System and method for safe information handling system boot
Information handling system security is maintained by locking the information handling system from boot of an operating system with a service processor of the information handling system. The service processor obtains authorization for boot from a third party authentication service by providing authentication information to the authentication service and requiring a successful authentication for boot. For example, the service processor releases a token upon successful authentication to authorize boot. In one embodiment, the authentication service sends a token to the service processor for the service processor to use to authorize boot.
1. An information handling system comprising:
a chassis;
plural components disposed in the chassis and operable to cooperate to process information under an operating system;
boot firmware stored on a processing component, the boot firmware operable to boot the operating system;
a service processor disposed in the chassis and interfaced with the boot firmware, the service processor operable to lock and unlock boot of the operating system; and
a boot authorization module operable to execute on the service processor, the boot authorization module operable at power-on of the service processor to query an authentication service through a network for authorization to boot the operating system and to unlock boot of the operating system if authorization is received from the authentication service;
wherein a determination of authorization to boot the operating system is made at the authentication service and communicated through the network to the boot authorization module.
2. The information handling system of claim 1 wherein the boot authorization module is further operable to unlock boot with a locally-stored token.
3. The information handling system of claim 1 wherein the boot authorization module retrieves a token from the authentication service as authorization to boot.
4. The information handling system of claim 3 wherein the boot authorization module unlocks boot with the token.
5. The information handling system of claim 1 wherein the boot authorization module queries the authentication service through a Transport Security Layer.
6. The information handling system of claim 1 wherein the service processor comprises a baseboard management controller.
7. The information handling system of claim 1 wherein the boot authorization module queries the authentication server through the Internet.
8. A method for securing an information handling system, the method comprising:
applying power to a service processor of the information handling system;
establishing an authentication between the service processor and an authentication server through a network;
determining a successful authentication at the authentication server;
communicating the successful authentication from the authentication server to the service processor; and
in response to the communicating, allowing with the service processor a boot of an operating system at the information handling system if an authentication is established.
9. The method of claim 8 wherein the service processor comprises a baseboard management controller.
10. The method of claim 8 wherein the service processor comprises a chipset.
11. The method of claim 8 wherein establishing an authentication further comprises:
sending authentication information from the service processor to the authentication server; and
unlocking the information handling system to allow boot upon return of authentication information from the authentication server.
12. The method of claim 8 wherein establishing an authentication further comprises:
providing an authentication token from the authentication server to the service processor; and
applying the token by the service processor to unlock boot of the information handling system.
13. The method of claim 8 wherein establishing an authentication further comprises communicating through a Transport Security Layer.
14. The method of claim 8 wherein the information handling system comprises a server information handling system.
15. The method of claim 8 wherein the information handling system comprises a portable information handling system.
16. A system for secure boot of an information handling system operating system, the system comprising:
a service processor integrated with the information handling system and operable to manage information handling system functions with processing components of the information handling system powered down; and
a boot authorization module executing on the service processor and operable to communicate through a network with a remote authorization service to obtain authorization for boot of the operating system, to lock boot of the operating system unless authorization is obtained, and to unlock boot of the operating system if authorization is received.
17. The system of claim 16 wherein the boot authorization module unlocks boot of the operating system by release of a locally-stored token.
18. The system of claim 16 wherein the boot authorization module unlocks boot of the operating system by retrieving a token from a token service and applying the token to unlock boot.
19. The system of claim 16 wherein the boot authorization module communicates with the authentication service through a Transport Security Layer.
20. The system of claim 16 wherein the service processor comprises a baseboard management controller.