Dell Products Inc.

Emc IP Holding Company LLC

Dell & Products L.p.

Viswanath Ponnuru

Chandrashekar Nelogal

Rama Rao Bisa

Chandrasekhar Mugunda

Shinose Abdul Rahiman

Dharma Bhushan Ramaiah

Vineeth Radhakrishnan

Parmeshwr Prasad

Raveendra Babu Madala

Vinay Sawal

Lee Eric Ballard

Ravishankar Kanakapura Nanjundaswamy

Kevin Thomas Marks

Mini Thottunkal Thankappan

Sumanth Vidyadhara

Chitrak Gupta

Santosh Hanamant Gore

Jason Matthew Young

Ramesha He

Judith A Furlong

K N Ravishankar

Krishnaprasad K

Vaideeswaran G

Ravikanth Chaganti

Shekar Babu Suryanarayana

Marshal F Savage

Eugene David Cho

Krishnaprasad Koladi

Rajesh Narayanan

Prasoon Kumar Sinha

Deepu Syam Sreedhar M

Yi Fang

Ke Xu

Magesh Kumar Sivaswamy

Huijun Xie

Shuva Brata Deb

Alan White

Vineeth Radharisknan

Igor Pedan

Sura Rajashekar Reddy

A node for a VSAN includes a BMC, a processor, and a plurality of VSAN objects. The processor instantiates a Cluster Membership, Monitoring, and Directory Service (CMMDS) and a BMC Service Module (SM). The CMMDS implements a Security Policy and Data Model (SPDM) architecture. The CMMDS determines an inventory list of the VSAN objects and a SPDM authentication state for each of the objects, and provides the inventory list and the SPDM authentication states to the BMC SM. The BMC SM provides the inventory list and the SPDM authentication state to the BMC. The BMC determines that a first VSAN object is not authenticated based upon the SPDM authentication state of the first VSAN object, and directs the CMMDS to halt input/output (I/O) operations on the VSAN to the first VSAN object.

Secure VSAN cluster using device authentication and integrity measurements

One example method includes receiving, by a distributed attestation proxy server (DAPS) from a client, an attestation request, establishing, by the DAPS, a secure communication channel with the client, performing, by the DAPS, a resource discovery process to identify a resource that meets a requirement of the client, facilitating, by the DAPS, an attestation exchange between the client and the resource, performing, by the DAPS, a verification and attestation process that comprises generation of an attestation result, transmitting, by the DAPS, the attestation result to the client, and when the attestation result is positive, establishing, by the DAPS, a secure communication channel between the client and the resource.

Proxy attestation service for multi-cloud tee hardware

According to embodiments of the present disclosure, systems and methods to advertise Security Protocol and Data Model (SPDM) command timing requirements are provided. According to one embodiment, an Information Handling System (IHS) includes a requester and a responder conforming to a SPDM specification in which the responder is configured with computer-executable logic to, in response to a request from a requester, generate an estimated amount of time to process a SPDM command, and send the estimated amount of time to the requester in response to the request. The requester may then wait the estimated amount of time between sending each of multiple ensuing commands to the responder.

Systems and methods to advertise SPDM command timing requirements

A system can receive an untrusted onboard announcement message from a remote computer, wherein the untrusted onboard announcement message comprises first data that identifies the remote computer and second data that indicates a current configuration of the remote computer. The system can identify a stored indication of an authorized configuration of the remote computer based on the data that identifies the remote computer. The system can determine that there is a mismatch between the authorized configuration of the remote computer and the current configuration of the remote computer. The system can determine a trust metrics evaluation score for the remote computer based on a type of hardware component change between the authorized configuration of the remote computer and the current configuration of the remote computer. The system can, in response to determining that the trust metrics evaluation score is greater than a threshold value, onboard the remote computer.

Trusted cloud device lifecycle management

Systems and methods provide for SPDM-enabled devices that conform to an SPDM specification. An SPDM-enabled device receives a request to provision a certificate chain on the device and sends an event notification message to a baseboard management controller. The event notification message indicates receipt of a request to provision a certificate chain in a slot on the SPDM-enabled device. The baseboard management controller evaluates the certificate chain against the device manufacturer's certificate profile policy. If the certificate chain is valid, then a validation successful message is sent to the SPDM-enabled device, which in turn sends a certificate provision response to a requesting device. If the certificate chain is not valid, then a validation failure message is sent to the SPDM-enabled device, which causes the SPDM-enabled device to enter a quarantine state.

Trusted and validated platform device certificate provisioning using security protocol data model (SPDM)

A system can receive an untrusted onboard announcement message from a remote computer. The system can, based on the untrusted onboard announcement message, initiate an onboarding service policy to verify a device location claims policy associated with the remote computer. The system can receive an indication of a remote access controller hardware component of the remote computer, wherein the indication is of verifying a network port authentication policy applicable to determine whether a port-based network access control protocol certificate hostname that is associated with the remote computer matches an entity attestation token attribute extensible authentication protocol-transport layer platform certificate hostname of the remote access controller hardware component to determine a network authentication status. The system can determine whether device onboard location is successful based on a device location verification policy status and the indication.

Location aware trusted cloud resource provisioning

An Information Handling System (IHS) includes multiple hardware devices, and a baseboard Management Controller (BMC) in communication with the plurality of hardware devices. The BMC includes executable instructions for monitoring the operating characteristics a hardware device that is operating in a fixed pass-through configuration with a workspace in which the workspace has been instantiated by a workspace orchestration service executed on the IHS. The executable instructions may determine that the operating characteristics are indicative of a security breach of the fixed pass-through configuration, and as such, may perform an operation to quarantine the one hardware device when the fixed pass-through configuration is determined to possess the security breach.

Workspace-based fixed pass-through monitoring system and method for hardware devices using a baseboard management controller (BMC)

A system can receive, from a remote computer of remote computers, inventory data representative of an inventory, wherein the inventory data indicates that the remote computer is configured to implement a shared memory pool with the remote computers according to a compute express link protocol. The system can receive, from the remote computer, a request to onboard the remote computer, wherein the request adheres to a defined security protocol and data model architecture, and wherein the system is configured to remotely manage the remote computers as part of a hybrid cloud platform that comprises the remote computers. The system can authenticate the remote computer based on the request and according to the defined security protocol and data model architecture. The system can implement the shared memory pool for the remote computers.

Memory pool management using a cloud platform

According to embodiments of the present disclosure, systems and methods to manage Security Protocol and Data Model (SPDM) secure communication sessions are provided. According to one embodiment, an Information Handling System (IHS) includes a Security Protocol and Data Model (SPDM)-enabled device conforming to a SPDM specification in which the SPDM-enabled device has a specified quantity of supported private communication sessions. The IHS also includes computer-executable instructions to, when an application requests use of one of the private communication sessions, determine whether one of the private communication sessions is available, and enable the application to communicate with the SPDM-enabled device through the one private communication session based on the determination.

Systems and methods to manage security protocol and data model (SPDM) secure communication sessions

Embodiments of systems and methods to provide a firmware update to devices configured in a redundant configuration in an Information Handling System (IHS) are disclosed. In an illustrative, non-limiting embodiment, an IHS may include computer-executable instructions to, when a signed certificate associated with a client expires, challenge the client by transmitting a first plurality of keys to a client IHS, wherein the client IHS is configured to respond the challenge by associating each of the keys with a second plurality of keys, pairing each of the first key with its associated second key, sending the paired first and second keys to the server IHS, and authenticate the client IHS by verifying that each of the first plurality of keys is associated with the second plurality of keys.

Systems and methods for reclaiming identity credentials in a cloud management service

According to one embodiment, a path obfuscation system includes first and second hardware devices, and first and second interfaces configured to provide communication between the first and second hardware devices using a security protocol and data model (SPDM) protocol. The first hardware device comprises computer-executable instructions to receive a message to be transmitted to the second hardware device, segment the message into multiple groups of packets, and randomly select either the first or second interface to transmit each group of packet to the second hardware device.

Communication path obfuscation system and method

A system for data processing, comprising a management controller operating on a processor and configured to load and execute one or more algorithms that provide the function of transmitting a request to a managed device using a Security Protocol and Data Model (SPDM) protocol and to receive a response from the managed device. A system management bus and security policy system operating on the processor is configured to execute one or more algorithms to process the response from the managed device to apply an SPDM security policy to the response.

Certificate authorization policy for security protocol and data model capable devices

An Information Handling System (IHS) includes multiple hardware devices, and a baseboard Management Controller (BMC) in communication with the plurality of hardware devices. The BMC includes executable instructions for causing the one hardware device to be inhibited from functioning with the IHS when at least one of the hardware devices is powered on, and performing an authentication procedure with that hardware device. After that hardware device has been successfully authenticated, the instructions then enable the one hardware device to function with the IHS.

System and method for device authentication using a baseboard management controller (BMC)

Methods, apparatus, and processor-readable storage media for out-of-band management security analysis and monitoring are provided herein. An example computer-implemented method includes generating control state configuration profiles for hardware components of at least one out-of-band server management controller, collecting data from the at least one out-of-band management controller via one or more interfaces, analyzing the collected data by comparing the collected data to the one or more control state configuration profiles and applying at least one rule-based engine to the collected data, and generating a notification of one or more security vulnerabilities associated with the at least one out-of-band server management controller based at least in part on the analyzing of the collected data, wherein the notification is to be utilized in connection with one or more security-related actions on at least a portion of at least one server.

Out-of-band management security analysis and monitoring

Growing community of inventors

Bengaluru, India

Viswanath Ponnuru