Abstract: On power-up, self-encrypting drives (SEDs, 150) are unlocked one after another in an order based on the SEDs' unlocking priorities. In determining the priorities, one or more of the following factors are taken into account: (1) the content stored on the SEDs; the SEDs storing the OS are given higher priorities; (2) the SEDs' access history on previous power-ups: if a SED was accessed earlier than other SEDs, then this SED is given a higher priority; (3) whether there is an access request pending for a SED. Such prioritization allows the system to reach full functionality faster on power-ups. Other features are also provided.

Abstract: A system for polling components is disclosed that includes a plurality of processors and a control system configured to interface with each of the plurality of processors, and to 1) poll each of the plurality of processors using a first polling loop and 2) transfer one of the plurality of processors to a second polling loop if the one of the plurality of processors is non-responsive to the poll.

Abstract: A system, method, and computer-readable medium for a security vulnerability detection operation. The security vulnerability operation includes configuring a firmware security profiling environment with a trusted host and a trusted service processor; receiving a firmware update file via the trusted service processor; using the trusted service processor to identify a security vulnerability within the firmware update file; and, installing the firmware update file to the information handling system only when no security vulnerability is identified by the trusted service processor, the installing being performed by the trusted host.

Abstract: An information handling system includes a device capable of sending and receiving security protocol and data model messages. A management controller with an authorization role as a designated leader is configured to verify authenticity of the device, discover authorization capabilities of the device, and set the authorization role of the device as a follower.

Abstract: A management controller sends a first firmware measurement request to verify integrity of a device. The first firmware measurement request is sent at initial power on of the device, and is sent subsequent to negotiating a secure session between the management controller and the device. The management controller verifies a first firmware measurement in a first firmware measurement response to the first firmware measurement request prior to storing the first firmware measurement, and sends a heartbeat request to the device to monitor for a device state change. The management controller may receive a heartbeat acknowledgement from the device in response to the heartbeat request, wherein the heartbeat acknowledgement includes an indication of the device state change. In response to the receipt of the heartbeat acknowledgment that includes the device state change, the management controller sends a second firmware measurement request to the device.

Abstract: An information handling system includes a processor, a system baseboard management controller (BMC), and a field-programmable gate array (FPGA) add-in card. The FPGA add-in card includes an FPGA programmed with accelerated function units (AFUs) to perform processing tasks for the processor. The AFUs include AFUs of a common type. A card BMC provides a temperature indication to the system BMC. The system BMC determines that a temperature of the FPGA add-in card exceeds a temperature threshold based upon the temperature indication, selects one of the common AFUs to be disabled, and directs the card BMC to disable the selected AFU. The card BMC disables the first AFU and not the second AFU in response to the direction to disable the first AFU.

Abstract: A redundant key management system includes a key management system coupled to a plurality of server devices through a network. A first server device includes a managed device coupled to a first remote access controller device that receive a device locking key from the key management system and uses it to lock the managed device. The first remote access controller device then encrypts the device locking key, broadcasts the encrypted device locking key through the network to a second remote access controller device in a second server device, and erases the device locking key. Subsequently, the first remote access controller device transmits a request to retrieve the encrypted device locking key. When the first remote access controller receives the encrypted device locking key from the second remote access controller device, it decrypts the encrypted device locking key and uses the resulting device locking key to unlock the managed device.

Abstract: An information handling system may include a processor, one or more accelerators communicatively coupled to the processor, and a management controller communicatively coupled to the processor and the one or more accelerators and configured for out-of-band management of the information handling system, the management controller further configured to receive information regarding the one or more accelerators, determine a criticality factor for each of the one or more accelerators based on the information, determine an accelerator health status for each of the one or more accelerators, and determine an overall system health of the information handling system based on the criticality factors and the accelerator health statuses.

Abstract: An information handling system may include a processor, a management controller configured for out-of-band management of the information handling system, and an internal accelerator communicatively coupled to the management controller and configured to execute an analytics engine for receiving events from the management controller and analyzing the events to perform one or more tasks based on the events.

Abstract: An information handling system may include a processor, a management controller configured for out-of-band management of the information handling system and further configured to emulate non-transitory computer readable media of the management controller as an emulated mass storage device to an operating system executing on the processor and execute a server application to expose the emulated mass storage device to one or more client information handling systems communicatively coupled to the management controller via a network.

Abstract: A key retrieval system includes a management system and a managed system that is coupled to the management system through a network. The managed system includes a managed device, a management system configuration storage, a remote access controller device that stores a management system configuration for the management system in the management system configuration storage and provides a key management client subsystem that is configured to use the management system configuration to access the management system. The managed system also includes a BIOS. The BIOS detects an event that triggers unlocking the managed device. The BIOS determines that the remote access controller device is unavailable and, in response, retrieves the management system configuration and accesses the management system using the management system configuration. The BIOS then retrieves the locking key from the management system and unlocks the managed device using the locking key.

Abstract: A system for data processing, comprising a management controller operating on a processor and configured to load and execute one or more algorithms that provide the function of transmitting a request to a managed device using a Security Protocol and Data Model (SPDM) protocol and to receive a response from the managed device. A system management bus and security policy system operating on the processor is configured to execute one or more algorithms to process the response from the managed device to apply an SPDM security policy to the response.

Abstract: A key management system includes a managed system coupled to a management system through a network. The managed system includes managed device locking subsystem(s) coupled to a managed device and a key storage. The managed device locking subsystem(s) retrieve, through the network from the management system, a managed device locking key that is configured to unlock the managed device. The managed device locking subsystem(s) then encrypt the managed device locking key to provide an encrypted managed device locking key, and store the encrypted managed device locking key in the key storage. Subsequent to storing the encrypted managed device locking key, the managed device locking subsystem(s) retrieve the encrypted managed device locking key from the key storage, and decrypt the encrypted managed device locking key to provide a decrypted managed device locking key. The managed device locking subsystem(s) then use the decrypted managed device locking key to unlock the managed device.

Abstract: An information handling system includes a device and a baseboard management controller. The device is configured to communicate with a processor of the information handling system. The baseboard management controller is configured to communicate with the device via an in-band communication channel. The baseboard management controller determines whether data is received from the device via an in-band communication channel, and determines whether the baseboard management controller may communicate with the device via an out-of-band communication channel. In response to the data not being received and the baseboard management controller not able to communicate with the device, the baseboard management controller detects a failure of the device. In response to the detection of the failure of the device, the baseboard management controller isolates the device.

Abstract: A system includes a management system, a managed system that is coupled to the management system through a network. The managed system comprises a managed device, a key identifier storage, a first managed device locking system coupled to the managed device and the key identifier storage, and a second managed device locking system coupled to the managed device, the key identifier storage, and the first managed device locking system. The first managed device locking system is configured to store a key identifier of the managed device in the key identifier storage and to provide access to a locking key of the managed device based upon the key identifier of the managed device, stored in a management system. The second managed device locking system is configured to monitor the managed device for an event that triggers unlocking the managed device, monitor operating status of the first managed device locking system.

Abstract: A key management system includes a managed system coupled to a management system through a network. The managed system includes managed device locking subsystem(s) coupled to a managed device and a key storage. The managed device locking subsystem(s) retrieve, through the network from the management system, a managed device locking key that is configured to unlock the managed device. The managed device locking subsystem(s) then encrypt the managed device locking key to provide an encrypted managed device locking key, and store the encrypted managed device locking key in the key storage. Subsequent to storing the encrypted managed device locking key, the managed device locking subsystem(s) retrieve the encrypted managed device locking key from the key storage, and decrypt the encrypted managed device locking key to provide a decrypted managed device locking key. The managed device locking subsystem(s) then use the decrypted managed device locking key to unlock the managed device.

Abstract: An information handling system includes a processor, and first and second field-programmable gate array (FPGA) add-in cards. The processor determines a configuration of the information handling system, the configuration defining architectural relationships among the first and second FPGA add-in cards and elements of the information handling system, determines that an accelerated function unit (AFU) performs its associated processing task more efficiently on the first FPGA add-in card than on the second FPGA add-in card based upon the configuration, and programs the first AFU on the first FPGA card in based upon the determination that the first AFU performs its associated processing task more efficiently on the first FPGA add-in card than on the second FPGA add-in card.

Abstract: A locking key secondary access system includes a key management system coupled to a secondary locking key access device and a server device via a network. The server device includes a managed device. The server device receives a request to unlock the managed device, and determines that a first access path via a first communication subsystem and through the network to the key management system is unavailable. In response, the server device provides locking key request information via a second communication subsystem to the secondary locking key access device. The secondary locking key access device may use the locking key information to retrieve a locking key for the managed device from the key management system. The secondary locking key access device sends the locking key to the server device via the second communication subsystem, and the server device uses the locking key to unlock the managed device.

Abstract: An information handling system includes a device and a baseboard management controller. The device is configured to communicate with a processor of the information handling system. The baseboard management controller is configured to communicate with the device via an in-band communication channel. The baseboard management controller determines whether data is received from the device via an in-band communication channel, and determines whether the baseboard management controller may communicate with the device via an out-of-band communication channel. In response to the data not being received and the baseboard management controller not able to communicate with the device, the baseboard management controller detects a failure of the device. In response to the detection of the failure of the device, the baseboard management controller isolates the device.

Abstract: An information handling system includes a processor, a system baseboard management controller (BMC), and a field-programmable gate array (FPGA) add-in card. The FPGA add-in card includes an FPGA programmed with accelerated function units (AFUs) to perform processing tasks for the processor. The AFUs include AFUs of a common type. A card BMC provides a temperature indication to the system BMC. The system BMC determines that a temperature of the FPGA add-in card exceeds a temperature threshold based upon the temperature indication, selects one of the common AFUs to be disabled, and directs the card BMC to disable the selected AFU. The card BMC disables the first AFU and not the second AFU in response to the direction to disable the first AFU.