System and method for secure provisioning of an information handling system

Patent metadata

Field	Value
Publication number	US-9166798-B2
Application number	US-201314074940-A
Country	US
Kind code	B2
Filing date	Nov 8, 2013
Priority date	Oct 17, 2008
Publication date	Oct 20, 2015
Grant date	Oct 20, 2015

Abstract

Systems and methods for reducing problems and disadvantages associated with provisioning of information handling systems, including without limitation those associated with bare metal provisioning of information handling systems, are disclosed. A system may include a processor, and a memory and an access controller each communicatively coupled to the processor. The access controller may store an enterprise public key associated with an enterprise private key and a platform private key associated with the system. The access controller may be configured to: (i) authenticate communications received from a provisioning server communicatively coupled to the access controller based at least on an enterprise public certificate associated with the provisioning server and (ii) establish an asymmetrically cryptographic communications channel between the access controller and the provisioning server based at least on a platform public key associated with the platform private key, the platform private key, the enterprise public key, and the enterprise private key.

First claim

What is claimed is:

1. An information handling system comprising:
a processor;
a memory communicatively coupled to the processor; and
an access controller communicatively coupled to the processor, the access controller having stored thereon an enterprise public key associated with an enterprise private key and a platform private key associated with the information handling system, the enterprise public key stored on the access controller prior to shipment of the information handling system to an enterprise associated with the enterprise public key, the access controller configured to:
establish an asymmetrically cryptographic communications channel between the access controller and a provisioning server based on keys, comprising a platform public key associated with the platform private key, the platform private key, the enterprise public key, and the enterprise private key, the platform public key encrypted using the enterprise public key and provided to the enterprise by a supplier; and
enable the information handling system to receive provisioning information from the provisioning server via the established communications channel, the provisioning information used to configure the information handling system.

2. The information handling system of claim 1 , the access controller further configured to encrypt communications to the provisioning server using the enterprise public key.

3. The information handling system of claim 1 , the access controller further configured to decrypt communications from the provisioning server using the platform private key.

4. The information handling system of claim 1 , the access controller further configured to provision the information handling system via communications received via the asymmetrically cryptographic communications channel.

5. The information handling system of claim 1 , the access controller further configured to establish a second asymmetrically cryptographic communications channel between the access controller and the provisioning server based at least on enterprise-provided credentials other than the enterprise public key and the enterprise private key.

6. The information handling system of claim 5 , the access controller further configured to provision the information handling system via communications received via the second asymmetrically cryptographic communications channel.

7. A non-transitory computer-readable medium, comprising instructions that, when executed by a processor, are configured to:
store an enterprise public key associated with an enterprise private key and a platform private key on an access controller associated with an information handling system, the enterprise public key stored on the access controller prior to shipment of the information handling system to an enterprise associated with the enterprise public key by a supplier;
communicate a platform public key associated with the platform private key from a supplier to the enterprise, the platform public key encrypted by the supplier using the enterprise public key; and
store a set of computer-readable instructions on the access controller, the set of computer-readable instructions configured to:
establish an asymmetrically cryptographic communications channel between the access controller and a provisioning server based on keys, comprising the platform public key, the platform private key, the enterprise public key, and the enterprise private key; and
enable the information handling system to receive provisioning information from the provisioning server via the established communications channel, the provisioning information used to configure the information handling system.

8. The non-transitory computer-readable medium of claim 7 , the set of instructions stored on the access controller further configured to encrypt communications to the provisioning server using the enterprise public key.

9. The non-transitory computer-readable medium of claim 7 , the set of instructions stored on the access controller further configured to decrypt communications from the provisioning server using the platform private key.

10. The non-transitory computer-readable medium of claim 7 , the set of instructions stored on the access controller further configured to provision the information handling system via communications received via the asymmetrically cryptographic communications channel.

11. The non-transitory computer-readable medium of claim 7 , the set of instructions stored on the access controller further configured to establish a second asymmetrically cryptographic communications channel between the access controller and the provisioning server based at least on enterprise-provided credentials other than the enterprise public key and the enterprise private key.

12. The non-transitory computer-readable medium of claim 11 , the set of instructions stored on the access controller further configured to provision the information handling system via communications received via the second asymmetrically cryptographic communications channel.

13. The non-transitory computer-readable medium of claim 7 , the instructions further configured to receive the enterprise public key from the enterprise.

14. A method for secure provisioning of an information handling system, comprising:
providing a supplier of an information handling system with an enterprise public key associated with an enterprise private key;
receiving from the supplier a platform public key associated with a platform private key, the platform public key encrypted using the enterprise public key;
storing the enterprise private key and the platform public key on computer-readable media associated with a provisioning server; and
establishing an asymmetrically cryptographic communications channel between the provisioning server and the access controller based on keys, comprising the platform public key, the platform private key, the enterprise public key, and the enterprise private key, the enterprise public key stored on the access controller prior to shipment of the information handling system to an enterprise; and
enabling the information handling system to receive provisioning information from the provisioning server via the established communications channel, the provisioning information used to configure the information handling system.

15. The method of claim 14 , further comprising encrypting communications to the information handling system using the platform public key.

16. The method of claim 14 , further comprising decrypting communications from the information handling system using the enterprise private key.

17. The method of claim 14 , further comprising provisioning the information handling system via communications received via the asymmetrically cryptographic communications channel.

18. The method of claim 14 , further comprising:
generating credentials other than the enterprise public key and the enterprise private key; and
establishing a second asymmetrically cryptographic communications channel between the access controller and the provisioning server based at least on the generated credentials.

19. The method of claim 14 , further comprising provisioning the information handling system via communications received via the second asymmetrically cryptographic communications channel.

Assignees

• Jaber Muhammed
• Shetty Sudhir
• Webb Iii Theodore
• Wilson John
• Dell Products Lp

Inventors

• Jaber Muhammed
• Shetty Sudhir
• Webb Iii Theodore
• Wilson John

Classifications

• H04L9/3263 Primary

  involving certificates, e.g. public key certificate [PKC] or attribute certificate [AC]; Public key infrastructure [PKI] arrangements (network architectures or network communication protocols for supporting authentication of entities using certificates in a packet data network H04L63/0823) · CPC title

• H04L9/3215

  using a plurality of channels (network architectures or network communication protocols using different networks H04L63/18) · CPC title

• H04L2209/56

  Financial cryptography, e.g. electronic payment or e-cash · CPC title