System and method for shared end device authentication for in-band requests
A converged infrastructure includes a shared device and compute devices. The compute devices include a baseboard management controller and applications including one or more entitled initiators. The baseboard management controllers generate a distributed provision list including certificates chains for the entitled initiators; and configure the shared device with the certificate chains. The shared device receive a critical command and an encrypted hash, determine a calculated hash of the critical command, decrypt the encrypted hash using keys from the certificate chains, and compare the calculated hash with the decrypted hashes to determine if the critical command comes from one of the entitled initiators.
1. A converged infrastructure comprising:
a shared device; and
a plurality of compute devices, the compute devices including a baseboard management controller and a plurality of applications, a subset of the applications being entitled initiators;
the baseboard management controller configured to:
establish a peer-to-peer network of baseboard management controllers over an out-of-band communication channel;
generate a distributed provision list including a certificate chain for the entitled initiators;
configure the shared device with the certificate chain; and
validate the certificate chain from the shared device against the distributed provision list; and
the shared device configured to:
receive a critical command and an encrypted hash;
determine a calculated hash of the critical command;
decrypt the encrypted hash using a plurality of keys from the certificate chain; and
compare the calculated hash with the plurality of decrypted hashes to determine if the critical command comes from one of the entitled initiators based on determining a match between the calculated hash and one of the decrypted hashes.
2. The converged infrastructure of claim 1 , wherein the baseboard management controllers are further configured to enter into an error state when validating fails and to notify an administrative user of the failed validation.
3. The converged infrastructure of claim 1 , wherein the distributed provision list is a blockchain ledger.
4. The converged infrastructure of claim 3 , wherein the blockchain ledger is a circular blockchain ledger.
5. The converged infrastructure of claim 1 , wherein the certificate chain includes public keys of the entitled initiators.
6. The converged infrastructure of claim 1 , wherein the baseboard management controllers are further configured to create or update the distributed provision list upon server host insertion or removal, device hot-plug or removal, shared device assignments or reassignments.
7. A method of establishing an authenticated certificate chain for a shared device, comprising:
establishing a peer-to-peer network of baseboard management controllers over an out-of-band communication channel;
generating a distributed provision list including public keys of a plurality of entitled initiators;
configuring a shared device with a certificate chain including the public keys;
validating the certificate chain from the shared device against the distributed provision list;
receiving, at the shared device, a critical command and an encrypted hash;
determining a calculated hash of the critical command;
decrypting the encrypted hash using the public keys from the certificate chain; and
comparing the calculated hash with the decrypted hashes to determine if the critical command comes from one of the entitled initiators based on determining a match between the calculated hash and one of the decrypted hashes.
8. The method of claim 7 , wherein when validating fails, entering into an error state and notifying an administrative user of the failed validation.
9. The method of claim 7 , further comprising the baseboard management controllers perform discovery over the out-of-band communication channel prior to establishing the peer-to-peer network.
10. The method of claim 7 , further comprising creating or updating the distributed provision list upon server host insertion or removal, device hot-plug or removal, shared device assignments or reassignments.
11. The method of claim 7 , wherein the out-of-band communication channel is a dedicated management local area network.
12. The method of claim 7 , further comprising performing the critical command when the calculated hash matches a decrypted hash using one of the public keys from the certificate chain.
13. The method of claim 7 , wherein the encrypted hash is encrypted with a private key of the application.
14. The method of claim 7 , further comprising decrypting the encrypted hash using a second key from the certificate chain and comparing the calculated hash to the second decrypted hash.
15. The method of claim 7 , further comprising discarding the critical command when all of the public keys from the certificate chain have been used to decrypt the hash and no match is found.
16. The method of claim 7 , wherein the critical command is received over an in-band communication channel.