Patent ID: 8745224

Claim:
Client platform hardware, comprising: a central processing unit (CPU) coupled to a memory controller hub (MCH), the MCH coupled to an input/output (I/O) controller hub (ICH), the MCH and ICH, when viewed as a whole, being integrated with access control circuitry and trusted platform circuitry, said MCH having a first interface to said CPU, said MCH having a second interface to a main memory, and said ICH having a plurality of I/O interfaces to engage in communication with a plurality of I/O devices; said access control circuitry comprising logic to: i) establish an out-of-band control channel with an I/O device, wherein, while the control channel is established, the I/O device is disabled from performing reads and writes of the client platform hardware, wherein the control channel collects platform configuration status information from the I/O device, and wherein the access control circuitry collects enablement/disablement platform configuration status information from each of the plurality of I/O devices; ii) issue a network connection request to a policy decision point remotely coupled to said client platform hardware through a network; iii) receive in response to said policy decision point having received said network connection request, a request from said policy decision point asking for platform configuration status information; iv) respond to the request from said policy decision point by providing the requested platform configuration status information, the platform configuration status information identifying each I/O device and its respective enabled/disabled status; v) receive an access control policy sent by said policy decision point in response to said policy decision point having received said platform configuration status information, said access control policy indicating desired enabled/disabled status for each of said I/O devices; and vi) enabling or disabling said I/O devices in accordance with said policy decision point; said trusted platform circuitry to encrypt said platform configuration status information prior to its being sent to said policy decision point, said trusted platform circuitry further comprising flash memory that stores one or more of the following for the encryption: a) keys; b) hash values; c) signatures; and d) certificates.