Systems and methods for streamlined platform component attestation

Patent metadata

Field	Value
Publication number	US-12592836-B2
Application number	US-202418780898-A
Country	US
Kind code	B2
Filing date	Jul 23, 2024
Priority date	Jul 23, 2024
Publication date	Mar 31, 2026
Grant date	Mar 31, 2026

Abstract

Systems and methods for streamlined platform attestation are described. In an illustrative, non-limiting embodiment, an Information Handling System (IHS) may include a processor and a memory coupled to the processor. The memory may have program instructions stored thereon that, upon execution, cause the IHS to: read root certificates for a plurality of components of the IHS; and embed the root certificates for the plurality of components into a platform certificate.

First claim

The invention claimed is:

1 . An Information Handling System (IHS), comprising:
a hardware processor; and a memory coupled to the hardware processor, the memory having program instructions stored thereon that, upon execution, cause the IHS to: read root certificates for a plurality of components of the IHS; and embed the root certificates for the plurality of hardware components into a platform certificate.

2 . The IHS of claim 1 , wherein the plurality of hardware components comprises at least one of: the hardware processor, the memory, a Graphics Processing Unit (GPU), a storage device, a network adapter, a power supply unit, a fan controller, an Input/Output (I/O) controller, a sensor, a Trusted Platform Module (TPM), or an Artificial Intelligence (AI)/Machine Learning (ML) device.

3 . The IHS of claim 2 , wherein the hardware components are manufactured by one or more third-party suppliers or an Original Equipment Manufacturer (OEM).

4 . The IHS of claim 1 , wherein the program instructions, upon execution, cause the IHS to:
read the root certificates for the plurality of hardware components from a database; and insert the root certificates into a Certificate Signing Request (CSR).

5 . The IHS of claim 4 , wherein to embed the root certificates for the plurality of hardware components into the platform certificate, the program instructions, upon execution, cause the IHS to submit the CSR to a Certificate Authority (CA).

6 . The IHS of claim 5 , wherein the CSR comprises a signed blob of data for each of the plurality of hardware components and a root certificate for each of the plurality of hardware components.

7 . The IHS of claim 6 , wherein the program instructions, upon execution, further cause the IHS to issue another CSR to the CA in response to a change to the one or more of the plurality of hardware components.

8 . The IHS of claim 1 , wherein the program instructions, upon execution, further cause the IHS to receive an updated platform certificate from the CA.

9 . The IHS of claim 1 , wherein the program instructions, upon execution, further cause the IHS to receive a request to verify one or more of the plurality of hardware components.

10 . The IHS of claim 9 , wherein the program instructions, upon execution, further cause the IHS to provide the platform certificate to a verifier, wherein the verifier is configured to verify an identity of the one or more of the plurality of hardware components based upon one or more corresponding root certificates embedded into the platform certificate.

11 . The IHS of claim 9 , wherein the program instructions, upon execution, further cause the IHS to provide the chain of certificates and signed blob of data from each of the plurality of hardware components to the verifier.

12 . A method, comprising:
receiving, by a verifier associated with a manufacturer of an Information Handling System (IHS), a platform certificate associated with the IHS, wherein the platform certificate comprises one or more root certificates for a plurality of hardware components of the IHS; and cryptographically verifying, by the verifier based upon the one or more root certificates, identities of the plurality of hardware components.

13 . The method of claim 12 , wherein the plurality of hardware components comprise at least one of: the hardware processor, the memory, a Graphics Processing Unit (GPU), a storage device, a network adapter, a power supply unit, a fan controller, an Input/Output (I/O) controller, a sensor, a Trusted Platform Module (TPM), or an Artificial Intelligence (AI)/Machine Learning (ML) device.

14 . The method of claim 12 , wherein the plurality of hardware components are manufactured by third-party suppliers or the manufacturer of the IHS.

15 . The method of claim 12 , wherein the platform certificate is signed by a Certificate Authority (CA) in response to a Certificate Signing Request (CSR) submitted by the IHS, and wherein the CSR comprises the one or more root certificates for the plurality of hardware components.

16 . A hardware memory device having program instructions stored thereon that, upon execution by a hardware processor of an Information Handling System (IHS), cause the IHS to: embed root certificates for a plurality of hardware components of the IHS into a platform certificate, wherein the root certificates are cryptographically trusted by different verifiers associated with manufacturers; and
verify the plurality of hardware components based upon the platform certificate through a verifier associated with a manufacturer of the IHS.

17 . The hardware memory device of claim 16 , wherein to embed the root certificates, the program instructions, upon execution by the hardware processor, cause the IHS to issue a Certificate Signing Request (CSR) to a Certificate Authority (CA).

18 . The hardware memory device of claim 17 , wherein the CSR comprises the root certificates.

19 . The hardware memory device of claim 17 , wherein the hardware processor is part of a heterogeneous computing platform selected from the group consisting of: a System-On-Chip (SoC), a Field-Programmable Gate Array (FPGA), and an Application-Specific Integrated Circuit (ASIC).

20 . The hardware memory device of claim 19 , wherein the heterogeneous computing platform comprises a Reduced Instruction Set Computer (RISC) processor coupled to the hardware processor via an interconnect, and wherein the interconnect comprises at least one of: an Advanced Microcontroller Bus Architecture (AMBA) bus, a QuickPath Interconnect (QPI) bus, or a HyperTransport (HT) bus.

Assignees

• Dell Products Lp

Inventors

• Kwon Hongsoon
• Nelogal Chandrashekar
• YOUNG Jason Matthew
• Rash Michael

Classifications

• H04L9/3265

  using certificate chains, trees or paths; Hierarchical trust model · CPC title

• H04L9/3263 Primary

  involving certificates, e.g. public key certificate [PKC] or attribute certificate [AC]; Public key infrastructure [PKI] arrangements (network architectures or network communication protocols for supporting authentication of entities using certificates in a packet data network H04L63/0823) · CPC title