Distributed secure communication system
A distributed secure communication system includes a first System Control Processor (SCP) subsystem coupled to second and third SCP subsystems via a network. The first SCP subsystem identifies the second SCP subsystem, signs a first SCP authentication communication with a first private key to provide a first signed SCP authentication communication that it transmits to the second SCP subsystem. The first SCP subsystem receives a second signed SCP authentication communication from the second SCP subsystem, authenticates the second signed SCP authentication communication using a second public key associated with the second SCP subsystem and, in response, establishes a first secure communication channel with the second SCP subsystem. The first SCP subsystem then receives an attestation of an authentication of the third SCP subsystem from the second SCP subsystem and, in response, establishes a second secure communication channel with the third SCP subsystem without the transmission of signed SCP authentication communications.
1. A distributed secure communication system, comprising:
a third System Control Processor (SCP) subsystem;
a second SCP subsystem that is coupled to the third SCP subsystem via a network; and
a first SCP subsystem that is coupled to the second SCP subsystem and the third SCP subsystem via the network, wherein the first SCP subsystem is configured to:
identify the second SCP subsystem and, in response, perform a signed communication secure communication channel establishment procedure with the second SCP subsystem that includes:
signing a first SCP authentication communication with a first private key to provide a first signed SCP authentication communication;
transmitting the first signed SCP authentication communication to the second SCP subsystem;
receiving a second signed SCP authentication communication from the second SCP subsystem and, in response, authenticating the second signed SCP authentication communication using a second public key associated with the second SCP subsystem; and
establishing, in response to authenticating the second signed SCP authentication communication, a first secure communication channel with the second SCP subsystem; and
receive, from the second SCP subsystem via the first secure communication channel, an attestation of an authentication of the third SCP subsystem that established a second secure communication channel between the SCP subsystem and the third SCP subsystem and, in response, establish a third secure communication channel with the third SCP subsystem without performing the signed communication secure communication channel establishment procedure with the third SCP subsystem.
2. The system of claim 1 , wherein the first SCP subsystem is configured to:
monitor for SCP subsystems and, in response, identify the second SCP subsystem.
3. The system of claim 1 , wherein the first SCP subsystem is configured to:
retrieve, via a network, the second public key associated with the second SCP subsystem.
4. The system of claim 1 , wherein the first SCP subsystem is configured to:
transmit, via the first secure communication channel, first control communications with the second SCP subsystem; and
transmit, via the third secure communication channel, second control communications with the third SCP subsystem.
5. The system of claim 4 , wherein the first SCP subsystem is configured to:
transmit, via a first unsecured communication channel, first data communications with the second SCP subsystem; and
transmit, via a second unsecured communication channel, second data communications with the third SCP subsystem.
6. The system of claim 1 , wherein the attestation of the authentication of the third SCP subsystem includes:
a third public key associated with the third SCP subsystem; and
third SCP subsystem communication connection information.
7. An Information Handling System (IHS), comprising:
a processing system; and
a memory system that is coupled to the processing system and that includes instructions that, when executed by the processing system, cause the processing system to provide a distributed secure communication engine that is configured to:
identify a second System Control Processor (SCP) subsystem and, in response, perform a signed communication secure communication channel establishment procedure with the second SCP subsystem that includes:
signing a first SCP authentication communication with a first private key to provide a first signed SCP authentication communication;
transmitting the first signed SCP authentication communication to the second SCP subsystem;
receiving a second signed SCP authentication communication from the second SCP subsystem and, in response, authenticating the second signed SCP authentication communication using a second public key associated with the second SCP subsystem; and
establishing, in response to authenticating the second signed SCP authentication communication, a first secure communication channel with the second SCP subsystem; and
receive, from the second SCP subsystem via the first secure communication channel, an attestation of an authentication of a third SCP subsystem that established a second secure communication channel between the second SCP subsystem and the third SCP subsystem and, in response, establish a third secure communication channel with the third SCP subsystem without performing the signed communication secure communication channel establishment procedure with the third SCP subsystem.
8. The IHS of claim 7 , wherein the distributed secure communication engine is configured to:
monitor for SCP subsystems and, in response, identify the second SCP subsystem.
9. The IHS of claim 7 , wherein the distributed secure communication engine is configured to:
retrieve, via a network, the second public key associated with the second SCP subsystem.
10. The IHS of claim 7 , wherein the distributed secure communication engine is configured to:
transmit, via the first secure communication channel, first control communications with the second SCP subsystem; and
transmit, via the third secure communication channel, second control communications with the third SCP subsystem.
11. The IHS of claim 10 , wherein the distributed secure communication engine is configured to:
transmit, via a first unsecured communication channel, first data communications with the second SCP subsystem; and
transmit, via a second unsecured communication channel, second data communications with the third SCP subsystem.
12. The IHS of claim 7 , wherein the attestation of the authentication of the third SCP subsystem includes:
a third public key associated with the third SCP subsystem; and
third SCP subsystem communication connection information.
13. The IHS of claim 7 , wherein the distributed secure communication engine is configured to:
receive, from the third SCP subsystem via the second secure communication channel, an attestation of an authentication of a fourth SCP subsystem that established a fourth secure communication channel between the third SCP subsystem and the fourth SCP subsystem and, in response, establish a fifth secure communication channel with the fourth SCP subsystem without performing the signed communication secure communication channel establishment procedure with the fourth SCP subsystem.
14. A method for providing distributed secure communications, comprising:
identifying, by a first System Control Processor (SCP) subsystem, a second SCP subsystem and, in response, performing a signed communication secure communication channel establishment procedure with the second SCP subsystem that includes:
signing a first SCP authentication communication with a first private key to provide a first signed SCP authentication communication;
transmitting, by the first SCP subsystem, the first signed SCP authentication communication to the second SCP subsystem;
receiving, by the first SCP subsystem, a second signed SCP authentication communication from the second SCP subsystem and, in response, authenticating the second signed SCP authentication communication using a second public key associated with the second SCP subsystem; and
establishing, by the first SCP subsystem in response to authenticating the second signed SCP authentication communication, a first secure communication channel with the second SCP subsystem; and
receiving, by the first SCP subsystem from the second SCP subsystem via the first secure communication channel, an attestation of an authentication of a third SCP subsystem that established a second secure communication channel between the second SCP subsystem and the third SCP subsystem and, in response, establishing a third secure communication channel with the third SCP subsystem without performing the signed communication secure communication channel establishment procedure with the third SCP subsystem.
15. The method of claim 14 , further comprising:
monitoring, by the first SCP subsystem, for SCP subsystems and, in response, identifying the second SCP subsystem.
16. The method of claim 14 , further comprising:
retrieving, by the first SCP subsystem via a network, the second public key associated with the second SCP subsystem.
17. The method of claim 14 , further comprising:
transmitting, by the first SCP subsystem via the first secure communication channel, first control communications with the second SCP subsystem; and
transmitting, by the first SCP subsystem via the second secure communication channel, second control communications with the third SCP subsystem.
18. The method of claim 17 , further comprising:
transmitting, by the first SCP subsystem via a first unsecured communication channel, first data communications with the second SCP subsystem; and
transmitting, by the first SCP subsystem via a second unsecured communication channel, second data communications with the third SCP subsystem.
19. The method of claim 14 , wherein the attestation of the authentication of the third SCP subsystem includes:
a third public key associated with the third SCP subsystem; and
third SCP subsystem communication connection information.
20. The method of claim 14 , further comprising
receiving, by the first SCP subsystem from the third SCP subsystem via the second secure communication channel, an attestation of an authentication of a fourth SCP subsystem that established a fourth secure communication channel between the third SCP subsystem and the fourth SCP subsystem and, in response, establishing a fifth secure communication channel with the fourth SCP subsystem without performing the signed communication secure communication channel establishment procedure with the fourth SCP subsystem.