Keyless method to secure physical access to information handling systems in a datacenter
Systems and methods are disclosed for securing an information handling system. A method for securing an information handling system may include securing the information handling system in an enclosure with a locking mechanism of a bezel; receiving a request to unlock the bezel at a baseboard management controller (BMC), the BMC communicatively coupled to the bezel; retrieving a first artifact stored in a trusted platform module (TPM) in response to the request; attempting to authorize the request using the first artifact; and unlocking the locking mechanism if the request is authorized.
1. An information handling system, comprising:
a bezel comprising a locking mechanism securing the information handling system in an enclosure;
a baseboard management controller (BMC) communicatively coupled to the bezel, the BMC configured to:
receive a request to unlock the locking mechanism;
attempt to retrieve a first artifact stored in a trusted platform module (TPM) in response to the request using platform configuration measurements unique to the BMC required to match with platform configuration measurements stored in the TPM, wherein the first artifact comprises first authentication information; and when the first artifact is retrieved:
attempt to authorize the request using the first artifact;
generate an unlock command comprising a digital signature generated with a second artifact from the TPM, wherein the second artifact comprises second authentication information; and
communicate the unlock command to a bezel controller, the bezel controller configured to:
verify the digital signature with a public key corresponding with the second artifact
unlock the locking mechanism if the request is authorized and the digital signature is verified.
2. The system of claim 1 , wherein the request includes a password required to unlock the locking mechanism.
3. The system of claim 2 , wherein attempting to authorize the request comprises comparing the password to the first artifact.
4. The system of claim 1 , wherein the bezel controller verifies the unlock command by comparing a nonce in the unlock command to a nonce stored in the bezel controller to protect against a replay attack, the nonce stored in the bezel controller generated by the bezel controller and communicated to the BMC prior to the BMC sending the unlock command.
5. The system of claim 1 , wherein the bezel further comprises a user interface for displaying and receiving data.
6. The system of claim 5 , wherein the request was received through the user interface.
7. The system of claim 1 , wherein the request is initiated from a location remote from the information handling system through an out-of-band communication channel.
8. A method of securing an information handling system comprising:
securing the information handling system in an enclosure with a locking mechanism of a bezel;
receiving a request to unlock the bezel at a baseboard management controller (BMC), the BMC communicatively coupled to the bezel;
attempting to retrieve a first artifact stored in a trusted platform module (TPM) in response to the request using platform configuration measurements unique to the BMC required to match with platform configuration measurements stored in the TPM, wherein the first artifact comprises first authentication information; and
when the first artifact is retrieved:
attempting to authorize the request using the first artifact;
generating an unlock command comprising a digital signature generated with a second artifact from the TPM, wherein the second artifact comprises second authentication information;
communicating the unlock command to a bezel controller;
verifying, by the bezel controller, the digital signature with a public key corresponding with the second artifact; and
unlocking, by the bezel controller, the locking mechanism if the request is authorized and the digital signature is verified.
9. The method of claim 8 , wherein the request includes a password required to unlock the locking mechanism.
10. The method of claim 9 , wherein attempting to authorize the request comprises comparing the password to the first artifact.
11. The method of claim 8 , wherein the bezel controller verifies the unlock command by comparing a nonce in the unlock command to a nonce stored in the bezel controller to protect against a replay attack, the nonce stored in the bezel controller generated by the bezel controller and communicated to the BMC prior to the BMC sending the unlock command.
12. The method of claim 8 , wherein the bezel further comprises a user interface for displaying and receiving data.
13. The method of claim 12 , wherein the request was received through the user interface.
14. The method of claim 8 , wherein the request is initiated from a location remote from the information handling system through an out-of-band communication channel.