Baseboard management controller (BMC)-based security processor
Technologies are described herein for providing a Baseboard Management Controller (“BMC”) -based security processor. The disclosed BMC-based security processor can provide a hardware Root of Trust (“RoT”) for a computing platform without the addition of specialized silicon to the platform and while minimizing the number of attack points. The disclosed BMC-based security processor can also provide functionality for securely filtering requests made on certain buses in a computing platform. Through implementations of the features identified briefly above, and others described herein, various technical benefits can be achieved such as, but not limited to, increased security as compared to previous computing systems that utilize a BMC to provide a hardware RoT and reduced complexity and cost as compared to previous computing systems that utilize a separate hardware device, such as a Field Programmable Gate Array (“FPGA”) or a microcontroller, to provide a hardware RoT.
1. A baseboard management controller (BMC) system on chip (SOC), comprising:
a memory storing an immutable public key;
a first processor providing a secure environment; and
a second processor providing a normal environment, wherein
upon powering on the first processor, the first processor is configured to
attempt to cryptographically verify a firmware for the BMC SOC using the public key, the firmware for the BMC SOC comprising a security subsystem and a management subsystem, the security subsystem configured to provide a hardware root of trust (HRoT) based upon the public key and the management subsystem configured to provide BMC functionality,
responsive to cryptographically verifying the firmware for the BMC SOC, begin executing the security subsystem on the first processor in the secure environment and causing the second processor to exit from reset and begin executing the management subsystem in the normal environment,
attempt to cryptographically verify a firmware for a host computer by way of the security subsystem, and
responsive to cryptographically verifying the firmware for the host computer, cause a host processor of the host computer to exit from reset and begin executing the firmware for the host computer.
2. The BMC SOC of claim 1 , wherein the first processor is further configured to recover the firmware for the BMC SOC responsive to determining that the firmware for the BMC SOC could not be cryptographically verified.
3. The BMC SOC of claim 1 , wherein the first processor is further configured to recover the firmware for the host computer responsive to determining that the firmware for the host computer could not be cryptographically verified.
4. The BMC SOC of claim 1 , further comprising a plurality of buses, wherein the plurality of buses is assigned to the secure environment.
5. The BMC SOC of claim 1 , wherein a plurality of controllers of the host computer are assigned to the secure environment.
6. The BMC SOC of claim 1 , wherein a memory storing the firmware for the BMC SOC and a memory storing the firmware for the host computer are assigned to the secure environment.
7. The BMC SOC of claim 4 , wherein the second processor providing the normal environment can access the memory storing the firmware for the BMC SOC and the memory storing the firmware for the host computer only by making requests to the first processor providing the secure environment.
8. A computer-implemented method, comprising:
upon powering on of a first processor of a baseboard management controller (BMC) system on chip (SOC), attempting to cryptographically verify a firmware for the BMC SOC by way of the first processor using an immutable public key stored in the BMC SOC, the firmware for the BMC SOC comprising a security subsystem and a management subsystem, the security subsystem configured to provide a hardware root of trust (HRoT) based upon the public key and the management subsystem configured to provide BMC functionality; and
responsive to cryptographically verifying the firmware for the BMC SOC, begin executing the security subsystem on the first processor in a secure environment and causing a second processor of the BMC SOC to exit from reset and begin executing the management subsystem in a normal environment.
9. The computer-implemented method of claim 8 , further comprising:
attempting to cryptographically verify a firmware for a host computer by way of the security subsystem executing in the secure environment on the first processor; and
responsive to cryptographically verifying the firmware for the host computer, cause a host processor of the host computer to exit from reset and begin executing the firmware for the host computer.
10. The computer-implemented method of claim 8 , further comprising recovering the firmware for the BMC SOC responsive to determining that the firmware for the BMC SOC could not be cryptographically verified.
11. The computer-implemented method of claim 9 , further comprising recovering the firmware for the host computer responsive to determining that the firmware for the host computer could not be cryptographically verified.
12. The computer-implemented method of claim 8 , wherein a plurality of buses is assigned to the secure environment.
13. The computer-implemented method of claim 8 , wherein a plurality of controllers is assigned to the secure environment.
14. The computer-implemented method of claim 8 , wherein a memory storing the firmware for the BMC SOC and a memory storing the firmware for the host computer are assigned to the secure environment.
15. The computer-implemented method of claim 14 , wherein the second processor can access the memory storing the firmware for the BMC SOC and the memory storing the firmware for the host computer only by making requests to the first processor.
16. A computing system, comprising:
a host processor;
a memory storing a firmware for the computing system;
a memory storing a firmware for a baseboard management controller (BMC) system on chip (SOC), the firmware for the BMC SOC comprising a security subsystem and a management subsystem, the security subsystem configured to provide a hardware root of trust (HRoT) and the management subsystem configured to provide BMC functionality; and
the BMC SOC, the BMC SOC comprising:
a memory storing an immutable public key;
a first processor providing a secure environment; and
a second processor providing a normal environment, wherein
upon powering on the first processor, the first processor is configured to
attempt to cryptographically verify the firmware for the BMC SOC using the public key,
responsive to cryptographically verifying the firmware for the BMC SOC, begin executing the security subsystem on the first processor in the secure environment and cause the second processor to exit from reset and begin executing the management subsystem,
attempt to cryptographically verify the firmware for the computing system by way of the security subsystem, and
responsive to cryptographically verifying the firmware for the computing system, cause the host processor of the computing system to exit from reset and begin executing the firmware for the computing system.
17. The computing system of claim 16 , wherein the first processor is further configured to recover the firmware for the BMC SOC responsive to determining that the firmware for the BMC SOC could not be cryptographically verified.
18. The computing system of claim 16 , wherein the first processor is further configured to recover the firmware for the computing system responsive to determining that the firmware for the computing system could not be cryptographically verified.
19. The computing system of claim 16 , further comprising a plurality of buses and a plurality of controllers, and wherein the plurality of buses and the plurality of controllers are assigned to the secure environment.
20. The computing system of claim 16 , wherein the memory storing the firmware for the BMC SOC and the memory storing the firmware for the computing system are assigned to the secure environment and wherein the second processor can access the memory storing the firmware for the BMC SOC and the memory storing the firmware for the computing system only by making requests to the first processor.