Secure certificate storage when a connectivity management system client is running on an operating system

Patent metadata

Field	Value
Publication number	US-11997073-B2
Application number	US-202217728362-A
Country	US
Kind code	B2
Filing date	Apr 25, 2022
Priority date	Apr 25, 2022
Publication date	May 28, 2024
Grant date	May 28, 2024

Abstract

A system, method, and computer-readable medium for performing a data center monitoring and management operation. The data center monitoring and management operation includes: providing a data center asset with a data center asset client module; establishing a connection between the data center asset client module and a connectivity management system of a data center monitoring and management console, the connectivity management system comprising a connectivity management system aggregator and a connectivity management system service; exchanging attestation and proof of ownership information between the data center asset communication client module and the connectivity management system service of the connectivity management system; establishing a secure communication channel between the data center asset client module and the connectivity management system aggregator based upon the attestation and proof of ownership information; and, exchanging information between the data center asset client module and the data center monitoring and management console via the secure communication channel between the data center asset client module and the connectivity management system aggregator.

First claim

What is claimed is:

1. A computer-implementable method for performing a data center monitoring and management operation, comprising:
providing a data center asset with a connectivity management system client module;
establishing a connection between the connectivity management system client module and a connectivity management system of a data center monitoring and management console, the connectivity management system comprising a connectivity management system aggregator and a connectivity management system service;
exchanging attestation and proof of ownership information between the connectivity management system client module and the connectivity management system service of the connectivity management system;
establishing a secure communication channel between the connectivity management system client module and the connectivity management system aggregator based upon the attestation and proof of ownership information; and,
exchanging information between the connectivity management system client module and the data center monitoring and management console via the secure communication channel between the connectivity management system client module and the connectivity management system aggregator.

2. The method of claim 1 , further comprising:
signing the attestation and proof of ownership messages prior to exchanging information between the connectivity management system client module and the data center monitoring and management console.

3. The method of claim 1 , wherein:
the data center asset comprises a baseboard management controller;
the attestation and ownership information are provided by the connectivity management system service; and,
at least one of the connectivity management system client module and the baseboard management controller provide the attestation and ownership information to another of the connectivity management system client module and the baseboard management controller.

4. The method of claim 3 , wherein:
the connectivity management system client module communicates with the baseboard management controller via an internal data center asset communication channel.

5. The method of claim 3 , wherein:
the baseboard management controller provides an initial trust exchange with the connectivity management system.

6. The method of claim 3 , wherein:
the baseboard management controller safely stores private security information on behalf of the connectivity management system client module.

7. A system comprising:
a processor;
a data bus coupled to the processor;
a connectivity management system client module; and,
a non-transitory, computer-readable storage medium embodying computer program code, the non-transitory, computer-readable storage medium being coupled to the data bus, the computer program code interacting with a plurality of computer operations and comprising instructions executable by the processor and configured for:
establishing a connection between the connectivity management system client module and a connectivity management system of a data center monitoring and management console, the connectivity management system comprising a connectivity management system aggregator and a connectivity management system service;
exchanging attestation and proof of ownership information between the connectivity management system client module and the connectivity management system service of the connectivity management system;
establishing a secure communication channel between the connectivity management system client module and the connectivity management system aggregator based upon the attestation and proof of ownership information; and,
exchanging information between the connectivity management system client module and the data center monitoring and management console via the secure communication channel between the connectivity management system client module and the connectivity management system aggregator.

8. The system of claim 7 , wherein the instructions executable by the processor are further configured for:
signing the attestation and proof of ownership messages prior to exchanging information between the connectivity management system client module and the data center monitoring and management console.

9. The system of claim 7 , wherein:
the data center asset comprises a baseboard management controller;
the attestation and ownership information are provided by the connectivity management system service; and,
at least one of the connectivity management system client module and the baseboard management controller provide the attestation and ownership information to another of the connectivity management system client module and the baseboard management controller.

10. The system of claim 9 , wherein:
the connectivity management system client module communicates with the baseboard management controller via an internal data center asset communication channel.

11. The system of claim 9 , wherein:
the baseboard management controller provides an initial trust exchange with the connectivity management system.

12. The system of claim 9 , wherein:
the baseboard management controller safely stores private security information on behalf of the connectivity management system client module.

13. A non-transitory, computer-readable storage medium embodying computer program code, the computer program code comprising computer executable instructions configured for:
providing a data center asset with a connectivity management system client module;
establishing a connection between the connectivity management system client module and a connectivity management system of a data center monitoring and management console, the connectivity management system comprising a connectivity management system aggregator and a connectivity management system service;
exchanging attestation and proof of ownership information between the connectivity management system client module and the connectivity management system service of the connectivity management system;
establishing a secure communication channel between the connectivity management system client module and the connectivity management system aggregator based upon the attestation and proof of ownership information; and,
exchanging information between the connectivity management system client module and the data center monitoring and management console via the secure communication channel between the connectivity management system client module and the connectivity management system aggregator.

14. The non-transitory, computer-readable storage medium of claim 13 , wherein the instructions executable by the processor are further configured for:
signing the attestation and proof of ownership messages prior to exchanging information between the connectivity management system client module and the data center monitoring and management console.

15. The non-transitory, computer-readable storage medium of claim 13 , wherein:
the data center asset comprises a baseboard management controller;
the attestation and ownership information are provided by the connectivity management system service; and,
at least one of the connectivity management system client module and the baseboard management controller provide the attestation and ownership information to another of the connectivity management system client module and the baseboard management controller.

16. The non-transitory, computer-readable storage medium of claim 15 , wherein:
the connectivity management system client module communicates with the baseboard management controller via an internal data center asset communication chann

Assignees

• Dell Products Lp

Inventors

• Jreij Elie A
• Prunier Dominique
• Shetty Sudhir V
• Williams Eric
• Brown Michael E

Classifications

• H04L63/04 Primary

  for providing a confidential data exchange among entities communicating through data packet networks · CPC title

• H04L67/141

  Setup of application sessions (admission control or resource allocation in data switching networks H04L47/70) · CPC title