Systems and methods to cryptographically verify information handling system configuration
The present disclosure provides various embodiments of systems and related methods to track and cryptographically verify system configuration changes. More specifically, systems and methods are disclosed herein to track an original system configuration of an information handling system (IHS) as the system was built by a manufacturing facility, and any system configuration changes that are made to the original system configuration after the IHS leaves the manufacturing facility. Once a user takes ownership of the IHS, systems and methods disclosed herein may be used to cryptographically verify a current system configuration of the IHS. In doing so, the present disclosure provides a way to authenticate or validate system configuration changes that may occur after the IHS leaves the manufacturing facility.
1. A system, comprising:
an information handling system (IHS) built by a manufacturing facility according to an original system configuration comprising hardware and/or software components included within the IHS at the manufacturing facility;
a first remote system coupled to the IHS via a network, wherein the first remote system comprises a first programmable integrated circuit that executes a first set of program instructions to track the original system configuration of the IHS, which identifies the hardware and/or software components included within the IHS at the manufacturing facility, and any changes made to the original system configuration after the IHS leaves the manufacturing facility, wherein the first programmable integrated circuit of the first remote system executes the first set of program instructions to track the original system configuration of the IHS by generating an initial platform attribute (PA) certificate containing information specifying the original system configuration; and
a second remote system coupled to the IHS and the first remote system via the network, wherein the second remote system comprises a second programmable integrated circuit that executes a second set of program instructions to verify a current system configuration of the IHS after a user takes ownership of the IHS;
wherein the IHS includes:
a trusted platform module (TPM) that stores a private and public Endorsement Key (EK), a private and public Platform Key (PK) and an EK certificate containing the public EK; and
a third programmable integrated circuit that executes a third set of program instructions to cryptographically verify the current system configuration of the IHS by communicating with the TPM and the second remote system.
2. The system as recited in claim 1 , wherein the initial PA certificate includes a system identifier that uniquely identifies the IHS and a plurality of component identifiers that identify the hardware and/or software components included within the IHS at the manufacturing facility.
3. A system comprising:
an information handling system (IHS) built by a manufacturing facility according to an original system configuration;
a first remote system coupled to the IHS via a network, wherein the first remote system comprises a first programmable integrated circuit that executes a first set of program instructions to track the original system configuration of the IHS, and any changes made to the original system configuration after the IHS leaves the manufacturing facility;
wherein the first programmable integrated circuit executes the first set of program instructions to track the original system configuration of the IHS by generating an initial platform attribute (PA) certificate containing information specifying the original system configuration; and
wherein if a system configuration change is made to the original system configuration after the IHS leaves the manufacturing facility, the first programmable integrated circuit further executes the first set of program instructions to track the system configuration change by generating a supplemental PA certificate containing information specifying the system configuration change; and
a second remote system coupled to the IHS and the first remote system via the network, wherein the second remote system comprises a second programmable integrated circuit that executes a second set of program instructions to verify a current system configuration of the IHS after a user takes ownership of the IHS; and
wherein the IHS includes:
a trusted platform module (TPM) that stores a private and public Endorsement Key (EK), a private and public Platform Key (PK) and an EK certificate containing the public EK; and
a third programmable integrated circuit that executes a third set of program instructions to cryptographically verify the current system configuration of the IHS by communicating with the TPM and the second remote system.
4. The system as recited in claim 3 , wherein the supplemental PA certificate includes a system identifier that uniquely identifies the IHS and one or more component identifiers that identify hardware and/or software components, which were added to the IHS after the IHS left the manufacturing facility.
5. The system as recited in claim 3 , further comprising a network portal coupled to the IHS, the first remote system and the second remote system via the network, wherein:
the EK certificate, the initial PA certificate and the public PK are provided to the network portal before the IHS leaves the manufacturing facility; and
the supplemental PA certificate and the public PK are provided to the network portal, if the system configuration change is made to the original system configuration after the IHS leaves the manufacturing facility.
6. The system as recited in claim 5 , wherein the third programmable integrated circuit of the IHS executes the third set of program instructions to initiate verification of the current system configuration by sending a first verification request to the second remote system, wherein the first verification request includes a system identifier that uniquely identifies the IHS.
7. The system as recited in claim 6 , wherein upon receiving the first verification request, the second programmable integrated circuit of the second remote system executes the second set of program instructions to:
use the system identifier to retrieve the EK certificate, the initial PA certificate and the public PK from the network portal;
generate a first nonce;
encrypt the first nonce with the public EK obtained from the EK certificate; and
send the encrypted first nonce to the IHS.
8. The system as recited in claim 7 , wherein upon receiving the encrypted first nonce from the second remote system, the third programmable integrated circuit of the IHS executes the third set of program instructions to:
send a first request to the TPM requesting the TPM to decrypt the encrypted first nonce using the private EK stored within the TPM;
retrieve the current system configuration of the IHS;
send a second request to the TPM requesting the TPM to sign the first nonce, the system identifier and the current system configuration using the private PK stored within the TPM; and
send a first signed message containing the first nonce, the system identifier and the current system configuration to the second remote system via the network.
9. The system as recited in claim 8 , wherein upon receiving the first signed message, the second programmable integrated circuit of the second remote system executes the second set of program instructions to:
verify the first nonce, the system identifier and the current system configuration contained within the first signed message using the public PK and the initial PA certificate retrieved from the network portal; and
send a first verification response to the IHS via the network.
10. The system as recited in claim 9 , wherein the first verification response confirms that the current system configuration matches the original system configuration if:
the first nonce contained within the first signed message matches the first nonce, which was generated by the second programmable integrated circuit of the second remote system upon receiving the verification request;
the system identifier contained within the first signed message matches the system identifier sent with the first verification request; and
the current system configuration contained within the first signed message matches the original system configuration specified in the initial PA certificate.
11. The system as recited in claim 9 , wherein the first verification response informs the IHS that the current system configuration does not match the original system configuration if:
the first nonce contained within the first signed message does not match the first nonce, which was generated by the second programmable integrated circuit of the second remote system; or
the system identifier contained within the first signed message does not match the system identifier sent with the first verification request; or
the current system configuration contained within the first signed message does not match the original system configuration specified in the initial PA certificate.
12. The system as recited in claim 9 , wherein if the first verification response informs the IHS that the current system configuration does not match the original system configuration, the third programmable integrated circuit of the IHS executes the third set of program instructions to determine if a supplemental PA certificate was generated for the IHS after the IHS left the manufacturing facility.
13. The system as recited in claim 12 , wherein if the supplemental PA certificate was generated for the IHS, the third programmable integrated circuit of the IHS executes the third set of program instructions to send a second verification request to the second remote system to initiate verification of the system configuration change specified in the supplemental PA certificate, wherein the second verification request includes the system identifier that uniquely identifies the IHS.
14. The system as recited in claim 13 , wherein upon receiving the second verification request, the second programmable integrated circuit of the second remote system executes the second set of program instructions to:
use the system identifier to retrieve the EK certificate, the supplemental PA certificate and the public PK from the network portal;
generate a second nonce;
encrypt the second nonce with the public EK obtained from the EK certificate; and
send the encrypted second nonce to the IHS.
15. The system as recited in claim 14 , wherein upon receiving the encrypted second nonce from the second remote system, the third programmable integrated circuit of the IHS executes the third set of program instructions to:
send a third request to the TPM requesting the TPM to decrypt the encrypted second nonce using the private EK stored within the TPM;
retrieve the system configuration change;
send a fourth request to the TPM requesting the TPM to sign the second nonce, the system identifier and the system configuration change using the private PK stored within the TPM; and
send a second signed message containing the second nonce, the system identifier and the system configuration change to the second remote system via the network.
16. The system as recited in claim 15 , wherein upon receiving the second signed message, the second programmable integrated circuit of the second remote system executes the second set of program instructions to:
verify the second nonce, the system identifier and the system configuration change contained within the second signed message using the public PK and the supplemental PA certificate retrieved from the network portal; and
send a second verification response to the IHS via the network.
17. The system as recited in claim 16 , wherein the second verification response confirms that the system configuration change retrieved by the third programmable integrated circuit of the IHS matches the system configuration change made to the original system configuration after the IHS leaves the manufacturing facility if:
the second nonce contained within the second signed message matches the second nonce, which was generated by the second programmable integrated circuit of the second remote system upon receiving the second verification request;
the system identifier contained within the second signed message matches the system identifier sent with the second verification request; and
the system configuration change contained within the second signed message matches the system configuration change specified in the supplemental PA certificate.
18. The system as recited in claim 16 , wherein the second verification response informs the IHS that the system configuration change retrieved by the third programmable integrated circuit of the IHS does not match the system configuration change made to the original system configuration after the IHS leaves the manufacturing facility if:
the second nonce contained within the second signed message does not match the second nonce, which was generated by the second programmable integrated circuit of the second remote system upon receiving the second verification request; or
the system identifier contained within the second signed message does not match the system identifier sent with the second verification request; or
the system configuration change contained within the second signed message does not match the system configuration change specified in the supplemental PA certificate.