Dell Products Inc.

Mini Thottunkal Thankappan

Rama Rao Bisa

Dharma Bhushan Ramaiah

Shinose Abdul Rahiman

Vineeth Radhakrishnan

Chandrashekar Nelogal

Deepaganesh Paulraj

Viswanath Ponnuru

A Anis Ahmed

Kala Sampathkumar

Hiren Kishorbhai Pitroda

Systems and methods update firmware during authentication of a hardware component of an IHS (Information Handling System), where firmware updates are managed by a remote access controller that provides remote management of the IHS. The remote access controller calculates a measurement based on firmware loaded for use by a hardware component of the IHS. Based on the measurement, an integrity of the firmware loaded for use by the hardware component is validated against a reference signature. When the integrity of the firmware is not validated, the hardware component is quarantined. When the integrity of the firmware is successfully validated, the remote access controller determines whether a firmware update is required for the firmware loaded by the hardware component. When a firmware update is required, an integrity of the updated firmware is validated, the updated firmware is loaded by the hardware component and further initialization of the hardware component is allowed.

Systems and methods for updates during firmware authentication

According to embodiments of the present disclosure, systems and methods to advertise Security Protocol and Data Model (SPDM) command timing requirements are provided. According to one embodiment, an Information Handling System (IHS) includes a requester and a responder conforming to a SPDM specification in which the responder is configured with computer-executable logic to, in response to a request from a requester, generate an estimated amount of time to process a SPDM command, and send the estimated amount of time to the requester in response to the request. The requester may then wait the estimated amount of time between sending each of multiple ensuing commands to the responder.

Systems and methods to advertise SPDM command timing requirements

According to embodiments of the present disclosure, systems and methods for SPDM device and BMC pairing are provided. According to one embodiment, an Information Handling System (IHS) includes a Security Protocol and Data Model (SPDM)-enabled device conforming to a SPDM specification, and a Baseboard Management Controller (BMC) configured with computer executable instructions to provision a SPDM identity certificate of the BMC in the SPDM-enabled device, verify that the BMC has been paired with the SPDM-enabled device using the SPDM identity certificate, and when the authentication of the SPDM-enabled device fails, inhibit operation of the SPDM-enabled device in the IHS.

Systems and methods for SPDM device and baseboard management controller (BMC) pairing

According to embodiments of the present disclosure, a Security Protocol and Data Model (SPDM)-enabled device uses a device identity to provide, among other things, a SPDM-based firmware protection system and method that, upon execution by computer-readable instructions, receive, from a requesting device, a request to update the SPDM-enabled device with a software package, and obtain the software package from an online portal. The computer-readable instructions further encrypt the software package with an encryption key, encrypt the encryption key with a device identity certificate of the requesting device, and send the encrypted software package and encrypted encryption key to the requesting device.

SPDM-based firmware protection system and method

According to embodiments of the present disclosure, a Security Protocol and Data Model (SPDM)-enabled device uses a device identity to provide, among other things, storing of warranty information, and a technique to uniquely identify the SPDM-enabled device so that its movement can be tracked. An Information Handling System (IHS) includes a processor and a memory coupled to the processor, the memory having program instructions that, upon execution, cause the IHS to obtain context information associated with the SPDM-enabled device conforming to a SPDM specification, generate an identity certificate including the context information, and store the certificate in a slot of the SPDM-enabled device.

SPDM-enabled device warranty management system and method

Systems and methods provide for SPDM-enabled devices that conform to an SPDM specification. An SPDM-enabled device receives a request to provision a certificate chain on the device and sends an event notification message to a baseboard management controller. The event notification message indicates receipt of a request to provision a certificate chain in a slot on the SPDM-enabled device. The baseboard management controller evaluates the certificate chain against the device manufacturer's certificate profile policy. If the certificate chain is valid, then a validation successful message is sent to the SPDM-enabled device, which in turn sends a certificate provision response to a requesting device. If the certificate chain is not valid, then a validation failure message is sent to the SPDM-enabled device, which causes the SPDM-enabled device to enter a quarantine state.

Trusted and validated platform device certificate provisioning using security protocol data model (SPDM)

Embodiments of the present disclosure provide a firmware update to multiple, similar hardware devices in an Information Handling System (IHS). In an illustrative, non-limiting embodiment, an IHS may include computer-executable instructions to receive a request to perform a firmware update to a plurality of devices, update a first of the plurality of devices with the requested firmware update, and calculate a health score for the first device as a result of the first device being updated. Based upon the health score, the system and method may determine whether to update the other devices based at least in part, on the determined health score, and update the other devices based on the determination.

Systems and methods for performing health score-based firmware updates

According to embodiments of the present disclosure, an Information Handling System (IHS) includes a plurality of Security Protocol and Data Model (SPDM)-enabled devices conforming to a SPDM specification, and instructions stored in a memory and executable by a processor to communicate with the SPDM-enabled devices to derive a trust score for each of the SPDM-enabled devices, and perform one or more optimization actions to optimize an overall security state of the IHS.

Systems and methods for security state optimization of SPDM-enabled devices

Systems and methods provide one or more host processor modules configured to host SPDM-enabled hardware devices, and a secure control module configured to host two or more baseboard management controllers. Each of the baseboard management controllers are configured to discover the SPDM-enabled hardware devices using SPDM messages, negotiate with at least one other baseboard management controller for access to individual ones of the SPDM-enabled hardware devices, and manage selected ones of the SPDM-enabled hardware devices.

System-level service discovery in a multi-baseboard management controller (BMC) environment

According to embodiments of the present disclosure, systems and methods to provide pre-deployment assessment for device integrity are disclosed. The pre-deployment assessment systems and methods include computer-executable instructions to identify a Security Protocol and Data Model (SPDM)-enabled device conforming to a SPDM specification, obtain one or more identifying parameters and one or more critical parameters from the SPDM-enabled device, and communicate with a server to obtain information about the SPDM-enabled device without sending any critical information to the server. The instructions then determine whether the SPDM-enabled device is authorized for use in the IHS by comparing the identifying parameters with the information obtained from the server, and when the SPDM-enabled device is authorized for use with the IHS, send the critical parameters to the server. However, when the SPDM-enabled device is not authorized for use with the IHS, the instructions inhibit sending of the critical parameters to the server.

Systems and methods to provide pre-deployment assessment for device integrity

Systems and methods provide an Information Handling System (IHS) comprising one or more host processor modules configured to host pluggable hardware devices and a secure control module configured to host a baseboard management controller. The baseboard management controller obtain an SPDM alias certificate from at least one pluggable hardware device, and retrieve an extended reality content link from the SPDM alias certificate and an error code database from the SPDM alias certificate. The extended reality content link may include one or more of a virtual reality content link, an augmented reality content link, and a mixed reality content link. The extended reality content link comprises a URL or address where virtual, augmented, or mixed reality content associated with the at least one pluggable hardware device is available. The error code database identifies error states associated with the at least one pluggable hardware device.

Extended reality assistance provided via security protocol data model (SPDM)

According to embodiments of the present disclosure, systems and methods to manage Security Protocol and Data Model (SPDM) secure communication sessions are provided. According to one embodiment, an Information Handling System (IHS) includes a Security Protocol and Data Model (SPDM)-enabled device conforming to a SPDM specification in which the SPDM-enabled device has a specified quantity of supported private communication sessions. The IHS also includes computer-executable instructions to, when an application requests use of one of the private communication sessions, determine whether one of the private communication sessions is available, and enable the application to communicate with the SPDM-enabled device through the one private communication session based on the determination.

Systems and methods to manage security protocol and data model (SPDM) secure communication sessions

According to embodiments of the present disclosure, a dynamic key distribution system is provided. The dynamic key distribution includes computer-executable instructions to encrypt, using a first Security Protocol and Data Model (SPDM)-enabled device conforming to a SPDM specification, an original Pre-Shared Key (PSK) with a SPDM identity certificate of the first SPDM-enabled device, wherein the original PSK is associated with a second SPDM-enabled device. The instructions are also configured to provision the encrypted PSK in the second SPDM-enabled device, and authenticate the second SPDM-enabled device by decrypting the encrypted PSK to obtain the original PSK using an SPDM protocol.

Systems and methods for key distribution of low end SPDM devices

Systems and methods provide thermal monitoring during updates to firmware used by managed hardware of an Information Handling System (IHS). A remote access controller of the IHS, that operates separate from CPUs of the IHS, initiates a firmware update for a hardware component via a bus mastered by the remote access controller. Except for transmissions in support of the firmware update, communications on the bus are blocked. While communications on the bus are blocked, a request is detected for transmission of a portion of the firmware update to the hardware component. A time is determined for responding to the request. Prior to the time for responding, a second of the hardware components of the IHS that shares the bus mastered by the remote access controller is polled for thermal data. During the firmware update of the hardware component, closed-loop cooling of the IHS is provided using the thermal data.

Systems and methods for thermal monitoring during firmware updates

According to embodiments of the present disclosure, an Information Handling System (IHS), systems and methods for identifying firmware versions of a firmware image using SPDM alias certificates are disclosed. In one embodiment, an IHS includes a Security Protocol and Data Model (SPDM)-enabled device conforming to a SPDM specification, and computer-executable instructions to receive a request to attest a firmware image, generate an alias certificate using a hash of the firmware and version information associated with the firmware in response to the request, and using the alias certificate, attest the version of the firmware image using the version information.

Growing community of inventors

Bengaluru, India

Mini Thottunkal Thankappan