Dell Products Inc.

Sanjeev Dambal

Chandrashekar Nelogal

Karthikeyan Rajagopalan

Vigneswaran Ponnusamy

Satyajit Dipakbhai Desai

Mukund Purshottam Khatri

Rama Rao Bisa

Marshal F Savage

Dinesh Kunnathur Ragupathi

Sundar Dasar

Sanjay Rao

Marcelo Silva Saraiva

Charles D Stracener

Diwahar Natarajan

Karthik Arunachalam

Texas Roemer

Kevin Warren Mundt

Chitrak Gupta

Yogesh Prabhakar Kulkarni

Jason Matthew Young

James Peter Giannoules

Syama Poluri

Sushma Basavarajaiah

Mark W Shutt

Pavan Kumar

Deepu Syam Sreedhar M

Wayne Robert Weilnau, Jr

Vance Edward Corn

Sruthi Reddy Mothukupally

Craig Phelps

Choudary Maddukuri

Patrick Oliver Boyd

Sreeram Veluthakkal

Kumaran Palaniappan

Kumaran Palaniappan Thangavelu

Sura Reddy

Krishna P Mohan

Sisir K Dash

A method for managing a storage system includes initiating, by a hardware resource manager, a boot-up of a storage controller managing the storage system comprising a plurality of storage devices, making a determination, by the storage controller, that the storage controller is in a secured mode, based on the determination: identifying a security state of each of the plurality of storage devices, determining that a storage device of the plurality of storage devices is in an unsecured state, and based on the unsecured state, sending, by the storage controller, a security operation request for securing the storage device, obtaining a secure state response from the hardware resource manager corresponding to securing the storage device, and based on the secure state response, resuming operation of the storage controller based on the secure mode.

Method and system for a secure management of storage devices using a key management service

Embodiments of systems and methods to provide a firmware update to devices configured in a redundant configuration in an Information Handling System (IHS) are disclosed. In an illustrative, non-limiting embodiment, an IHS may include computer-executable instructions to receive a request for a secret known by the IHS, and attest the RAC by verifying that the public key exists in a manifest that is configured to store identifying information about a plurality of devices configured in the IHS. The request is signed using a private key of a first asymmetric key pair generated by a Remote Access Controller (RAC). Using a second public key of a second asymmetric key pair, the instructions encrypt the requested secret; and send the encrypted secret to the RAC, wherein the RAC is configured to use the second private key of the second asymmetric key pair to decrypt the encrypted secret.

Systems and methods for secure secret provisioning of remote access controllers

Method and system for a conditional key storage using network information of a key management service

In general, embodiments of the invention relate to a method and system for managing a storage system. In many traditional implementations host bus adapter (HBA) manages the storage device, however frequently the HBA cannot implement the necessary methods to secure a self-encrypting drive (SED). One or more embodiments of the invention use a baseboard management controller (BMC) to manage the security of the SEDs as well as the security life cycle of the SEDs, while the HBA acts as a passthrough conduit between the SED and BMC.

Securing SEDs behind a HBA controllers with a passthrough mechanism using BMC

Method and system for a conditional key storage in a hardware resource manager

In one or more embodiments, one or more systems, one or more methods, and/or one or more processes may determine that the staged job needs to be executed by a baseboard management controller (BMC) while an information handling system (IHS) is held in a power-on self-test; create a hybrid job associated with the staged job; reboot the IHS; launch an IHS firmware application in a pre-boot IHS firmware environment; provide, to the BMC, a command to execute a first portion of the hybrid job; obtain, by the BMC, an authentication key; provide, by the BMC, the authentication key to the non-volatile storage device; execute, by the BMC, the first portion of the hybrid job to configure the non-volatile storage device; and execute, by the IHS firmware application, the second portion of the hybrid job to poll the baseboard management controller for a result status of configuring the non-volatile storage device.

System and method of configuring a non-volatile storage device

A disclosed method for managing encryption keys, which may be performed by a key management server, responds to receiving, from a first client, a request to create a new key for a self-encrypting drive (SED) associated with the first client by retrieving unique identifiers of the first client and the SED, generating and storing the new key and a corresponding key identifier (KeyID), and associating the unique identifiers of the SED and first client with the new key. Upon receiving, from a second client, a locate key request that includes the SED identifier, providing the new key, the KeyID, and the first client identifier to the second client. Associating the SED and first client identifiers with the new key may include adding the identifiers as attributes of the KeyID. Embodiments may be implemented in accordance with a key management interoperability protocol (KMIP) standard.

Managing migration of self encrypted drive within a single key management system user group

An information handling system may include a processor and a management controller communicatively coupled to the processor. The management controller may be configured to, in response to an encrypted storage resource being coupled to the information handling system: transmitting a request to at least one other management controller for an encryption key associated with the encrypted storage resource; receiving a response from the at least one other management controller, the response including the encryption key associated with the encrypted storage resource; and unlocking the encrypted storage resource with the received encryption key.

Management controller based drive migration

An information handling system includes an endpoint device and a service processor. The endpoint device is configured to share a passphrase with the service processor via shared memory architecture transfer mechanism. The service processor is configured generate the sent hash of a message; encrypt the message, the sent hash, and the nonce value using the passphrase to form an encrypted message; and transmit the encrypted message to the endpoint device over a sideband interface. The storage controller is further configured to decrypt the encrypted message using the passphrase to obtain the message, the sent hash, and the nonce value; compare the nonce value to a counter to determine if the nonce value is an old nonce value; calculate an observed hash of the message; and accept the message when the nonce value is not an old nonce value and the observed hash matches the received hash.

Mechanism to secure side band communication between service processor and an end point

A key retrieval system includes a management system and a managed system that is coupled to the management system through a network. The managed system includes a managed device, a management system configuration storage, a remote access controller device that stores a management system configuration for the management system in the management system configuration storage and provides a key management client subsystem that is configured to use the management system configuration to access the management system. The managed system also includes a BIOS. The BIOS detects an event that triggers unlocking the managed device. The BIOS determines that the remote access controller device is unavailable and, in response, retrieves the management system configuration and accesses the management system using the management system configuration. The BIOS then retrieves the locking key from the management system and unlocks the managed device using the locking key.

Key recovery system

Systems and methods for enabling license management in pre-boot environments are described. In some embodiments, a method may include: loading, by a Basic System Input/Output (BIOS) of an Information Handling System (IHS), prior to the booting of any Operating System (OS) by the IHS, a license manager Unified Extensible Firmware Interface (UEFI) driver; and executing, by the BIOS, a command received from a component or device coupled to the IHS following a license management protocol provided by the UEFI driver, where the command is to obtain or verify license data.

License management in pre-boot environments

An information handling system includes a first node configured to generate a random alphanumeric string, to receive a cipher text and a key from an enterprise key management server, and to decrypt the cipher text using the key and an algorithm to generate a first decrypted value. The first node compares the random alphanumeric string with the first decrypted value to verify the key that is received at the first node. A second node receives the cipher text, the key, and the algorithm from the first node in response to the first decrypted value matching the random alphanumeric string. The second node decrypts the cipher text using the key and the algorithm to generate a second decrypted value, and the first node compares the second decrypted value with the random alphanumeric string to verify the key that is received at the second node. A self-encrypting drive receives the key from the second node in response to the second decrypted value matching the random alphanumeric string, and uses the key upon authentication of the key by the second node.

Method and apparatus for ensuring integrity of keys in a secure enterprise key manager solution

An information handling system includes storage drives, a first storage controller configured to map to a first subset of the storage drives, a second storage controller configured to map to a second subset of the storage drives different from the first subset, and a BMC. The BMC directs the storage controllers to detect storage traffic to the first and second subsets of storage drives, compares the storage traffic from the storage controllers, and remaps the first storage controller to map storage transactions on a third subset of the storage drives different from the first subset when the comparison indicates that the first storage traffic is greater than the second storage traffic.

System and method to detect storage controller workloads and to dynamically split a backplane

A method and system provide local key management for storage enclosures. The method includes retrieving first security content from a security vault of a service processor, then dynamically detecting a hardware interface communicatively coupled to the service processor. A data storage device, communicatively coupled to the hardware interface is dynamically detected. A dynamic determination is made as to whether the data storage device is a self-encrypting capable data storage device. In response to the data storage device being a self-encrypting capable data storage device, a second security content is retrieved from the data storage device, and a validation regarding an association between the first security content and the second security content is made. Finally, in response to a positive validation of the association between the first security content and the second security content, security keys are transmitted to the data storage device, and access to the data storage device is enabled.

Local key management for storage devices

Methods, devices and systems for identifying storage devices received within a plurality of drive bays, where the devices are identified via a visual indicator associated with each drive bay. A controller identifies storage devices that host booted operating systems. The controller activates the visual indicator associated with drive bays that receive the identified booted storage devices. The visual indicator may be a status light generated by a light source associated with each drive bay. This visual indicator may also be a graphical component of a remote management interface. To identify storage devices with booted operating systems, the controller determines the visual indicators to activate based on information received from a storage controller identifying the storage devices at each bay and an identification of booted drives received from a BIOS. The visual indictors may separately identify booted storage devices and bootable storage devices that are not presently booted.

System and method to remotely detect and report bootable physical disk location

Growing community of inventors

Austin, TX, United States of America

Sanjeev Dambal