Dell Products Inc.

Shinose Abdul Rahiman

Rama Rao Bisa

Dharma Bhushan Ramaiah

Vineeth Radhakrishnan

Mini Thottunkal Thankappan

Viswanath Ponnuru

Chandrashekar Nelogal

Chandrasekhar Mugunda

Chitrak Gupta

Nikhith Ganigarakoppal Kantharaju

Sumalatha Pagadala

Sushmitha Naik

Mukund Purshottam Khatri

Elie Antoun Jreij

Deepaganesh Paulraj

Parmeshwr Prasad

Ankit Kumar Singh

Sushma Basavarajaiah

Kala Sampathkumar

Vinod Parackal Saby

Krishnaprasad K

Vineeth Radharisknan

According to embodiments of the present disclosure, systems and methods to advertise Security Protocol and Data Model (SPDM) command timing requirements are provided. According to one embodiment, an Information Handling System (IHS) includes a requester and a responder conforming to a SPDM specification in which the responder is configured with computer-executable logic to, in response to a request from a requester, generate an estimated amount of time to process a SPDM command, and send the estimated amount of time to the requester in response to the request. The requester may then wait the estimated amount of time between sending each of multiple ensuing commands to the responder.

Systems and methods to advertise SPDM command timing requirements

According to embodiments of the present disclosure, a Security Protocol and Data Model (SPDM)-enabled device uses a device identity to provide, among other things, a SPDM-based firmware protection system and method that, upon execution by computer-readable instructions, receive, from a requesting device, a request to update the SPDM-enabled device with a software package, and obtain the software package from an online portal. The computer-readable instructions further encrypt the software package with an encryption key, encrypt the encryption key with a device identity certificate of the requesting device, and send the encrypted software package and encrypted encryption key to the requesting device.

SPDM-based firmware protection system and method

Systems and methods provide for SPDM-enabled devices that conform to an SPDM specification. An SPDM-enabled device receives a request to provision a certificate chain on the device and sends an event notification message to a baseboard management controller. The event notification message indicates receipt of a request to provision a certificate chain in a slot on the SPDM-enabled device. The baseboard management controller evaluates the certificate chain against the device manufacturer's certificate profile policy. If the certificate chain is valid, then a validation successful message is sent to the SPDM-enabled device, which in turn sends a certificate provision response to a requesting device. If the certificate chain is not valid, then a validation failure message is sent to the SPDM-enabled device, which causes the SPDM-enabled device to enter a quarantine state.

Trusted and validated platform device certificate provisioning using security protocol data model (SPDM)

An Information Handling System (IHS) includes multiple hardware devices, and a baseboard Management Controller (BMC) in communication with the plurality of hardware devices. The BMC includes executable instructions for monitoring the operating characteristics a hardware device that is operating in a fixed pass-through configuration with a workspace in which the workspace has been instantiated by a workspace orchestration service executed on the IHS. The executable instructions may determine that the operating characteristics are indicative of a security breach of the fixed pass-through configuration, and as such, may perform an operation to quarantine the one hardware device when the fixed pass-through configuration is determined to possess the security breach.

Workspace-based fixed pass-through monitoring system and method for hardware devices using a baseboard management controller (BMC)

Embodiments of the present disclosure provide a firmware update to multiple, similar hardware devices in an Information Handling System (IHS). In an illustrative, non-limiting embodiment, an IHS may include computer-executable instructions to receive a request to perform a firmware update to a plurality of devices, update a first of the plurality of devices with the requested firmware update, and calculate a health score for the first device as a result of the first device being updated. Based upon the health score, the system and method may determine whether to update the other devices based at least in part, on the determined health score, and update the other devices based on the determination.

Systems and methods for performing health score-based firmware updates

According to embodiments of the present disclosure, an Information Handling System (IHS) includes a plurality of Security Protocol and Data Model (SPDM)-enabled devices conforming to a SPDM specification, and instructions stored in a memory and executable by a processor to communicate with the SPDM-enabled devices to derive a trust score for each of the SPDM-enabled devices, and perform one or more optimization actions to optimize an overall security state of the IHS.

Systems and methods for security state optimization of SPDM-enabled devices

According to embodiments of the present disclosure, systems and methods to provide pre-deployment assessment for device integrity are disclosed. The pre-deployment assessment systems and methods include computer-executable instructions to identify a Security Protocol and Data Model (SPDM)-enabled device conforming to a SPDM specification, obtain one or more identifying parameters and one or more critical parameters from the SPDM-enabled device, and communicate with a server to obtain information about the SPDM-enabled device without sending any critical information to the server. The instructions then determine whether the SPDM-enabled device is authorized for use in the IHS by comparing the identifying parameters with the information obtained from the server, and when the SPDM-enabled device is authorized for use with the IHS, send the critical parameters to the server. However, when the SPDM-enabled device is not authorized for use with the IHS, the instructions inhibit sending of the critical parameters to the server.

Systems and methods to provide pre-deployment assessment for device integrity

According to embodiments of the present disclosure, systems and methods to manage Security Protocol and Data Model (SPDM) secure communication sessions are provided. According to one embodiment, an Information Handling System (IHS) includes a Security Protocol and Data Model (SPDM)-enabled device conforming to a SPDM specification in which the SPDM-enabled device has a specified quantity of supported private communication sessions. The IHS also includes computer-executable instructions to, when an application requests use of one of the private communication sessions, determine whether one of the private communication sessions is available, and enable the application to communicate with the SPDM-enabled device through the one private communication session based on the determination.

Systems and methods to manage security protocol and data model (SPDM) secure communication sessions

A software RAID/management communication system includes a chassis housing a software Redundant Array of Independent Disk (RAID) subsystem and a management subsystem that are each coupled to a storage device having a storage device memory subsystem. The software RAID subsystem provides a software RAID information request in the storage device memory subsystem that requests the management subsystem provide software RAID information associated with the operation of a software RAID provided by the software RAID subsystem, the software RAID subsystem then periodically accesses the storage device memory subsystem and, when the software RAID subsystem determines that the management subsystem has provided a software RAID information response in the storage device memory subsystem, the software RAID subsystem retrieves the software RAID information that was provided in the storage device memory subsystem by the management subsystem.

Software raid/management communication system

According to embodiments of the present disclosure, a dynamic key distribution system is provided. The dynamic key distribution includes computer-executable instructions to encrypt, using a first Security Protocol and Data Model (SPDM)-enabled device conforming to a SPDM specification, an original Pre-Shared Key (PSK) with a SPDM identity certificate of the first SPDM-enabled device, wherein the original PSK is associated with a second SPDM-enabled device. The instructions are also configured to provision the encrypted PSK in the second SPDM-enabled device, and authenticate the second SPDM-enabled device by decrypting the encrypted PSK to obtain the original PSK using an SPDM protocol.

Systems and methods for key distribution of low end SPDM devices

A software RAID/management communication system includes a chassis housing a software RAID subsystem coupled to a shared memory subsystem and storage devices, and a management subsystem that is coupled to the storage devices, and that is coupled to the shared memory subsystem via an MMBI connection. The management subsystem determines that at least one of the storage devices does not include a storage device memory subsystem that is configured for software RAID/management communications and, in response, transmits MCTP communications via the MMBI connection to retrieve RAID configuration information from the storage device(s) via the software RAID subsystem and the shared memory subsystem. The management subsystem then uses the RAID configuration information to perform at least one RAID management operation on at least one RAID logical storage device provided by the storage device(s).

A resilient software Redundant Array of Independent Disk (RAID)/management communication system includes a chassis housing a software RAID subsystem coupled to a plurality of storage devices that are also coupled to a management subsystem. The software RAID subsystem designates a first storage device in the plurality of storage devices as a primary storage device and a second storage device in the plurality of storage devices as a secondary storage device, and uses the respective storage device memory subsystem in the first storage device to transmit first management communications with the management subsystem. If the software RAID subsystem determines that the first storage device is unavailable, it uses the respective storage device memory subsystem in the second storage device to transmit second management communications with the management subsystem.

Resilient software raid/management communication system

A software Redundant Array of Independent Disk (RAID)/management trusted storage-device-based communication system includes a chassis housing a software Redundant Array of Independent Disk (RAID) subsystem, a storage device that is coupled to the software RAID subsystem and that includes a storage device memory subsystem, and a management subsystem that is coupled to the storage device. The management subsystem authenticates the storage device to establish management subsystem/storage device trust between the management subsystem and the storage device and, in response, uses the storage device to establish management subsystem/software RAID subsystem trust between the management subsystem and the software RAID subsystem. In response to establishing the management subsystem/storage device trust and the management subsystem/software RAID subsystem trust, the management subsystem transmits communications with the software RAID subsystem via the storage device memory subsystem in the storage device.

Software raid/management trusted storage-device-based communication system

Systems and methods provide thermal monitoring during updates to firmware used by managed hardware of an Information Handling System (IHS). A remote access controller of the IHS, that operates separate from CPUs of the IHS, initiates a firmware update for a hardware component via a bus mastered by the remote access controller. Except for transmissions in support of the firmware update, communications on the bus are blocked. While communications on the bus are blocked, a request is detected for transmission of a portion of the firmware update to the hardware component. A time is determined for responding to the request. Prior to the time for responding, a second of the hardware components of the IHS that shares the bus mastered by the remote access controller is polled for thermal data. During the firmware update of the hardware component, closed-loop cooling of the IHS is provided using the thermal data.

Systems and methods for thermal monitoring during firmware updates

According to embodiments of the present disclosure, an Information Handling System (IHS), systems and methods for identifying firmware versions of a firmware image using SPDM alias certificates are disclosed. In one embodiment, an IHS includes a Security Protocol and Data Model (SPDM)-enabled device conforming to a SPDM specification, and computer-executable instructions to receive a request to attest a firmware image, generate an alias certificate using a hash of the firmware and version information associated with the firmware in response to the request, and using the alias certificate, attest the version of the firmware image using the version information.

Growing community of inventors

Bengaluru, India

Shinose Abdul Rahiman