Abstract: According to embodiments of the present disclosure, systems and methods to provide pre-deployment assessment for device integrity are disclosed. The pre-deployment assessment systems and methods include computer-executable instructions to identify a Security Protocol and Data Model (SPDM)-enabled device conforming to a SPDM specification, obtain one or more identifying parameters and one or more critical parameters from the SPDM-enabled device, and communicate with a server to obtain information about the SPDM-enabled device without sending any critical information to the server. The instructions then determine whether the SPDM-enabled device is authorized for use in the IHS by comparing the identifying parameters with the information obtained from the server, and when the SPDM-enabled device is authorized for use with the IHS, send the critical parameters to the server.

Abstract: Systems and methods are provided for validation and enforcement of the use of factory-provisioned geographic restrictions for the operation of certain hardware components of IHSs (Information Handling Systems). During factory provisioning of the IHS, a factory-signed certificate is uploaded to the IHS that identifies the factory-installed hardware of the IHS and any geographic restrictions on those individual hardware components, such as restrictions that limit the operation of specialized hardware to a particular data center. Upon deployment of the IHS, validation procedures use an inventory from the certificate to validate the detected IHS hardware as factory-installed. The validation procedures use the geographic restriction from the certificate to confirm the detected IHS hardware is configured to operate at the location at which the IHS is operation.

Abstract: Systems and methods are provided for validation and enforcement of the use of factory-provisioned boot restrictions for the operation of an (Information Handling Systems). During factory provisioning of the IHS, a factory-signed certificate is uploaded to the IHS that identifies the factory-installed hardware of the IHS and any boot restrictions on individual factory-installed hardware, such as restrictions on a hardware component to boot using only factory-provision firmware or the component is to be disabled. Upon deployment of the IHS, validation procedures use an inventory from the certificate to validate the detected IHS hardware as factory-installed. The validation procedures use the boot restriction from the certificate to confirm the detected IHS hardware components are each configured for operation according to the boot restrictions.

Abstract: Systems and methods are provided for validated transfer of replaceable hardware components within a computing cluster comprised of multiple IHSs (Information Handling Systems), such as rack-mounted servers. During factory provisioning of the IHS, a factory-signed inventory certificate is uploaded to each IHS that identifies factory-installed hardware of the IHS. This inventory certificate is used to validate that the detected hardware of the IHS is genuine factory-installed hardware. Upon a successful validation of detected hardware by an IHS, a cluster management console is notified. Based on the notifications of validated hardware by the IHS, the cluster management console identifies replaceable hardware components installed within IHSs that are members of the computing cluster. The cluster management console generates a delta certificate that authorizes operation by the IHS of the replaceable hardware components installed within IHSs that are members of the computing cluster.

Abstract: Systems and methods are provided for event-based generation of delta certificates for validation of modifications to IHSs (Information Handling Systems), such as rack-mounted servers. During factory provisioning of the IHS, a factory-signed inventory certificate is uploaded to the IHS that identifies factory-installed hardware of the IHS and that also specifies cryptographic identification that are available for any these factory-installed hardware components. This inventory certificate is used to validate that the detected hardware of the IHS is genuine factory-installed hardware. Once validated, a remote access controller of the IHS initiates monitoring for cryptographic events that affect the ability to validate any of the factory-installed hardware. Upon detecting a cryptographic event, the remote access controller generates a delta certificate for validating components affected by the cryptographic event.

Abstract: Systems and methods are provided for supporting validation of flexible configurations of hardware components installed in IHSs (Information Handling Systems). During factory provisioning of an IHS, a factory-signed inventory certificate is uploaded to the IHS that identifies factory-installed hardware of the IHS, and that also includes designations for each of the factory-installed hardware components as required or optional components. Upon deployment of the IHS, validation procedures of the IHS use the inventory certificate to validate the detected IHS hardware as factory-installed hardware. When a hardware component specified in the inventory certificate as optional is not present in the detected hardware components, booting of the IHS may continue. When a hardware component specified in the inventory certificate as required is not present in the detected hardware components, a validation failure is signaled.

Abstract: According to embodiments of the present disclosure, systems and methods to manage Security Protocol and Data Model (SPDM) secure communication sessions are provided. According to one embodiment, an Information Handling System (IHS) includes a Security Protocol and Data Model (SPDM)-enabled device conforming to a SPDM specification in which the SPDM-enabled device has a specified quantity of supported private communication sessions. The IHS also includes computer-executable instructions to, when an application requests use of one of the private communication sessions, determine whether one of the private communication sessions is available, and enable the application to communicate with the SPDM-enabled device through the one private communication session based on the determination.

Abstract: A software RAID/management communication system includes a chassis housing a software Redundant Array of Independent Disk (RAID) subsystem and a management subsystem that are each coupled to a storage device having a storage device memory subsystem. The software RAID subsystem provides a software RAID information request in the storage device memory subsystem that requests the management subsystem provide software RAID information associated with the operation of a software RAID provided by the software RAID subsystem, the software RAID subsystem then periodically accesses the storage device memory subsystem and, when the software RAID subsystem determines that the management subsystem has provided a software RAID information response in the storage device memory subsystem, the software RAID subsystem retrieves the software RAID information that was provided in the storage device memory subsystem by the management subsystem.

Abstract: According to embodiments of the present disclosure, a dynamic key distribution system is provided. The dynamic key distribution includes computer-executable instructions to encrypt, using a first Security Protocol and Data Model (SPDM)-enabled device conforming to a SPDM specification, an original Pre-Shared Key (PSK) with a SPDM identity certificate of the first SPDM-enabled device, wherein the original PSK is associated with a second SPDM-enabled device. The instructions are also configured to provision the encrypted PSK in the second SPDM-enabled device, and authenticate the second SPDM-enabled device by decrypting the encrypted PSK to obtain the original PSK using an SPDM protocol.

Abstract: A RAID integrity verification system includes a chassis housing a software RAID subsystem that is coupled to storage devices and configured to provide a logical storage device using the storage devices. A management subsystem in the chassis is coupled to the storage devices and retrieves first RAID configuration information associated with the logical storage device from each of the storage devices and uses it to generate a first RAID logical storage device integrity verification measurement block. Subsequently, the management subsystem retrieves second RAID configuration information associated with the logical storage device from each of the storage devices and uses it to generate a second RAID logical storage device integrity verification measurement block.

Abstract: A software RAID/management communication system includes a chassis housing a software RAID subsystem coupled to a shared memory subsystem and storage devices, and a management subsystem that is coupled to the storage devices, and that is coupled to the shared memory subsystem via an MMBI connection. The management subsystem determines that at least one of the storage devices does not include a storage device memory subsystem that is configured for software RAID/management communications and, in response, transmits MCTP communications via the MMBI connection to retrieve RAID configuration information from the storage device(s) via the software RAID subsystem and the shared memory subsystem. The management subsystem then uses the RAID configuration information to perform at least one RAID management operation on at least one RAID logical storage device provided by the storage device(s).

Abstract: A management-subsystem-based software RAID configuration system includes a chassis housing storage devices that each include a respective storage device memory subsystem and that are each coupled to a management subsystem and a software RAID subsystem. The software RAID subsystem uses the storage devices to create a RAID.

Abstract: A software RAID/management communication system includes a chassis housing a software RAID subsystem coupled to a shared memory subsystem and storage devices, and a management subsystem that is coupled to the storage devices, and that is coupled to the shared memory subsystem via an MMBI connection. The management subsystem determines that at least one of the storage devices does not include a storage device memory subsystem that is configured for software RAID/management communications and, in response, transmits MCTP communications via the MMBI connection to retrieve RAID configuration information from the storage device(s) via the software RAID subsystem and the shared memory subsystem. The management subsystem then uses the RAID configuration information to perform at least one RAID management operation on at least one RAID logical storage device provided by the storage device(s).

Abstract: A software Redundant Array of Independent Disk (RAID)/management trusted storage-device-based communication system includes a chassis housing a software Redundant Array of Independent Disk (RAID) subsystem, a storage device that is coupled to the software RAID subsystem and that includes a storage device memory subsystem, and a management subsystem that is coupled to the storage device. The management subsystem authenticates the storage device to establish management subsystem/storage device trust between the management subsystem and the storage device and, in response, uses the storage device to establish management subsystem/software RAID subsystem trust between the management subsystem and the software RAID subsystem. In response to establishing the management subsystem/storage device trust and the management subsystem/software RAID subsystem trust, the management subsystem transmits communications with the software RAID subsystem via the storage device memory subsystem in the storage device.

Abstract: A resilient software Redundant Array of Independent Disk (RAID)/management communication system includes a chassis housing a software RAID subsystem coupled to a plurality of storage devices that are also coupled to a management subsystem. The software RAID subsystem designates a first storage device in the plurality of storage devices as a primary storage device and a second storage device in the plurality of storage devices as a secondary storage device, and uses the respective storage device memory subsystem in the first storage device to transmit first management communications with the management subsystem. If the software RAID subsystem determines that the first storage device is unavailable, it uses the respective storage device memory subsystem in the second storage device to transmit second management communications with the management subsystem.

Abstract: A software RAID/management communication system includes a chassis housing a software Redundant Array of Independent Disk (RAID) subsystem and a management subsystem that are each coupled to a storage device having a storage device memory subsystem. The software RAID subsystem provides a software RAID information request in the storage device memory subsystem that requests the management subsystem provide software RAID information associated with the operation of a software RAID provided by the software RAID subsystem, the software RAID subsystem then periodically accesses the storage device memory subsystem and, when the software RAID subsystem determines that the management subsystem has provided a software RAID information response in the storage device memory subsystem, the software RAID subsystem retrieves the software RAID information that was provided in the storage device memory subsystem by the management subsystem.

Abstract: A software Redundant Array of Independent Disk (RAID)/management trusted storage-device-based communication system includes a chassis housing a software Redundant Array of Independent Disk (RAID) subsystem, a storage device that is coupled to the software RAID subsystem and that includes a storage device memory subsystem, and a management subsystem that is coupled to the storage device. The management subsystem authenticates the storage device to establish management subsystem/storage device trust between the management subsystem and the storage device and, in response, uses the storage device to establish management subsystem/software RAID subsystem trust between the management subsystem and the software RAID subsystem. In response to establishing the management subsystem/storage device trust and the management subsystem/software RAID subsystem trust, the management subsystem transmits communications with the software RAID subsystem via the storage device memory subsystem in the storage device.

Abstract: A resilient software Redundant Array of Independent Disk (RAID)/management communication system includes a chassis housing a software RAID subsystem coupled to a plurality of storage devices that are also coupled to a management subsystem. The software RAID subsystem designates a first storage device in the plurality of storage devices as a primary storage device and a second storage device in the plurality of storage devices as a secondary storage device, and uses the respective storage device memory subsystem in the first storage device to transmit first management communications with the management subsystem. If the software RAID subsystem determines that the first storage device is unavailable, it uses the respective storage device memory subsystem in the second storage device to transmit second management communications with the management subsystem.

Abstract: Systems and methods provide thermal monitoring during updates to firmware used by managed hardware of an Information Handling System (IHS). A remote access controller of the IHS, that operates separate from CPUs of the IHS, initiates a firmware update for a hardware component via a bus mastered by the remote access controller. Except for transmissions in support of the firmware update, communications on the bus are blocked. While communications on the bus are blocked, a request is detected for transmission of a portion of the firmware update to the hardware component. A time is determined for responding to the request. Prior to the time for responding, a second of the hardware components of the IHS that shares the bus mastered by the remote access controller is polled for thermal data. During the firmware update of the hardware component, closed-loop cooling of the IHS is provided using the thermal data.

Abstract: According to embodiments of the present disclosure, an Information Handling System (IHS), systems and methods for identifying firmware versions of a firmware image using SPDM alias certificates are disclosed. In one embodiment, an IHS includes a Security Protocol and Data Model (SPDM)-enabled device conforming to a SPDM specification, and computer-executable instructions to receive a request to attest a firmware image, generate an alias certificate using a hash of the firmware and version information associated with the firmware in response to the request, and using the alias certificate, attest the version of the firmware image using the version information.