Abstract: A system for providing computer implemented services using information handling systems includes a composed information handling system that provides, at least in part, the computer implemented services and a system control processor manager. The system control processor manager instantiates a utilization monitor in a system control processor of the composed information handling system; and monitors, using the utilization monitor, a use rate of computing resources of the composed information handling system by a client.

Abstract: A distributed secure communication system includes a first System Control Processor (SCP) subsystem coupled to second and third SCP subsystems via a network. The first SCP subsystem identifies the second SCP subsystem, signs a first SCP authentication communication with a first private key to provide a first signed SCP authentication communication that it transmits to the second SCP subsystem. The first SCP subsystem receives a second signed SCP authentication communication from the second SCP subsystem, authenticates the second signed SCP authentication communication using a second public key associated with the second SCP subsystem and, in response, establishes a first secure communication channel with the second SCP subsystem.

Abstract: A method for managing composed information handling systems includes obtaining, by a system control processor, a composition request for a composed information handling system of the composed information handling systems, wherein the composition request comprises an operational instances requirement, and initially allocating only a minimum number of instances of a resource based on the operational instances requirement to the composed information handling system, wherein at least one of the minimum number of instances of the resource is provided by a first information handling system, wherein the first information handling system is operatively connected to the system control processor manager.

Abstract: A system for managing composed information handling systems to manage access to data by applications hosted by the composed information handling systems includes a system control processor that instantiates a composed information handling system using a compute resource set that hosts applications and a hardware resource set that stores a portion of the data, associates, using authorization information, storage areas of the at least one hardware resource set with the applications to obtain storage area associations, obtains a data access request from the compute resource set for the portion of the data which is stored in a storage area of the storage areas, makes a determination, based on the storage area associations and an initiator of the data access request, that the initiator of the data access request is not authorized to access the portion of the data, and refuses to service the data access request.

Abstract: A basic input/output system provides an interface for a core aggregation layout that identifies a grouping of processor cores into core aggregations, wherein each of the core aggregations is associated with a maximum allowable C-state. A processor may monitor an information handling system during operation of an application to gather data associated with latency sensitivity of the application, update the core aggregation layout based on the data gathered during the operation of the application, and pin a thread for execution to one of the processor cores based on the latency sensitivity of the application and the maximum allowable C-state.

Abstract: Embodiments of systems and methods for inter-Baseboard Management Controller (BMC) integration for High Performance Computing (HPC) platforms are described. In some embodiments, an HPC platform may include a first BMC coupled to a host processor; and a hardware accelerator comprising: (a) one or more managed subsystems coupled to the host processor, and (b) a second BMC coupled to the one or more managed subsystems and decoupled from the host processor, wherein the first BMC and the second BMC are coupled to each other via a high-speed, Out-of-Band (OOB) management link.

Abstract: A device-capability-based locking key management system includes a key management system coupled to a server device via a network. The server device includes storage devices coupled to a remote access controller device. The remote access controller device identifies each of the storage devices, and then identifies a key management profile for each of the storage devices. A first key management profile identified for at least one first storage device is different from a second key management profile identified for at least one second storage device. The remote access controller device then uses the respective key management profile identified for each of the storage devices to create a respective key management sub-client for each of the storage devices, and each respective key management sub-client communicates with the key management system to provide a locking key for its respective storage device.

Abstract: A key management system includes a managed system coupled to a management system through a network. The managed system includes managed device locking subsystem(s) coupled to a managed device and a key storage. The managed device locking subsystem(s) retrieve, through the network from the management system, a managed device locking key that is configured to unlock the managed device. The managed device locking subsystem(s) then encrypt the managed device locking key to provide an encrypted managed device locking key, and store the encrypted managed device locking key in the key storage. Subsequent to storing the encrypted managed device locking key, the managed device locking subsystem(s) retrieve the encrypted managed device locking key from the key storage, and decrypt the encrypted managed device locking key to provide a decrypted managed device locking key. The managed device locking subsystem(s) then use the decrypted managed device locking key to unlock the managed device.

Abstract: Systems and procedures are provided for validating an IHS (Information Handling System) as operating using only factory-provisioned firmware. During factory provisioning of the IHS, a signed inventory certificate is uploaded to the IHS that includes an inventory identifying firmware for use in the operation of the IHS. Upon delivery and initialization of the IHS, the inventory certificate is retrieved by a pre-boot validation process. An inventory of firmware used by hardware components of the IHS is then collected. The validation process compares the collected inventory of firmware against the inventory of factory-provisioned firmware from the inventory certificate in order to validate the IHS is operating using only factory-provisioned firmware. A validation failure is signaled when the comparison indicates that a hardware component is not operating using the factory-provisioned firmware specified in the inventory certificate.

Abstract: Systems and procedures are provided for importing cryptographic credentials of a customer to an IHS (Information Handling System). During factory provisioning of the IHS, a signed inventory certificate is uploaded to the IHS that includes an encrypted access code for unlocking the IHS and also includes encrypted credentials provided by the customer. Upon delivery and initialization of the IHS, the inventory certificate is retrieved by a pre-boot validation process. A cryptographic challenge is issued that presents the encrypted access code. Further initialization of the IHS is halted until a response to the challenge is received from the customer that provides the decrypted access code. When the decrypted access code is received, further initialization of the IHS is enabled and the encrypted credentials from the inventory certificate are imported to the IHS, thus allowing the customer to establish an independent root of trusted components using the IHS.

Abstract: Systems and methods are provided for customer validation of hardware of an IHS (Information Handling System). During factory provisioning of the IHS, a signed inventory certificate is uploaded to the IHS that identifies factory installed components of the IHS. Upon deployment of the IHS, a customer issues a request for hardware validation, such as via an API exposed by a trusted component of the IHS. The IHS generates a certificate signing request (CSR) that specifies factory-installed hardware components of the IHS. The CSR is transmitted to the customer for use in generating an inventory certificate signed by a certificate authority that is selected by the customer. The customer's signed inventory certificate is stored to the IHS and used in validating some or all of the hardware of the IHS by comparing detected hardware components of the IHS against the inventory specified in the inventory certificate received from the customer.

Abstract: Systems and procedures are provided for validating an IHS (Information Handling System) as operating using only factory-provisioned lockable devices. During factory provisioning of the IHS, a signed inventory certificate is uploaded to the IHS that includes an inventory of factory-provisioned lockable devices and also includes encrypted code(s) for accessing the lockable devices. Upon delivery and initialization of the IHS, the inventory certificate is retrieved by a pre-boot validation process. An inventory of detected lockable devices of the IHS is then collected. The validation process compares the collected inventory of detected lockable devices against the inventory of factory-provisioned lockable devices from the inventory certificate in order to validate the IHS is operating using only factory-provisioned lockable devices.

Abstract: Systems and procedures are provided for validating an IHS (Information Handling System) as operating using only factory-provisioned I/O ports. During factory provisioning of the IHS, a signed inventory certificate that includes an inventory of factory-provisioned I/O ports of the IHS is uploaded to the IHS. Upon delivery and initialization of the IHS, the inventory certificate is retrieved by a pre-boot validation process. An inventory of detected I/O ports of the IHS is then collected. The validation process compares the collected inventory of detected I/O ports against the inventory of factory-provisioned I/O ports from the inventory certificate in order to validate the IHS is operating using only factory-provisioned I/O ports. Through embodiments, any I/O ports of the IHS other than the I/O ports validated as factory-provisioned are not usable by any software or hardware of the IHS.

Abstract: Systems and procedures are provided for tracking hardware components of an IHS (Information Handling System). During factory provisioning of an IHS, an inventory certificate to the IHS is stored to the IHS that includes an inventory identifying factory-installed hardware components of the IHS. Also during the factory provisioning, a record is stored in a component datastore of the factory-installed hardware specified in the inventory certificate. Upon initialization of the delivered IHS, a pre-boot validation environment is initialized on the IHS and the stored inventory certificate is retrieved and used to validate the detected hardware components of the IHS. The results of the validation are then reported to a component datastore, where they are used to identify any transfer of a factory-installed hardware component. The factory datastore is updated in subsequent validations to reflect any detected modifications to the IHS in tracking genuine components.

Abstract: Systems and procedures are provided for enforcing geographic restrictions on the operation of an IHS (Information Handling System). During factory provisioning of the IHS, a signed inventory certificate is uploaded to the IHS that specifies a plurality of allowed geographic locations at which the IHS is operational. Upon delivery and initial powering of the IHS, a validation environment is instantiated and further initialization of the IHS is halted until a location of the IHS can be determined. Once a geographic location of the IHS has been determined, it is compared to the allowed geographic locations from the inventory certificate stored during factory provisioning. When the location of the IHS is not at an allowed geographic location specified in the inventory certificate, the IHS is rendered non-operational. When the location of the IHS is at an allowed geographic location specified in the inventory certificate, further initialization of the IHS is enabled.

Abstract: Embodiments of systems and methods for intelligent accelerator license management are described. In some embodiments, a High Performance Computing (HPC) platform may include: a first Baseboard Management Controller (BMC), and a hardware accelerator comprising a second BMC, where at least one of the first or second BMCs is configured to: identify a type of a workload to be executed, at least in part, by the hardware accelerator, and retrieve a license corresponding to the workload.

Abstract: Embodiments of systems and methods for inter-Baseboard Management Controller (BMC) integration for High Performance Computing (HPC) platforms are described. In some embodiments, an HPC platform may include a first BMC coupled to a host processor; and a hardware accelerator comprising: (a) one or more managed subsystems coupled to the host processor, and (b) a second BMC coupled to the one or more managed subsystems and decoupled from the host processor, wherein the first BMC and the second BMC are coupled to each other via a high-speed, Out-of-Band (OOB) management link.

Abstract: Embodiments of systems and methods for power throttling of High Performance Computing (HPC) components are described. In some embodiments, an HPC platform may include: a system Baseboard Management Controller (BMC), and an accelerator tray comprising a tray BMC coupled to a plurality of managed subsystems and to the system BMC, where the system BMC is configured to: in response to a power excursion event, instruct the tray BMC to throttle a first managed subsystem by a first amount and to throttle a second managed subsystem by a second amount.

Abstract: Embodiments of systems and methods for high-availability (HA) management networks for High Performance Computing (HPC) platforms are described. In some embodiments, an HPC platform may include a first Baseboard Management Controller (BMC) having a first network port; and a hardware accelerator comprising a second BMC having a second network port, where at least one of: (a) the first BMC is configured to share the first network port with the second BMC in response to a determination that the second network port has failed or has insufficient bandwidth, or (b) the second BMC is configured to share the second network port with the first BMC in response to a determination that the first network port has failed or has insufficient bandwidth.

Abstract: A method for managing composed information handling systems includes obtaining a composition request for a composed information handling system, making a first determination that a first information handling system is not capable of servicing the composition request local, and based on the first determination: allocating, an available resource on the first information handling system to the composed information handling system, sending a resource allocation request to a system control processor manager for access to an additional resource, obtain, in response to the allocation request, a notification for access to a second information handling system of the information handling systems that provides the available resource, setting up management services for available resource and the additional resource to obtain logical hardware resources, and presenting the logical hardware resources to at least one compute resource set as bare metal resources.