Mechanism to secure side band communication between service processor and an end point

1. An information handling system, comprising:

a self-encrypting storage device configured to store data in an encrypted state; and

a storage controller configured to:

manage the self-encrypting storage device;

generate a passphrase;

share the passphrase with a baseboard management controller via a shared memory architecture transfer mechanism;

receive an encrypted message from the baseboard management controller;

decrypt the encrypted message using the passphrase to obtain a message, a sent hash, and a nonce value, the message including an encryption key to access the self-encrypting storage device;

compare the nonce value to a counter to determine if the nonce value is an old nonce value;

calculate an observed hash of the message;

compare the observed hash with the sent hash; and

accept the message when the nonce value is not an old nonce value and the observed hash matches the received hash;

the baseboard management controller in communication with the storage controller using a sideband interface and configured to:

receive the passphrase from the storage controller via shared memory architecture transfer mechanism;

generate the sent hash of the message;

encrypt the message, the sent hash, and the nonce value using the passphrase to form the encrypted message; and

transmit the encrypted message to the storage controller over the sideband interface.

2. The information handling system of claim 1 , wherein the communication over the sideband interface is an inter-integrated circuit interface.

3. The information handling system of claim 1 , wherein the communication over the sideband interface utilizes a management component transport protocol.

4. The information handling system of claim 1 , wherein the baseboard management controller is further configured to communicate with an enterprise key management server over a management network.

5. The information handling system of claim 1 , wherein the baseboard management controller is further configured to store the passphrase and a current counter value in a persistent memory location and reestablish communication using the passphrase and current counter after a reboot.

6. The information handling system of claim 1 , wherein the storage controller is configured to generate a new passphrase and send the new passphrase to the baseboard management controller via encrypted message.

7. A method of encrypting communication, comprising:

managing a self-encrypting storage device;

generating a passphrase;

sharing the passphrase with a service processor via a shared memory architecture transfer mechanism;

receiving an encrypted message from the service processor over a sideband interface;

decrypting the encrypted message using the passphrase to obtain a message, a received hash, and a nonce value, the message including an encryption key to access a self-encrypting storage device;

comparing the nonce value to a counter to determine if the nonce value is an old nonce value;

calculating an observed hash of the message;

comparing the observed hash with the received hash; and

accepting the message when the nonce value is not an old nonce value and the observed hash matches the received hash.

8. The method of claim 7 ; further comprising rejecting the message when the nonce value is an old nonce value or when the hash does not match the calculated hash.

9. The method of claim 7 ; further comprising generating a hash of a message; encrypting the message, the hash, and nonce value using the passphrase to form an encrypted message; and transmitting the encrypted message to the endpoint device over the sideband interface.

10. The method of claim 7 ; wherein the message includes a key, and further comprising accessing a self-encrypting storage device using the key.

11. The method of claim 7 ; wherein the sideband interface is an I2C interface.

12. The method of claim 7 ; wherein the communication over the sideband interface utilizes a management component transport protocol.

13. A method of encrypting communication, comprising:

receiving a passphrase from an endpoint device via shared memory architecture transfer mechanism;

generating a hash of a message;

encrypting the message, the hash, and a nonce value using the passphrase to form an encrypted message; and

transmitting the encrypted message to the endpoint device over a sideband interface;

receiving an encrypted message from the endpoint device over the sideband interface;

decrypting the encrypted message using the passphrase to obtain a message, a received hash, and a nonce value;

comparing the nonce value to a counter to determine if the nonce value is an old nonce value;

calculating an observed hash of the message;

comparing the observed hash with the received hash;

accepting the message when the nonce value is not an old nonce value and the observed hash matches the received hash; and

storing the passphrase and a current counter value in a persistent memory location and reestablishing communication using the passphrase and current counter after a reboot.

14. The method of claim 13 ; further comprising rejecting the message when the nonce value is an old nonce value or when the hash does not match the calculated hash.

15. The method of claim 13 , further comprising receiving a key from an enterprise key management server, wherein the message includes the key.

16. The method of claim 13 ; wherein the sideband interface is an inter-integrated circuit interface.

17. The method of claim 13 ; wherein the communication over the sideband interface utilizes a management component transport protocol.