Systems and methods for establishing and using device identity in information handling systems
Methods and system are provided for establishing and using a uniform device identity. For instance, an information handling system (IHS) may include multiple hardware components, each of the hardware components having a respective device identity. A device identity selector may be set, either at manufacture or by a trusted downstream partner, where the device identity selector identifies one of the device identities for use by the IHS. As remote nodes or applications perform attestation operations, the IHS may use the selected device identity for attestation.
1 . A method for selecting a first device identity from a plurality of available device identities, the method comprising:
accessing a protected data store that has a plurality of entries, including a first entry for the first device identity and a second entry for a second device identity, wherein the first device identity corresponds to a first hardware device of a node and the second device identity corresponds to a second hardware device of the node, further wherein the first device identity is associated with a first certificate and the second device identity is associated with a second certificate;
at a Basic Input Output System (BIOS) or Unified Extensible Firmware Interface (UEFI), verifying that a device identity selector, which indicates the first device identity, refers to an allowed device identity;
at the BIOS or UEFI, validating the first hardware device associated with the first device identity; and
communicating, from the BIOS or UEFI to an operating system, the first certificate and an instruction to use the first device identity as an identity for the node for attestation by software running on a host device of the node or for attestation by a remote node.
2 . The method of claim 1 , wherein communicating the first certificate comprises:
communicating between the BIOS or UEFI and the operating system according to Advanced Configuration and Power Interface (ACPI) protocols.
3 . The method of claim 1 , further comprising:
storing, in the protected data store, a trusted manifest that includes data indicating the plurality of available device identities as being allowed and includes the device identity selector; and
wherein verifying that the device identity selector refers to an allowed device identity includes determining that the device identity selector identifies an entry in the data indicating the plurality of available device identities.
4 . The method of claim 3 , further comprising:
during BIOS or UEFI setup, configuring the data indicating the plurality of available device identities as being allowed and configuring the device identity selector.
5 . The method of claim 1 , wherein validating the first hardware device comprises:
performing a proof of possession operation based on the first device identity.
6 . The method of claim 1 , wherein the first hardware device comprises the host device.
7 . The method of claim 1 , wherein the BIOS or UEFI is associated with a central processing unit (CPU) of the host device, and wherein the first hardware device comprises a device other than the host device.
8 . The method of claim 7 , wherein the first hardware device comprises a hardware accelerator or a baseboard management controller (BMC).
9 . The method of claim 1 , wherein the first certificate comprises an identifier of the first hardware device and a public key of the first hardware device.
10 . An Information Handling System (IHS) comprising:
a host device comprising one or more processors and having a first device identity and a first hardware root of trust;
a hardware component having a second device identity and a second hardware root of trust, wherein the first device identity is associated with a first certificate and the second device identity is associated with a second certificate; and
one or more memory devices coupled to the one or more processors, the memory devices storing computer-readable instructions that, upon execution by the one or more processors, cause the host device to:
receive, by an operating system of the host device, an indication of the second device identity for use as a device identity of the IHS from a Basic Input Output System (BIOS) or Unified Extensible Firmware Interface (UEFI) during operating system boot, wherein the indication of the second device identity includes the second certificate;
in response to the indication of the second device identity, load a driver associated with the hardware component and communicate with the hardware component via the driver;
receive a first attestation request from a remote node to perform attestation of the IHS; and
facilitate attestation with respect to the second device identity, including facilitating a proof of possession operation with respect to a private key corresponding to the second hardware root of trust, in response to the first attestation request.
11 . The IHS of claim 10 , wherein the hardware component comprises a baseboard management controller (BMC) configured to provide out-of-band management for the host device.
12 . The IHS of claim 10 , wherein the hardware component comprises a hardware accelerator coupled to the host device.
13 . The IHS of claim 10 , wherein the instructions to cause the host device to receive the indication of the second device identity from the BIOS or UEFI comprises instructions to cause the operating system to:
receive the second certificate according to Advanced Configuration and Power Interface (ACPI) protocols.
14 . The IHS of claim 10 , further comprising instructions that cause the host device to:
receive a second attestation request from a software application running on the operating system to perform attestation of the IHS; and
facilitate attestation with respect to the second device identity, including facilitating a subsequent proof of possession operation with respect to the private key corresponding to the second hardware root of trust, in response to the second attestation request.
15 . A computer-readable storage device having instructions stored thereon for validating secure assembly of an IHS (Information Handling System), wherein execution of the instructions by one or more processors of the IHS causes an operating system (OS) of the IHS to:
receive, from a Basic Input Output System (BIOS) or Unified Extensible Firmware Interface (UEFI), a certificate of a first hardware component of the IHS and an instruction to use a device identity of the first hardware component as a device identity of the IHS for attestation by software running on a host of the IHS or for attestation by a remote node;
in response to the instruction to use the device identity of the first hardware component, load a driver associated with the hardware component and communicate with the hardware component via the driver; and
facilitate attestation of the IHS, including facilitating a proof of possession operation with respect to a private key corresponding to a hardware root of trust of the first hardware component.
16 . The computer-readable storage device of claim 15 , wherein the BIOS or UEFI is associated with a central processing unit (CPU) of the host, and wherein the certificate is associated with a device other than the host.
17 . The computer-readable storage device of claim 16 , wherein the certificate is associated with a hardware accelerator of the IHS.
18 . The computer-readable storage device of claim 16 , wherein the certificate is associated with a baseboard management controller (BMC) of the IHS.
19 . The computer-readable storage device of claim 15 , wherein the certificate of the first hardware component comprises an identifier of the first hardware component and a public key of the first hardware component.
20 . The computer-readable storage device of claim 15 , wherein the instructions to cause the IHS to receive the certificate comprises instructions to:
employ Advanced Configuration and Power Interface (ACPI) protocols to receive the certificate.