Out-of-Band (OOB) packet authentication in heterogeneous computing platforms
Systems and methods for Out-of-Band (OOB) packet authentication in heterogeneous computing platforms. In some embodiments, an Information Handling System (IHS) may include a heterogeneous computing platform and an OOB Microcontroller Unit (MCU) integrated into the heterogeneous computing platform, where the OOB MCU is configured to receive an OOB packet and use a crypto device to validate the OOB packet.
1 . An Information Handling System (IHS), comprising:
a heterogeneous computing platform; and
an Out-of-Band (OOB) Microcontroller Unit (MCU) integrated into the heterogeneous computing platform, wherein the OOB MCU is configured to:
receive an OOB packet;
determine, based at least in part on an opaque identifier configured in a header of the OOB packet, whether the OOB packet is a baseline OOB packet or an opaque OOB packet;
determine, based at least in part on an opaque route header configured in the header of the OOB packet, a target device within the IHS to process the OOB packet;
in response to a determination, based at least in part on the opaque identifier, that the OOB packet is the opaque OOB packet, route the OOB packet, based on the opaque route header, to OEM-owned firmware resident in an Embedded Controller (EC) domain or in an isolated execution area within the OOB MCU, wherein the EC or OOB MCU is configured with a map, key, or decode ring required to interpret an opaque payload portion of the OOB packet, and wherein the heterogeneous computing platform is restricted from access to the map, key, or decode ring; and
validate the OOB packet by a crypto device selected based at least in part on the header of the OOB packet.
2 . The IHS of claim 1 , wherein the heterogeneous computing platform comprises: a System-On-Chip (SoC), a Field-Programmable Gate Array (FPGA), or an Application-Specific Integrated Circuit (ASIC).
3 . The IHS of claim 1 , wherein the heterogeneous computing platform comprises a Reduced Instruction Set Computer (RISC) processor and a plurality of devices coupled to an interconnect.
4 . The IHS of claim 3 , wherein the plurality of devices comprises at least one of: a Graphical Processing Unit (GPU), an audio Digital Signal Processor (aDSP), a sensor hub, a Neural Processing Unit (NPU), a Tensor Processing Unit (TPU), a Neural Network Processor (NNP), an Intelligence Processing Unit (IPU), an Image Signal Processor (ISP), or a Video Processing Unit (VPU).
5 . The IHS of claim 3 , wherein the interconnect comprises at least one of: an Advanced Microcontroller Bus Architecture (AMBA) bus, a QuickPath Interconnect (QPI) bus, or a HyperTransport (HT) bus.
6 . The IHS of claim 1 , wherein the crypto device is integrated into the OOB MCU.
7 . The IHS of claim 1 , wherein the crypto device is integrated into the heterogeneous computing platform and coupled to the OOB MCU via an interconnect.
8 . The IHS of claim 1 , wherein the crypto device is integrated into an Embedded Controller (EC) coupled to the OOB MCU via a low-bandwidth bus controller.
9 . The IHS of claim 1 , wherein the crypto device comprises at least one of: a trusted execution module, a Secure Processing Unit (SPU), or a crypto offload engine, and wherein the OOB MCU is configured to select the crypto device, at least in part, in response to a determination that the OOB packet comprises an opaque OOB packet.
10 . The IHS of claim 1 , wherein the OOB packet is received by the OOB MCU as part of an OOB packet sniff operation while a host processor of the heterogeneous computing platform is in a low-power state.
11 . The IHS of claim 10 , wherein to validate the OOB packet with the crypto device, the OOB MCU is configured to allow the crypto device to be powered during a packet validation operation, and to disallow the crypto device from receipt of power after completion of the packet validation operation.
12 . The IHS of claim 11 , wherein the low-power state comprises an Advanced Configuration and Power Interface (ACPI) G3 state.
13 . The IHS of claim 1 , wherein to validate the OOB packet, the crypto device is configured to calculate a digest of at least a portion of the OOB packet, encrypt at least a portion of the digest with a public encryption key, and compare a result of the encryption against a signature portion of the OOB packet.
14 . An Embedded Controller (EC) integrated into or coupled to a heterogeneous computing platform of an Information Handling System (IHS), the EC comprising:
a processor core distinct from any host processor of the heterogeneous computing platform; and
a memory coupled to the processor core, the memory configured with program instructions stored thereon that, upon execution by the processor core, cause the EC to:
receive an Out-of-Band (OOB) packet;
determine, based at least in part on an opaque identifier configured in a header of the OOB packet, whether the OOB packet is a baseline OOB packet or an opaque OOB packet;
determine, based at least in part on an opaque route header configured in the header of the OOB packet, a target device within the IHS to process the OOB packet;
in response to a determination, based at least in part on the opaque identifier, that the OOB packet is the opaque OOB packet, route the OOB packet, based on the opaque route header, to OEM-owned firmware resident in an EC domain or in an isolated execution area within an OOB Microcontroller Unit (MCU) integrated into the heterogeneous computing platform, wherein the EC or OOB MCU is configured with a map, key, or decode ring required to interpret an opaque payload portion of the OOB packet, and wherein the heterogeneous computing platform is restricted from access to the map, key, or decode ring; and
validate the OOB packet with a crypto device selected based at least in part on the header of the OOB packet.
15 . The EC of claim 14 , wherein the crypto device is selected from the group consisting of: (i) a crypto device integrated into the EC, (ii) a crypto device integrated into the OOB MCU, wherein the OOB MCU is integrated into the heterogeneous computing platform and coupled to the EC via a low-bandwidth bus controller, and (iii) a crypto device integrated into the heterogeneous computing platform and coupled to the OOB MCU via an interconnect.
16 . The EC of claim 15 , wherein the program instructions, upon execution, cause the EC to select the crypto device based, at least in part, upon a determination that the OOB packet comprises an opaque OOB packet.
17 . The EC of claim 14 , wherein the OOB packet is received by the EC as part of an OOB packet sniff operation while a host processor of the heterogeneous computing platform is in a low-power state, and wherein to validate the OOB packet with the crypto device, the EC is configured to: (i) allow the crypto device to be powered during a packet validation operation, and (ii) stop the crypto device from receipt of power upon completion of the packet validation operation.
18 . A method, comprising:
receiving, at a cloud server or Information Technology Decision Maker (ITDM) terminal, an Out-of-Band (OOB) packet transmitted by an Information Handling System (IHS) and encoded with an OEM-specific map, key, or decode ring, wherein the OOB packet comprises a header configured with an opaque identifier indicating whether the OOB packet is a baseline OOB packet or an opaque OOB packet, and wherein, when the OOB packet is the opaque OOB packet, the OEM-specific map, key, or decode ring necessary for interpreting an opaque payload portion of the OOB packet is not shared with the IHS such that the opaque payload portion is at least partially undecipherable by an OOB Microcontroller Unit (MCU) or Embedded Controller (EC) integrated into or coupled to a heterogeneous computing platform of the IHS; and
authenticating the OOB packet based, at least in part, on an encryption key pair associated with the OOB MCU.
19 . The method of claim 18 , wherein the OOB packet is received by the cloud server or ITDM terminal in connection with an OOB packet sniffing operation by the IHS while a host processor of the heterogeneous computing platform is in a low-power state.
20 . The method of claim 18 , wherein authenticating the OOB packet comprises calculating a digest of at least a portion of the OOB packet, encrypting at least a portion of the digest with a public encryption key, and comparing a result of the encryption against a signature portion of the OOB packet.