Abstract: Embodiments of systems and methods to identify and remediate performance degradation during firmware update in a cluster environment are described. In an illustrative, non-limiting embodiment, an IHS may include computer-executable instructions to receive a request to perform a firmware update on a plurality of computing devices of a computing cluster, obtain an inventory of the computing cluster, and determine a scheduling sequence for updating the computing devices so that the performance of the cluster is optimally maintained. The instructions may then perform the firmware update on each of the computing devices according to the determined scheduling sequence.

Abstract: Embodiments of systems and methods to provide a firmware update to devices configured in a redundant configuration in an Information Handling System (IHS) are disclosed. In an illustrative, non-limiting embodiment, an IHS may include computer-executable instructions to receive a target firmware update image associated with a first of the devices, establish a shared memory communication channel with the first device, store the target firmware update image in the shared memory communication channel, and using the shared memory communication channel, perform a firmware update on the first device using the stored target firmware update image.

Abstract: An information handling system includes a device capable of sending and receiving security protocol and data model messages. A management controller with an authorization role as a designated leader is configured to verify authenticity of the device, discover authorization capabilities of the device, and set the authorization role of the device as a follower.

Abstract: An information handling system may include at least one processor and a memory. The information handling system may be configured to: receive an update package for applying an update to at least one information handling resource of the information handling system, wherein the update package includes metadata regarding at least one dependency of the update package; subsequent to receiving the update package, retrieve a revised version of the metadata, wherein the revised version of the metadata indicates a revised at least one dependency; based on the revised at least one dependency, carry out a configuration change; and apply the update.

Abstract: A computing device component monitoring system includes at least one certificate generation system, and a computing device that includes a first component and that is coupled to the at least one certificate generation system via a network. The computing device receives a first component verification certificate from the at least one certificate generation system that identifies a first component lifetime after which the first component in the computing device should be replaced, and stores the first component verification certificate in a database that is accessible to the computing device. The computing device determines that the first component lifetime has been exceeded, and identifies a first component alert policy in response. The computing device generates a first component alert based on the first component alert policy.

Abstract: An Information Handling System (IHS) includes at least one hardware device in communication with a Baseboard Management Controller (BMC). The hardware device includes executable instructions for establishing a secure communication channel with the BMC, and subsequently receiving a list of allowed commands from the BMC. When a command is received by the hardware device, it determines whether the command is included in the list such that when the command is in the list and the command is received within the secure communication channel, the hardware device performs the command. However, when the command is in the list and the command is received outside of the secure communication channel, the hardware device ignores the command.

Abstract: An information handling system may include a processor, one or more accelerators communicatively coupled to the processor, and a management controller communicatively coupled to the processor and the one or more accelerators and configured for out-of-band management of the information handling system, the management controller further configured to receive information regarding the one or more accelerators, determine a criticality factor for each of the one or more accelerators based on the information, determine an accelerator health status for each of the one or more accelerators, and determine an overall system health of the information handling system based on the criticality factors and the accelerator health statuses.

Abstract: An Information Handling System (IHS) includes multiple hardware devices, and a baseboard Management Controller (BMC) in communication with multiple hardware devices of the IHS. The BMC includes executable instructions for transmitting a broadcast message to the hardware devices in which the broadcast message has a block of data including a digital signature of the BMC. Each of the hardware devices that receive the broadcast message are configured to transmit a broadcast acknowledgment message to the BMC. Using the block of data, the BMC and hardware devices may perform a mutual consensus procedure with other using a cryptographic hash function of the block of data.

Abstract: A key management system includes a managed system coupled to a management system through a network. The managed system includes managed device locking subsystem(s) coupled to a managed device and a key storage. The managed device locking subsystem(s) retrieve, through the network from the management system, a managed device locking key that is configured to unlock the managed device. The managed device locking subsystem(s) then encrypt the managed device locking key to provide an encrypted managed device locking key, and store the encrypted managed device locking key in the key storage. Subsequent to storing the encrypted managed device locking key, the managed device locking subsystem(s) retrieve the encrypted managed device locking key from the key storage, and decrypt the encrypted managed device locking key to provide a decrypted managed device locking key. The managed device locking subsystem(s) then use the decrypted managed device locking key to unlock the managed device.

Abstract: A device-capability-based locking key management system includes a key management system coupled to a server device via a network. The server device includes storage devices coupled to a remote access controller device. The remote access controller device identifies each of the storage devices, and then identifies a key management profile for each of the storage devices. A first key management profile identified for at least one first storage device is different from a second key management profile identified for at least one second storage device. The remote access controller device then uses the respective key management profile identified for each of the storage devices to create a respective key management sub-client for each of the storage devices, and each respective key management sub-client communicates with the key management system to provide a locking key for its respective storage device.

Abstract: A system and method are disclosed for delegating, by a resource-constrained device, a privilege to a basic input/output system, wherein the privilege allows the basic input/output system to authenticate an endpoint device on behalf of the resource-constrained device. The system and method also includes generating an asymmetric security key that includes a private key and a public key and transmitting the public key to the basic input/output system, wherein the public key is included in a proxy certificate generated by the basic input/output system. In addition, the system and method includes establishing a secure session between the basic input/output system and the endpoint device using the private key and the proxy certificate, wherein the secure session is used by the basic input/output system to authenticate and verify that the endpoint device is authorized to perform an operation.

Abstract: A system for data processing, comprising a management controller operating on a processor and configured to load and execute one or more algorithms that provide the function of transmitting a request to a managed device using a Security Protocol and Data Model (SPDM) protocol and to receive a response from the managed device. A system management bus and security policy system operating on the processor is configured to execute one or more algorithms to process the response from the managed device to apply an SPDM security policy to the response.

Abstract: An Information Handling System (IHS) includes at least one hardware device in communication with a Baseboard Management Controller (BMC). The hardware device includes executable instructions for establishing a secure communication channel with the BMC, and subsequently receiving a list of allowed commands from the BMC. When a command is received by the hardware device, it determines whether the command is included in the list such that when the command is in the list and the command is received within the secure communication channel, the hardware device performs the command. However, when the command is in the list and the command is received outside of the secure communication channel, the hardware device ignores the command.

Abstract: An Information Handling System (IHS) includes multiple hardware devices, and a baseboard Management Controller (BMC) in communication with the plurality of hardware devices. The BMC includes executable instructions for monitoring the operating characteristics a hardware device that is operating in a fixed pass-through configuration with a workspace in which the workspace has been instantiated by a workspace orchestration service executed on the IHS. The executable instructions may determine that the operating characteristics are indicative of a security breach of the fixed pass-through configuration, and as such, may perform an operation to quarantine the one hardware device when the fixed pass-through configuration is determined to possess the security breach.

Abstract: An Information Handling System (IHS) includes multiple hardware devices, and a baseboard Management Controller (BMC) in communication with multiple hardware devices of the IHS. The BMC includes executable instructions for transmitting a broadcast message to the hardware devices in which the broadcast message has a block of data including a digital signature of the BMC. Each of the hardware devices that receive the broadcast message are configured to transmit a broadcast acknowledgment message to the BMC. Using the block of data, the BMC and hardware devices may perform a mutual consensus procedure with other using a cryptographic hash function of the block of data.

Abstract: According to one embodiment, a path obfuscation system includes first and second hardware devices, and first and second interfaces configured to provide communication between the first and second hardware devices using a security protocol and data model (SPDM) protocol. The first hardware device comprises computer-executable instructions to receive a message to be transmitted to the second hardware device, segment the message into multiple groups of packets, and randomly select either the first or second interface to transmit each group of packet to the second hardware device.

Abstract: An Information Handling System (IHS) includes multiple hardware devices, and a baseboard Management Controller (BMC) in communication with the plurality of hardware devices. The BMC includes executable instructions for causing the one hardware device to be inhibited from functioning with the IHS when at least one of the hardware devices is powered on, and performing an authentication procedure with that hardware device. After that hardware device has been successfully authenticated, the instructions then enable the one hardware device to function with the IHS.

Abstract: A system for data processing, comprising a management controller operating on a processor and configured to load and execute one or more algorithms that provide the function of transmitting a request to a managed device using a Security Protocol and Data Model (SPDM) protocol and to receive a response from the managed device. A system management bus and security policy system operating on the processor is configured to execute one or more algorithms to process the response from the managed device to apply an SPDM security policy to the response.

Abstract: An information handling system includes a processor, a system baseboard management controller (BMC), and a field-programmable gate array (FPGA) add-in card. The FPGA add-in card includes an FPGA and a card BMC. The FPGA is programmed with a plurality of accelerated function units (AFUs) to perform processing tasks for the processor. The card BMC receives a first indication from the system BMC, the first indication to halt a first processing task associated with a first AFU, halts the first processing task in response to the first indication, receives a second AFU from the system BMC, and reprograms the FPGA with the second AFU.

Abstract: A management controller sends a first firmware measurement request to verify integrity of a device. The first firmware measurement request is sent at initial power on of the device, and is sent subsequent to negotiating a secure session between the management controller and the device. The management controller verifies a first firmware measurement in a first firmware measurement response to the first firmware measurement request prior to storing the first firmware measurement, and sends a heartbeat request to the device to monitor for a device state change. The management controller may receive a heartbeat acknowledgement from the device in response to the heartbeat request, wherein the heartbeat acknowledgement includes an indication of the device state change. In response to the receipt of the heartbeat acknowledgment that includes the device state change, the management controller sends a second firmware measurement request to the device.