Compounded intrinsic identities for information handling systems (IHSs)

Patent metadata

Field	Value
Publication number	US-12519641-B2
Application number	US-202318184186-A
Country	US
Kind code	B2
Filing date	Mar 15, 2023
Priority date	Mar 15, 2023
Publication date	Jan 6, 2026
Grant date	Jan 6, 2026

Abstract

Systems and methods for producing, using, and managing Compounded Intrinsic Identities (CIIS) for Information Handling Systems (IHSs) are described. In an illustrative, non-limiting embodiment, an IHS may include a processor and a memory coupled to the processor, the memory having program instructions stored thereon that, upon execution by the processor, cause the IHS to: receive a first indication of a first variable associated with a unique physical or electrical aspect of a first IHS component, receive a second indication of a second variable associated with a unique physical or electrical aspect of a second IHS component, and produce at least one identity seed associated with the IHS based, at least in part, upon a combination of the first and second indications.

First claim

The invention claimed is:

1 . An Information Handling System (IHS), comprising:
a processor; and a memory coupled to the processor, the memory configured with program instructions stored thereon that, upon execution by the processor, cause the IHS to perform operations upon IHS boot in response to an asynchronous reset of the processor, wherein the operations comprise:
receive a first indication that comprises a first variable associated with a unique physical or electrical aspect of a first IHS component;
permit initialization upon IHS boot of a Peripheral Component Interconnect Express (PCIe) communication link configured in a PCIe bus in the IHS, wherein initialization of the PCIe communication link comprises train the PCIe communication link, and wherein the PCIe bus interconnects a plurality of PCIe peripherals that comprise at least one pluggable PCIe card;
obtain a PCle communication link train voltage while the PCIe communication link is trained, via a sense lead electrically connected to a second IHS component that comprises the PCIe bus, wherein a value of the PCIe communication link train voltage is a second indication of a second variable associated with a unique electrical aspect of the second IHS component;
apply a first one-way function (ONF) to the first variable to produce a first ONF output;
apply a second ONF to the value of the PCIe communication link train voltage to produce a second ONF output;
concatenate the second ONF output onto a previous second ONF output, to produce a concatenated second ONF output;
produce at least one identity seed associated with the IHS based, at least in part, upon a combination of the first ONF output and the concatenated second ONF output;
log changes to the at least one identity seed as a function of time; and
trigger a notification based, at least in part, upon a frequency of logged changes to the at least one identity seed.

2 . The IHS of claim 1 , wherein the processor comprises an Embedded Controller (EC) or a Baseboard Management Controller (BMC).

3 . The IHS of claim 1 , wherein the first IHS component is selected from the group consisting of: the processor, a Central Processing Unit (CPU), a Graphics Processing Unit (GPU), a Trusted Platform Module (TPM), a Systems-On-Chip (SoC), and a voltage regulator.

4 . The IHS of claim 1 , wherein the first IHS component is selected from the group consisting of: a pluggable Peripheral Component Interconnect Express (PCIe) card, a Power Supply Unit (PSU), and a pluggable Datacenter-ready Secure Control Module (DC-SCM).

5 . The IHS of claim 1 , wherein at least one of the first or second variables further comprises an immutable variable.

6 . The IHS of claim 5 , wherein the immutable variable comprises a voltage calibration value.

7 . The IHS of claim 1 , wherein at least one of the first or second variables further comprises a mutable variable.

8 . The IHS of claim 7 , wherein the at least one of the first or second mutable variables further comprises at least one of: an undervoltage interrupt register value, a voltage rail level, a switch status, an analog-to-digital calibration value, a digital-to-analog calibration value, or one or more PCIe link train data variables selected from the group consisting of calibration, sweep voltage, and strength.

9 . The IHS of claim 1 , wherein further program instructions, upon execution, cause the IHS to perform further operations comprising produce the at least one identity seed based, at least in part, on the first ONF output, the concatenated second ONF output, and at least one Key Derivation Function (KDF).

10 . The IHS of claim 1 , wherein further program instructions, upon execution, cause the IHS to perform further operations comprising create a cryptographic key pair usable to uniquely identify the IHS based, at least in part, upon the at least one identity seed.

11 . The IHS of claim 10 , wherein the cryptographic key pair is created based upon a combination of indications of exclusively immutable variables.

12 . The IHS of claim 11 , wherein further program instructions, upon execution, cause the IHS to perform further operations comprising provide a public key portion of the cryptographic key pair to a service configured to verify or attest an identify of the IHS.

13 . The IHS of claim 10 , wherein the cryptographic key pair is created based upon a combination of indications of mutable and immutable variables.

14 . The IHS of claim 13 , wherein further program instructions, upon execution, cause the IHS to perform further operations comprising provide a public key portion of the cryptographic key pair to a service configured to notify a user or Information Technology Decision Maker (ITDM) of a hardware change with respect to the IHS.

15 . A memory device configured with program instructions stored thereon that, upon execution by a processor configured in an Embedded Controller (EC) or Baseboard Management Controller (BMC) of an Information Handling System (IHS), cause the EC or BMC to perform operations upon IHS boot in response to an asynchronous reset of the processor, wherein the operations comprise:
receive a first indication that comprises a first variable associated with a unique physical or electrical aspect of a first IHS component; permit initialization upon IHS boot of a Peripheral Component Interconnect Express (PCIe) communication link configured in a PCle bus in the IHS, wherein initialization of the PCIe communication link comprises train the PCIe communication link, and wherein the PCIe bus interconnects a plurality of PCIe peripherals that comprise at least one pluggable PCIe card; obtain a PCIe communication link train voltage while the PCIe communication link is trained, via a sense lead electrically connected to a second IHS component that comprises the PCIe bus, wherein a value of the PCIe communication link train voltage is a second indication of a second variable associated with a unique electrical aspect of the second IHS component; apply a first one-way function (ONF) to the first variable to produce a first ONF output; apply a second ONF to the value of the PCIe communication link train voltage to produce a second ONF output; concatenate the second ONF output onto a previous second ONF output, to produce a concatenated second ONF output; produce at least one identity seed associated with the IHS based, at least in part, upon a combination of the first ONF output and the concatenated second ONF output; create a cryptographic key pair usable to uniquely identify the IHS based, at least in part, upon the at least one identity seed; log changes to the at least one identity seed as a function of time; and trigger a notification based, at least in part, upon a frequency of logged changes to the at least one identity seed.

16 . The memory device of claim 15 , wherein the at least one identity seed is produced based upon indications of exclusively immutable variables associated with the unique physical or electrical aspects, and wherein further program instructions, upon execution, further cause the IHS to perform operations that comprise provide a public key portion of the cryptographic key pair to a service configured to: verify or attest an identity of the IHS, or detect tampering with the IHS.

17 . The memory device of claim 15 , wherein the at least one identity seed is produced based upon indications of mutable and immutable variables associated with the unique physical or electrical aspects, and wherein further program instructions, upon execution, further c

Assignees

• Dell Products Lp

Inventors

• Cho Eugene David
• Taveira Milton Olavo Decarvalho
• Khatri Mukund P

Classifications

• H04L9/0825

  using asymmetric-key encryption or public key infrastructure [PKI], e.g. key signature or public key certificates · CPC title

• H04L9/0838 Primary

  Key agreement, i.e. key establishment technique in which a shared key is derived by parties as a function of information contributed by, or associated with, each of these (network architectures or network communication protocols for key exchange in a packet data network H04L63/061) · CPC title

• H04L9/0866

  involving user or device identifiers, e.g. serial number, physical or biometrical information, DNA, hand-signature or measurable physical characteristics · CPC title

• H04L9/32 Primary

  including means for verifying the identity or authority of a user of the system {or for message authentication, e.g. authorization, entity authentication, data integrity or data verification, non-repudiation, key authentication or verification of credentials} · CPC title