Split chain of digital certificates for supply chain integrity

Patent metadata

Field	Value
Publication number	US-11985258-B2
Application number	US-202217648741-A
Country	US
Kind code	B2
Filing date	Jan 24, 2022
Priority date	Jan 24, 2022
Publication date	May 14, 2024
Grant date	May 14, 2024

Abstract

Systems and methods provide validation of hardware components of an IHS (Information Handling System). An attestation certificate stored to the IHS specifies authenticated instructions for operation of a hardware component of the IHS. This attestation certificate is endorsed by a self-signed root attestation certificate. An identity certificate, also stored to the IHS, specifies an identity of the hardware component and is endorsed using an embedded keypair of the hardware component. The root attestation certificate is validated to ensure it corresponds to the hardware component specified in the identity certificate, where this validation confirms that a public key included in the identity certificate is identical to a public key included in the attestation certificate. Through use of the same public key by both certificates, the attestation certificate can be validated as corresponding to the identity certificate without accessing the embedded keypair of the hardware component used to sign the identity certificate.

First claim

The invention claimed is:

1. A method for validating hardware components of an IHS (Information Handling System), the method comprising:
retrieving an attestation certificate that is stored to the IHS, wherein the attestation certificate specifies authenticated instructions for operation of a hardware component of the IHS, and wherein the attestation certificate is endorsed by a self-signed root attestation certificate;
retrieving an identity certificate that is stored to the IHS, wherein the identity certificate specifies an identity of the hardware component, and wherein the identity certificate is endorsed using an embedded keypair of the hardware component; and
validating that the root attestation certificate corresponds to the hardware component that is specified in the identity certificate by confirming that a public key included in the identity certificate is identical to a public key included in the attestation certificate.

2. The method of claim 1 , wherein the hardware component of the IHS comprises at least one of a storage controller, a network controller, a storage device, an FPGA (Field Programmable Gate Array) and a remote access controller.

3. The method of claim 1 , wherein the identity of the hardware component included in the identity certificate is a unique identifier of the hardware component collected during the factory assembly of the IHS.

4. The method of claim 1 , wherein the authenticated instructions for operation of the hardware component included in the attestation certificate comprise firmware instructions for operation by the hardware component.

5. The method of claim 1 , wherein the hardware component comprises an SPDM (Security Protocol and Data Model) compliant hardware component.

6. The method of claim 1 , wherein the embedded keypair of the hardware component is used by an Embedded Certificate Authority in the endorsement of the identity certificate.

7. The method of claim 1 , wherein the root attestation certificate is validated as corresponding to the hardware component specified in the identity certificate without accessing the embedded keypair of the hardware component.

8. The method of claim 1 , wherein the attestation certificate comprises a chain of attestation certificates, wherein the leaf attestation certificate of this chain validates the current instructions for use in validating the hardware component.

9. The method of claim 8 , further comprising: authenticating the leaf attestation certificate by validating control by the root attestation certificate of a private key corresponding to a public key included in the leaf attestation certificate.

10. The method of claim 1 , further comprising: validating an identity reported by the hardware component against the identity of the hardware component from the identity certificate.

11. The method of claim 10 , wherein the identity of the hardware component from the identity certificate comprises a unique identifier for the hardware component that is collected during factory assembly of the IHS.

12. The method of claim 1 , further comprising: validating instructions reported for use by the hardware component against the authenticated instructions specified by the attestation certificate.

13. The method of claim 12 , wherein the authenticated instructions specified by the attestation certificate comprise firmware instructions for operation of the hardware component.

14. A computer-readable storage device having instructions stored thereon for validating hardware components of an IHS (Information Handling System), wherein execution of the instructions by one or more processors causes the one or more processors to:
retrieve an attestation certificate that is stored to the IHS, wherein the attestation certificate specifies authenticated instructions for operation of a hardware component of the IHS, and wherein the attestation certificate is endorsed by a self-signed root attestation certificate;
retrieve an identity certificate that is stored to the IHS, wherein the identity certificate specifies an identity of the hardware component, and wherein the identity certificate is endorsed using an embedded keypair of the hardware component; and
validate that the root attestation certificate corresponds to the hardware component that is specified in the identity certificate by confirming that a public key included in the identity certificate is identical to a public key included in the attestation certificate.

15. The computer-readable storage device of claim 14 , wherein the hardware component of the IHS comprises at least one of a storage controller, a network controller, a storage device, an FPGA (Field Programmable Gate Array) and a remote access controller.

16. The computer-readable storage device of claim 14 , wherein the identity of the hardware component included in the identity certificate is a unique identifier of the hardware component collected during the factory assembly of the IHS.

17. The computer-readable storage device of claim 14 , wherein the authenticated instructions for operation of the hardware component included in the attestation certificate comprise firmware instructions for operation by the hardware component.

18. The computer-readable storage device of claim 14 , wherein the hardware component comprises an SPDM (Security Protocol and Data Model) compliant hard component.

19. An IHS (Information Handling System) comprising:
one or more processors;
one or more memory devices coupled to the processors, the memory devices storing computer-readable instructions that, upon execution by the processors cause an operating system to run on the IHS; and
a remote access controller comprising one or more logic units and further comprising one or more memory devices storing computer-readable instructions that, upon execution by the logic units, cause a pre-boot validation process to:
retrieve an attestation certificate that is stored to the IHS, wherein the attestation certificate specifies authenticated instructions for operation of a hardware component of the IHS, and wherein the attestation certificate is endorsed by a self-signed root attestation certificate;
retrieve an identity certificate that is stored to the IHS, wherein the identity certificate specifies an identity of the hardware component, and wherein the identity certificate is endorsed using an embedded keypair of the hardware component; and
validate that the root attestation certificate corresponds to the hardware component that is specified in the identity certificate by confirming that a public key included in the identity certificate is identical to a public key included in the attestation certificate.

20. The IHS of claim 19 , wherein the hardware component comprises an SPDM (Security Protocol and Data Model) compliant hardware component.

Assignees

• Dell Products Lp

Inventors

• YOUNG Jason Matthew
• Cho Eugene David
• Xie Huijun
• Nelogal Chandrashekar
• Savage Marshal F
• Ponnuru Viswanath

Classifications

• H04L9/3268 Primary

  using certificate validation, registration, distribution or revocation, e.g. certificate revocation list [CRL] · CPC title

• H04L9/0825

  using asymmetric-key encryption or public key infrastructure [PKI], e.g. key signature or public key certificates · CPC title

• H04L9/3265 Primary

  using certificate chains, trees or paths; Hierarchical trust model · CPC title

• H04L2209/12

  Details relating to cryptographic hardware or logic circuitry · CPC title

• H04L9/0891

  Revocation or update of secret information, e.g. encryption key update or rekeying · CPC title