System and method for cryptographically coupling a media controller to a baseboard management controller
An information handling system includes a baseboard management controller and a media controller. The baseboard management controller includes a memory, and an immutable attribute of the baseboard management controller is fused in the memory during a factory process of the information handling system. The baseboard management controller generates a first seed value based on the immutable attribute, generates a first key value based on the first seed value, and provides the first key value. The media controller includes a secure memory and a processor. The processor receives the first key value from the baseboard management controller, and stores, during the factory process, the first key value in the secure memory. The first key value cryptographically links the secure memory to the baseboard management controller.
1. An information handling system, comprising:
a baseboard management controller including a memory, wherein an immutable attribute of the baseboard management controller is fused in the memory during a factory process of the information handling system, wherein the immutable attribute cannot be changed after the immutable attribute is fused in the memory, the baseboard management controller to generate a first seed value based on the immutable attribute, to generate a first key value based on the first seed value, and to provide the first key value; and
a media controller to communicate with the baseboard management controller, the media controller including:
a secure memory; and
a processor to communicate with the baseboard management controller and with the secure memory, the processor to receive the first key value from the baseboard management controller, and to store, during the factory process, the first key value in the secure memory, wherein the first key value cryptographically links the secure memory to the baseboard management controller.
2. The information handling system of claim 1 , during an operation of the information handling system:
the baseboard management controller to provide an access request of the secure memory, to generate a first hash of the immutable attribute, and to providing both the immutable attribute and the first hash to the media controller; and
the processor of the media controller to generate a second hash of the immutable attribute based on the stored first key value and the immutable attribute, to compare the second hash to the first hash, if the second hash matches the first hash, to allow access to data in the secure memory; and if the second hash does not match the first hash, to initiate a security policy for the information handling system, wherein the security policy prevents the baseboard management controller from accessing the data within the secure memory.
3. The information handling system of claim 2 , wherein prior to the detecting of the access request: the baseboard management controller to begin a second execution of the bootloader program to launch the information handling system in a secure boot mode.
4. The information handling system of claim 1 , wherein the baseboard management controller further includes:
a processor; and
hardware circuitry, wherein the generating of the first seed value comprises: the processor to retrieve the immutable attribute from the memory of the baseboard management controller, and to provide the immutable attribute to hardware circuitry, and the hardware circuitry to encrypt the immutable attribute, wherein the encrypted immutable attribute is the first seed value.
5. The information handling system of claim 4 , wherein encrypting the immutable attribute comprises: the hardware circuitry to encrypt the immutable attribute via a hidden root key unique to the baseboard management controller.
6. The information handling system of claim 1 , wherein the secure memory is embedded on a same die as the media controller.
7. The information handling system of claim 1 , wherein the immutable attribute is a media access controller address of the baseboard management controller.
8. A method during a factory process of an information handling system, the method comprising:
beginning execution of a bootloader program of the information handling system;
generating a first seed value based on an immutable attribute of a baseboard management controller of the information handling system, wherein the immutable attribute of the baseboard management controller is fused in a memory of the baseboard management controller, wherein the immutable attribute cannot be changed after the immutable attribute is fused in the memory;
generating a first key value based on the first seed value;
providing the first key value to a media controller of the information handling system; and
storing the first key value in a secure memory of the media controller, wherein the first key value cryptographically links the secure memory to the baseboard management controller.
9. The method of claim 8 , further comprising:
during an operation of the information handling system:
detecting an access request of the secure memory, wherein the access request is from the baseboard management controller;
generating a first hash of the immutable attribute;
providing both the immutable attribute and the first hash to the media controller;
generating a second hash of the immutable attribute based on the first key value and the immutable attribute;
comparing the second hash to the first hash;
if the second hash matches the first hash, allowing access to data in the secure memory; and
if the second hash does not match the first hash, initiating a security policy for the information handling system, wherein the security policy prevents the baseboard management controller from accessing the data within the secure memory.
10. The method of claim 9 , wherein prior to the detecting of the access request, the method further comprises:
beginning a second execution of the bootloader program to launch the information handling system in a secure boot mode.
11. The method of claim 8 , wherein the generating of the first seed value comprises:
retrieving the immutable attribute from a memory of the baseboard management controller;
providing the immutable attribute to hardware circuitry; and
encrypting, by the hardware circuitry, the immutable attribute, wherein the encrypted immutable attribute is the first seed value.
12. The method of claim 11 , wherein encrypting the immutable attribute comprises:
encrypting the immutable attribute via a hidden root key unique to the baseboard management controller.
13. The method of claim 8 , wherein the secure memory is embedded on a same die as the media controller.
14. The method of claim 8 , wherein the immutable attribute is a media access controller address of the baseboard management controller.
15. A non-transitory computer-readable medium including code that when executed by a processor causes the processor to perform a method, the method comprising:
during a factory process of an information handling system:
beginning execution of a bootloader program of the information handling system;
generating a first seed value based on an immutable attribute of a baseboard management controller of the information handling system, wherein the immutable attribute of the baseboard management controller is fused in a memory of the baseboard management controller, wherein the immutable attribute cannot be changed after the immutable attribute is fused in the memory;
generating a first key value based on the first seed value; providing both the immutable attribute and the first seed value to a media controller of the information handling system; and
storing the first key value in a secure memory of the media controller, wherein the first key value cryptographically links the secure memory to the baseboard management controller.
16. The non-transitory computer-readable medium of claim 15 , further comprising:
during an operation of the information handling system:
detecting an access request of the secure memory, wherein the access request is from the baseboard management controller;
generating a first hash of the immutable attribute;
providing both the immutable attribute and the first hash to the media controller;
generating a second hash of the immutable attribute based on the first key value and the immutable attribute;
comparing the second hash to the first hash stored in the secure memory;
if the second hash matches the first hash, allowing access to data in the secure memory; and
if the second hash does not match the first hash, initiating a security policy for the information handling system, wherein the security policy prevents the baseboard management controller from accessing the data within the secure memory.
17. The non-transitory computer-readable medium of claim 16 , wherein prior to the detecting of the access request, the method further comprises:
beginning a second execution of the bootloader program to launch the information handling system in a secure boot mode.
18. The non-transitory computer-readable medium of claim 15 , wherein the generating of the first seed value comprises:
retrieving the immutable attribute from a memory of the baseboard management controller;
providing the immutable attribute to hardware circuitry; and
encrypting, by the hardware circuitry, the immutable attribute, wherein the encrypted immutable attribute is the first seed value.
19. The non-transitory computer-readable medium of claim 18 , wherein encrypting the immutable attribute comprises:
encrypting the immutable attribute via a hidden root key unique to the baseboard management controller.
20. The non-transitory computer-readable medium of claim 15 , wherein the immutable attribute is a media access controller address of the baseboard management controller.