OS; wherein when the OS requires access to the Enterprise server, the ME uses the KEK to obtain a ticket specific to the Enterprise server, and the OS retrieves the ticket specific to the Enterprise server from the ME.