Field replaceable unit authentication system

Patent metadata

Field	Value
Publication number	US-9652253-B2
Application number	US-201514856231-A
Country	US
Kind code	B2
Filing date	Sep 16, 2015
Priority date	Sep 16, 2015
Publication date	May 16, 2017
Grant date	May 16, 2017

Abstract

A field replaceable unit authentication system provides for a field replaceable unit device to be positioned in a chassis. A trusted platform module is included in the field replaceable unit device. A network operating system engine may be provided in the field replaceable unit device and coupled to the trusted platform module. The network operating system engine participates in a boot process with a booting subsystem to generate current boot metric data that is provided for storage in the trusted platform module. A platform management controller in the field replaceable unit device retrieves the current boot metric data from the trusted platform module, authenticates the trusted platform module, and compares the current boot metric data to previously stored boot metric data to determine whether to authenticate the network operating system engine. If authenticated, the network operating system engine then authenticates the platform management controller.

First claim

What is claimed is:

1. A field replaceable unit authentication system, comprising:
a chassis;
at least one connector located in the chassis; and
a field replaceable unit device located in the chassis and coupled to the at least one connector, wherein the field replaceable unit device includes:
a trusted platform module;
a network operating system engine that is coupled to the trusted platform module and that is configured to participate in a boot process that generates current boot metric data that is provided for storage in the trusted platform module; and
a platform management controller that is coupled to the trusted platform module and the network operating system engine, wherein the platform management controller is configured to retrieve the current boot metric data from the trusted platform module, authenticate the trusted platform module, and compare the current boot metric data to previously stored boot metric data to determine whether to authenticate the network operating system engine.

2. The field replaceable unit authentication system of claim 1 , wherein the platform management controller is configured, in response to determining to authenticate the network operating system engine, to assign at least one authentication role to the network operating system engine.

3. The field replaceable unit authentication system of claim 1 , wherein the platform management controller is configured, in response to determining to not authenticate the network operating system engine, to cease providing power to the network operating system engine.

4. The field replaceable unit authentication system of claim 1 , wherein the network operating system engine is configured, in response to being authenticated by the platform management controller, to authenticate the platform management controller.

5. The field replaceable unit authentication system of claim 4 , wherein the network operating system is configured, in response to being authenticated by the platform management controller and authenticating the platform management controller, to determine that a device has been coupled to the field replaceable unit device through the at least one connector and, in response, authenticate the device.

6. The field replaceable unit authentication system of claim 4 , wherein the authentication of the platform management controller by the network operating system engine includes the network operating system engine sending the platform management controller an authentication message that is encrypted with a field replaceable unit public key for the field replaceable unit device, and the platform management controller decrypting the authentication message with a field replaceable unit private key for the field replaceable unit device.

7. The field replaceable unit authentication system of claim 1 , wherein the trusted platform module is configured to encrypt the current boot metric data with a trusted platform module private key to provide encrypted current boot metric data, and wherein the platform management controller is configured to decrypt the encrypted current boot metric data with a trusted platform module public key.

8. An information handling system (IHS), comprising:
a booting subsystem;
a trusted platform module that is coupled to the booting subsystem and that is configured to couple to a network operating system engine, wherein the trusted platform module is configured to receive and store current boot metric data that is generated when the booting subsystem and the network operating system engine perform a boot process; and
a platform management controller that is coupled to the trusted platform module, wherein the platform management controller is configured to retrieve the current boot metric data from the trusted platform module in response to the booting subsystem and the network operating system engine performing the boot process, authenticate the trusted platform module, and compare the current boot metric data to previously stored boot metric data to determine whether to authenticate the network operating system engine.

9. The IHS of claim 8 , wherein the platform management controller is configured, in response to determining to authenticate the network operating system engine, to assign at least one authentication role to the network operating system engine.

10. The IHS of claim 8 , wherein the platform management controller is configured, in response to determining to not authenticate the network operating system engine, to cease providing power to the network operating system engine.

11. The IHS of claim 8 , wherein the platform management controller is configured, following a determination to authenticate the network operating system engine, to receive an authentication message from the network operating system engine and, in response, provide an authentication response to the network operating system engine.

12. The IHS of claim 8 , wherein the trusted platform module is configured to encrypt the current boot metric data with a trusted platform module private key to provide encrypted current boot metric data, and wherein the platform management controller is configured to decrypt the encrypted current boot metric data with a trusted platform module public key.

13. The IHS of claim 8 , wherein the booting subsystem includes a Basic Input/Output System (BIOS) and a boot loader.

14. A method for authentication in a field replaceable unit, comprising:
performing a boot process in a field replaceable unit device;
generating current boot metric data during the performance of the boot process;
storing, in a trusted platform module in the field replaceable unit device, the current boot metric data;
retrieving, by a platform management controller in the field replaceable unit device from the trusted platform module, the current boot metric data;
authenticating, by the platform management controller, the trusted platform module; and
comparing, by the platform management controller, the current boot metric data to previously stored boot metric data to determine whether to authenticate a network operating system engine that participated in the performance of the boot process.

15. The method of claim 14 , further comprising:
assigning, by the platform management controller in response to determining to authenticate the network operating system engine, at least one authentication role to the network operating system engine.

16. The method of claim 14 , further comprising:
ceasing, by the platform management controller in response to determining to not authenticate the network operating system engine, the provisioning of power to the network operating system engine.

17. The method of claim 14 , further comprising:
authenticating, by the network operating system engine in response to being authenticated by the platform management controller, the platform management controller.

18. The method of claim 17 , further comprising:
determining, by the network operating system engine in response to being authenticated by the platform management controller and authenticating the platform management controller, that a device has been coupled to the field replaceable unit device; and
authenticating, by the network operating system engine, the device.

19. The method of claim 17 , wherein the authentication of the platform management controller by the network operating system engine includes:
sending, by the network operating system engine to the platform management controller, an authentication message that is encrypted with a field replac

Assignees

• Dell Products Lp

Inventors

• Narayanan Padmanabhan
• Pulluru Rajasekhar

Classifications

• H04L9/14

  using a plurality of keys or algorithms · CPC title

• H04L63/06

  for supporting key management in a packet data network (cryptographic mechanisms or cryptographic arrangements for key management H04L9/08) · CPC title

• G06F9/4416 Primary

  Network booting; Remote initial program loading [RIPL] · CPC title

• H04L9/006 Primary

  involving public key infrastructure [PKI] trust models (network architecture or network communication protocol for supporting authentication of entities using certificates in a packet data network H04L63/0823) · CPC title

• H04L9/0877

  using additional device, e.g. trusted platform module [TPM], smartcard, USB or hardware security module [HSM] · CPC title