Dell Products Inc.

Dell USA L.p.

Secureworks, Inc.

Mukund Purshottam Khatri

Elie Antoun Jreij

Robert Wayne Hormuth

Jimmy Doyle Pike

Gaurav Chawla

William Price Dawkins

Mark Steven Sanders

Marshal F Savage

Walter A O'Brien, Iii

Timothy Michael Lambert

Eugene David Cho

Jason Matthew Young

Wei G Liu

Chitrak Gupta

Rama Rao Bisa

Yossef Saad

Johan Rahardjo

Sushma Basavarajaiah

Sudhir Vittal Shetty

Kevin Thomas Marks

Muhammed K Jaber

William Carl Munger

Theodore Stratton Webb

Stuart Allen Berke

Robert Boyd Curtis

Bhavesh Govindbhai Patel

Akkiah Choudary Maddukuri

Vijay Bharat Nijhawan

Tuyet-Huong Thi Nguyen

Michael Karl Molloy

Chandrashekar Nelogal

Surender V Brahmaroutu

Manoj Sharad Gujarathi

John Erven Jenne

Paul Theodore Artman

William Sauber

Austin Patrick Bolen

Lee Eric Ballard

John S Loffink

Lee B Zaretsky

Sanjeev Dambal

Robert Talbott Stevens, Iv

Philip Dale Chidester

Damon Earley

Paul Dennis Stultz

George Mathew

Anand Prakash Joshi

Deepaganesh Paulraj

Tyler B Duncan

Indrani Paul

Allen Chester Wynn

Jinsaku Masuyama

Andrew Butcher

Jon R Ramsey

George Gilman Richards, Iii

Cynthia M Merkin

Dirie N Herzi

Mark W Shutt

Kala Sampathkumar

Donald W Gerhart

Jacqueline Hegedus Wilson

Manjunath Am

Michael David Shepherd

Yogesh Varma

Binay A Kuruvila

Sandor Tibor Farkas

Shekar Babu Suryanarayana

Joseph LaSalle White

Shawn Joel Dube

John S Harwood

Yogesh Prabhakar Kulkarni

Mark Mcgrath Bailey

Shyamkumar Thiyagarajan Iyer

Dominick Adam Lovicott

Michael A Brundridge

Chandrasekhar Mugunda

Vadhiraj Sankaranarayanan

Madhusudhan Rangarajan

Sundar Dasar

Ching-Lung Chao

Shinose Abdul Rahiman

Balaji Bapu Gururaja Rao

Paul W Vancil

Charles Terrence Perusse, Jr

Michael Joseph Stumpf

Jonathan Foster Lewis

Stuart William Hayes

David Michael Pereira

Sanjay Rao

Prashanth Giri

Anil Venkatasubba Rao

Ramesh Radhakrishnan

Srinivas Giri Raju Gowda

Wai-Ming Richard Chan

Wayne Robert Weilnau, Jr

Prakash Nara

Quy Hoang

Sanjiv Sinha

Jaydev M Reddy

Ajay Shenoy

Techniques are provided for security key integrity verification using inventory certificates. One method comprises receiving a user request to perform an action: obtaining an inventory certificate associated with a device; extracting a security key identifier from a security key corresponding to the device; validating the security key by comparing the extracted security key identifier to a security key identifier in the inventory certificate; and authorizing a performance of the action based on a result of the comparison. A validity of the inventory certificate may be evaluated (e.g., by evaluating a signature associated with the inventory certificate). The inventory certificate may be stored in a secure memory of the device prior to a delivery of the device to a purchaser of the device.

Security key integrity verification using inventory certificates

Embodiments of systems and methods for intelligent accelerator license management are described. In some embodiments, a High Performance Computing (HPC) platform may include: a first Baseboard Management Controller (BMC), and a hardware accelerator comprising a second BMC, where at least one of the first or second BMCs is configured to: identify a type of a workload to be executed, at least in part, by the hardware accelerator, and retrieve a license corresponding to the workload.

Intelligent accelerator license management

An information handling system includes multiple components including a first component. The first component includes a protected memory and a basic input/output system (BIOS). The protected memory stores a revoked versions list. The BIOS initializes a firmware update for a firmware image having a firmware version. The BIOS scans the revoked versions list for the firmware version of the firmware image. In response to the firmware version not being located within the revoked versions list, the BIOS completes the firmware update, and determines whether a revoked firmware version is included in the firmware update. In response to the revoked firmware version being included in the firmware update, the BIOS adds an entry in the revoked versions list. The entry is associated with the revoked firmware version included in the firmware update.

Revoked firmware rollback prevention

Embodiments of systems and methods for power throttling of High Performance Computing (HPC) components are described. In some embodiments, an HPC platform may include: a system Baseboard Management Controller (BMC), and an accelerator tray comprising a tray BMC coupled to a plurality of managed subsystems and to the system BMC, where the system BMC is configured to: in response to a power excursion event, instruct the tray BMC to throttle a first managed subsystem by a first amount and to throttle a second managed subsystem by a second amount.

Power throttling of high performance computing (HPC) platform components

An information handling system includes a protected memory that stores identifiers of locked down devices. The system receives a firmware update package for a device within the information handling system. The firmware update package includes a firmware update for the device. The system determines whether an identifier for the device is located within protected memory. If the identifier for the device is located within the protected memory, then the system prevents the firmware update for the device.

Granular lockdown of operating system based firmware updates

A method for managing a storage system includes initiating, by a hardware resource manager, a boot-up of a storage controller managing the storage system comprising a plurality of storage devices, making a determination, by the storage controller, that the storage controller is in a secured mode, based on the determination: identifying a security state of each of the plurality of storage devices, determining that a storage device of the plurality of storage devices is in an unsecured state, and based on the unsecured state, sending, by the storage controller, a security operation request for securing the storage device, obtaining a secure state response from the hardware resource manager corresponding to securing the storage device, and based on the secure state response, resuming operation of the storage controller based on the secure mode.

Method and system for a conditional key storage using network information of a key management service

Systems and procedures are provided for validating an IHS (Information Handling System) as operating using only factory-provisioned I/O ports. During factory provisioning of the IHS, a signed inventory certificate that includes an inventory of factory-provisioned I/O ports of the IHS is uploaded to the IHS. Upon delivery and initialization of the IHS, the inventory certificate is retrieved by a pre-boot validation process. An inventory of detected I/O ports of the IHS is then collected. The validation process compares the collected inventory of detected I/O ports against the inventory of factory-provisioned I/O ports from the inventory certificate in order to validate the IHS is operating using only factory-provisioned I/O ports. Through embodiments, any I/O ports of the IHS other than the I/O ports validated as factory-provisioned are not usable by any software or hardware of the IHS.

Physical port validation for information handling systems

Various embodiments provide methods for validating secure assembly and delivery of an IHS (Information Handling System) by confirming that the detected hardware components of the IHS include only factory installed hardware components. During factory provisioning of an IHS, an inventory certificate is uploaded to the IHS, where the inventory certificate includes an inventory that identifies the hardware components installed during factory assembly of the IHS. An inventory is collected of the detected hardware components of the IHS. The collected inventory is compared against the inventory from the inventory certificate in order to validate the detected hardware components of the IHS as the same hardware components that were installed during factory assembly of the IHS. Embodiments provide a customer receiving an IHS with a capability of validating that a delivered IHS includes only factory installed hardware components.

Validating secure assembly and delivery of information handling systems

Techniques are provided for identity-based verification of software code layers. One method comprises obtaining, by a current layer of software code executing on a security processor of a security sub-system, in connection with a boot of the security sub-system, an identity key of the current layer, wherein the identity key of the current layer is based on a value generated during a provisioning of the security sub-system, wherein the value is based on a firmware image of at least one layer of the software code; obtaining an encrypted secure boot public key of a next layer; decrypting the encrypted secure boot public key of the next layer using the obtained identity key of the current layer; verifying the next layer using the decrypted secure boot public key of the next layer; and executing the next layer based at least in part on a result of the verifying.

Identity-based verification of software code layers

Techniques are provided for provisioning multiple platform root of trust (PRoT) entities using role-based identity certificates. One method comprises obtaining a designation of a PRoT entity of a hardware device as a PRoT leader associated with a leader role; recording the leader role as a role attribute in an identity certificate; and providing the identity certificate to the hardware device during a provisioning of the hardware device, wherein the given PRoT entity assumes the leader role of the hardware device and initiates security actions of the PRoT leader upon an initiation of the hardware device. Leader responsibilities can be assigned to the PRoT leader and the one or more leader responsibilities of the PRoT leader may be recorded as a leader responsibility attribute in the identity certificate.

Provisioning multiple platform root of trust entities of a hardware device using role-based identity certificates

Systems and procedures are provided for tracking hardware components of an IHS (Information Handling System). During factory provisioning of an IHS, an inventory certificate to the IHS is stored to the IHS that includes an inventory identifying factory-installed hardware components of the IHS. Also during the factory provisioning, a record is stored in a component datastore of the factory-installed hardware specified in the inventory certificate. Upon initialization of the delivered IHS, a pre-boot validation environment is initialized on the IHS and the stored inventory certificate is retrieved and used to validate the detected hardware components of the IHS. The results of the validation are then reported to a component datastore, where they are used to identify any transfer of a factory-installed hardware component. The factory datastore is updated in subsequent validations to reflect any detected modifications to the IHS in tracking genuine components.

Component tracking for information handling systems

A system control processor manager uses composed information handling systems that utilize resource sets of information handling systems and an infrastructure manager. The infrastructure manager obtains a composition request for a composed information handling system; allocates a portion of resource sets to the composed information handling system using a telemetry data map; makes a determination that at least one of the portion of the allocated resource sets is hosted by an information handling system that does not include a physical system control processor; and in response to the determination: provides the information handling system with access to a system control processor without adding any physical system control processors to the information handling system; and directs access requests, by entities hosted by the information handling system and directed to the portion of the allocated resource sets, through the system control processor.

Method and system for providing composable infrastructure capabilities

Methods and systems for managing the operation of data processing systems are disclosed. A data processing system may include a computing device that may enter various operating states by performing various types of startups. The startups may include use of code bases for which the computing device may not inherently be able to validate. To reduce risk of using the code bases, the computing device may perform processes to validate the code bases prior to using the code bases. Additionally, the computing devices may limit the types of interfaces that may be established during the startups while allowing other types of interfaces to be established to provide startup flexibility.

System and method for flexible startup of data processing systems

Various embodiments provide methods for validating hardware modifications of an IHS (Information Handling System) by confirming that a hardware modification corresponds to a hardware component supplied for installation in the IHS by a trusted entity. During factory provisioning of an IHS, an inventory certificate that specifies the factory installed IHS hardware is uploaded to the IHS and is also stored for ongoing support of the IHS. Upon a hardware component being supplied for installation in the IHS by a trusted entity, the inventory of the stored inventory certificate is updated to identify the supplied component and the updated certificate is transmitted to the IHS. An inventory of detected hardware components of the IHS is compared against the inventory from the updated inventory certificate in order to validate the detected hardware of the IHS includes the component, supplied by the trusted entity, that is identified in the updated inventory certificate.

Validating secure modifications to information handling systems

Systems and methods for factory management of regional cryptographic algorithms in an Information Handling System (IHS) are described. In an embodiment, an IHS may include: a host processor; a security processor coupled to the host processor; and a memory coupled to the security processor, the memory having program instructions stored thereon that, upon execution, cause the security processor to: generate a Cryptographic Algorithm Identity (CAI) key pair comprising a CAI public key and a CAI private key; issue a CAI Certificate Signing Request (CSR) to a factory IHS, where the CAI CSR comprises the CAI public key; receive a signed CAI certificate from the factory IHS, where the signed CAI certificate is usable to activate a selected set of regional cryptographic algorithms among a superset of regional cryptographic algorithms stored, during manufacturing of the IHS, in a firmware of the security processor; and store the signed CAI certificate.

Factory management of regional cryptographic algorithms in an information handling system

Growing community of inventors

Austin, TX, United States of America

Mukund Purshottam Khatri