Systems and methods for hardware attestation in an information handling system
A method may include, during execution of a basic input/output system comprising boot firmware configured to be the first code executed by the processor when the information handling system is booted and/or powered on and execute prior to execution of an operating system of the information handling system, executing a hardware attestation verification application configured to: (i) read a platform certificate comprising information associated with one or more information handling resources of the information handling system recorded during creation of the platform certificate; (ii) perform hardware attestation of the information handling system by comparing information associated with the one or more information handling resources and the information stored within the platform certificate; and (iii) generate a log indicative of the results of the hardware attestation.
1. An information handling system comprising:
a processor; and
a basic input/output system including boot firmware comprising the first code executed by the processor when the information handling system is booted and/or powered on and executed prior to execution of an operating system of the information handling system, the basic input/output system embodied in non-transitory computer-readable media communicatively coupled to the processor and configured, when loaded and executed by the processor, to execute a hardware attestation verification application prior to execution of an operating system of the information handling system wherein the hardware attestation verification application, when executed, performs operations including:
reading a platform certificate comprising identifying information associated with one or more hardware resources of the information handling system recorded during creation of the platform certificate;
comparing the identifying information associated with the one or more hardware resources and the information stored within the platform certificate; and
generating a log indicative of the comparing.
2. The information handling system of claim 1 , wherein the hardware attestation verification application performs the operations in accordance with a hardware attestation policy wherein the hardware attestation policy includes configuration parameters indicative of at least one of:
one of a plurality of selectable levels of attestation; and
a frequency parameter indicative of how often the operations are performed.
3. The information handling system of claim 2 , wherein the plurality of selectable levels of attestation include:
a first level for performing attestation of each of the one or more hardware resources; and
a second level for performing attestation of less than all of the one or more hardware resources.
4. The information handling system of claim 1 , wherein the platform certificate is created by a manufacturer of the information handling system prior to delivery of the information handling system to its intended end user.
5. The information handling system of claim 1 , wherein the information handling system comprises a cryptoprocessor and the platform certificate is bound to the information handling system by the cryptoprocessor.
6. The information handling system of claim 1 , wherein the platform certificate is cryptographically signed with a signature and the hardware attestation verification application is configured to verify the signature when performing hardware attestation.
7. A method comprising, during execution of a basic input/output system comprising boot firmware configured to be the first code executed by the processor when the information handling system is booted and/or powered on and execute prior to execution of an operating system of the information handling system, executing a hardware attestation verification application configured to perform operations including:
reading a platform certificate comprising identifying information associated with one or more hardware resources of the information handling system recorded during creation of the platform certificate;
comparing the identifying information associated with the one or more hardware resources and the information stored within the platform certificate; and
generating a log indicative of the results of the comparing.
8. The method of claim 7 , wherein the hardware attestation verification application performs the operations in accordance with a hardware attestation policy wherein the hardware attestation policy includes configuration parameters indicative of at least one of:
one of a plurality of selectable levels of attestation; and
a frequency parameter indicative of how often the operations are performed.
9. The method of claim 8 , wherein the plurality of selectable levels of attestation include:
a first level for performing attestation of each of the one or more hardware resources; and
a second level for performing attestation of less than all of the one or more hardware resources.
10. The method of claim 7 , wherein the platform certificate is created by a manufacturer of the information handling system prior to delivery of the information handling system to its intended end user.
11. The method of claim 7 , wherein the information handling system comprises a cryptoprocessor and the platform certificate is bound to the information handling system by the cryptoprocessor.
12. The method of claim 7 , wherein the platform certificate is cryptographically signed with a signature and the hardware attestation verification application is configured to verify the signature when performing hardware attestation.
13. An article of manufacture comprising:
a non-transitory computer readable medium; and
computer-executable instructions carried on the computer readable medium, the instructions readable by a processor, the instructions, when read and executed, for causing the processor to, during execution of a basic input/output system comprising boot firmware configured to be the first code executed by the processor when the information handling system is booted and/or powered on and executed prior to execution of an operating system of the information handling system, executing a hardware attestation verification application configured to perform operations including:
reading a platform certificate comprising identifying information associated with one or more hardware resources of the information handling system recorded during creation of the platform certificate;
comparing the identifying information associated with the one or more hardware resources and the information stored within the platform certificate; and
generating a log indicative of the results of the comparing.
14. The article of claim 13 , wherein the hardware attestation verification application performs the operations in accordance with a hardware attestation policy wherein the hardware attestation policy includes configuration parameters indicative of at least one of:
one of a plurality of selectable levels of attestation; and
a frequency parameter indicative of how often the operations are performed.
15. The article of claim 14 , wherein the plurality of selectable levels of attestation include:
a first level for performing attestation of each of the one or more hardware resources; and
a second level for performing attestation of less than all of the one or more hardware resources.
16. The article of claim 13 , wherein the platform certificate is created by a manufacturer of the information handling system prior to delivery of the information handling system to its intended end user.
17. The article of claim 13 , wherein the information handling system comprises a cryptoprocessor and the platform certificate is bound to the information handling system by the cryptoprocessor.
18. The article of claim 13 , wherein the platform certificate is cryptographically signed with a signature and the hardware attestation verification application is configured to verify the signature when performing hardware attestation.