Hewlett Packard Enterprise Development LP

Darrell R Haskell

Nigel John Edwards

Ludovic Emmanuel Paul Noel Jacquin

Kevin G Depew

Luis E Luciani, Jr

Thomas M Laffey

Blaine R Southam

James T Bodner

Guilherme De Campos Magalhaes

Kairo Cesar Pinto Tavares

David Blocker

Nicholas Mark Hawkins

Thomas E Kessler

Walton A Rosen

Timothy Pletcher

John S Harsany

Thomas Kessler

Systems and methods are provided for agentless attestation. Agentless attestation can measure the integrity of customer servers without requiring an agent software program to be downloaded to each of the enterprise computer devices. In particular, the system can integrate several standalone components to measure the integrity of monitored devices. This also allows the data center to authenticate, verify, audit, and update any hardware change, including a Platform Certificate.

Agentless attestation as a service

A computer platform includes a security processor; at least one hardware processor; and a memory. The security processor stores data representing a private platform key. The private platform key is part of an asymmetric pair of keys, and the asymmetric pair of keys includes a public platform key. The memory stores a firmware image. The firmware image includes data representing a root certificate of a public key infrastructure that signs a second certificate that is associated with the computer platform. The second certificate includes the public platform key and binding information binding the second certificate to the computer platform. The firmware image includes instructions that, when executed by the hardware processor(s), cause the hardware processor(s) to access data representing the second certificate and determine whether the second certificate is valid based on the root certificate and the binding information. The instructions, when executed by the hardware processor(s), further cause the hardware processor(s) to, responsive to determining that the second certificate is valid, use the public platform key to secure communication with the security processor.

Securing communications with security processors using platform keys

In some examples, an electronic device includes a component comprising information, a secure storage, and a controller to generate a digital signature based on the information of the component, and detect a modification of the component based on the digital signature. The controller can also detect a receipt of an invalid credential, and log, to the secure storage, an indication of the modification of the component and an indication of the receipt of the invalid credential.

Logging modification indications for electronic device components

Examples disclosed herein relate to a computing device that includes a central processing unit, a management controller separate from the central processing unit, and a security co-processor. The management controller is powered using an auxiliary power rail that provides power to the management controller while the computing device is in an auxiliary power state. The security co-processor includes device unique data. The management controller receives the device unique data and stores a representation at a secure location. At a later time, the management controller receives endorsement information from an expected location of the security co-processor. The management controller determines whether to perform an action on the computing device based on an analysis of the endorsement information and the stored representation of the device unique data.

Determine whether to perform action on computing device based on analysis of endorsement information of a security co-processor

Example implementations relate to automatic diagnostic mode to identify a potential cause of a boot problem of a system. In an example, the automatic diagnostic mode iteratively isolates subsystems of the system in coordination with a baseboard management controller. For each iteration of subsystem isolation, a system boot is executed while a subsystem is isolated. The system boot is monitored against a watchdog timer of the baseboard management controller to determine if the system boot is successful. If the system boot is successful, the isolated subsystem is marked as a potential cause of the boot problem of the system. If the system boot is unsuccessful, the automatic diagnostic mode continues to iteratively isolate the subsystems.

Automatic diagnostic mode to determine potential cause of boot problem

Growing community of inventors

Houston, TX, United States of America

Darrell R Haskell