Secure data collection for validation of installed components of information handling systems
Methods and system are provided for validating the secure assembly and delivery of an IHS (Information Handling System). During factory provisioning of the IHS, an inventory certificate is uploaded to the IHS. The certificate includes: an inventory of hardware components installed during factory assembly of the IHS, validation schemas the provide instructions for identifying the hardware components, and digital signatures used to confirm the integrity of the validation schemas. Upon delivery of the IHS, a validation process retrieves the inventory certificate and confirms the integrity of the validation schemas. Based on validation schema instructions, the validation process collects an inventory of the detected IHS hardware. The validation schema instructions are further used to compare the collected inventory against the inventory from the inventory certificate in order to validate the detected hardware components of the IHS as the same hardware components installed during factory assembly of the IHS.
1. A method for validating secure assembly of an Information Handling System (IHS), the method comprising:
retrieving an inventory certificate uploaded to the IHS during factory provisioning of the IHS, wherein the inventory certificate includes an inventory identifying a plurality of factory installed hardware components installed during a factory assembly of the IHS, wherein the inventory certificate further includes a plurality of validation schemas that comprise instructions for identifying the plurality of factory installed hardware components of the IHS, wherein at least one of the validation schemas specifies whether a given hardware component is identifiable via a Basic Input/Output System (BIOS) query, and wherein the inventory certificate further includes a plurality of respective digital signatures corresponding to the validation schemas for identifying the plurality of factory installed hardware components of the IHS;
confirming the integrity of the plurality of validation schemas included in the inventory certificate based, at least in part, on the plurality of respective digital signatures in the inventory certificate;
collecting an inventory of detected hardware components of the IHS, wherein the inventory is collected based on the instructions for identifying the plurality of factory installed hardware components of the IHS comprised in the plurality of validation schemas included in the inventory certificate; and
comparing the collected inventory of detected components against the inventory from the inventory certificate in order to validate the detected hardware components of the IHS as the same plurality of factory installed hardware components installed during the factory assembly of the IHS.
2. The method of claim 1 , wherein the inventory certificate is signed using a keypair of a certificate authority and wherein a private key of the keypair is used to generate the respective digital signatures corresponding to the validation schemas.
3. The method of claim 2 , wherein the integrity of validation schemas is determined using a public key of the keypair of the certificate authority.
4. The method of claim 1 , further comprising retrieving a component certificate uploaded to the IHS upon a first hardware component being supplied for installation in the IHS, wherein the component certificate includes an inventory identifying the first hardware component, a first validation schema that comprises instructions for identifying the first hardware component, and a first digital signature corresponding to the first validation schema.
5. The method of claim 4 , further comprising confirming the integrity of the first validation schema included in the component certificate based on the first digital signature in the component certificate.
6. The method of claim 5 , wherein the inventory is further collected based on the instructions comprised in the first validation schema included in the component certificate.
7. The method of claim 6 , further comprising comparing the collected inventory of detected components against the inventory from the component certificate in order to identify the first hardware component supplied for installation in the IHS in collected inventory.
8. The method of claim 1 , wherein the comparisons are conducted based on the instructions comprised in the plurality of validation schemas included in the inventory certificate.
9. The method of claim 8 , wherein the inventory certificate further includes a digital signature corresponding to validation logic for use in evaluating the instructions comprised in the plurality of validation schemas.
10. An Information Handling System (IHS), comprising:
a processor; and
a plurality of hardware components coupled to the processor, wherein during factory provisioning of the IHS a signed inventory certificate is uploaded to the IHS that includes an inventory identifying a plurality of factory installed hardware components installed during a factory assembly of the IHS, wherein the inventory certificate further includes a plurality of validation schemas that comprise instructions for identifying the plurality of factory installed hardware components of the IHS, and wherein the inventory certificate further includes a plurality of respective digital signatures corresponding to the validation schemas for identifying the plurality of factory installed hardware components of the IHS, and wherein the plurality of hardware components comprise:
one or more processors; and
one or more memory devices coupled to the processors, the memory devices storing computer-readable instructions that, upon execution by the processors, cause a validation process of the IHS to:
confirm the integrity of the plurality of validation schemas included in the inventory certificate based, at least in part, on the plurality of respective digital signatures in the inventory certificate;
collect an inventory of the plurality of hardware components, wherein the inventory is collected based on the instructions for identifying the plurality of factory installed hardware components of the IHS comprised in the plurality of validation schemas included in the inventory certificate, wherein at least one of the validation schemas specifies whether a given hardware component is identifiable via a Trusted Platform Module (TPM) query; and
compare the collected inventory against the inventory from the inventory certificate in order to validate the plurality of hardware components of the IHS as the same plurality of factory installed hardware components installed during the factory assembly of the IHS.
11. The IHS of claim 10 , wherein the given hardware component comprises a secure memory module.
12. The IHS of claim 10 , wherein the inventory certificate is signed using a keypair of a certificate authority and wherein a private key of the keypair is used to generate the respective digital signatures corresponding to the validation schemas, and wherein the integrity of validation schemas is determined using a public key of the keypair of the certificate authority.
13. The IHS of claim 10 , wherein the validation process additionally retrieves a component certificate uploaded to the IHS upon a first hardware component being supplied for installation in the IHS, wherein the component certificate includes an inventory identifying the first hardware component, a first validation schema that comprises instructions for identifying the first hardware component, and a first digital signature corresponding to the first validation schema.
14. The IHS of claim 13 , wherein the validation process additionally confirms the integrity of the first validation schema included in the component certificate based on the first digital signature in the component certificate.
15. The IHS of claim 14 , wherein the validation process additionally further collects the inventory based on the instructions comprised in the first validation schema included in the component certificate.
16. The IHS of claim 15 , wherein the validation process additionally compares the collected inventory of detected components against the inventory from the component certificate in order to identify the first hardware component supplied for installation in the IHS in collected inventory.
17. The IHS of claim 10 , wherein the validation process comprises a pre-boot process of the IHS.
18. A computer-readable storage device having instructions stored thereon for validating secure assembly of an Information Handling System (IHS), wherein execution of the instructions by one or more processors of the IHS causes a validation process of the IHS to:
retrieve an inventory certificate uploaded to the IHS during factory provisioning of the IHS, wherein the inventory certificate includes an inventory identifying a plurality of factory installed hardware components installed during a factory assembly of the IHS, wherein the inventory certificate further includes a plurality of validation schemas that comprise instructions for identifying the plurality of factory installed hardware components of the IHS, wherein at least one of the validation schemas specifies whether a given hardware component is identifiable via a Basic Input/Output System (BIOS) query or a Trusted Platform Module (TPM) query, and wherein the inventory certificate further includes a plurality of respective digital signatures corresponding to the validation schemas for identifying the plurality of factory installed hardware components of the IHS;
confirm the integrity of plurality of validation schemas included in the inventory certificate based, at least in part, on the plurality of respective digital signatures in the inventory certificate;
collect an inventory of detected hardware components of the IHS, wherein the inventory is collected based on the instructions for identifying the plurality of factory installed hardware components of the IHS comprised in the plurality of validation schemas included in the inventory certificate; and
compare the collected inventory of detected hardware components against the inventory from the inventory certificate in order to validate the detected hardware components of the IHS as the same plurality of factory installed hardware components installed during the factory assembly of the IHS.
19. The storage device of claim 18 , wherein the inventory certificate is signed using a keypair of a certificate authority and wherein a private key of the keypair is used to generate the respective digital signatures corresponding to the validation schemas, and wherein the integrity of validation schemas is determined using a public key of the keypair of the certificate authority.
20. The storage device of claim 19 , wherein the comparisons are conducted based on the instructions comprised in the plurality of validation schemas included in the inventory certificate.