Systems and methods for hardware root of trust with protected redundant memory for authentication failure scenarios

Patent metadata

Field	Value
Publication number	US-2021216640-A1
Application number	US-202016740277-A
Country	US
Kind code	A1
Filing date	Jan 10, 2020
Priority date	Jan 10, 2020
Publication date	Jul 15, 2021
Grant date	—

Abstract

A cryptoprocessor may comprise processing logic configured to upon powering up of a management controller communicatively coupled to a processor of an information handling system and configured to provide management of the information handling system via management traffic communicated between the management controller and a dedicated management network external to the information handling system, preventing the management controller from booting, attempt to authenticate a primary executable code image stored in a primary memory and a backup image to the primary executable code image stored in a secondary memory, and responsive to at least one of the primary executable code image and the backup image being authenticated, allow the management controller to execute an authenticated image comprising one of the primary executable code image and the backup image.

First claim

What is claimed is:

1 . An information handling system comprising:
a processor; a management controller communicatively coupled to the processor and configured to provide management of the information handling system via management traffic communicated between the management controller and a dedicated management network external to the information handling system; a primary memory for storing a primary executable code image associated with the management controller; a secondary memory for storing a backup image to the primary executable code image; and a cryptoprocessor communicatively coupled to the management controller and configured to:
upon powering up of the management controller, preventing the management controller from booting from either of the primary executable code image and the backup image;
attempt to authenticate the primary executable code image and the backup image; and
responsive to at least one of the primary executable code image and the backup image being authenticated, allow the management controller to execute an authenticated image comprising one of the primary executable code image and the backup image.

2 . The information handling system of claim 1 , wherein the cryptoprocessor is further configured to, responsive to one of the primary executable code image and the backup image failing authentication, prevent the management controller from accessing a memory comprising one of the primary memory and the secondary memory having stored thereon the one of the primary executable code image and the backup image that failed authentication.

3 . The information handling system of claim 1 , wherein the cryptoprocessor is further configured to, responsive to one of the primary executable code image and the backup image failing authentication, communicate an indication to the management controller of such failed authentication.

4 . The information handling system of claim 3 , wherein, responsive to the indication, the management controller is configured to request the cryptoprocessor to allow the management controller to access a memory comprising one of the primary memory and the secondary memory having stored thereon the one of primary executable code image and the backup image that failed authentication, to allow the management controller to recover the one of the primary executable code image and the backup image that failed authentication.

5 . The information handling system of claim 1 , wherein the cryptoprocessor is further configured to, responsive to both of the primary executable code image and the backup image being authenticated, prevent the management controller from accessing the secondary memory during runtime of the management controller in absence of an authenticated sideband request to the secondary memory.

6 . The information handling system of claim 1 , wherein the management controller comprises a baseboard management controller.

7 . The information handling system of claim 1 , wherein the primary executable code image comprises a bootloader of the management controller.

8 . A method comprising, in an information handling system comprising a processor, a management controller communicatively coupled to the processor and configured to provide management of the information handling system via management traffic communicated between the management controller and a dedicated management network external to the information handling system, a primary memory for storing a primary executable code image associated with the management controller, and a secondary memory for storing a backup image to the primary executable code image:
upon powering up of the management controller, preventing the management controller from booting from either of the primary executable code image and the backup image; attempting to authenticate the primary executable code image and the backup image; and responsive to at least one of the primary executable code image and the backup image being authenticated, allow the management controller to execute an authenticated image comprising one of the primary executable code image and the backup image.

9 . The method of claim 8 , further comprising, responsive to one of the primary executable code image and the backup image failing authentication, preventing the management controller from accessing a memory comprising one of the primary memory and the secondary memory having stored thereon the one of the primary executable code image and the backup image that failed authentication.

10 . The method of claim 8 , further comprising, responsive to one of the primary executable code image and the backup image failing authentication, communicating an indication to the management controller of such failed authentication.

11 . The method of claim 10 , wherein, responsive to the indication, the management controller is configured to request access to a memory comprising one of the primary memory and the secondary memory having stored thereon the one of the primary executable code image and the backup image that failed authentication, to allow the management controller to recover the one of the primary executable code image and the backup image that failed authentication.

12 . The method of claim 8 , further comprising, responsive to both of the primary executable code image and the backup image being authenticated, preventing the management controller from accessing the secondary memory during runtime of the management controller in absence of an authenticated sideband request to the secondary memory.

13 . The method of claim 8 , wherein the management controller comprises a baseboard management controller.

14 . The method of claim 8 , wherein the primary executable code image comprises a bootloader of the management controller.

15 . A cryptoprocessor comprising processing logic configured to:
upon powering up of a management controller communicatively coupled to a processor of an information handling system and configured to provide management of the information handling system via management traffic communicated between the management controller and a dedicated management network external to the information handling system, preventing the management controller from booting; attempt to authenticate a primary executable code image stored in a primary memory and a backup image to the primary executable code image stored in a secondary memory; and responsive to at least one of the primary executable code image and the backup image being authenticated, allow the management controller to execute an authenticated image comprising one of the primary executable code image and the backup image.

16 . The cryptoprocessor of claim 15 , wherein the cryptoprocessor is further configured to, responsive to one of the primary executable code image and the backup image failing authentication, prevent the management controller from accessing a memory comprising one of the primary memory and the secondary memory having stored thereon the one of the primary executable code image and the backup image that failed authentication.

17 . The cryptoprocessor of claim 15 , wherein the cryptoprocessor is further configured to, responsive to one of the primary executable code image and the backup image failing authentication, communicate an indication to the management controller of such failed authentication.

18 . The cryptoprocessor of claim 17 , wherein, responsive to the indication, the management controller is configured to request the cryptoprocessor to allow the management controller to access a memory co

Assignees

• Dell Products Lp

Inventors

• Boyle Richard J
• Wrobel Andrew
• Kakarla Samant
• Mcdaniel Ryan C

Classifications

• G06F11/1666

  where the redundant component is memory or memory area · CPC title

• G06F11/1417

  Boot up procedures · CPC title

• G06F21/78

  to assure secure storage of data (address-based protection against unauthorised use of memory G06F12/14; record carriers for use with machines and with at least a part designed to carry digital markings G06K19/00) · CPC title

• G06F21/72

  in cryptographic circuits · CPC title

• G06F21/575 Primary

  Secure boot · CPC title