Abstract: A process includes accessing by a management controller of a computer platform, a platform certificate that is stored in a secure memory. The platform certificate includes data representing a reference inventory for the computer platform. The platform certificate includes data representing information designated to bind the platform certificate to a security processor. The security processor is accessible by the management controller. The security processor is inaccessible by an operating system of the computer platform. The process includes verifying the platform certificate. Verifying the platform certificate includes validating, by the management controller, a signature of the platform certificate; and validating, by the management controller, the information designated to bind the platform certificate to the security processor. Verifying the platform certificate includes comparing, by the management controller, a second inventory of the computer platform to the reference inventory.

Abstract: An apparatus includes a host and a baseboard management controller. The baseboard management controller includes a semiconductor package; and the semiconductor package includes a memory, a security hardware processor; and a main hardware processor. The main hardware processor causes the baseboard management controller to serve as an agent that, independently from the host, responds to communications with a remote management entity to manage the host. The security hardware processor manages the storage of a secret of the host in the memory.

Abstract: A process includes a first tenant of a plurality of tenants communicating with a security processor of a computer platform, via a first physical request interface of the security processor, to acquire ownership of a first command execution engine of the security processor associated with the first physical request interface. The process includes a second tenant of the plurality of tenants communicating with the security processor, via a second physical request interface of the security processor, to acquire ownership of a second command execution engine of the security processor associated with the second physical request interface. The process includes the security processor receiving a first request from the first tenant in the first physical interface, and the second processor receiving a second request from the second tenant in the second physical request interface.

Abstract: In some examples, a system receives input information relating to a security level for an information technology (IT) stack comprising a plurality of layers including a hardware layer and a software layer, where the input information is technology and product agnostic. The system discovers components of the plurality of layers of the IT stack, accesses a knowledge base that maps the security level and the discovered components to configuration instructions relating to security controls, and configures the IT stack with the security controls using the configuration instructions.

Abstract: A technique includes detecting a presence of a hardware security module in a computer. The hardware security module performs trusted computing base measurements in response to the boot of the computer. The technique includes detecting an intention to change firmware of the computer and regulating providing a message warning about an impact of the change based on the determination. The regulation includes determining whether an operating system of the computer binds operations to the trusted computing base measurements and allowing communication of the message based on the determination.

Abstract: Examples disclosed herein relate to systems and methods for assigning an identifier to a node-based system. For example, systems and methods may: discover the plurality of nodes; determine a node of the plurality of nodes to be a controller node: authenticate, at a management component of the controller node, a respective identifier associated with each node of the plurality of nodes; and based on the authentication, assign a complex identifier to a complex comprising the plurality of nodes, wherein the complex identifier comprises the identifier associated with the controller node.

Abstract: Examples disclosed herein relate to performing an action based on a pre-boot measurement of a firmware image. In an example, at a firmware component in a system, a measurement of a firmware image may be determined prior to booting of the system, beginning from a hardware root of trust boot block, by a Trusted Platform Module (TPM) emulator engine that emulates a hardware-based TPM. A pre-determined measurement of the firmware image may be retrieved from a storage location within the system. The measurement of the firmware image may be compared with the pre-determined measurement of the firmware image prior to booting of the system. In response to a determination that the measurement of the firmware image is different from the pre-determined measurement of the firmware image, performing an action.

Abstract: A technique includes detecting a presence of a hardware security module in a computer. The hardware security module performs trusted computing base measurements in response to the boot of the computer. The technique includes detecting an intention to change firmware of the computer and regulating providing a message warning about an impact of the change based on the determination. The regulation includes determining whether an operating system of the computer binds operations to the trusted computing base measurements and allowing communication of the message based on the determination.

Abstract: In exemplary aspects described herein, system memory is secured using protected memory regions. Portions of a system memory are assigned to endpoint devices, such as peripheral component interconnect express (PCIe) compliant devices. The portions of the system memory can include protected memory regions. The protected memory regions of the system memory assigned to each of the endpoint devices are configured to control access thereto using device identifiers and/or process identifiers, such as a process address space ID (PASID). When a transaction request is received by a device, the memory included in that request is used to determine whether it corresponds to a protected memory region. If so, the transaction request is executed if the identifiers in the request match the identifiers for which access is allowed to that protected memory region.

Abstract: In some examples, a system receives input information relating to a security level for an information technology (IT) stack comprising a plurality of layers including a hardware layer and a software layer, where the input information is technology and product agnostic. The system discovers components of the plurality of layers of the IT stack, accesses a knowledge base that maps the security level and the discovered components to configuration instructions relating to security controls, and configures the IT stack with the security controls using the configuration instructions.

Abstract: In exemplary aspects described herein, system memory is secured using protected memory regions. Portions of a system memory are assigned to endpoint devices, such as peripheral component interconnect express (PCIe) compliant devices. The portions of the system memory can include protected memory regions. The protected memory regions of the system memory assigned to each of the endpoint devices are configured to control access thereto using device identifiers and/or process identifiers, such as a process address space ID (PASID). When a transaction request is received by a device, the memory included in that request is used to determine whether it corresponds to a protected memory region. If so, the transaction request is executed if the identifiers in the request match the identifiers for which access is allowed to that protected memory region.

Abstract: Examples disclosed herein relate to performing an action based on a pre-boot measurement of a firmware image. In an example, at a firmware component in a system, a measurement of a firmware image may be determined prior to booting of the system, beginning from a hardware root of trust boot block, by a Trusted Platform Module (TPM) emulator engine that emulates a hardware-based TPM. A pre-determined measurement of the firmware image may be retrieved from a storage location within the system. The measurement of the firmware image may be compared with the pre-determined measurement of the firmware image prior to booting of the system. In response to a determination that the measurement of the firmware image is different from the pre-determined measurement of the firmware image, performing an action.

Abstract: An example computing system in accordance with an aspect of the present disclosure includes a first controller and a second controller. The first controller is to verify integrity of a first root of trust (ROT), and generate an integrity signal indicating the results. The second controller is to verify integrity of a second ROT, write the firmware image to the first controller, and verify integrity of the written firmware image.

Abstract: Various examples described herein provide for firmware verification on a peripheral device that can couple to a computing device. Before operating firmware is executed on the peripheral device, boot firmware can execute on the peripheral device and cause the peripheral device to generate a hash of the operating firmware. The peripheral device can transmit the hash to a validator external to the peripheral device, such as a management processor. The peripheral device can receive, from the validator, a validation decision based on the transmitted hash. In response to the validation decision indicating invalidity of the operating firmware, the peripheral device can execute recovery firmware to cause the peripheral device to retrieve replacement firmware. Depending on the example, the retrieved replacement firmware may replace the operating firmware or the operating firmware may be updated based on the retrieved replacement firmware.

Abstract: In some examples, a computing device includes a data port, device memory to store firmware for the computing device, and verification circuitry. The verification circuitry may override operation of the data port responsive to a determination that firmware verification mode criteria are satisfied. The verification circuitry may also extract firmware data from the device memory for verification of the firmware and provide the firmware data to an external device connected to the computing device through the data port.

Abstract: Examples disclosed herein relate to performing an action based on a pre-boot measurement of a firmware image. In an example, at a firmware component in a system, a measurement of a firmware image may be determined prior to booting of the system, beginning from a hardware root of trust boot block, by a Trusted Platform Module (TPM) emulator engine that emulates a hardware-based TPM. A pre-determined measurement of the firmware image may be retrieved from a storage location within the system. The measurement of the firmware image may be compared with the pre-determined measurement of the firmware image prior to booting of the system. In response to a determination that the measurement of the firmware image is different from the pre-determined measurement of the firmware image, performing an action.

Abstract: Systems and methods for performing operations on memory of a computing device are disclosed. According to an aspect, a method includes storing update data on a first memory of a computing device, wherein the update data comprises data for updating a second memory on the computing device. The method also includes initiating an update mode on the second memory. Further, the method includes suspending an I/O operation of the second memory. The method also includes switching the computing device to a system management mode (SMM) while the second memory is in the update mode. Further, the method includes retrieving the update data from the first memory. The method also includes determining whether the update data is valid. The method also includes resuming the I/O operation of the second memory for updating the second memory based on the retrieved update data in response to determining that the update data is valid.

Abstract: Methods and systems for performing one or more operations on a first computing device are disclosed. A method includes receiving, from a second computing device via a short-range wireless communication, a service session setup request and an identifier of one of the second computing device and an associated user of the second computing device. The method further includes determining whether to authorize the service session setup request based on the identifier. Then in response to determining to authorize the service session setup request, a service session may be established between the first and the second computing devices. The method also includes receiving one or more service instructions that are allowable based on the identifier. The method furthermore includes performing, at the first computing device, the one or more operations based on the service instructions.

Abstract: Various examples described herein provide for firmware verification on a peripheral device that can couple to a computing device. Before operating firmware is executed on the peripheral device, boot firmware can execute on the peripheral device and cause the peripheral device to generate a hash of the operating firmware. The peripheral device can transmit the hash to a validator external to the peripheral device, such as a management processor. The peripheral device can receive, from the validator, a validation decision based on the transmitted hash. In response to the validation decision indicating invalidity of the operating firmware, the peripheral device can execute recovery firmware to cause the peripheral device to retrieve replacement firmware. Depending on the example, the retrieved replacement firmware may replace the operating firmware or the operating firmware may be updated based on the retrieved replacement firmware.

Abstract: In some examples, a computing device includes a data port, device memory to store firmware for the computing device, and verification circuitry. The verification circuitry may override operation of the data port responsive to a determination that firmware verification mode criteria are satisfied. The verification circuitry may also extract firmware data from the device memory for verification of the firmware and provide the firmware data to an external device connected to the computing device through the data port.