Managing trusted platform module (tpm) replacement at an information handling system

Patent metadata

Field	Value
Publication number	US-2025356062-A1
Application number	US-202418664426-A
Country	US
Kind code	A1
Filing date	May 15, 2024
Priority date	May 15, 2024
Publication date	Nov 20, 2025
Grant date	—

Abstract

Managing TPM replacement at a IHS, including encrypting, by the client IHS, a storage device at the client IHS utilizing a first TPM and first keys; providing, by the client IHS and to the management server IHS, the first keys; storing the first keys at a database; detecting replacement of the first TPM with a second TPM at the client IHS, and in response: requesting, by the client IHS, the first keys; receiving, from the management server IHS, the first keys; decrypting, by the client IHS, the storage device at the client IHS utilizing the second TPM and the first keys; encrypting, by the client IHS, the storage device at the client IHS utilizing the second TPM and second keys differing from the first keys; providing, to the management server IHS, the second keys; and storing the second keys at the database.

First claim

What is claimed is:

1 . A computer-implemented method of managing trusted platform module (TPM) replacement at a client information handling system (IHS), including:
registering the client IHS to a management server information handling system (IHS); encrypting, by the client IHS at a first time, a storage device at the client IHS utilizing a first TPM and first keys; providing, by the client IHS and to the management server IHS, the first keys; storing, by the management server IHS, the first keys at a database; detecting, at a second time after the first time, replacement of the first TPM with a second TPM at the client IHS, and in response:
requesting, by the client IHS and to the management server IHS, the first keys;
receiving, from the management server IHS and by the client IHS, the first keys;
decrypting, by the client IHS, the storage device at the client IHS utilizing the second TPM and the first keys;
encrypting, by the client IHS, the storage device at the client IHS utilizing the second TPM and second keys differing from the first keys;
providing, by the client IHS and to the management server IHS, the second keys; and
storing, by the management server IHS, the second keys at the database.

2 . The computer-implemented method of claim 1 , further including:
storing, at the first TPM, additional keys and certifications; providing, by the client IHS and to the management server IHS, the additional keys and the certifications; and storing, by the management server IHS, the additional keys and the certifications at the database.

3 . The computer-implemented method of claim 2 , further including:
identifying, by the client IHS, an adjustment of the additional keys; and periodically syncing the additional keys and the certifications with the management server IHS, including the adjustment of the additional keys.

4 . The computer-implemented method of claim 3 , wherein requesting the first keys further includes requesting the additional keys and the certifications, the method further including receiving, from the management server IHS and by the client IHS, the additional keys and the certifications.

5 . The computer-implemented method of claim 1 , wherein detecting replacement of the first TPM with the second TPM further includes detecting a failure to boot of the storage device.

6 . The computer-implemented method of claim 1 , wherein the first keys and the second keys are stored at the database in an encrypted format.

7 . A computing environment, including:
a server management information handling system comprising a processor having access to memory media storing instructions executable by the processor to perform operations; a client information handling system comprising a processor having access to memory media storing instructions executable by the processor to perform operations, comprising:
registering the client IHS to a management server information handling system (IHS);
encrypting, at a first time, a storage device at the client IHS utilizing a first TPM and first keys;
providing, to the management server IHS, the first keys;
wherein the management server IHS is configured to perform operations:
storing the first keys at a database;
wherein the client IHS is configured to perform operations:
detecting, at a second time after the first time, replacement of the first TPM with a second TPM at the client IHS, and in response:
requesting, to the management server IHS, the first keys;
receiving, from the management server IHS, the first keys;
decrypting the storage device at the client IHS utilizing the second TPM and the first keys;
encrypting the storage device at the client IHS utilizing the second TPM and second keys differing from the first keys;
providing, to the management server IHS, the second keys; and

wherein the management server IHS is configured to perform operations:
storing the second keys at the database.

8 . The computing environment of claim 7 ,
wherein the client IHS is configured to perform operations:
storing, at the first TPM, additional keys and certifications;
providing, to the management server IHS, the additional keys and the certifications; and
wherein the management server IHS is configured to perform operations:
storing the additional keys and the certifications at the database.

9 . The computing environment of claim 8 ,
wherein the client IHS is configured to perform operations:
identifying an adjustment of the additional keys; and
periodically syncing the additional keys and the certifications with the management server IHS, including the adjustment of the additional keys.

10 . The computing environment of claim 9 , wherein requesting the first keys further includes requesting the additional keys and the certifications, the method further including receiving, from the management server IHS and by the client IHS, the additional keys and the certifications.

11 . The computing environment of claim 7 , wherein detecting replacement of the first TPM with the second TPM further includes detecting a failure to boot of the storage device.

12 . The computing environment of claim 7 , wherein the first keys and the second keys are stored at the database in an encrypted format.

13 . A non-transitory computer-readable medium storing software comprising instructions executable by one or more computers which, upon such execution, cause the one or more computers to perform operations comprising:
registering the client IHS to a management server information handling system (IHS);
encrypting, by the client IHS at a first time, a storage device at the client IHS utilizing a first TPM and first keys;
providing, by the client IHS and to the management server IHS, the first keys;
storing, by the management server IHS, the first keys at a database;
detecting, at a second time after the first time, replacement of the first TPM with a second TPM at the client IHS, and in response:
requesting, by the client IHS and to the management server IHS, the first keys;
receiving, from the management server IHS and by the client IHS, the first keys;
decrypting, by the client IHS, the storage device at the client IHS utilizing the second TPM and the first keys;
encrypting, by the client IHS, the storage device at the client IHS utilizing the second TPM and second keys differing from the first keys;
providing, by the client IHS and to the management server IHS, the second keys; and
storing, by the management server IHS, the second keys at the database.

14 . The non-transitory computer-readable medium of claim 13 , the operations further including:
storing, at the first TPM, additional keys and certifications; providing, by the client IHS and to the management server IHS, the additional keys and the certifications; and storing, by the management server IHS, the additional keys and the certifications at the database.

15 . The non-transitory computer-readable medium of claim 14 , the operations further including:
identifying, by the client IHS, an adjustment of the additional keys; and periodically syncing the additional keys and the certifications with the management server IHS, including the adjustment of the additional keys.

16 . The non-transitory computer-readable medium of claim 15 , wherein requesting the first keys further includes requesting the additional keys and the certifications, the method further including receiving, from the management server IHS and by the client IHS, the additional keys and the certifications.

17 . The non

Assignees

• Dell Products Lp

Inventors

• Jain Shailesh Hastimal
• Vajravel Gokul Thiruchengode
• H V Ramanaa

Classifications

• G06F21/575

  Secure boot · CPC title

• G06F21/602

  Providing cryptographic facilities or services · CPC title

• G06F2221/2107

  File encryption · CPC title

• G06F21/78 Primary

  to assure secure storage of data (address-based protection against unauthorised use of memory G06F12/14; record carriers for use with machines and with at least a part designed to carry digital markings G06K19/00) · CPC title