Hardware platform authentication and multi-platform validation

Methods and apparatuses enable authentication of a hardware platform on a network. The authenticated hardware platform can validate the credentials of virtual machines executing on the hardware platform. The authentication of the hardware platform on the network enables network access to the validated virtual machines. The network access of the virtual machines is managed by the hardware platform, including allowing differentiated access based on, for example, the security posture of each virtual machine.

FIELD

Embodiments of the invention relate to authentication of a network device, and more particularly to authenticating a hardware platform of the device.

BACKGROUND

The increase in virtualization technology allows many advantages in having multiple “different devices” executing on a single hardware platform (software virtualization), or the generation of a hardware platform on which to execute from available hardware resources (hardware virtualization). As virtualization increases in use and becomes more common, the scenario can arise within a network (e.g., on an enterprise) where the number of identities that need to be managed in the enterprise grows exponentially. Virtualization allows for the provisioning and dropping of systems dynamically, which increases the complexity of identity management.

One particularly complex problem associated with identity management of multiple identities that can be dynamically provisioned is authentication of a device for purposes of network access and the application of network security policies. If multiple devices (entities) request authentication of a connection using a standard such as 802.1x (e.g., 802.11(a, b, g), 802.12, 802.16, etc.), the task of identity management may prove to be impractical on current systems. Under traditional approaches, an information technology administrator could be faced with needing to balance the security risk of introducing new systems against the productivity benefits accompanying virtualization.

DETAILED DESCRIPTION

As used herein, references to one or more “embodiments” are to be understood as describing a particular feature, structure, or characteristic included in at least one implementation of the invention. Phrases such as “in one embodiment” or “in an alternate embodiment” appearing herein describe various embodiments and implementations of the invention, and do not necessarily all refer to the same embodiment. However, they are also not necessarily mutually exclusive. Descriptions of certain details and implementations follow, with an overview description of embodiments of the invention, followed by a more detailed description with reference to the drawings.

The identity of a platform for purposes of network authentication can be associated with the hardware platform of a device. As used herein, a hardware platform refers to a processing resource having memory and other hardware resources on which a primary operating system partition and other virtual partitions execute. The hardware platform authenticates on the network with an authentication authority. The authentication of the hardware platform can then be used for each virtual device executing on the hardware platform. The network only has to authenticate a single entity associated with a particular hardware device, significantly reducing the task of identity management in the network. The hardware platform itself authenticates the multiple different virtual machines associated with the hardware platform.

In addition to reducing the identity management for the network, the identity of the hardware can be provided in a manner that makes it unlikely to be modified or spoofed, as can happen when operating systems handle the authentication credentials (e.g., if the security of an operating system is breached, the secure information accessible to the operating system is compromised). Thus, having the hardware provide the authentication credentials to the network provides a more robust identity verification. Additionally, the hardware itself can create a virtual environment on the hardware platform (i.e., similar to a mini network) by managing the virtual machines executing on the hardware platform. In one embodiment, the hardware platform enforces a security policy for all virtual machines on the hardware platform using a host-based firewall to manage communication and network access. Communication can be limited, and network access controlled on a precise basis. Similar to having a firewall on a subnet that protects a group of devices on the subnet, the hardware platform can act as the gateway for all virtual entities executing on the hardware platform. In contrast to a network, all the virtual entities execute on the same hardware platform, rather than sharing a network.

To provide security policy enforcement and network access control, the hardware platform controls the network interface. In one embodiment, the hardware platform includes filters on a network interface that allow port- and protocol-based controls. Each partition (e.g., virtual device) on the hardware platform can be controlled according to a specific policy. The partitions may achieve different levels of access, e.g., based on the credentials presented. The identity and security posture of each partition can influence network authorization decisions.

In traditional systems, each operating system must authenticate and provide security compliance information as part of the connection process to gain access to a network from an authentication entity (e.g., a policy decision point (PDP) and/or a policy enforcement point (PEP)). The hardware platform as described herein can act as a PEP, effectively removing the PEP from the network level to the device level. By authenticating the hardware platform and having the hardware platform authenticate the partitions executing on it, a significant authentication burden can be removed from the network level. Additionally, having a hardware based firewall and security protection to manage the connection policies for the virtual machines on the hardware platform provides a robust model for security that requires much less overhead from the enterprise.

In one embodiment, applications could be isolated or enclaved, for purposes of network access/visibility. The hardware platform can give access to a virtual machine to a portion of a network (e.g., specific addresses, ports) while restricting others. The enclaved resources would be protected from compromise from entities outside the enclave network.

FIG. 1is a block diagram of an embodiment of a system having an authentication agent that authenticates a hardware platform with a network authentication entity. System100includes hardware platform110, which represents a hardware platform as described above. Hardware platform110includes multiple elements/components, and allows for multiple partitions to execute on the available hardware. Hardware platform110can be, for example, the hardware components of a laptop or desktop computer, workstation, or other computing device capable of generating multiple virtual machines.

Hardware platform110includes processor112, which provides computing capabilities and the ability to execute various operations. Processor112may include any type of microprocessor, central processing unit (CPU), processing core including multi-core devices, etc. In one embodiment, processor112represents separate physical processor chips that operate in conjunction to provide processing to hardware platform110. Processor112controls the overall operation of hardware platform110, and may be, or may include, one or more programmable general-purpose or special-purpose microprocessors, digital signal processors (DSPs), programmable controllers, application specific integrated circuits (ASICs), programmable logic devices (PLDs), or the like, or a combination of such devices.

Hardware platform110includes memory controller hub (MCH)114, which may be integrated onto an integrated circuit of processor112, or may exist external to processor112. MCH114represents the control logic that controls main memory (mem)116of hardware platform110. As used herein, coupling refers to any type of connectivity, whether electrical, mechanical, and/or communicative. Coupling of one device to another may occur through other hardware. Software components can be coupled to each other or to hardware through function calls, or other invocations of a routine/subroutine. Main memory116represents the main memory of hardware platform110to provide temporary storage for code or data to be executed by processor112. Memory116may include read-only memory (ROM), flash memory, one or more varieties of random access memory (RAM, e.g., static RAM (SRAM), dynamic RAM (DRAM) synchronous DRAM (SDRAM), etc.), or a combination of memory technologies.

Input/output (I/O) controller hub (ICH)122represents control logic that couples I/O devices and/or peripheral devices to processor112and/or memory114. In one embodiment, ICH122includes active management technology (AMT—e.g., as available from Intel Corporation of Santa Clara, Calif.). AMT124represents hardware and/or software/firmware that provide advanced features to hardware platform110. In one embodiment, AMT124is implemented as a standalone microcontroller on hardware platform110. In another embodiment, AMT124is implemented as firmware on an existing chip of ICH122. AMT124is an out-of-band component with respect to processor112, or an operating system executing on processor112. An out-of-band component refers to a component (or in the case of firmware on an existing chip, to processes) that is not visible to an operating system executing on processor112. An out-of-band component executes in a manner that is not accessible to processor112or an operating system executing on processor112. AMT124generally has the ability to influence network connectivity, as discussed in more detail below.

In one embodiment, AMT124includes memory126to store keys, identity information, credentials, etc. Volatile or non-volatile memory may be used. In one embodiment, memory126includes a secure flash device (e.g., a trusted platform module (TPM) in accordance with the Trusted Computing Group suggestions).

ICH122is coupled to one or more components, such as peripheral132, I/O134, storage136, and network interface (NI)138. Peripheral132represents any type of peripheral device that could be connected to hardware platform, including external drives, universal serial bus (USB) devices, enhancement and/or utility cards, etc. I/O134represents one or more of different types of input and/or output devices, such as monitors, display screens, audio devices, keyboards/keypads, pointer devices (e.g., mouse), etc. Storage136represents non-volatile storage or non-volatile memory for hardware platform110. Non-volatile memory may include any one or more of a conventional magnetic disk (e.g., hard disk), an optical disk (e.g., CD-ROM (compact disk-read only memory), DVD (digital video/versatile disc) based storage), magneto-optical (MO) storage, semiconductor-based storage (e.g., flash), etc. Network interface138represents hardware and software that connects to devices external to hardware platform110. Network interface138generally includes a network interface card.

Network160represents any type of network with associated hardware and software components. Network160can include one or more of a local area network (LAN), wide area network (WAN), metropolitan area network (MAN), global area network (GAN) such as the Internet, or any combination thereof. The connectivity hardware may include Category-5 or other twisted pair cable, coaxial cable, wireless communication transceivers, etc., as well as flow direction hardware (e.g., interface circuits/cards, switches, routers, servers).

Authentication entity170is also coupled to network160. In one embodiment, network160includes, or alternatively is included within, an enterprise network. Authentication entity170represents one or more devices on a network (e.g., on an enterprise network) that determine what devices can connect to the network and/or determine whether a security policy is being followed by a connecting device. Authentication entity170may also be referred to as an “authentication authority” for the network. Authentication entity170may include policy server172, which provides a policy decision point (PDP) for the network. Policy server172provides one or more network security policies, including information for determining what devices can connect to a network, and under what circumstances. The policies may allow different levels of access to different users/devices. The policies can also determine what security posture and/or what level of authorization is permissible for given credentials.

Authenticator174enables authentication entity170to authenticate or verify/validate the identity of a device that requests network access. Authenticator174typically receives credentials from the device and checks them against known information. In one embodiment, authenticator174provides policy enforcement (as a policy enforcement point (PEP)), assigning and restricting network access based on credentials received. Authenticator174can check received credentials against information stored in authentication server176, which includes information (i.e., credentials) about the devices/users to be connected to the network. The information commonly includes a user name or other user and/or device identifier, and a password. Other information is also possible (e.g., biometric information, secure keys, etc.).

Host operating system (OS)102executes on hardware platform110. Host OS is generally considered a primary partition. In one embodiment, one or more other partitions or virtual machines also execute on hardware platform110. Virtual machines (VMs)104-108represent other entities executing on hardware platform110. VMs104-108can be dynamically provisioned and de-provisioned on hardware platform110. The virtual machines (which may also be referred to as virtual partitions, or simply partitions) are managed by VM controller140. VM controller140allocates resources for the virtual machines.

System100also includes authentication agent150coupled to hardware platform110. Authentication agent150is generally part of hardware platform110. In one embodiment, authentication agent150is part of AMT124. Authentication agent150may alternatively be a standalone component or entity on hardware platform110. Authentication agent150allows for authentication of hardware platform110with authentication entity on behalf of one or more (e.g., all) partitions executing on the hardware platform. In one embodiment, selected VMs are designated by a flag or other indicator to authenticate themselves on the network. Other VMs obtain network access through the authentication of the hardware platform. In another embodiment, authentication of hardware platform110on the network is performed on behalf of all VMs executing on the hardware platform, including any VMs that may be provisioned after the authentication of the hardware platform. Authentication agent150authenticates or validates one or more VMs executing on the hardware platform, instead of providing credentials for those entities to the network for authentication.

FIG. 2is a block diagram of an embodiment of a system having a hardware platform that is authenticated with an authentication agent that provides firewall service. System200includes hardware platform210, which provides hardware on which host operating system (OS)202and one or more virtual machines (VMs)204-208execute. VMs204-208can be separate OS partitions. VMs204-208are managed by VM controller220, and can be dynamically provisioned and de-provisioned. Each VM will include an identity that can be represented as credentials to present for purposes of authentication for network connectivity.

Traditional systems required each VM to provide credentials over network240to network authenticator250for network access. However, because the VMs can be dynamically provisioned, the traditional requirement for individual VM identity management by network authenticator250could result in hundreds or thousands of network identities that network authenticator250would need to manage. Management of so many entities could result in an identity crisis for network authenticator250in traditional system. In one embodiment, hardware platform210includes AMT230, which includes authentication agent232. Authentication agent232provides for authentication of the hardware platform according to any embodiment described herein.

In one embodiment, authentication agent232provides firewall services to hardware platform210. The firewall services provided by authentication agent232cannot be attacked or disabled by an attacker that compromises host OS202. Thus, firewall services provided by authentication agent232are more secure from attack than traditional software firewalls that interact with the host operating system. Authentication agent232stores in memory, or has access to memory that stores, firewall table234. Firewall table234provides policy enforcement rules to authentication agent232to enable authentication agent232to enforce network security policy locally on hardware platform210. In one embodiment, firewall table234is received from network authenticator250, or is based on information received from network authenticator250. Thus, policy enforcement can be provided by the hardware platform itself to secure host OS202and one or more of VMs204-208.

FIG. 3is a block diagram of an embodiment of a control hub having an active management entity that enforces rules of a firewall table. System300represents a hardware platform on which multiple partitions execute. System300includes control hub310, which may represent an ICH or MCH, or other hub or control circuit that includes AMT320. In one embodiment, AMT320performs operations that authenticate the hardware platform of system300, and leverages that authentication to provide network access to the partitions executing on system300. AMT320validates the individual partitions and manages the network connections established by the partitions. As part of the management of the network access by the partitions, AMT320may access memory330that includes firewall table340. Memory330can be any type of memory, whether volatile or non-volatile, accessible to AMT320. Memory330can be private to AMT320, or may be a secure portion or partition of a memory available on the hardware platform.

Firewall table340may simply represent a table of rules that AMT320applies. Thus, AMT320could be referred to as a firewall because it performs network access restriction functions based on the information in firewall table340. Examples of information that firewall table340may contain are partition identifier342, partition posture344, ingress rules346, egress rules348, and other conditions350. Other types of information may be stored in firewall table340.

Partition identifier342indicates the partition number to which the rules specified in the other columns applies. Although a primary partition and 3 additional partitions are indicated in partition identifier342, more or fewer partitions can be provided in a system. Posture344indicates an authentication posture of the partition. Additional rules may be included regarding authorization or other security postures. As shown, examples of authorization posture values could include “valid,” “inadequate,” or “indeterminable” (e.g., not able to be discerned due to a configuration of the partition). Other postures could be provided, depending on the implementation.

Ingress rules346can specify address accessibility for the given partitions for inbound traffic. The specification may be “ANY ANY,” which permits all traffic on all ports, or specific traffic accessibility can be provided. Similar restrictions can be provided in egress rules348. Note that although the allowable traffic assignments are the same for ingress and egress traffic in firewall table340for a given partition, there is not a requirement to permit the same traffic channels for inbound and outbound traffic.

Condition350can provide conditions that apply to a particular partition. The information can be merely descriptive, rather than providing substantive restrictions. Examples of the conditions may be that a partition has full production access, that a partition is placed on a remediation network (e.g., until a defective security posture is corrected), that the partition has guest network access, or that the partition is assigned to an enclave network associated with a particular application (e.g., a network dedicated to enterprise software traffic). The different network assignments can be protected by different filtering and firewalling on the network. Thus, the rule assignments in ingress rules346and egress rules348will typically correspond to network separations provided on the network.

FIG. 4is a block diagram of an embodiment of an authentication agent. Authentication agent400includes control logic402, which implements logical functional control to direct operation of authentication agent400, and/or hardware associated with directing operation of authentication agent400. Logic may be hardware logic circuits and/or software routines. The logic may be instructions executing on a processor of a computing device. In one embodiment, authentication agent400includes one or more applications404, which represent code sequences and/or programs that provide instructions to control logic402. Authentication agent400includes memory406and/or access to memory resource406for storing data and/or instructions. Memory406may include memory local to authentication agent400, as well as, or alternatively, including memory of a system on which authentication agent400resides. Authentication agent400also includes one or more interfaces408, which represent access interfaces to/from (an input/output interface) authentication agent400with regard to entities (electronic or human) external to authentication agent400. Interfaces408include mechanisms through which authentication agent400can be incorporated into a host system.

Authentication agent400also includes authentication engine410, which represents one or more functional components that enable authentication agent400to provide authentication operations. The authentication operations include authenticating a hardware platform on the network, and authenticating partitions to the hardware platform. The functions or features of the components include, or are provided by, one or more of hardware authentication (authen) module420, partition authentication module430, and policy enforcement point440. Each module may further include other modules to provide specific functionality. As used herein, a module refers to routine, a subsystem, etc., whether implemented in hardware, software, or some combination. One or more modules can be implemented as hardware while other(s) are implemented in software.

Hardware authentication module420enables authentication engine410to authenticate a hardware platform with a network. Hardware authentication module420includes hardware identifier module422, which determines/identifies an identity associated with a hardware platform. For example, current network authentication typically involves the storing of a user name and password at a network authentication authority. The user name and password are presented to the authentication authority, which can then provide access. Instead, or in addition to what is traditionally done, the authentication authority may store an identity assigned to a hardware component of the hardware platform. For example, a unique identifier can be assigned and stored by an authentication agent for each hardware device in the system. Thus, hardware identifier module422may store and manage the hardware identity.

Network authentication module424of hardware authentication module420retrieves the identity and presents it as part of a presentation of credentials to the authentication authority in conjunction with a request to access the network. In one embodiment, network authentication module424authenticates the hardware platform on the network at initialization or in conjunction with initialization of the hardware platform (either from startup or reset). Network authentication module424could authenticate the hardware platform after initialization. The authentication of the hardware platform can be performed prior to or after provisioning of a partition, which could include the host OS or primary partition.

Partition authentication module430enables authentication engine410to validate the credentials of partitions executing on a hardware platform with which authentication agent400is associated. Partition authentication module430includes credential receiver module432to receive the credentials of the various partitions. Credential receiver module432may include a redirection from a network interface. For example, credential receiver module432could direct a network interface controller to forward credentials received from the various partitions to authentication agent400. Instead of forwarding the credentials to the network authentication authority for validation, the credentials are validated by partition authentication module430. Partition authentication module430includes authentication verifier434, which checks the credentials against known information for a requesting partition. The number of identities to manage at the authentication agent is much smaller and more manageable than the number of entities that would need to be managed by a server for the entire network.

When validated with partition authentication module430, validated partitions can access the network based on the connections available to the hardware platform. In one embodiment, the hardware platform has restricted access based on its credentials. Thus, the partitions on the hardware platform cannot have access greater than what is available to the hardware platform. In one embodiment, unlimited access is granted from the network to the hardware platform, and the hardware platform via authentication agent400provides restrictions on the partitions.

Policy enforcement point (PEP)440enables authentication engine410to manage network connections open by one or more partitions on the hardware platform. Through PEP440, authentication engine410controls network access of partitions executing on the hardware platform, allowing differentiated network access. The differentiated network access can be provided based on security posture of the partitions, authorizations associated with the credentials, etc. PEP440includes firewall442, which provides security enforcement to network connections of partitions validated by authentication agent400. Firewall442applies rules, for example, from a rule table that stores the permissions established for each partition.

In one embodiment, PEP440includes one or more network interface filters444. Network interface filter444enables PEP440to control network access with fine granularity. Network interface filter444can restrict or allow traffic of particular protocols, from particular device, on particular ports, over particular channels, etc., or any combination. Network interface filters444can enable PEP440to manage all connections on the hardware platform.

PEP440includes platform connection manager446to track and manage connections for all validated partitions. Platform connection manager446operates in conjunction with network interface filters444to determine an appropriate network, an appropriate level of access, etc., for a given partition, and enforce the determination.

The descriptions herein of managers or modules, describe components that may include hardware, software, and/or a combination of these. In a case where a component to perform operations described herein includes software, the software data, instructions, and/or configuration may be provided via an article of manufacture by a machine/electronic device/hardware. An article of manufacture may include a machine readable medium having content to provide instructions, data, etc. The content may result in an electronic device as described herein, performing various operations or executions described. A machine readable medium includes any mechanism that provides (i.e., stores and/or transmits) information/content in a form accessible by a machine (e.g., computing device, electronic device, electronic system/subsystem, etc.). For example, a machine readable medium includes recordable/non-recordable media (e.g., read only memory (ROM), random access memory (RAM), magnetic disk storage media, optical storage media, flash memory devices, etc.). The machine readable medium may further include an electronic device having code loaded on a storage that may be executed when the electronic device is in operation. Thus, delivering an electronic device with such code may be understood as providing the article of manufacture with such content described herein. Furthermore, storing code on a database or other memory location and offering the code for download over a communication medium may be understood as providing the article of manufacture with such content described herein.

FIG. 5is a flow diagram of an embodiment of a process for authenticating a hardware platform with a network, and authenticating with the hardware platform partitions executing on the hardware platform. An authentication agent identifies hardware credentials associated with a hardware platform to be authenticated on the network,502. The authentication agent presents the credentials and negotiates the network authentication. Thus, the authentication agent authenticates the hardware on the network,504. The hardware platform is authenticated on behalf of partitions executing on the hardware platform.

The authentication agent receives credentials from a partition that requests network access,506. The authentication agent enters an authentication procedure with the partition and attempts to validate the partition's identity,508. If the partition is validated,510, the authentication agent receives the request by the validated partition for network access,512. The validated partition is allowed access to the network under the authentication of the hardware platform,514, as appropriate for the credentials provided (e.g., certain partitions may be restricted in access). The authentication agent can continue to monitor traffic from the authenticated partition and enforce a network security policy to the network access of the partition,516. The enforcing of the policy generally includes assigning a network and restriction control. For example, a partition may be given access only to a particular network (e.g., a virtual enclave network designated for particular applications). The authentication agent can continue to manage the connection,518.

The partition may not validate. A partition that does not validate, or a partition for which a security posture cannot be determined may fail validation,510. The authentication agent can determine if the failed validation is remedial,520. The failed validation may be remedial, for example, if a remediation network is set up. The authentication agent can then assign the partition to the remediation network. Similarly, the validation may fail to gain access to the network because the partition has “guest” credentials, and so is assigned to a guest network. In one embodiment, the partition fails to validate, and network access may be prevented,522. If remediation is possible,520, the authentication agent prevents access to restricted networks or portions of the network/protocols, ports, etc., and/or provides remediation,524. Remediation may include updating a security posture of the partition to enable it to be compliant with a security policy and gain more expanded network access.

A flow diagram as illustrated herein provides an example of a sequence of various operations. Although shown in a particular sequence or order, unless otherwise specified, the order of the operations can be modified. Thus, the illustrated implementations should be understood only as examples, and operations can be performed in a different order, and some operations may be performed in parallel.