Dell Products Inc.

Dell USA L.p.

Secureworks, Inc.

Mukund Purshottam Khatri

Elie Antoun Jreij

Robert Wayne Hormuth

Jimmy Doyle Pike

Gaurav Chawla

William Price Dawkins

Mark Steven Sanders

Walter A O'Brien, Iii

Marshal F Savage

Jason Matthew Young

Timothy Michael Lambert

Eugene David Cho

Wei G Liu

Chitrak Gupta

Rama Rao Bisa

Yossef Saad

Johan Rahardjo

Sushma Basavarajaiah

Sudhir Vittal Shetty

Kevin Thomas Marks

Muhammed K Jaber

Theodore Stratton Webb

Stuart Allen Berke

Robert Boyd Curtis

William Carl Munger

Akkiah Choudary Maddukuri

Vijay Bharat Nijhawan

Bhavesh Govindbhai Patel

Tuyet-Huong Thi Nguyen

Michael Karl Molloy

Chandrashekar Nelogal

Surender V Brahmaroutu

Manoj Sharad Gujarathi

Wayne R Weilnau, Jr

John Erven Jenne

Paul Theodore Artman

William Sauber

Austin Patrick Bolen

Lee Eric Ballard

John S Loffink

Lee B Zaretsky

Sanjeev Dambal

Robert Talbott Stevens, Iv

Philip Dale Chidester

Damon Earley

Paul Dennis Stultz

George Mathew

Anand Prakash Joshi

Deepaganesh Paulraj

Indrani Paul

Tyler B Duncan

Allen Chester Wynn

Jinsaku Masuyama

Andrew Butcher

Jon R Ramsey

George Gilman Richards, Iii

Cynthia M Merkin

Dirie N Herzi

Mark W Shutt

Donald W Gerhart

Kala Sampathkumar

Jacqueline Hegedus Wilson

Michael David Shepherd

Manjunath Am

Yogesh Varma

Binay A Kuruvila

Sandor Tibor Farkas

Shekar Babu Suryanarayana

Joseph LaSalle White

Shawn Joel Dube

John S Harwood

Yogesh Prabhakar Kulkarni

Mark Mcgrath Bailey

Shyamkumar Thiyagarajan Iyer

Dominick Adam Lovicott

Michael A Brundridge

Chandrasekhar Mugunda

Vadhiraj Sankaranarayanan

Madhusudhan Rangarajan

Sundar Dasar

Ching-Lung Chao

Balaji Bapu Gururaja Rao

Paul W Vancil

Shinose Abdul Rahiman

Charles Terrence Perusse, Jr

Michael Joseph Stumpf

Jonathan Foster Lewis

Stuart William Hayes

David Michael Pereira

Sanjay Rao

Prashanth Giri

Anil Venkatasubba Rao

Ramesh Radhakrishnan

Wayne Robert Weilnau, Jr

Wai-Ming Richard Chan

Srinivas Giri Raju Gowda

Quy Hoang

Sanjiv Sinha

Prakash Nara

Jaydev M Reddy

Embodiments of systems and methods for power throttling of High Performance Computing (HPC) components are described. In some embodiments, an HPC platform may include: a system Baseboard Management Controller (BMC), and an accelerator tray comprising a tray BMC coupled to a plurality of managed subsystems and to the system BMC, where the system BMC is configured to: in response to a power excursion event, instruct the tray BMC to throttle a first managed subsystem by a first amount and to throttle a second managed subsystem by a second amount.

Power throttling of high performance computing (HPC) platform components

An information handling system includes a protected memory that stores identifiers of locked down devices. The system receives a firmware update package for a device within the information handling system. The firmware update package includes a firmware update for the device. The system determines whether an identifier for the device is located within protected memory. If the identifier for the device is located within the protected memory, then the system prevents the firmware update for the device.

Granular lockdown of operating system based firmware updates

A method for managing a storage system includes initiating, by a hardware resource manager, a boot-up of a storage controller managing the storage system comprising a plurality of storage devices, making a determination, by the storage controller, that the storage controller is in a secured mode, based on the determination: identifying a security state of each of the plurality of storage devices, determining that a storage device of the plurality of storage devices is in an unsecured state, and based on the unsecured state, sending, by the storage controller, a security operation request for securing the storage device, obtaining a secure state response from the hardware resource manager corresponding to securing the storage device, and based on the secure state response, resuming operation of the storage controller based on the secure mode.

Method and system for a conditional key storage using network information of a key management service

Systems and procedures are provided for validating an IHS (Information Handling System) as operating using only factory-provisioned I/O ports. During factory provisioning of the IHS, a signed inventory certificate that includes an inventory of factory-provisioned I/O ports of the IHS is uploaded to the IHS. Upon delivery and initialization of the IHS, the inventory certificate is retrieved by a pre-boot validation process. An inventory of detected I/O ports of the IHS is then collected. The validation process compares the collected inventory of detected I/O ports against the inventory of factory-provisioned I/O ports from the inventory certificate in order to validate the IHS is operating using only factory-provisioned I/O ports. Through embodiments, any I/O ports of the IHS other than the I/O ports validated as factory-provisioned are not usable by any software or hardware of the IHS.

Physical port validation for information handling systems

Various embodiments provide methods for validating secure assembly and delivery of an IHS (Information Handling System) by confirming that the detected hardware components of the IHS include only factory installed hardware components. During factory provisioning of an IHS, an inventory certificate is uploaded to the IHS, where the inventory certificate includes an inventory that identifies the hardware components installed during factory assembly of the IHS. An inventory is collected of the detected hardware components of the IHS. The collected inventory is compared against the inventory from the inventory certificate in order to validate the detected hardware components of the IHS as the same hardware components that were installed during factory assembly of the IHS. Embodiments provide a customer receiving an IHS with a capability of validating that a delivered IHS includes only factory installed hardware components.

Validating secure assembly and delivery of information handling systems

Techniques are provided for identity-based verification of software code layers. One method comprises obtaining, by a current layer of software code executing on a security processor of a security sub-system, in connection with a boot of the security sub-system, an identity key of the current layer, wherein the identity key of the current layer is based on a value generated during a provisioning of the security sub-system, wherein the value is based on a firmware image of at least one layer of the software code; obtaining an encrypted secure boot public key of a next layer; decrypting the encrypted secure boot public key of the next layer using the obtained identity key of the current layer; verifying the next layer using the decrypted secure boot public key of the next layer; and executing the next layer based at least in part on a result of the verifying.

Identity-based verification of software code layers

Techniques are provided for provisioning multiple platform root of trust (PRoT) entities using role-based identity certificates. One method comprises obtaining a designation of a PRoT entity of a hardware device as a PRoT leader associated with a leader role; recording the leader role as a role attribute in an identity certificate; and providing the identity certificate to the hardware device during a provisioning of the hardware device, wherein the given PRoT entity assumes the leader role of the hardware device and initiates security actions of the PRoT leader upon an initiation of the hardware device. Leader responsibilities can be assigned to the PRoT leader and the one or more leader responsibilities of the PRoT leader may be recorded as a leader responsibility attribute in the identity certificate.

Provisioning multiple platform root of trust entities of a hardware device using role-based identity certificates

Systems and procedures are provided for tracking hardware components of an IHS (Information Handling System). During factory provisioning of an IHS, an inventory certificate to the IHS is stored to the IHS that includes an inventory identifying factory-installed hardware components of the IHS. Also during the factory provisioning, a record is stored in a component datastore of the factory-installed hardware specified in the inventory certificate. Upon initialization of the delivered IHS, a pre-boot validation environment is initialized on the IHS and the stored inventory certificate is retrieved and used to validate the detected hardware components of the IHS. The results of the validation are then reported to a component datastore, where they are used to identify any transfer of a factory-installed hardware component. The factory datastore is updated in subsequent validations to reflect any detected modifications to the IHS in tracking genuine components.

Component tracking for information handling systems

A system control processor manager uses composed information handling systems that utilize resource sets of information handling systems and an infrastructure manager. The infrastructure manager obtains a composition request for a composed information handling system; allocates a portion of resource sets to the composed information handling system using a telemetry data map; makes a determination that at least one of the portion of the allocated resource sets is hosted by an information handling system that does not include a physical system control processor; and in response to the determination: provides the information handling system with access to a system control processor without adding any physical system control processors to the information handling system; and directs access requests, by entities hosted by the information handling system and directed to the portion of the allocated resource sets, through the system control processor.

Method and system for providing composable infrastructure capabilities

Methods and systems for managing the operation of data processing systems are disclosed. A data processing system may include a computing device that may enter various operating states by performing various types of startups. The startups may include use of code bases for which the computing device may not inherently be able to validate. To reduce risk of using the code bases, the computing device may perform processes to validate the code bases prior to using the code bases. Additionally, the computing devices may limit the types of interfaces that may be established during the startups while allowing other types of interfaces to be established to provide startup flexibility.

System and method for flexible startup of data processing systems

Various embodiments provide methods for validating hardware modifications of an IHS (Information Handling System) by confirming that a hardware modification corresponds to a hardware component supplied for installation in the IHS by a trusted entity. During factory provisioning of an IHS, an inventory certificate that specifies the factory installed IHS hardware is uploaded to the IHS and is also stored for ongoing support of the IHS. Upon a hardware component being supplied for installation in the IHS by a trusted entity, the inventory of the stored inventory certificate is updated to identify the supplied component and the updated certificate is transmitted to the IHS. An inventory of detected hardware components of the IHS is compared against the inventory from the updated inventory certificate in order to validate the detected hardware of the IHS includes the component, supplied by the trusted entity, that is identified in the updated inventory certificate.

Validating secure modifications to information handling systems

Systems and methods for factory management of regional cryptographic algorithms in an Information Handling System (IHS) are described. In an embodiment, an IHS may include: a host processor; a security processor coupled to the host processor; and a memory coupled to the security processor, the memory having program instructions stored thereon that, upon execution, cause the security processor to: generate a Cryptographic Algorithm Identity (CAI) key pair comprising a CAI public key and a CAI private key; issue a CAI Certificate Signing Request (CSR) to a factory IHS, where the CAI CSR comprises the CAI public key; receive a signed CAI certificate from the factory IHS, where the signed CAI certificate is usable to activate a selected set of regional cryptographic algorithms among a superset of regional cryptographic algorithms stored, during manufacturing of the IHS, in a firmware of the security processor; and store the signed CAI certificate.

Factory management of regional cryptographic algorithms in an information handling system

Method and system for a conditional key storage in a hardware resource manager

Systems and procedures are provided for enforcing geographic restrictions on the operation of an IHS (Information Handling System). During factory provisioning of the IHS, a signed inventory certificate is uploaded to the IHS that specifies a plurality of allowed geographic locations at which the IHS is operational. Upon delivery and initial powering of the IHS, a validation environment is instantiated and further initialization of the IHS is halted until a location of the IHS can be determined. Once a geographic location of the IHS has been determined, it is compared to the allowed geographic locations from the inventory certificate stored during factory provisioning. When the location of the IHS is not at an allowed geographic location specified in the inventory certificate, the IHS is rendered non-operational. When the location of the IHS is at an allowed geographic location specified in the inventory certificate, further initialization of the IHS is enabled.

Geographic restrictions for information handling systems

An information handling system includes a basic input/output system configured to update an attribute of a system-wide firmware downgrade security policy prior to booting to an operating system of the information handling system. The attribute of the system-wide firmware downgrade security policy is used to determine whether to allow or to disallow downgrade of a firmware to a version. A processor may perform the downgrade of the firmware, wherein the downgrade of the firmware includes the processor further configured to check the attribute of the system-wide firmware downgrade security policy and to store a firmware image in a scratchpad. If the attribute of the system-wide firmware downgrade security policy allows the downgrade of the firmware to the version, then the processor may continue with the downgrade of the firmware otherwise discard the firmware image in the scratchpad.

System and method for system-wide firmware downgrade control

Growing community of inventors

Austin, TX, United States of America

Mukund Purshottam Khatri