Abstract: An Information Handling System (IHS) includes multiple hardware devices, and a baseboard Management Controller (BMC) in communication with the plurality of hardware devices. The BMC includes a first processor for executing a custom BMC firmware stack, and transmitting a watchdog message at an ongoing basis. The BMC also includes a second processor for receiving the watchdog message. When the watchdog message is received within a specified elapsed period of time, allow continued operation of the custom BMC firmware stack, and when not received within the specified elapsed period of time, place the BMC in a failsafe mode of operation.

Abstract: Systems and methods provide validation of hardware components of an IHS (Information Handling System). An attestation certificate stored to the IHS specifies authenticated instructions for operation of a hardware component of the IHS. This attestation certificate is endorsed by a self-signed root attestation certificate. An identity certificate, also stored to the IHS, specifies an identity of the hardware component and is endorsed using an embedded keypair of the hardware component. The root attestation certificate is validated to ensure it corresponds to the hardware component specified in the identity certificate, where this validation confirms that a public key included in the identity certificate is identical to a public key included in the attestation certificate.

Abstract: In general, embodiments of the invention relate to implementing a secure boot process in information handling systems that supports both an external root of trust (eRoT) and an internal root of trust (RoT). Further, embodiments of the invention relate to binding a management controller to a specific chassis and, in the case where the eRoT is used, to an eRoT. When the management controller and the chassis are provisioned according to one or more embodiments of the invention, security checks may be performed by management controller executing an initial program loader (IPL) using the aforementioned bindings. If the bindings are not present or do not match, then the boot process halts and the user is unable to use the information handling system.

Abstract: An Information Handling System (IHS) includes multiple hardware devices, and a baseboard Management Controller (BMC) in communication with the plurality of hardware devices. The BMC includes executable instructions for monitoring a parameter of one or more of the hardware devices of the IHS when a custom BMC firmware stack is executed on the BMC. The instructions that monitor the parameter are separate and distinct from the instructions of the custom BMC firmware stack. When the parameter exceeds a specified threshold, the instructions are further executed to control the BMC to perform one or more operations to remediate the excessive parameter.

Abstract: A method for dynamic immutable security personalization for enterprise products. Specifically, the disclosed method describes how a computer processor (e.g., baseboard management controller) of an enterprise product can personalize security requirements in trusted facilities, along the supply chain route of the enterprise product, so that trusted assumptions concerning the enterprise product can be made. Further, through dynamic immutable security personalization, these trusted assumptions are allowed to change over time (e.g., from being less restrictive to more restrictive) as changing enterprise product configuration states are captured while the enterprise product traverses the supply chain route.

Abstract: A BMC firmware security system includes a BMC coupled to a programmable circuit device and a first storage subsystem. In response to BMC initialization, the BMC uses a system identifier to verify that a license in the first storage subsystem authorizes the BMC to use BMC firmware in the BMC, uses branding identity information in the BMC to verify that the BMC is branded for the BMC firmware, determines that the programmable circuit device identifies the BMC firmware and, in response, the performs BMC initialization operations using the BMC firmware. A BIOS is coupled to the programmable circuit device and a second storage system. In response to BIOS initialization, the BIOS uses the branding identity information in the second storage subsystem to identify the BMC firmware, determines that the programmable circuit device identifies the BMC firmware and, in response, performs BIOS initialization operations.

Abstract: An Information Handling System (IHS) includes multiple hardware devices, and a baseboard Management Controller (BMC) in communication with the plurality of hardware devices. The BMC includes executable instructions for when a custom BMC firmware stack is executed on the BMC, monitoring a parameter of one or more of the hardware devices of the IHS. The instructions that monitor the parameter are separate and distinct from the instructions of the custom BMC firmware stack. The instructions also controls the BMC to perform one or more operations to remediate an excessive parameter when the parameter exceeds a specified threshold.

Abstract: An Information Handling System (IHS) includes multiple hardware devices, and a baseboard Management Controller (BMC) in communication with the plurality of hardware devices. The BMC includes instructions for executing an assistance application (APP) in an untrusted domain of the BMC. The assistance APP configured to monitor a custom BMC firmware stack executed in the untrusted domain. The instructions are further executed to verify an integrity of the assistance APP from a trusted domain of the BMC by encrypting communications between the trusted and untrusted domains using an encryption key that comprises a function of a time counter value.

Abstract: An Information Handling System (IHS) includes multiple hardware devices, and a baseboard Management Controller (BMC) in communication with the plurality of hardware devices. The BMC includes instructions for executing an assistance application (APP) in an untrusted domain of the BMC. The assistance APP configured to monitor a custom BMC firmware stack executed in the untrusted domain. The instructions are further executed to verify an integrity of the assistance APP from a trusted domain of the BMC by encrypting communications between the trusted and untrusted domains using an encryption key that comprises a function of a time counter value.

Abstract: An Information Handling System (IHS) includes multiple hardware devices, and a baseboard Management Controller (BMC) in communication with the plurality of hardware devices. The BMC includes instructions for executing a bootloader to verify an integrity of a first firmware stack, and boot the first firmware stack on a first processor. Once booted, the first firmware stack verifies the integrity of a first code segment on a second processor that is also used to execute a custom BMC firmware stack. The first code segment is executed to verify the integrity of one or more vendor supplied code segments executed on the second processor.

Abstract: In general, embodiments of the invention relate to implementing a secure boot process in information handling systems that supports both an external root of trust (eRoT) and an internal root of trust (RoT). Further, embodiments of the invention relate to binding a management controller to a specific chassis and, in the case where the eRoT is used, to an eRoT. When the management controller and the chassis are provisioned according to one or more embodiments of the invention, security checks may be performed by management controller executing an initial program loader (IPL) using the aforementioned bindings. If the bindings are not present or do not match, then the boot process halts and the user is unable to use the information handling system.

Abstract: Embodiments of systems and methods for deriving dependent symmetric encryption keys based upon a type of secure boot using a security processor are described. In some embodiments, a security processor may include: a core; and a memory coupled to the core, the memory having program instructions stored thereon that, upon execution by the core, cause the security processor to: retrieve a first symmetric key based, at least in part, upon a type of secure boot performed to bootstrap an Information Handling System (IHS); and derive a second symmetric key based, at least in part, upon the first symmetric key.

Abstract: Embodiments of systems and methods for managing control of a security processor in a supply chain are described. In some embodiments, a security processor may include: a core; and a memory coupled to the core, the memory having program instructions stored thereon that, upon execution by the core, cause the security processor to: store a first public key usable to initiate a first secure boot process and unusable to initiate a second secure boot process; store a second public key usable to initiate the second secure boot process and unusable to initiate the first secure boot process; and in response to a first change of control or ownership of the security processor, render the first public key unusable to initiate the first secure boot process.

Abstract: Embodiments of systems and methods for indicating a type of secure boot to endpoint devices by a security processor are described. In some embodiments, a security processor may include: a core and a memory coupled to the core, the memory having program instructions stored thereon that, upon execution by the core, cause the security processor to: identify a type of secure boot last performed to bootstrap an Information Handling System (IHS); and make an indication of the type of secure boot available to a host processor or Baseboard Management Controller (BMC) of the IHS.

Abstract: Embodiments of systems and methods for automatically evicting an owner of a security processor are described. In some embodiments, a security processor may include: a core and a memory coupled to the core, the memory having program instructions stored thereon that, upon execution by the core, cause the security processor to: determine that a secure boot public key last used by a first entity to bootstrap an Information Handling System (IHS) fails to bootstrap the IHS; in response to the determination, identify another secure boot public key usable by a second entity to bootstrap the IHS; and in response to the security processor being in a factory environment, increment a counter associated with the first entity to evict the first entity in favor of the second entity.

Abstract: Systems and methods are provided for validating components of an Information Handling System (IHS). During factory provisioning of the IHS, an owner certificate is stored that specifies an identity of a motherboard installed during manufacture of the IHS. The owner certificate is signed by a certificate authority of an owner of the IHS that retains capabilities for specifying the use of boot code provided by successive renters of the IHS. A renter certificate is also stored that specifies an identity of a chassis to which the motherboard is installed during manufacture of the IHS. Upon a transfer of control or ownership of the IHS, boot code operations by the security processor identify a motherboard and chassis in use by the IHS and utilize the motherboard and chassis certificates to validate that the identified motherboard and chassis are the same motherboard and chassis installed during manufacture of the IHS.

Abstract: As part of a factory provisioning of an Information Handling System (IHS), a signed replaceable hardware certificate is stored that identifies any replaceable hardware components coupled to the IHS during the factory provisioning. Upon a transfer of control or ownership of the IHS, replaceable hardware components that are coupled to the IHS are detected, and the replaceable hardware certificate is utilized to validate that the identified replaceable hardware components detected as coupled to the IHS are the same replaceable hardware components coupled to the IHS during the factory provisioning. A security processor of the IHS may support boot code operations for generating additional replaceable hardware certificates that can be used to validate the integrity of any changes the replaceable hardware of the IHS, such as upon its next power cycle.

Abstract: During factory provisioning of an Information Handling System (IHS), a key injection authorization certificate is stored that authorizes key injection by a renter of the IHS. An IHS owner retains capabilities for specifying the use of boot code of successive renters of the IHS. Upon a transfer of control or ownership of the IHS, a key injection request certificate provided by the renter is validated and use of the key injection request certificate is authorized for transferring cryptographic credentials to the IHS. The key injection authorization certificate specifies an identity of the IHS that is authorized for key injection by the renter and the key injection request certificate specifies an identity of the IHS that is requested for key injection by the renter. Transfer of credentials is authorized when the two certificates are both valid and the identity of the IHS specified in the two certificates is the same.

Abstract: As part of a factory provisioning of an Information Handling System (IHS), a configuration certificate is stored that identifies a pre-boot configuration of the IHS resulting from the factory provisioning. Upon a transfer of control or ownership of the IHS, a pre-boot configuration of the IHS is identified and the configuration certificate is utilized to validate that the identified pre-boot configuration is the same as the pre-boot configuration of the IHS resulting from the factory provisioning. A security processor of the IHS may support boot code operations for generating additional configuration certificates that can be used to validate the integrity of any changes the IHS configuration, such as upon its next power cycle.

Abstract: Embodiments of systems and methods for deriving independent symmetric encryption keys based upon a type of secure boot using a security processor are described. In some embodiments, a security processor may include: a core; and a memory coupled to the core, the memory having program instructions stored thereon that, upon execution by the core, cause the security processor to: identify a type of secure boot performed to bootstrap an Information Handling System (IHS); and derive a symmetric encryption key based upon the type of secure boot.