LCS trust system

Patent metadata

Field	Value
Publication number	US-12430439-B2
Application number	US-202418418462-A
Country	US
Kind code	B2
Filing date	Jan 22, 2024
Priority date	Jan 22, 2024
Publication date	Sep 30, 2025
Grant date	Sep 30, 2025

Abstract

An LCS trust system includes resource devices including respective resource device pTPMs, and an SCP device including an SCP device pTPM and providing a resource management system with a resource management system vTPM. The resource management system uses the resource management system vTPM to establish a first trust relationship with the SCP device via the SCP device pTPM, and respective second trust relationships with each of the resource devices via their respective resource device pTPMs. The resource management system the uses a subset of the resource devices to provide an LCS that includes an LCS vTPM and that uses the LCS vTPM to establish a respective third trust relationship with each of the subset of the resource devices via their respective resource device pTPMs. As such, a chain of trust is provided for the LCS that is based at least upon the first, respective second, and respective third trust relationships.

First claim

What is claimed is:

1. A Logically Composed System (LCS) trust system, comprising:
a plurality of first resource devices that each include a respective first resource device physical Trusted Platform Module (pTPM);
a first System Control Processor (SCP) device that includes a first SCP device pTPM; and
a resource management system that is provided by the first SCP device, that includes a resource management system virtual Trusted Platform Module (vTPM), and that is configured to:
establish, using the resource management system vTPM, a first trust relationship with the first SCP device via the first SCP device pTPM;
establish, using the resource management system vTPM, a respective second trust relationship with each of the plurality of first resource devices via the respective first resource device pTPM that is included in that first resource device; and
provide, using a first subset of the plurality of first resource devices, a Logically Composed System (LCS) that includes an LCS vTPM and that is configured to:
establish, using the LCS vTPM, a respective third trust relationship with each of the first subset of the plurality of first resource devices via the respective first resource device pTPM in that first resource device in order to provide a first chain of trust for the LCS that is based at least upon:
the first trust relationship established between the resource management system and the first SCP device;
the respective second trust relationships between the resource management system and each of the first subset of the plurality of first resource devices; and
the respective third trust relationship between each of the first subset of the plurality of first resource devices and the LCS.

2. The system of claim 1 , further comprising:
a second resource device that includes a second resource device pTPM, that provides the resource management system along with the first SCP device, and that is configured to:
establish, using the second resource device pTPM, a fourth trust relationship with the first SCP device via the first SCP device pTPM, wherein the resource management system is configured to establish the first trust relationship with the first SCP device by establishing, using the resource management system vTPM, a fifth trust relationship with the second resource device via the second resource device pTPM such that the first trust relationship established between the resource management system and the first SCP device is based at least upon:
the fourth trust relationship established between the second resource device and the first SCP device; and
the fifth trust relationship established between the second resource device and the resource management system.

3. The system of claim 1 , further comprising:
a respective second SCP device including a respective second SCP device pTPM and coupling each of the first subset of the plurality of first resource devices to the resource management system, wherein each respective second SCP device is configured to:
establish, using the respective second SCP device pTPM in that respective second SCP device, a fourth trust relationship with its first resource device via the respective first resource device pTPM in that first resource device, wherein the resource management system is configured to establish the respective second trust relationship with each of the plurality of first resource devices by establishing, using the resource management system vTPM, a fifth trust relationship with each of the respective second SCP devices via the respective second SCP device pTPM in that respective second SCP device such that each respective second trust relationship established between the resource management system and each of the first subset of the plurality of first resource devices is based at least upon:
the fourth trust relationship established between each respective second SCP device and its first resource device; and
the fifth trust relationship established between each respective second SCP device and the resource management system.

4. The system of claim 1 , wherein the resource management system is configured to:
provide, using a second subset of the plurality of first resource devices that is different than the first subset of the plurality of first resource devices, the LCS that is configured to:
establish, using the LCS vTPM, a respective fourth trust relationship with each of the second subset of the plurality of first resource devices via the respective first resource device pTPM in that first resource device in order to provide a second chain of trust for the LCS that is based at least upon:
the first trust relationship established between the resource management system and the first SCP device;
the respective second trust relationships between the resource management system and each of the second subset of the plurality of first resource devices; and
the respective fourth trust relationship between each of the second subset of the plurality of first resource devices and the LCS.

5. The system of claim 1 , wherein the LCS vTPM includes an LCS vTPM endorsement key generated using at least a first SCP device pTPM endorsement key from the first SCP device pTPM included in the first SCP device, and a respective first resource device pTPM endorsement key from each of the respective first resource device pTPMs included in each of the first subset of the plurality of first resource devices.

6. The system of claim 1 , wherein the resource management system vTPM includes a resource management system vTPM endorsement key generated using at least a first SCP device pTPM endorsement key from the first SCP device pTPM included in the first SCP device.

7. An Information Handling System (IHS), comprising:
a processing system; and
a memory system that is coupled to the processing system and that includes instructions that, when executed by the processing system, cause the processing system to provide a resource management engine that is configured to:
establish, using a resource management engine virtual Trusted Platform Module (vTPM) that is included in the resource management engine, a first trust relationship with a first System Control Processor (SCP) device that includes at least a portion of the processing system that provides the resource management engine via a first SCP device physical Trusted Platform Module (pTPM) that is included in the first SCP device;
establish, using the resource management engine vTPM, a respective second trust relationship with each of a plurality of first resource devices via a respective first resource device pTPM that is included in that first resource device; and
provide, using a first subset of the plurality of first resource devices, a Logically Composed System (LCS) that includes an LCS vTPM and that is configured to:
establish, using the LCS vTPM, a respective third trust relationship with each of the first subset of the plurality of first resource devices via the respective first resource device pTPM in that first resource device in order to provide a first chain of trust for the LCS that is based at least upon:
the first trust relationship established between the resource management system and the first SCP device;
the respective second trust relationships between the resource management system and each of the first subset of the plurality of first resource devices; and
the respective third trust relationship between each of the first subset of the plurality of first resource devices and the LCS.

8. The IHS of claim 7 , wherein resource management engine is configured to:
establish the first trust relationship with the first SCP device by establishing, using the resource management system vTPM, a fourth trust relationship with a

Assignees

• Dell Products Lp

Inventors

• Farley Douglas Lang
• Gowda Srinivas Giri Raju
• Cho Eugene David
• Cockrell Trevor Christian
• Lawson David Craig

Classifications

• G06F21/57 Primary

  Certifying or maintaining trusted computer platforms, e.g. secure boots or power-downs, version controls, system software checks, secure updates or assessing vulnerabilities · CPC title