Device locking key management system
A key management system includes a managed system coupled to a management system through a network. The managed system includes managed device locking subsystem(s) coupled to a managed device and a key storage. The managed device locking subsystem(s) retrieve, through the network from the management system, a managed device locking key that is configured to unlock the managed device. The managed device locking subsystem(s) then encrypt the managed device locking key to provide an encrypted managed device locking key, and store the encrypted managed device locking key in the key storage. Subsequent to storing the encrypted managed device locking key, the managed device locking subsystem(s) retrieve the encrypted managed device locking key from the key storage, and decrypt the encrypted managed device locking key to provide a decrypted managed device locking key. The managed device locking subsystem(s) then use the decrypted managed device locking key to unlock the managed device.
1. A key management system, comprising
a management system; and
a managed system that is coupled to the management system through a network, wherein the managed system includes:
a managed device;
a managed device locking key storage; and
at least one managed device locking subsystem that is coupled to the managed device and the managed device locking key storage, wherein the at least one managed device locking subsystem is configured to:
retrieve, by a remote access controller included in the at least one managed device locking subsystem and via an out-of-band network connection through the network from the management system, a managed device locking key that is configured to unlock the managed device;
encrypt, by the remote access controller, the managed device locking key to provide an encrypted managed device locking key;
store, by the remote access controller, the encrypted managed device locking key in the managed device locking key storage;
retrieve, from the managed device locking key storage subsequent to storing the encrypted managed device locking key, the encrypted managed device locking key;
decrypt the encrypted managed device locking key to provide a decrypted managed device locking key; and
unlock, using the decrypted managed device locking key, the managed device.
2. The system of claim 1 , wherein the at least one managed device locking subsystem includes a remote access controller device that is configured to:
retrieve the managed device locking key, encrypt the managed device locking key to provide the encrypted managed device locking key, store the encrypted managed device locking key, retrieve the encrypted managed device locking key, decrypt the encrypted managed device locking key to provide the decrypted managed device locking key, and unlock the managed device using the decrypted managed device locking key.
3. The system of claim 1 , wherein the remote access controller device is configured to:
retrieve the encrypted managed device locking key, decrypt the encrypted managed device locking key to provide the decrypted managed device locking key, and unlock the managed device using the decrypted managed device locking key, and wherein the at least one managed device locking subsystem includes:
a Basic Input Output System (BIOS) that, when the remote access controller device is unavailable, is configured to:
retrieve the encrypted managed device locking key, decrypt the encrypted managed device locking key to provide the decrypted managed device locking key, and unlock the managed device using the decrypted managed device locking key.
4. The system of claim 1 , wherein the managed system includes:
an encryption key module that is configured to provide encryption keys, and wherein the at least one managed device locking subsystem is coupled to the encryption key module and is configured to:
retrieve, at a first time, an encryption key from the encryption key module;
encrypt, using the encryption key, the managed device locking key to provide the encrypted managed device locking key;
retrieve, at a second time that is subsequent to the first time, the encryption key from the encryption key module; and
decrypt, using the encryption key, the encrypted managed device locking key to provide the decrypted managed device locking key.
5. The system of claim 1 , wherein the at least one managed device locking subsystem is configured to:
determine whether the encrypted managed device locking key that is stored in the managed device locking key storage satisfies an encrypted managed device locking key storage duration; and
retrieve, from the managed device locking key storage in response to determining that the encrypted managed device locking key that is stored in the managed device locking key storage satisfies the encrypted managed device locking key storage duration, the encrypted managed device locking key.
6. The system of claim 1 , wherein the at least one managed device locking subsystem is configured to:
determine whether the encrypted managed device locking key that is stored in the managed device locking key storage satisfies an encrypted managed device locking key power cycle rule; and
erase, from the managed device locking key storage in response to determining that the encrypted managed device locking key that is stored in the managed device locking key storage does not satisfy the encrypted managed device locking key power cycle rule, the encrypted managed device locking key.
7. An Information Handling System (IHS), comprising:
at least one processing system; and
at least one memory system that is coupled to the at least one processing system and that includes instructions that, when executed by the at least one processing system, cause the at least one processing system to provide at least one managed device locking subsystem that is configured to:
retrieve, by a remote access controller via an out-of-band network connection through a network from a management system, a managed device locking key that is configured to unlock a managed device, wherein the at least one managed device locking subsystem is provided by:
a first processing system and a first memory system that is coupled to the first processing system and that includes instructions that, when executed by the first processing system, cause the first processing system to provide the remote access controller;
encrypt, by the remote access controller, the managed device locking key to provide an encrypted managed device locking key;
store, by the remote access controller, the encrypted managed device locking key in a managed device locking key storage;
retrieve, from the managed device locking key storage subsequent to storing the encrypted managed device locking key, the encrypted managed device locking key;
decrypt the encrypted managed device locking key to provide a decrypted managed device locking key; and
unlock, using the decrypted managed device locking key, the managed device.
8. The IHS of claim 7 , wherein the at least one managed device locking subsystem is provided by a first processing system and a first memory system that is coupled to the first processing system and that includes instructions that, when executed by the first processing system, cause the first processing system to provide a remote access controller that is configured to:
retrieve the managed device locking key, encrypt the managed device locking key to provide the encrypted managed device locking key, store the encrypted managed device locking key, retrieve the encrypted managed device locking key, decrypt the encrypted managed device locking key to provide the decrypted managed device locking key, and unlock the managed device using the decrypted managed device locking key.
9. The IHS of claim 7 , wherein the
remote access controller is configured to:
retrieve the encrypted managed device locking key, decrypt the encrypted managed device locking key to provide the decrypted managed device locking key, and unlock the managed device using the decrypted managed device locking key, and wherein the at least one managed device locking subsystem is provided by:
a second processing system and a second memory system that is coupled to the second processing system and that includes instructions that, when executed by the second processing system, cause the second processing system to provide a Basic Input Output System (BIOS) that, when the remote access controller is unavailable, is configured to:
retrieve the encrypted managed device locking key, decrypt the encrypted managed device locking key to provide the decrypted managed device locking key, and unlock the managed device using the decrypted managed device locking key.
10. The IHS of claim 7 , wherein the at least one managed device locking subsystem is configured to:
retrieve, at a first time, an encryption key from an encryption key module;
encrypt, using the encryption key, the managed device locking key to provide the encrypted managed device locking key;
retrieve, at a second time that is subsequent to the first time, the encryption key from the encryption key module; and
decrypt, using the encryption key, the encrypted managed device locking key to provide the decrypted managed device locking key.
11. The IHS of claim 7 , wherein the at least one managed device locking subsystem is configured to:
determine, at a first time, whether the encrypted managed device locking key that is stored in the managed device locking key storage satisfies an encrypted managed device locking key storage duration; and
retrieve, from the managed device locking key storage in response to determining that the encrypted managed device locking key that is stored in the managed device locking key storage satisfies the encrypted managed device locking key storage duration, the encrypted managed device locking key.
12. The IHS of claim 11 , wherein the at least one managed device locking subsystem is configured to:
determine, at a second time that is subsequent to the first time, whether the encrypted managed device locking key that is stored in the managed device locking key storage satisfies the encrypted managed device locking key storage duration; and
erase, from the managed device locking key storage in response to determining that the encrypted managed device locking key that is stored in the managed device locking key storage does not satisfy the encrypted managed device locking key storage duration, the encrypted managed device locking key.
13. The IHS of claim 7 , wherein the at least one managed device locking subsystem is configured to:
determine whether the encrypted managed device locking key that is stored in the managed device locking key storage satisfies an encrypted managed device locking key power cycle rule; and
erase, from the managed device locking key storage in response to determining that the encrypted managed device locking key that is stored in the managed device locking key storage does not satisfy the encrypted managed device locking key power cycle rule, the encrypted managed device locking key.
14. A method for managing keys, comprising:
retrieving, by at least one managed device locking subsystem that is included in a managed system, that is provided by a remote access controller device, and via an out-of-band network connection through a network from a management system, a managed device locking key that is configured to unlock a managed device that is included in the managed system;
encrypting, by the remote access controller device, the managed device locking key to provide an encrypted managed device locking key;
storing, by the remote access controller device, the encrypted managed device locking key in a managed device locking key storage that is included in the managed system;
retrieving, by the at least one managed device locking subsystem from the managed device locking key storage subsequent to storing the encrypted managed device locking key, the encrypted managed device locking key;
decrypting, by the at least one managed device locking subsystem, the encrypted managed device locking key to provide a decrypted managed device locking key; and
unlocking, by the at least one managed device locking subsystem using the decrypted managed device locking key, the managed device.
15. The method of claim 14 , wherein the at least one managed device locking subsystem is provided by a remote access controller device that performs the retrieving the managed device locking key, the encrypting the managed device locking key to provide the encrypted managed device locking key, the storing the encrypted managed device locking key, the retrieving the encrypted managed device locking key, the decrypting the encrypted managed device locking key to provide the decrypted managed device locking key, and the unlocking the managed device using the decrypted managed device locking key.
16. The method of claim 14 , wherein the remote access controller device performs the retrieving the encrypted managed device locking key, the decrypting the encrypted managed device locking key to provide the decrypted managed device locking key, and the unlocking the managed device using the decrypted managed device locking key, and wherein the at least one managed device locking subsystem is provided by:
a Basic Input Output System (BIOS) that performs, when the remote access controller is unavailable, the retrieving the encrypted managed device locking key, the decrypting the encrypted managed device locking key to provide the decrypted managed device locking key, and the unlocking the managed device using the decrypted managed device locking key.
17. The method of claim 14 , further comprising:
retrieving, by the at least one managed device subsystem at a first time, an encryption key from the encryption key module;
encrypting, by the at least one managed device subsystem using the encryption key, the managed device locking key to provide the encrypted managed device locking key;
retrieving, by the at least one managed device subsystem at a second time that is subsequent to the first time, the encryption key from the encryption key module; and
decrypting, by the at least one managed device subsystem using the encryption key, the encrypted managed device locking key to provide the decrypted managed device locking key.
18. The method of claim 14 , further comprising:
determining, by the at least one managed device subsystem at a first time, whether the encrypted managed device locking key that is stored in the managed device locking key storage satisfies an encrypted managed device locking key storage duration; and
retrieving, by the at least one managed device subsystem from the managed device locking key storage in response to determining that the encrypted managed device locking key that is stored in the managed device locking key storage satisfies the encrypted managed device locking key storage duration, the encrypted managed device locking.
19. The method of claim 18 , further comprising:
determining, by the at least one managed device subsystem at a second time that is subsequent to the first time, whether the encrypted managed device locking key that is stored in the managed device locking key storage satisfies the encrypted managed device locking key storage duration; and
erasing, by the at least one managed device subsystem from the managed device locking key storage in response to determining that the encrypted managed device locking key that is stored in the managed device locking key storage does not satisfy the encrypted managed device locking key storage duration, the encrypted managed device locking key.
20. The method of claim 14 , further comprising:
determining, by the at least one managed device subsystem, whether the encrypted managed device locking key that is stored in the managed device locking key storage satisfies an encrypted managed device locking key power cycle rule; and
erasing, by the at least one managed device subsystem from the managed device locking key storage in response to determining that the encrypted managed device locking key that is stored in the managed device locking key storage does not satisfy the encrypted managed device locking key power cycle rule, the encrypted managed device locking key.