Abstract: A system and method are disclosed for delegating, by a resource-constrained device, a privilege to a basic input/output system, wherein the privilege allows the basic input/output system to authenticate an endpoint device on behalf of the resource-constrained device. The system and method also includes generating an asymmetric security key that includes a private key and a public key and transmitting the public key to the basic input/output system, wherein the public key is included in a proxy certificate generated by the basic input/output system. In addition, the system and method includes establishing a secure session between the basic input/output system and the endpoint device using the private key and the proxy certificate, wherein the secure session is used by the basic input/output system to authenticate and verify that the endpoint device is authorized to perform an operation.

Abstract: An information handling system includes a device capable of sending and receiving security protocol and data model messages. A management controller with an authorization role as a designated leader is configured to verify authenticity of the device, discover authorization capabilities of the device, and set the authorization role of the device as a follower.

Abstract: An information handling system includes a memory and a baseboard management controller. The memory stores one or more device update packages, and each of the first device update packages includes an inter-integrated circuit payload. The baseboard management controller receives a first device update package, and stores the first device update package in the memory. In response to the first device update package being stored in the memory, the baseboard management controller launches a handler. The baseboard management controller retrieves a bus number and an address for a target device identified in the first device update package. The baseboard management controller parses data in a body of the inter-integrated circuit payload of the first device update package, and executes inter-integrated circuit commands in the body to provide a firmware image update to the target device.

Abstract: Methods and systems for managing operation of data processing systems are disclosed. To manage operation of the data processing systems, the data processing systems may collect and use diagnostic data to manage various devices. The diagnostic data may be collected using different processes depending on the state of operable connections between components of the data processing systems, and the capabilities of the devices from which the diagnostic data is collected. The diagnostic data may be collected by invoking collection functionality of the devices, or through management of diagnostic data collection processes by other devices.

Abstract: A firmware update system includes firmware storage device(s), an operating system engine coupled to the firmware storage device(s), and a remote access controller device coupled to the firmware storage device(s) and the operating system engine. The remote access controller device receives a single out-of-band firmware update command and, in response, performs a firmware storage device unlock operation to unlock the firmware storage device(s), transmits a firmware update package including a firmware update utility and a firmware update image to the operating system engine to cause the operating system engine to utilize the firmware update utility to update firmware stored in the firmware storage device(s) that was unlocked with the firmware update image and, subsequent to the operating system engine updating the firmware stored in the at least one firmware storage device that was unlocked, performs a firmware storage device lock operation to lock the firmware storage device(s).

Abstract: An Information Handling System (IHS) includes multiple hardware devices, and a baseboard Management Controller (BMC) in communication with the plurality of hardware devices. The BMC includes executable instructions for beginning execution of a first BMC firmware stack, and during execution of the first BMC firmware stack, halt execution of the first BMC firmware stack, and begin execution of a second BMC firmware stack. At least a portion of the executable instructions used to generate the first BMC firmware stack are different than the executable instructions used to generate the second BMC firmware stack.

Abstract: An Information Handling System (IHS) includes at least one hardware device in communication with a Baseboard Management Controller (BMC). The hardware device includes executable instructions for establishing a secure communication channel with the BMC, and subsequently receiving a list of allowed commands from the BMC. When a command is received by the hardware device, it determines whether the command is included in the list such that when the command is in the list and the command is received within the secure communication channel, the hardware device performs the command. However, when the command is in the list and the command is received outside of the secure communication channel, the hardware device ignores the command.

Abstract: An Information Handling System (IHS) includes multiple hardware devices, and a baseboard Management Controller (BMC) in communication with multiple hardware devices of the IHS. The BMC includes executable instructions for monitoring a parameter of one or more of the hardware devices when a custom BMC firmware stack is executed on the BMC. The instructions that monitor the parameter are separate and distinct from the instructions of the custom BMC firmware stack. The instructions also control the BMC to perform one or more operations to remediate an excessive parameter when the parameter exceeds a specified threshold.

Abstract: An Information Handling System (IHS) includes multiple hardware devices, and a baseboard Management Controller (BMC) in communication with the plurality of hardware devices. The BMC includes a first processor for executing a custom BMC firmware stack, and transmitting a watchdog message at an ongoing basis. The BMC also includes a second processor for receiving the watchdog message. When the watchdog message is received within a specified elapsed period of time, allow continued operation of the custom BMC firmware stack, and when not received within the specified elapsed period of time, place the BMC in a failsafe mode of operation.

Abstract: An Information Handling System (IHS) includes multiple hardware devices, and a baseboard Management Controller (BMC) in communication with the plurality of hardware devices. The BMC includes executable instructions for monitoring a parameter of one or more of the hardware devices of the IHS when a custom BMC firmware stack is executed on the BMC. The instructions that monitor the parameter are separate and distinct from the instructions of the custom BMC firmware stack. When the parameter exceeds a specified threshold, the instructions are further executed to control the BMC to perform one or more operations to remediate the excessive parameter.

Abstract: An Information Handling System (IHS) includes multiple hardware devices, and a baseboard Management Controller (BMC) in communication with multiple hardware devices of the IHS. The BMC includes executable instructions for transmitting a broadcast message to the hardware devices in which the broadcast message has a block of data including a digital signature of the BMC. Each of the hardware devices that receive the broadcast message are configured to transmit a broadcast acknowledgment message to the BMC. Using the block of data, the BMC and hardware devices may perform a mutual consensus procedure with other using a cryptographic hash function of the block of data.

Abstract: An information handling system includes a memory and a baseboard management controller. The memory stores one or more device update packages, and each of the first device update packages includes an inter-integrated circuit payload. The baseboard management controller receives a first device update package, and stores the first device update package in the memory. In response to the first device update package being stored in the memory, the baseboard management controller launches a handler. The baseboard management controller retrieves a bus number and an address for a target device identified in the first device update package. The baseboard management controller parses data in a body of the inter-integrated circuit payload of the first device update package, and executes inter-integrated circuit commands in the body to provide a firmware image update to the target device.

Abstract: A system and method are disclosed for delegating, by a resource-constrained device, a privilege to a basic input/output system, wherein the privilege allows the basic input/output system to authenticate an endpoint device on behalf of the resource-constrained device. The system and method also includes generating an asymmetric security key that includes a private key and a public key and transmitting the public key to the basic input/output system, wherein the public key is included in a proxy certificate generated by the basic input/output system. In addition, the system and method includes establishing a secure session between the basic input/output system and the endpoint device using the private key and the proxy certificate, wherein the secure session is used by the basic input/output system to authenticate and verify that the endpoint device is authorized to perform an operation.

Abstract: A system for data processing, comprising a management controller operating on a processor and configured to load and execute one or more algorithms that provide the function of transmitting a request to a managed device using a Security Protocol and Data Model (SPDM) protocol and to receive a response from the managed device. A system management bus and security policy system operating on the processor is configured to execute one or more algorithms to process the response from the managed device to apply an SPDM security policy to the response.

Abstract: An Information Handling System (IHS) includes multiple hardware devices, and a baseboard Management Controller (BMC) in communication with the plurality of hardware devices. The BMC includes executable instructions for when a custom BMC firmware stack is executed on the BMC, monitoring a parameter of one or more of the hardware devices of the IHS. The instructions that monitor the parameter are separate and distinct from the instructions of the custom BMC firmware stack. The instructions also controls the BMC to perform one or more operations to remediate an excessive parameter when the parameter exceeds a specified threshold.

Abstract: An Information Handling System (IHS) includes multiple hardware devices, and a baseboard Management Controller (BMC) in communication with the plurality of hardware devices. The BMC includes executable instructions for causing the one hardware device to be inhibited from functioning with the IHS when at least one of the hardware devices is powered on, and performing an authentication procedure with that hardware device. After that hardware device has been successfully authenticated, the instructions then enable the one hardware device to function with the IHS.

Abstract: According to one embodiment, a path obfuscation system includes first and second hardware devices, and first and second interfaces configured to provide communication between the first and second hardware devices using a security protocol and data model (SPDM) protocol. The first hardware device comprises computer-executable instructions to receive a message to be transmitted to the second hardware device, segment the message into multiple groups of packets, and randomly select either the first or second interface to transmit each group of packet to the second hardware device.

Abstract: An Information Handling System (IHS) includes at least one hardware device in communication with a Baseboard Management Controller (BMC). The hardware device includes executable instructions for establishing a secure communication channel with the BMC, and subsequently receiving a list of allowed commands from the BMC. When a command is received by the hardware device, it determines whether the command is included in the list such that when the command is in the list and the command is received within the secure communication channel, the hardware device performs the command. However, when the command is in the list and the command is received outside of the secure communication channel, the hardware device ignores the command.

Abstract: An Information Handling System (IHS) includes multiple hardware devices, and a baseboard Management Controller (BMC) in communication with the plurality of hardware devices. The BMC includes executable instructions for monitoring the operating characteristics a hardware device that is operating in a fixed pass-through configuration with a workspace in which the workspace has been instantiated by a workspace orchestration service executed on the IHS. The executable instructions may determine that the operating characteristics are indicative of a security breach of the fixed pass-through configuration, and as such, may perform an operation to quarantine the one hardware device when the fixed pass-through configuration is determined to possess the security breach.

Abstract: An Information Handling System (IHS) includes multiple hardware devices, and a baseboard Management Controller (BMC) in communication with multiple hardware devices of the IHS. The BMC includes executable instructions for transmitting a broadcast message to the hardware devices in which the broadcast message has a block of data including a digital signature of the BMC. Each of the hardware devices that receive the broadcast message are configured to transmit a broadcast acknowledgment message to the BMC. Using the block of data, the BMC and hardware devices may perform a mutual consensus procedure with other using a cryptographic hash function of the block of data.