Systems and methods for management domain attestation service

1. An information handling system comprising:

a processor; and

a program of instructions embodied in non-transitory computer-readable media, the program of instructions configured to, when executed by the processor:

retrieve a profile from a management controller of a second information handling system, the management controller configured to provide out-of-band management of the second information handling system via management traffic communicated between the management controller and a dedicated management network external to the second information handling system, the out-of-band management including management of the second information handling system when the second information handling system is in a powered-off state, and the profile including data regarding a configuration of the management controller, wherein the profile includes data regarding a runtime configuration of the management controller, the data including at least one value that was stored in a selected memory location of the management controller during runtime execution of the management controller;

compare the profile to one or more golden profiles to determine whether security of the management controller has been compromised;

responsive to the profile matching a golden profile of the one or more golden profiles, permit the management controller to continue execution; and

responsive to the profile failing to match a golden profile of the one or more golden profiles, take remedial action with respect to the management controller.

2. The information handling system of claim 1 , wherein the profile is embodied in a platform control register associated with a cryptoprocessor associated with the management controller.

3. The information handling system of claim 1 , wherein the profile is encrypted by a private key of a public/private key pair, and the program of instructions is further configured to decrypt the profile with a public key of the public/private key pair to validate the profile before comparison to the one or more golden profiles.

4. The information handling system of claim 1 , wherein the profile further includes data regarding a boot-time configuration of the management controller.

5. The information handling system of claim 1 , wherein the remedial action comprises segregating the management controller into an untrusted subnet of the dedicated management network.

6. The information handling system of claim 5 , wherein the remedial action further comprises segregating a host system of the second information handling system into an untrusted subnet of a data network coupled to the host system.

7. A method comprising:

retrieving a profile from a management controller of an information handling system, the management controller configured to provide out-of-band management of the information handling system via management traffic communicated between the management controller and a dedicated management network external to the information handling system, the out-of-band management including management of the information handling system when the information handling system is in a powered-off state, and the profile including data regarding a configuration of the management controller, wherein the profile includes data regarding a runtime configuration of the management controller, the data including at least one value that was stored in a selected memory location of the management controller during runtime execution of the management controller;

comparing the profile to one or more golden profiles to determine whether security of the management controller has been compromised;

responsive to the profile matching a golden profile of the one or more golden profiles, permitting the management controller to continue execution; and

responsive to the profile failing to match a golden profile of the one or more golden profiles, taking remedial action with respect to the management controller.

8. The method of claim 7 , wherein the profile is embodied in a platform control register associated with a cryptoprocessor associated with the management controller.

9. The method of claim 7 , wherein the profile is encrypted by a private key of a public/private key pair, and the method further comprises decrypting the profile with a public key of the public/private key pair to validate the profile before comparison to the one or more golden profiles.

10. The method of claim 7 , wherein the profile further includes data regarding a boot-time configuration of the management controller.

11. The method of claim 7 , wherein the remedial action comprises segregating the management controller into an untrusted subnet of the dedicated management network.

12. The method of claim 11 , wherein the remedial action further comprises segregating a host system of the information handling system into an untrusted subnet of a data network coupled to the host system.

13. An article of manufacture comprising:

a non-transitory computer-readable medium; and

computer-executable instructions carried on the computer-readable medium, the instructions readable by a processor, the instructions, when read and executed, for causing the processor to:

retrieve a profile from a management controller of an information handling system, the management controller configured to provide out-of-band management of the information handling system via management traffic communicated between the management controller and a dedicated management network external to the information handling system, the out-of-band management including management of the information handling system when the information handling system is in a powered-off state, and the profile including data regarding a configuration of the management controller, wherein the profile includes data regarding a runtime configuration of the management controller, the data including at least one value that was stored in a selected memory location of the management controller during runtime execution of the management controller;

compare the profile to one or more golden profiles to determine whether security of the management controller has been compromised;

responsive to the profile matching a golden profile of the one or more golden profiles, permit the management controller to continue execution; and

responsive to the profile failing to match a golden profile of the one or more golden profiles, take remedial action with respect to the management controller.

14. The article of claim 13 , wherein the profile is embodied in a platform control register associated with a cryptoprocessor associated with the management controller.

15. The article of claim 13 , wherein the profile is encrypted by a private key of a public/private key pair, and the instructions further cause the processor to decrypt the profile with a public key of the public/private key pair to validate the profile before comparison to the one or more golden profiles.

16. The article of claim 13 , wherein the profile further includes data regarding a boot-time configuration of the management controller.

17. The article of claim 13 , wherein the remedial action comprises segregating the management controller into an untrusted subnet of the dedicated management network.

18. The article of claim 17 , wherein the remedial action further comprises segregating a host system of the information handling system into an untrusted subnet of a data network coupled to the host system.