Abstract: According to embodiments of the present disclosure, a certificate caching system and method is provided using Security Protocol and Data Model (SPDM)-enabled Baseboard Management Controller (BMC). The system time verification system and method include program instructions that may be executed on an Information Handling System (HIS) to obtain a certificate from a SPDM-enabled device configured in a target computing device, identify a cache associated with the target computing device, determine whether the certificate is a hardware bound certificate, and store the certificate in the cache based upon the determination.

Abstract: Systems and methods are provided for supporting validation of flexible configurations of hardware components installed in IHSs (Information Handling Systems). During factory provisioning of an IHS, a factory-signed inventory certificate is uploaded to the IHS that identifies factory-installed hardware of the IHS, and that also includes designations for each of the factory-installed hardware components as required or optional components. Upon deployment of the IHS, validation procedures of the IHS use the inventory certificate to validate the detected IHS hardware as factory-installed hardware. When a hardware component specified in the inventory certificate as optional is not present in the detected hardware components, booting of the IHS may continue. When a hardware component specified in the inventory certificate as required is not present in the detected hardware components, a validation failure is signaled.

Abstract: A management-subsystem-based software RAID configuration system includes a chassis housing storage devices that each include a respective storage device memory subsystem and that are each coupled to a management subsystem and a software RAID subsystem. The software RAID subsystem uses the storage devices to create a RAID.

Abstract: According to embodiments of the present disclosure, trust scores and related recommendations may be generated for an Information Handling System (IHS) with multiple Security Protocol and Data Model (SPDM)-enabled devices. The trust scores and recommendations may be provided by computer-executable instructions that, when executed by a processor, receive a plurality of trust-based data elements from a plurality of Security Protocol and Data Model (SPDM)-enabled devices conforming to a SPDM specification, and derive an overall trust based score for the IHS based upon the received trust-based data elements. The SPDM-enabled devices are configured in a computing device. The trust-based data element are associated with a plurality of SPDM-based measurements performed on the SPDM-enabled devices.

Abstract: Systems and methods are provided for validation and enforcement of the use of factory-provisioned boot restrictions for the operation of an (Information Handling Systems). During factory provisioning of the IHS, a factory-signed certificate is uploaded to the IHS that identifies the factory-installed hardware of the IHS and any boot restrictions on individual factory-installed hardware, such as restrictions on a hardware component to boot using only factory-provision firmware or the component is to be disabled. Upon deployment of the IHS, validation procedures use an inventory from the certificate to validate the detected IHS hardware as factory-installed. The validation procedures use the boot restriction from the certificate to confirm the detected IHS hardware components are each configured for operation according to the boot restrictions.

Abstract: System and methods are provided for updating firmware used by a managed hardware component of an Information Handling System (IHS). A remote access controller of the IHS, that operates separate from CPUs of the IHS and that provides remote management of the IHS, initiates an update of firmware used to operate the hardware component. A programmable hardware accelerator is detected within an inventory of managed hardware components of the IHS. Availability of the hardware accelerator is determined for transmission of data to the hardware component. Transmission of a firmware image to the hardware component is delegated to the hardware accelerator, providing faster transmission of the firmware image than would be possible by the remote access controller. Upon transmission of the firmware image by the hardware accelerator, the firmware of the hardware component is updated using the firmware image transmitted by the hardware accelerator.

Abstract: Systems and methods are provided for validation and enforcement of the use of factory-provisioned geographic restrictions for the operation of certain hardware components of IHSs (Information Handling Systems). During factory provisioning of the IHS, a factory-signed certificate is uploaded to the IHS that identifies the factory-installed hardware of the IHS and any geographic restrictions on those individual hardware components, such as restrictions that limit the operation of specialized hardware to a particular data center. Upon deployment of the IHS, validation procedures use an inventory from the certificate to validate the detected IHS hardware as factory-installed. The validation procedures use the geographic restriction from the certificate to confirm the detected IHS hardware is configured to operate at the location at which the IHS is operation.

Abstract: A RAID integrity verification system includes a chassis housing a software RAID subsystem that is coupled to storage devices and configured to provide a logical storage device using the storage devices. A management subsystem in the chassis is coupled to the storage devices and retrieves first RAID configuration information associated with the logical storage device from each of the storage devices and uses it to generate a first RAID logical storage device integrity verification measurement block. Subsequently, the management subsystem retrieves second RAID configuration information associated with the logical storage device from each of the storage devices and uses it to generate a second RAID logical storage device integrity verification measurement block.

Abstract: According to embodiments of the present disclosure, systems and methods to advertise Security Protocol and Data Model (SPDM) command timing requirements are provided. According to one embodiment, an Information Handling System (IHS) includes a requester and a responder conforming to a SPDM specification in which the responder is configured with computer-executable logic to, in response to a request from a requester, generate an estimated amount of time to process a SPDM command, and send the estimated amount of time to the requester in response to the request. The requester may then wait the estimated amount of time between sending each of multiple ensuing commands to the responder.

Abstract: According to embodiments of the present disclosure, systems and methods for SPDM device and BMC pairing are provided. According to one embodiment, an Information Handling System (IHS) includes a Security Protocol and Data Model (SPDM)-enabled device conforming to a SPDM specification, and a Baseboard Management Controller (BMC) configured with computer executable instructions to provision a SPDM identity certificate of the BMC in the SPDM-enabled device, verify that the BMC has been paired with the SPDM-enabled device using the SPDM identity certificate, and when the authentication of the SPDM-enabled device fails, inhibit operation of the SPDM-enabled device in the IHS.

Abstract: According to embodiments of the present disclosure, a Security Protocol and Data Model (SPDM)-enabled device uses a device identity to provide, among other things, a SPDM-based firmware protection system and method that, upon execution by computer-readable instructions, receive, from a requesting device, a request to update the SPDM-enabled device with a software package, and obtain the software package from an online portal. The computer-readable instructions further encrypt the software package with an encryption key, encrypt the encryption key with a device identity certificate of the requesting device, and send the encrypted software package and encrypted encryption key to the requesting device.

Abstract: According to embodiments of the present disclosure, a Security Protocol and Data Model (SPDM)-enabled device uses a device identity to provide, among other things, storing of warranty information, and a technique to uniquely identify the SPDM-enabled device so that its movement can be tracked. An Information Handling System (IHS) includes a processor and a memory coupled to the processor, the memory having program instructions that, upon execution, cause the IHS to obtain context information associated with the SPDM-enabled device conforming to a SPDM specification, generate an identity certificate including the context information, and store the certificate in a slot of the SPDM-enabled device.

Abstract: Systems and methods provide for SPDM-enabled devices that conform to an SPDM specification. An SPDM-enabled device receives a request to provision a certificate chain on the device and sends an event notification message to a baseboard management controller. The event notification message indicates receipt of a request to provision a certificate chain in a slot on the SPDM-enabled device. The baseboard management controller evaluates the certificate chain against the device manufacturer's certificate profile policy. If the certificate chain is valid, then a validation successful message is sent to the SPDM-enabled device, which in turn sends a certificate provision response to a requesting device. If the certificate chain is not valid, then a validation failure message is sent to the SPDM-enabled device, which causes the SPDM-enabled device to enter a quarantine state.

Abstract: An Information Handling System (IHS) includes multiple hardware devices, and a baseboard Management Controller (BMC) in communication with the plurality of hardware devices. The BMC includes executable instructions for monitoring the operating characteristics a hardware device that is operating in a fixed pass-through configuration with a workspace in which the workspace has been instantiated by a workspace orchestration service executed on the IHS. The executable instructions may determine that the operating characteristics are indicative of a security breach of the fixed pass-through configuration, and as such, may perform an operation to quarantine the one hardware device when the fixed pass-through configuration is determined to possess the security breach.

Abstract: Embodiments of the present disclosure provide a firmware update to multiple, similar hardware devices in an Information Handling System (IHS). In an illustrative, non-limiting embodiment, an IHS may include computer-executable instructions to receive a request to perform a firmware update to a plurality of devices, update a first of the plurality of devices with the requested firmware update, and calculate a health score for the first device as a result of the first device being updated. Based upon the health score, the system and method may determine whether to update the other devices based at least in part, on the determined health score, and update the other devices based on the determination.

Abstract: According to embodiments of the present disclosure, an Information Handling System (IHS) includes a plurality of Security Protocol and Data Model (SPDM)-enabled devices conforming to a SPDM specification, and instructions stored in a memory and executable by a processor to communicate with the SPDM-enabled devices to derive a trust score for each of the SPDM-enabled devices, and perform one or more optimization actions to optimize an overall security state of the IHS.

Abstract: According to embodiments of the present disclosure, systems and methods to provide pre-deployment assessment for device integrity are disclosed. The pre-deployment assessment systems and methods include computer-executable instructions to identify a Security Protocol and Data Model (SPDM)-enabled device conforming to a SPDM specification, obtain one or more identifying parameters and one or more critical parameters from the SPDM-enabled device, and communicate with a server to obtain information about the SPDM-enabled device without sending any critical information to the server. The instructions then determine whether the SPDM-enabled device is authorized for use in the IHS by comparing the identifying parameters with the information obtained from the server, and when the SPDM-enabled device is authorized for use with the IHS, send the critical parameters to the server.

Abstract: Systems and methods are provided for validation and enforcement of the use of factory-provisioned geographic restrictions for the operation of certain hardware components of IHSs (Information Handling Systems). During factory provisioning of the IHS, a factory-signed certificate is uploaded to the IHS that identifies the factory-installed hardware of the IHS and any geographic restrictions on those individual hardware components, such as restrictions that limit the operation of specialized hardware to a particular data center. Upon deployment of the IHS, validation procedures use an inventory from the certificate to validate the detected IHS hardware as factory-installed. The validation procedures use the geographic restriction from the certificate to confirm the detected IHS hardware is configured to operate at the location at which the IHS is operation.

Abstract: Systems and methods are provided for validation and enforcement of the use of factory-provisioned boot restrictions for the operation of an (Information Handling Systems). During factory provisioning of the IHS, a factory-signed certificate is uploaded to the IHS that identifies the factory-installed hardware of the IHS and any boot restrictions on individual factory-installed hardware, such as restrictions on a hardware component to boot using only factory-provision firmware or the component is to be disabled. Upon deployment of the IHS, validation procedures use an inventory from the certificate to validate the detected IHS hardware as factory-installed. The validation procedures use the boot restriction from the certificate to confirm the detected IHS hardware components are each configured for operation according to the boot restrictions.

Abstract: Systems and methods are provided for validated transfer of replaceable hardware components within a computing cluster comprised of multiple IHSs (Information Handling Systems), such as rack-mounted servers. During factory provisioning of the IHS, a factory-signed inventory certificate is uploaded to each IHS that identifies factory-installed hardware of the IHS. This inventory certificate is used to validate that the detected hardware of the IHS is genuine factory-installed hardware. Upon a successful validation of detected hardware by an IHS, a cluster management console is notified. Based on the notifications of validated hardware by the IHS, the cluster management console identifies replaceable hardware components installed within IHSs that are members of the computing cluster. The cluster management console generates a delta certificate that authorizes operation by the IHS of the replaceable hardware components installed within IHSs that are members of the computing cluster.