Dell Products Inc.

Jason Matthew Young

Marshal F Savage

Mukund Purshottam Khatri

A Anis Ahmed

Viswanath Ponnuru

Charles D Robison

Chandrashekar Nelogal

Wei G Liu

Vinay Sawal

Muzhar S Khokhar

Daniel E Cummins

Eugene David Cho

Anurag Sharma

Sanjeev Dambal

Harmeet Singh

Wayne Robert Weilnau, Jr

Sreeram Veluthakkal

Huijun Xie

Aaron M Randall

Gowree Sankara Rao Kurmana

Balakrishna Padhy

Systems and methods are provided for validation of the transfer of hardware components between two different IHSs (Information Handling Systems). During factory provisioning of the two IHSs, a factory-signed inventory certificate is uploaded to each IHS that identifies factory-installed hardware of the respective IHS. This inventory certificate is used to validate that the detected hardware of each IHS is genuine factory-installed hardware. When a discrepancy is detected during these validations, each IHS notifies a certificate management system. If the certificate management system receives discrepancy notifications from two IHSs that correspond to an authorized transfer of hardware components between these IHSs, delta certificates are generated for use by each IHS in validating these changes to the factory-installed hardware in each respective IHS.

Validation of component transfers between information handling systems

A system can receive an untrusted onboard announcement message from a remote computer. The system can, based on the untrusted onboard announcement message, initiate an onboarding service policy to verify a device location claims policy associated with the remote computer. The system can receive an indication of a remote access controller hardware component of the remote computer, wherein the indication is of verifying a network port authentication policy applicable to determine whether a port-based network access control protocol certificate hostname that is associated with the remote computer matches an entity attestation token attribute extensible authentication protocol-transport layer platform certificate hostname of the remote access controller hardware component to determine a network authentication status. The system can determine whether device onboard location is successful based on a device location verification policy status and the indication.

Location aware trusted cloud resource provisioning

Embodiments of systems and methods to provide a firmware update to devices configured in a redundant configuration in an Information Handling System (IHS) are disclosed. In an illustrative, non-limiting embodiment, an IHS may include computer-executable instructions to receive a request for a secret known by the IHS, and attest the RAC by verifying that the public key exists in a manifest that is configured to store identifying information about a plurality of devices configured in the IHS. The request is signed using a private key of a first asymmetric key pair generated by a Remote Access Controller (RAC). Using a second public key of a second asymmetric key pair, the instructions encrypt the requested secret; and send the encrypted secret to the RAC, wherein the RAC is configured to use the second private key of the second asymmetric key pair to decrypt the encrypted secret.

Systems and methods for secure secret provisioning of remote access controllers

Systems and procedures are provided for validating an IHS (Information Handling System) as operating using only factory-provisioned I/O ports. During factory provisioning of the IHS, a signed inventory certificate that includes an inventory of factory-provisioned I/O ports of the IHS is uploaded to the IHS. Upon delivery and initialization of the IHS, the inventory certificate is retrieved by a pre-boot validation process. An inventory of detected I/O ports of the IHS is then collected. The validation process compares the collected inventory of detected I/O ports against the inventory of factory-provisioned I/O ports from the inventory certificate in order to validate the IHS is operating using only factory-provisioned I/O ports. Through embodiments, any I/O ports of the IHS other than the I/O ports validated as factory-provisioned are not usable by any software or hardware of the IHS.

Physical port validation for information handling systems

Various embodiments provide methods for validating secure assembly and delivery of an IHS (Information Handling System) by confirming that the detected hardware components of the IHS include only factory installed hardware components. During factory provisioning of an IHS, an inventory certificate is uploaded to the IHS, where the inventory certificate includes an inventory that identifies the hardware components installed during factory assembly of the IHS. An inventory is collected of the detected hardware components of the IHS. The collected inventory is compared against the inventory from the inventory certificate in order to validate the detected hardware components of the IHS as the same hardware components that were installed during factory assembly of the IHS. Embodiments provide a customer receiving an IHS with a capability of validating that a delivered IHS includes only factory installed hardware components.

Validating secure assembly and delivery of information handling systems

A voucher management system receives, from a computing device manufacturer system, an ownership voucher that transfers ownership of a computing device from the computing device manufacturer system to the voucher management system, and a hardware attestation certificate for the computing device, and associates them with the computing device in a voucher management database. When the voucher management system determines that the ownership of the computing device should be transferred to an end user system, it automatically generates second ownership transfer data by signing an end user system public key with a voucher management system private key, provides the second ownership transfer data in the ownership voucher in order to transfer ownership of the computing device from the voucher management system to the end user system, and provides the ownership voucher and the hardware attestation certificate to the end user system.

Fast identity online (FIDO) device onboarding (FDO) protocol computing device hardware attestation system

Systems and procedures are provided for tracking hardware components of an IHS (Information Handling System). During factory provisioning of an IHS, an inventory certificate to the IHS is stored to the IHS that includes an inventory identifying factory-installed hardware components of the IHS. Also during the factory provisioning, a record is stored in a component datastore of the factory-installed hardware specified in the inventory certificate. Upon initialization of the delivered IHS, a pre-boot validation environment is initialized on the IHS and the stored inventory certificate is retrieved and used to validate the detected hardware components of the IHS. The results of the validation are then reported to a component datastore, where they are used to identify any transfer of a factory-installed hardware component. The factory datastore is updated in subsequent validations to reflect any detected modifications to the IHS in tracking genuine components.

Component tracking for information handling systems

A system for verifying unique components are installed in an end user information handling system comprises a manufacturing facility collecting component information into a data structure, encrypting the data structure, creating a secured component verification (SCV) certificate, signing the SCV certificate and communicating the SCV certificate to a repository, the repository storing the signed SCV certificate. A copy of the signed SCV certificate is saved onto the information handling system. When the information handling system is delivered, the copy of the SCV certificate is compared with the SCV certificate stored in the repository. If they match, the information handling system is verified. If a unique component is replaced, a delta certificate is created and stored with the original SCV certificate in the repository such that all changes to unique components in the information handling system are tracked.

System and method for secured shipment verification and component forensic tracking

Methods and system are provided for validating the secure assembly and delivery of an IHS (Information Handling System). During factory provisioning of the IHS, an inventory certificate is uploaded to the IHS. The certificate includes: an inventory of hardware components installed during factory assembly of the IHS, validation schemas the provide instructions for identifying the hardware components, and digital signatures used to confirm the integrity of the validation schemas. Upon delivery of the IHS, a validation process retrieves the inventory certificate and confirms the integrity of the validation schemas. Based on validation schema instructions, the validation process collects an inventory of the detected IHS hardware. The validation schema instructions are further used to compare the collected inventory against the inventory from the inventory certificate in order to validate the detected hardware components of the IHS as the same hardware components installed during factory assembly of the IHS.

Secure data collection for validation of installed components of information handling systems

Methods and systems are provided for validating and registering an IHS (Information Handling System) and components of the IHS for technical support. Upon delivery and initialization of an IHS, an inventory certificate that was uploaded to the IHS during factory provisioning of the IHS is retrieved. The inventory certificate includes an inventory that identifies factory-installed hardware components in the IHS. The inventory also specifies whether a registration requirement has been specified for the IHS, such as to initiate technical support. While still operating a pre-boot validation process, an inventory is collected of the detected hardware components of the IHS. Based on the inventory certificate, the validation process confirms whether a detected hardware component is a factory-installed hardware component and determines whether registration is required. If required, registration of the IHS is initiated by the validation process and initialization of the IHS continues.

Validation and registration for information handling systems

Various embodiments provide methods for validating hardware modifications of an IHS (Information Handling System) by confirming that a hardware modification corresponds to a hardware component supplied for installation in the IHS by a trusted entity. During factory provisioning of an IHS, an inventory certificate that specifies the factory installed IHS hardware is uploaded to the IHS and is also stored for ongoing support of the IHS. Upon a hardware component being supplied for installation in the IHS by a trusted entity, the inventory of the stored inventory certificate is updated to identify the supplied component and the updated certificate is transmitted to the IHS. An inventory of detected hardware components of the IHS is compared against the inventory from the updated inventory certificate in order to validate the detected hardware of the IHS includes the component, supplied by the trusted entity, that is identified in the updated inventory certificate.

Validating secure modifications to information handling systems

Systems and procedures are provided for enforcing geographic restrictions on the operation of an IHS (Information Handling System). During factory provisioning of the IHS, a signed inventory certificate is uploaded to the IHS that specifies a plurality of allowed geographic locations at which the IHS is operational. Upon delivery and initial powering of the IHS, a validation environment is instantiated and further initialization of the IHS is halted until a location of the IHS can be determined. Once a geographic location of the IHS has been determined, it is compared to the allowed geographic locations from the inventory certificate stored during factory provisioning. When the location of the IHS is not at an allowed geographic location specified in the inventory certificate, the IHS is rendered non-operational. When the location of the IHS is at an allowed geographic location specified in the inventory certificate, further initialization of the IHS is enabled.

Geographic restrictions for information handling systems

System and method are provided for assigning a service identifier for use by an IHS (Information Handling System), where a new service identifier may be assigned to the IHS due to replacement of hardware of the IHS. The IHS is provisioned with an inventory certificate that identifies hardware components of the IHS, including a service identifier for the IHS. Support provided for the IHS is tracked based on this service identifier. A hardware component of the IHS is removed, where the service identifier is assigned to this removed hardware component. A replacement hardware component is installed in the IHS. An updated inventory certificate is generated that assigns a new service identifier to the replacement hardware component installed in the IHS. The IHS is provisioned with the updated inventory certificate that specifies the new service identifier. Support provided for the IHS is now tracked based on the new service identifier.

Assignment of service identity for information handling systems

Systems and methods provide validation of hardware components of an IHS (Information Handling System). An attestation certificate stored to the IHS specifies authenticated instructions for operation of a hardware component of the IHS. This attestation certificate is endorsed by a self-signed root attestation certificate. An identity certificate, also stored to the IHS, specifies an identity of the hardware component and is endorsed using an embedded keypair of the hardware component. The root attestation certificate is validated to ensure it corresponds to the hardware component specified in the identity certificate, where this validation confirms that a public key included in the identity certificate is identical to a public key included in the attestation certificate. Through use of the same public key by both certificates, the attestation certificate can be validated as corresponding to the identity certificate without accessing the embedded keypair of the hardware component used to sign the identity certificate.

Split chain of digital certificates for supply chain integrity

Embodiments provide methods for validating secure delivery of an IHS (Information Handling System) by confirming that the packages by which the IHS was delivered include only the packages used to ship the IHS from a factory or other trusted entity. During factory provisioning of the IHS, a shipping certificate is uploaded to the IHS, where the certificate includes shipping identifiers that are each associated with a package used to ship the IHS. Upon receiving packages by which the IHS has been shipped, shipping identifiers, such as bar codes and RFID codes, are collected from the received packages. The shipping identifiers collected from the received packages are compared against the shipping identifiers from the shipping certificate in order to validate the plurality of received packages as the same packages that were used to ship the IHS.

Growing community of inventors

Round Rock, TX, United States of America

Jason Matthew Young