Persistent memory passphrase management
An information handling system may include a persistent memory configured to be secured via a passphrase; a basic input/output system (BIOS); and a management controller configured to provide out-of-band management of the information handling system. The BIOS may be configured to set the passphrase of the persistent memory, encrypt the passphrase via a first key of a first asymmetric key pair, and transmit the encrypted passphrase to the management controller. The management controller may be configured to decrypt the encrypted passphrase via a second key of the first asymmetric key pair, re-encrypt the passphrase via a first key of a second asymmetric key pair, and transmit the re-encrypted passphrase to an external management console via an out-of-band management interface.
1. An information handling system comprising:
a persistent memory configured to be secured via a passphrase;
a basic input/output system (BIOS); and
a management controller configured to provide out-of-band management of the information handling system;
wherein the BIOS is configured to set the passphrase of the persistent memory, encrypt the passphrase via a first key of a first asymmetric key pair, and transmit the encrypted passphrase to the management controller; and
wherein the management controller is configured to decrypt the encrypted passphrase via a second key of the first asymmetric key pair, re-encrypt the passphrase via a first key of a second asymmetric key pair, wherein the second asymmetric key pair is different from the first asymmetric key pair, and transmit the re-encrypted passphrase to an external management console via an out-of-band management interface, the external management console being configured to decrypt the re-encrypted passphrase via a second key of the second asymmetric key pair.
2. The information handling system of claim 1 , wherein the BIOS is a Unified Extensible Firmware Interface (UEFI) BIOS.
3. The information handling system of claim 1 , wherein the management controller is a baseboard management controller (BMC).
4. The information handling system of claim 1 , wherein the external management console is configured to store a list of persistent memory identifiers and corresponding passphrases.
5. The information handling system of claim 1 , wherein the BIOS is configured to transmit the encrypted passphrase to the management controller via an in-band interface.
6. The information handling system of claim 5 , wherein the in-band interface is a keyboard controller style (KCS) interface.
7. A method comprising:
a basic input/output system (BIOS) of an information handling system setting a passphrase of a persistent memory of the information handling system;
the BIOS encrypting the passphrase via a first key of a first asymmetric key pair;
the BIOS transmitting the encrypted passphrase to a management controller configured to provide out-of-band management of the information handling system;
the management controller decrypting the encrypted passphrase via a second key of the first asymmetric key pair;
the management controller re-encrypting the passphrase via a first key of a second asymmetric key pair wherein the second asymmetric key pair is different from the first asymmetric key pair;
the management controller transmitting the re-encrypted passphrase to an external management console via an out-of-band management interface; and
the external management console decrypting the re-encrypted passphrase via a second key of the second asymmetric key pair.
8. The method of claim 7 , wherein the BIOS is a Unified Extensible Firmware Interface (UEFI) BIOS.
9. The method of claim 7 , wherein the management controller is a baseboard management controller (BMC).
10. The method of claim 7 , further comprising storing, at the external management console, a list of persistent memory identifiers and corresponding passphrases.
11. The method of claim 7 , wherein the BIOS transmits the encrypted passphrase to the management controller via an in-band interface.
12. An article of manufacture comprising a non-transitory, computer-readable medium having computer-executable code thereon that is executable by an information handling system for:
causing a basic input/output system (BIOS) of the information handling system to set a passphrase of a persistent memory of the information handling system;
causing the BIOS to encrypt the passphrase via a first key of a first asymmetric key pair;
causing the BIOS to transmit the encrypted passphrase to a management controller configured to provide out-of-band management of the information handling system;
causing the management controller to decrypt the encrypted passphrase via a second key of the first asymmetric key pair;
causing the management controller to re-encrypt the passphrase via a first key of a second asymmetric key pair wherein the second asymmetric key pair is different from the first asymmetric key pair; and
causing the management controller to transmit the re-encrypted passphrase to an external management console via an out-of-band management interface, the external management console being configured to decrypt the re-encrypted passphrase via a second key of the second asymmetric key pair.
13. The article of claim 12 , wherein the BIOS is a Unified Extensible Firmware Interface (UEFI) BIOS.
14. The article of claim 12 , wherein the management controller is a baseboard management controller (BMC).
15. The article of claim 12 , wherein the external management console is configured to store a list of persistent memory identifiers and corresponding passphrases.
16. The article of claim 12 , wherein the BIOS is configured to transmit the encrypted passphrase to the management controller via an in-band interface.
17. The article of claim 12 , wherein the first and second asymmetric key pairs are Rivest-Shamir-Adleman (RSA) key pairs.