Systems and methods for dual-ported cryptoprocessor for host system and management controller shared cryptoprocessor resources
View Patent ↗In accordance with these and other embodiments of the disclosure, an information handling system may include a host system comprising a host system processor, a management controller communicatively coupled to the host system processor and configured to provide management of the information handling system via management traffic communicated between the management controller and a dedicated management network external to the information handling system, and a cryptoprocessor having a first communications interface to the host system and a second communications interface to the management controller and configured to carry out cryptographic operations on data communicated to the cryptoprocessor from the host system and the management controller such that the cryptoprocessor is accessible to the host system and the management controller.
1. An information handling system comprising:
a host system comprising a host system processor;
a management controller communicatively coupled to the host system processor and configured to provide management of the information handling system via management traffic communicated between the management controller and a dedicated management network external to the information handling system; and
a dual-ported, shared cryptoprocessor having a first communications interface coupled, via a platform controller hub, to the host system and a second communications interface coupled directly to the management controller, the cryptoprocessor being configured to carry out cryptographic operations both on data communicated to the cryptoprocessor from the host system and on data communicated to the cryptoprocessor from the management controller such that the cryptoprocessor is accessible to the host system and the management controller.
2. The information handling system of claim 1 , wherein the cryptoprocessor is further configured to allow sharing of data stored in a shared secure memory of the cryptoprocessor by the host system and the management controller.
3. The information handling system of claim 2 , wherein the cryptoprocessor is further configured to store a certificate usable to establish a trusted secure channel between the host system and the management controller via the cryptoprocessor, the trusted secure channel being usable for exchange of secure information between the host system and the management controller.
4. The information handling system of claim 3 , wherein the trusted secure channel is authenticated by at least one of a measurement associated with the host system and a measurement associated with the management controller.
5. The information handling system of claim 1 , wherein the cryptoprocessor is further configured to provide a secure sideband interface for management of the cryptoprocessor by the management controller.
6. The information handling system of claim 5 , wherein the management controller is further configured to manage the cryptoprocessor via the secure sideband interface by performing at least one of:
monitoring an establishment bit status of the host system in order to determine a run-time security status check of the host system;
configuring cryptoprocessor manufacture configuration bits;
updating cryptoprocessor firmware; and
performing secure monitoring of the host system.
7. The information handling system of claim 1 , wherein the cryptoprocessor is further configured to provide co-location of cryptoprocessor services owned by the management controller within the cryptoprocessor owned by the host system.
8. A method comprising:
coupling a host system of an information handling system to a first communications interface of a dual-ported, shared cryptoprocessor, wherein the coupling between the host system and the cryptoprocessor is via a platform controller hub of the host system, and wherein the host system includes a host system processor;
coupling a second communications interface of the cryptoprocessor directly to a management controller communicatively coupled to the host system processor and configured to provide management of the information handling system via management traffic communicated between the management controller and a dedicated management network external to the information handling system; and
the cryptoprocessor carrying out cryptographic operations both on data communicated to the cryptoprocessor from the host system and on data communicated to the cryptoprocessor from the management controller such that the cryptoprocessor is accessible to the host system and the management controller.
9. The method of claim 8 , further comprising sharing of data stored in a shared secure memory of the cryptoprocessor by the host system and the management controller.
10. The method of claim 9 , further comprising storing a certificate usable to establish a trusted secure channel between the host system and the management controller via the cryptoprocessor, the trusted secure channel being usable for exchange of secure information between the host system and the management controller.
11. The method of claim 10 , further comprising authenticating the trusted secure channel by at least one of a measurement associated with the host system and a measurement associated with the management controller.
12. The method of claim 8 , further comprising providing a secure sideband interface for management of the cryptoprocessor by the management controller.
13. The method of claim 12 , further comprising managing, by the management controller, the cryptoprocessor via the secure sideband interface by performing at least one of:
monitoring an establishment bit status of the host system in order to determine a run-time security status check of the host system;
configuring cryptoprocessor manufacture configuration bits;
updating cryptoprocessor firmware; and
performing secure monitoring of the host system.
14. The method of claim 8 , further comprising providing co-location of cryptoprocessor services owned by the management controller within the cryptoprocessor owned by the host system.
15. An article of manufacture comprising:
a non-transitory computer-readable medium; and
computer-executable instructions carried on the computer-readable medium, the instructions readable by a processor, the instructions, when read and executed, for causing the processor to:
couple a host system of an information handling system to a first communications interface of a dual-ported, shared cryptoprocessor, wherein the coupling between the host system and the cryptoprocessor is via a platform controller hub of the host system, and wherein the host system includes a host system processor;
couple a second communications interface of the cryptoprocessor directly to a management controller communicatively coupled to the host system processor and configured to provide management of the information handling system via management traffic communicated between the management controller and a dedicated management network external to the information handling system; and
carry out, at the cryptoprocessor, cryptographic operations both on data communicated to the cryptoprocessor from the host system and on data communicated to the cryptoprocessor from the management controller such that the cryptoprocessor is accessible to the host system and the management controller.
16. The article of claim 15 , the instructions for further causing the processor to share data stored in a shared secure memory of the cryptoprocessor by the host system and the management controller.
17. The article of claim 16 , the instructions for further causing the processor to store a certificate usable to establish a trusted secure channel between the host system and the management controller via the cryptoprocessor, the trusted secure channel being usable for exchange of secure information between the host system and the management controller.
18. The article of claim 17 , the instructions for further causing the processor to authenticate the trusted secure channel by at least one of a measurement associated with the host system and a measurement associated with the management controller.
19. The article of claim 15 , the instructions for further causing the processor to provide a secure sideband interface for management of the cryptoprocessor by the management controller.
20. The article of claim 19 , the instructions for further causing the processor to allow management, by the management controller, of the cryptoprocessor via the secure sideband interface by performing at least one of:
monitoring an establishment bit status of the host system in order to determine a run-time security status check of the host system;
configuring cryptoprocessor manufacture configuration bits;
updating cryptoprocessor firmware; and
performing secure monitoring of the host system.
21. The article of claim 15 , the instructions for further causing the processor to provide co-location of cryptoprocessor services owned by the management controller within the cryptoprocessor owned by the host system.