Field-replaceable unit (FRU) secure component binding

Patent metadata

Field	Value
Publication number	US-11650936-B2
Application number	US-202016926628-A
Country	US
Kind code	B2
Filing date	Jul 10, 2020
Priority date	May 8, 2020
Publication date	May 16, 2023
Grant date	May 16, 2023

Abstract

Systems and methods are provided for binding one or more components to an identification component of a hardware module. Each of the serial numbers for the one or more components are included within a module-specific authentication certificate that is stored within the identification component of the hardware module. When connected to a computing platform, an authentication system of the computing platform is capable of retrieving the module-specific authentication certificate. The authentication system can compare the list of serial numbers included in the module-specific authentication certificate with one or more serial numbers read over a first interface. If the two lists of serial numbers match, the authentication system can flag the hardware module as authenticate through authentication of all components of the hardware module.

First claim

What is claimed is:

1. A management system comprising:
a processor; and
a non-transitory storage medium storing instructions executable on the processor to:
perform an authentication of a hardware module comprising a plurality of components by:
accessing a module specific authentication certificate from an identification component of the hardware module over a first interface, the module specific authentication certificate comprising information representing serial numbers of the plurality of components in the hardware module;
authenticating the hardware module based on the information representing the serial numbers in the module specific authentication certificate;

generate a nonce key in response to the authentication of the hardware module based on the information representing the serial numbers in the module specific authentication certificate;
write the nonce key to a register of the hardware module;
receive, from a controller, a value included in an access request to access the hardware module, wherein the controller is to access the hardware module over a second interface different from the first interface;
compare the value with the nonce key read from the register of the hardware module; and
provide an indication to allow the access request in response to the value matching the nonce key.

2. The management system of claim 1 , wherein the module specific authentication certificate is part of authentication information stored in the identification component, and the instructions are executable on the processor to:
in response to the authentication of the hardware module, flag the hardware module as authentic; and
provide an authenticated list of the serial numbers to an application of a computing platform that the management system is part of.

3. The management system of claim 1 , wherein the hardware module comprises a memory device, and the access of the hardware module by the controller comprises an access of the memory device by a memory controller.

4. The management system of claim 1 , wherein the instructions are executable on the processor to perform the authentication of the hardware module by comparing the information representing the serial numbers in the module specific authentication certificate with information representing component serial numbers from another source.

5. The management system of claim 4 , wherein the information representing the serial numbers in the module specific authentication certificate comprises a hash of the serial numbers, and the comparing compares the hash to a hash from the another source, and wherein the hash of the serial numbers is contained in the module specific authentication certificate.

6. The management system of claim 1 , wherein the hardware module comprises a field replaceable unit (FRU), and the plurality of components are on a printed circuit board (PCB).

7. The management system of claim 1 , wherein the plurality of components comprise one or more of a register, a power management integrated circuit (PMIC), or a dual in line memory module (DIMM).

8. A method comprising:
detecting, by a first device of a computing platform, a hardware module communicatively connected to the computing platform;
retrieving, by the first device, authentication information stored on an identification component of the hardware module over a first interface, the authentication information including a module specific authentication certificate comprising information representing serial numbers of a plurality of components on the hardware module;
authenticating the hardware module by comparing, by the first device, the information representing the serial numbers from the module specific authentication certificate retrieved from the identification component with information representing component serial numbers from another source;
in response to successfully authenticating the hardware module based on the information representing the serial numbers from the module specific authentication certificate retrieved from the identification component, writing, by the first device, a nonce key to a nonce register of the identification component of the hardware module;
receiving, by a second device, a request to access the hardware module from an application on the computing platform, the request including an identifier key identifying the hardware module and an address to access, wherein the request is received over a second interface;
reading, by the second device, the nonce key from the nonce register of the hardware module;
comparing, by the second device, the nonce key from the nonce register of the hardware module and the identifier key included within the request to access;
in response to the identifier key matching the nonce key read from the nonce register, determining, by the second device, that the hardware module is an authenticated hardware module; and
allowing, by the second device, access to the hardware module at the address included in the request.

9. The method of claim 8 , further comprising:
in response to the identifier key not matching the nonce key, determining, by the second device, that the hardware module at the address is not authenticated.

10. The method of claim 9 , further comprising flagging, by the second device, the hardware module at the address as a non-authenticated module.

11. The method of claim 10 , wherein the first device is a management system of the computing platform, the second device is a memory controller of the computing platform, and the hardware module is a memory module.

12. The method of claim 8 , wherein the module specific authentication certificate comprises a plain text list of the serial numbers, and the comparing of the information representing the serial numbers comprises comparing the plain text list of the serial numbers to the component serial numbers from the another source.

13. The method of claim 8 , wherein the information representing the serial numbers in the module specific authentication certificate comprises a hash value generated by applying a hash algorithm to the serial numbers, and the comparing of the information representing the serial numbers comprises comparing the hash value to a hash of the component serial numbers from the another source.

14. The method of claim 8 , wherein the nonce key written to the nonce register comprises a random value.

15. The method of claim 8 , wherein the first interface is a management interface, and the second interface is a memory interface.

16. A management system comprising:
a processor; and
a non-transitory storage medium storing instructions executable on the processor to:
perform an authentication of a hardware module comprising a plurality of components by:
accessing a module specific authentication certificate from an identification component of the hardware module, the module specific authentication certificate comprising information representing serial numbers of the plurality of components in the hardware module, wherein the hardware module is a memory module;
authenticating the hardware module based on the information representing the serial numbers in the module specific authentication certificate;

generate a nonce key in response to the authentication of the hardware module based on the information representing the serial numbers in the module specific authentication certificate;
write the nonce key to a register of the hardware module;
receive, from a memory controller, a value included in an access request to access the hardware module;
compare the value with the nonce key read from the register of the hardw

Assignees

• Hewlett Packard Entpr Dev Lp

Inventors

• Benedict Melvin K
• Edwards Nigel
• Pope Eric L

Classifications

• G06F12/1433 Primary

  for a module or a part of a module · CPC title

• G06F21/44

  Program or device authentication · CPC title

• G06F12/1466

  Key-lock mechanism · CPC title

• G06F2212/1052

  Security improvement · CPC title