Systems and methods for dynamic policy assignment of secure communication sessions using SPDM

Inventors: Vineeth Radhakrishnan (Palakkad, IN); Mini Thottunkal Thankappan (Bangalore, IN); Shinose Abdul Rahiman (Bangalore, IN); Rama Rao Bisa (Bangalore, IN); Dharma Bhushan Ramaiah (Bangalore, IN)

Assignee: Dell Products L.P.

H04L63/20 H04L63/0428

View Patent ↗

Loading inventors, assignments & file history…

Monitor This Case

Get email alerts when status or documents change.

Order Certified Copies

Most orders are placed with the USPTO same day — all within 24 business hours.

Order via The Patent Place →

Pre-filled with this patent's details

Quick Facts

Patent No.: US 12665930
App. No.: 18/177,153
Granted: Jun 23, 2026
Kind: B2

External Links

USPTO Patent Center↗ Full Patent PDF↗

Abstract

According to embodiments of the present disclosure, an Information Handling System (IHS) includes systems and methods for dynamic policy assignment of secure communication using a Security Protocol and Data Model (SPDM). The IHS includes a first SPDM-enabled device conforming to a SPDM specification that receives a request to transmit data to a second SPDM-enabled device, obtains one or more policies associated with a corresponding one or more transmission criteria of the first SPDM-enabled device relative to the second SPDM-enabled device, and determines whether the data is to be encrypted based upon whether a transmission of the data meets the transmission criteria. Based upon the determination, the first SPDM-enabled device encrypts the data prior to transmitting the data to the second SPDM-enabled device.

Claims (33)

1 . An Information Handling System (IHS) comprising:

a first Security Protocol and Data Model (SPDM)-enabled device conforming to a SPDM specification, wherein the first SPDM-enabled device comprises at least one memory coupled to at least one processor, the at least one memory having program instructions stored thereon that, upon execution by the at least one processor, cause the at least one processor to:

receive a request to transmit data to a second SPDM-enabled device;

obtain one or more policies associated with a corresponding one or more transmission criteria of the first SPDM-enabled device relative to the second SPDM-enabled device;

determine whether the data is to be encrypted based upon whether a transmission of the data meets the transmission criteria, wherein the determination is made on a message-by-message basis; and

when the message has a size that is less than a threshold value and is configured within a trust boundary of the first SPDM-enabled device relative to the second SPDM-enabled device, transmit the data unencrypted, otherwise, encrypt the data prior to transmitting the data to the second SPDM-enabled device, the size and the trust boundary comprising the transmission criteria.

2 . The IHS of claim 1 , wherein the program instructions, upon execution, further cause the IHS to:

obtain a plurality of policies associated with a corresponding plurality of transmission criteria of the first SPDM-enabled device relative to the second SPDM-enabled device; and

determine whether the data is to be encrypted based upon whether a transmission of the data meets a combination of the transmission criteria.

3 . The IHS of claim 1 , wherein the program instructions, upon execution, further cause the IHS to obtain the plurality of policies from a truth table.

4 . The IHS of claim 1 , wherein the first SPDM-enabled device comprises a Baseboard Management Controller (BMC) that manages the operation of the second SPDM-enabled device comprising a component of the IHS.

5 . The IHS of claim 1 , wherein the program instructions, upon execution, further cause the IHS to, prior to transmitting the data to the second SPDM-enabled device, transmit the transmission criteria to the second SPDM-enabled device, wherein the second SPDM-enabled device is configured to process the transmission criteria for receiving the data.

6 . The IHS of claim 1 , wherein the trust boundary comprises a common motherboard.

7 . A dynamic policy assignment method comprising:

receiving, by a first Security Protocol and Data Model (SPDM)-enabled device, a request to transmit data to a second SPDM-enabled device, wherein the first SPDM-enabled device conforms to a SPDM specification;

obtaining, by the first SPDM-enabled device, one or more policies associated with a corresponding one or more transmission criteria of the first SPDM-enabled device relative to the second SPDM-enabled device;

determining, by the first SPDM-enabled device, whether the data is to be encrypted based upon whether a transmission of the data meets the transmission criteria, wherein the determination is made on a message-by-message basis; and

when the message has a size that is less than a threshold value and is configured within a trust boundary of the first SPDM-enabled device relative to the second SPDM-enabled device, transmitting the data unencrypted, otherwise, encrypting the data prior to transmitting the data to the second SPDM-enabled device, the size and the trust boundary comprising the transmission criteria.

8 . The dynamic policy assignment method of claim 7 , further comprising:

obtaining, by the first SPDM-enabled device, a plurality of policies associated with a corresponding plurality of transmission criteria of the first SPDM-enabled device relative to the second SPDM-enabled device from a truth table; and

determining, by the first SPDM-enabled device, whether the data is to be encrypted based upon whether a transmission of the data meets a combination of the transmission criteria.

9 . The dynamic policy assignment method of claim 7 , further comprising, prior to transmitting the data to the second SPDM-enabled device, transmitting, by the first SPDM-enabled device, the transmission criteria to the second SPDM-enabled device, wherein the second SPDM-enabled device is configured to process the transmission criteria for receiving the data.

10 . The dynamic policy assignment method of claim 7 , wherein the trust boundary comprises a common motherboard.

11 . A computer program product comprising a non-transitory computer readable storage medium having program instructions stored thereon that, upon execution by an Information Handling System (IHS), cause the IHS to:

receive a request to transmit data to a second SPDM-enabled device;

obtain one or more policies associated with a corresponding one or more transmission criteria of a first Security Protocol and Data Model (SPDM)-enabled device relative to the second SPDM-enabled device, wherein the first SPDM-enabled device conforms to a SPDM specification;

determine whether the data is to be encrypted based upon whether a transmission of the data meets the transmission criteria, wherein the determination is made on a message-by-message basis; and

12 . The computer program product of claim 11 , wherein the program instructions, upon execution, further cause the IHS to:

obtain a plurality of policies associated with a corresponding plurality of transmission criteria of the first SPDM-enabled device relative to the second SPDM-enabled device; and

determine whether the data is to be encrypted based upon whether a transmission of the data meets a combination of the transmission criteria.

13 . The computer program product of claim 11 , wherein the data is configured to be organized in the message, wherein the transmission criteria comprises a size of the message.

14 . The computer program product of claim 11 , wherein the transmission criteria comprises a trust boundary of the first SPDM-enabled device relative to the second SPDM-enabled device, wherein the trust boundary comprises a common motherboard.