Abstract: A process includes accessing by a management controller of a computer platform, a platform certificate that is stored in a secure memory. The platform certificate includes data representing a reference inventory for the computer platform. The platform certificate includes data representing information designated to bind the platform certificate to a security processor. The security processor is accessible by the management controller. The security processor is inaccessible by an operating system of the computer platform. The process includes verifying the platform certificate. Verifying the platform certificate includes validating, by the management controller, a signature of the platform certificate; and validating, by the management controller, the information designated to bind the platform certificate to the security processor. Verifying the platform certificate includes comparing, by the management controller, a second inventory of the computer platform to the reference inventory.

Abstract: In some examples, a security processor receives, from a first management device, measurement data of one or more second management devices. The measurement data is computed at the one or more second management devices based on information in the one or more second management devices and sent from the one or more second management devices to the first management device. The security processor stores the measurement data in a secure storage of the security processor, and provides a representation of the measurement data to validate an integrity of the information in the one or more second management devices.

Abstract: A process includes accessing by a management controller of a computer platform, a platform certificate that is stored in a secure memory. The platform certificate includes data representing a reference inventory for the computer platform. The platform certificate includes data representing information designated to bind the platform certificate to a security processor. The security processor is accessible by the management controller. The security processor is inaccessible by an operating system of the computer platform. The process includes verifying the platform certificate. Verifying the platform certificate includes validating, by the management controller, a signature of the platform certificate; and validating, by the management controller, the information designated to bind the platform certificate to the security processor. Verifying the platform certificate includes comparing, by the management controller, a second inventory of the computer platform to the reference inventory.

Abstract: An apparatus includes a host and a baseboard management controller. The baseboard management controller includes a semiconductor package; and the semiconductor package includes a memory, a security hardware processor; and a main hardware processor. The main hardware processor causes the baseboard management controller to serve as an agent that, independently from the host, responds to communications with a remote management entity to manage the host. The security hardware processor manages the storage of a secret of the host in the memory.

Abstract: A process includes aggregating a time sequence of samples. Each sample has a plurality of dimensions that correspond to respective metrics that are associated with a microservice. Each sample includes, for each dimension, a measurement of the metric that corresponds to the dimension. The process includes identifying a given sample of the time sequence of samples based on measurements of first samples of the time sequence of samples and determining a sensitivity dependency of the metrics based on the measurements of the given sample. The process includes determining whether the microservice has been subjected to a security attack based on the sensitive dependency.

Abstract: An apparatus includes a host and a baseboard management controller. The baseboard management controller includes a semiconductor package; and the semiconductor package includes a memory, a security hardware processor; and a main hardware processor. The main hardware processor causes the baseboard management controller to serve as an agent that, independently from the host, responds to communications with a remote management entity to manage the host. The security hardware processor manages the storage of a secret of the host in the memory.

Abstract: A process includes a first tenant of a plurality of tenants communicating with a security processor of a computer platform, via a first physical request interface of the security processor, to acquire ownership of a first command execution engine of the security processor associated with the first physical request interface. The process includes a second tenant of the plurality of tenants communicating with the security processor, via a second physical request interface of the security processor, to acquire ownership of a second command execution engine of the security processor associated with the second physical request interface. The process includes the security processor receiving a first request from the first tenant in the first physical interface, and the second processor receiving a second request from the second tenant in the second physical request interface.

Abstract: In some examples, a security chip for an electronic device includes a nonvolatile memory to store a collection of encryption keys for encrypting information to produce encrypted information. The security chip includes a discrete secure erase hardware logic and is separate from a collection of device processors of the electronic device. The discrete secure erase hardware logic receives an erase indication indicating a request to erase the encrypted information. In response to the erase indication, the discrete secure erase hardware logic erases the collection of encryption keys in the nonvolatile memory, and activates an output indication to cause activation of an erase indicator at the electronic device.

Abstract: A process includes accessing by a management controller of a computer platform, a platform certificate that is stored in a secure memory. The platform certificate includes data representing a reference inventory for the computer platform. The platform certificate includes data representing information designated to bind the platform certificate to a security processor. The security processor is accessible by the management controller. The security processor is inaccessible by an operating system of the computer platform. The process includes verifying the platform certificate. Verifying the platform certificate includes validating, by the management controller, a signature of the platform certificate; and validating, by the management controller, the information designated to bind the platform certificate to the security processor. Verifying the platform certificate includes comparing, by the management controller, a second inventory of the computer platform to the reference inventory.

Abstract: An apparatus includes a host and a baseboard management controller. The baseboard management controller includes a semiconductor package; and the semiconductor package includes a memory, a security hardware processor; and a main hardware processor. The main hardware processor causes the baseboard management controller to serve as an agent that, independently from the host, responds to communications with a remote management entity to manage the host. The security hardware processor manages the storage of a secret of the host in the memory.

Abstract: A process includes a first tenant of a plurality of tenants communicating with a security processor of a computer platform, via a first physical request interface of the security processor, to acquire ownership of a first command execution engine of the security processor associated with the first physical request interface. The process includes a second tenant of the plurality of tenants communicating with the security processor, via a second physical request interface of the security processor, to acquire ownership of a second command execution engine of the security processor associated with the second physical request interface. The process includes the security processor receiving a first request from the first tenant in the first physical interface, and the second processor receiving a second request from the second tenant in the second physical request interface.

Abstract: In some examples, a system receives input information relating to a security level for an information technology (IT) stack comprising a plurality of layers including a hardware layer and a software layer, where the input information is technology and product agnostic. The system discovers components of the plurality of layers of the IT stack, accesses a knowledge base that maps the security level and the discovered components to configuration instructions relating to security controls, and configures the IT stack with the security controls using the configuration instructions.

Abstract: A technique includes detecting a presence of a hardware security module in a computer. The hardware security module performs trusted computing base measurements in response to the boot of the computer. The technique includes detecting an intention to change firmware of the computer and regulating providing a message warning about an impact of the change based on the determination. The regulation includes determining whether an operating system of the computer binds operations to the trusted computing base measurements and allowing communication of the message based on the determination.

Abstract: Examples disclosed herein relate to systems and methods for assigning an identifier to a node-based system. For example, systems and methods may: discover the plurality of nodes; determine a node of the plurality of nodes to be a controller node: authenticate, at a management component of the controller node, a respective identifier associated with each node of the plurality of nodes; and based on the authentication, assign a complex identifier to a complex comprising the plurality of nodes, wherein the complex identifier comprises the identifier associated with the controller node.

Abstract: Examples disclosed herein relate to performing an action based on a pre-boot measurement of a firmware image. In an example, at a firmware component in a system, a measurement of a firmware image may be determined prior to booting of the system, beginning from a hardware root of trust boot block, by a Trusted Platform Module (TPM) emulator engine that emulates a hardware-based TPM. A pre-determined measurement of the firmware image may be retrieved from a storage location within the system. The measurement of the firmware image may be compared with the pre-determined measurement of the firmware image prior to booting of the system. In response to a determination that the measurement of the firmware image is different from the pre-determined measurement of the firmware image, performing an action.

Abstract: A technique includes detecting a presence of a hardware security module in a computer. The hardware security module performs trusted computing base measurements in response to the boot of the computer. The technique includes detecting an intention to change firmware of the computer and regulating providing a message warning about an impact of the change based on the determination. The regulation includes determining whether an operating system of the computer binds operations to the trusted computing base measurements and allowing communication of the message based on the determination.

Abstract: In exemplary aspects described herein, system memory is secured using protected memory regions. Portions of a system memory are assigned to endpoint devices, such as peripheral component interconnect express (PCIe) compliant devices. The portions of the system memory can include protected memory regions. The protected memory regions of the system memory assigned to each of the endpoint devices are configured to control access thereto using device identifiers and/or process identifiers, such as a process address space ID (PASID). When a transaction request is received by a device, the memory included in that request is used to determine whether it corresponds to a protected memory region. If so, the transaction request is executed if the identifiers in the request match the identifiers for which access is allowed to that protected memory region.

Abstract: In some examples, a system receives input information relating to a security level for an information technology (IT) stack comprising a plurality of layers including a hardware layer and a software layer, where the input information is technology and product agnostic. The system discovers components of the plurality of layers of the IT stack, accesses a knowledge base that maps the security level and the discovered components to configuration instructions relating to security controls, and configures the IT stack with the security controls using the configuration instructions.

Abstract: In exemplary aspects described herein, system memory is secured using protected memory regions. Portions of a system memory are assigned to endpoint devices, such as peripheral component interconnect express (PCIe) compliant devices. The portions of the system memory can include protected memory regions. The protected memory regions of the system memory assigned to each of the endpoint devices are configured to control access thereto using device identifiers and/or process identifiers, such as a process address space ID (PASID). When a transaction request is received by a device, the memory included in that request is used to determine whether it corresponds to a protected memory region. If so, the transaction request is executed if the identifiers in the request match the identifiers for which access is allowed to that protected memory region.

Abstract: Examples disclosed herein relate to performing an action based on a pre-boot measurement of a firmware image. In an example, at a firmware component in a system, a measurement of a firmware image may be determined prior to booting of the system, beginning from a hardware root of trust boot block, by a Trusted Platform Module (TPM) emulator engine that emulates a hardware-based TPM. A pre-determined measurement of the firmware image may be retrieved from a storage location within the system. The measurement of the firmware image may be compared with the pre-determined measurement of the firmware image prior to booting of the system. In response to a determination that the measurement of the firmware image is different from the pre-determined measurement of the firmware image, performing an action.