Validating secure assembly and delivery of information handling systems
Various embodiments provide methods for validating secure assembly and delivery of an IHS (Information Handling System) by confirming that the detected hardware components of the IHS include only factory installed hardware components. During factory provisioning of an IHS, an inventory certificate is uploaded to the IHS, where the inventory certificate includes an inventory that identifies the hardware components installed during factory assembly of the IHS. An inventory is collected of the detected hardware components of the IHS. The collected inventory is compared against the inventory from the inventory certificate in order to validate the detected hardware components of the IHS as the same hardware components that were installed during factory assembly of the IHS. Embodiments provide a customer receiving an IHS with a capability of validating that a delivered IHS includes only factory installed hardware components.
1. A method for validating secure assembly and delivery of an IHS (Information Handling System), the method comprising:
initiating, by the IHS, a pre-boot operating environment comprising a validation process that operates prior to booting an operating system of the IHS;
retrieving, by the validation process of the IHS, an inventory certificate uploaded to the IHS during factory provisioning of the IHS, wherein the inventory certificate includes a signed inventory identifying a plurality of hardware components installed during factory assembly of the IHS, wherein the inventory certificate is uploaded to a non-removeable, persistent memory of the IHS during the factory provisioning of the IHS, and wherein the inventory certificate is a public key identity certificate generated in response to a CSR (Certificate Signing Request) generated by the IHS during the factory provisioning of the IHS;
utilizing, by the validation process of the IHS, a public key included in the inventory certificate to validate the signed inventory was cryptographically signed by the IHS;
collecting, by the validation process of the IHS, an inventory of detected hardware components of the IHS; and
comparing, by the validation process of the IHS, the collected inventory of detected hardware components against the signed inventory from the inventory certificate uploaded to the IHS during factory provisioning of the IHS in order to validate the detected hardware components of the IHS as the same hardware components installed during factory assembly of the IHS.
2. The method of claim 1 , wherein the signed inventory included in the inventory certificate is based on a manifest of uniquely identifiable hardware components installed during the factory assembly of the IHS.
3. The method of claim 1 , wherein the inventory certificate, including the inventory signed by the IHS being provisioned, is signed during the factory provisioning of the IHS via operations by a factory certificate authority.
4. The method of claim 3 , further comprising validating, using a public key associated with the factory certificate authority, that the inventory certificate was signed by the factory certificate authority, and wherein the public key included in the inventory certificate used to validate the signed inventory comprises a public key of a private keypair generated by the IHS during factory provisioning of the IHS.
5. The method of claim 1 , wherein the inventory certificate is uploaded to the persistent memory via operations by a remote access controller of the IHS, and wherein the signed inventory is signed by the remote access controller of the IHS.
6. The method of claim 1 , wherein the validation of the secure assembly and delivery of the IHS is conducted by a pre-boot validation process of the IHS.
7. The method of claim 6 , wherein the pre-boot validation process is implemented by a remote access controller of the IHS.
8. The method of claim 1 , wherein the comparison of the collected inventory against the signed inventory from the inventory certificate identifies any discrepancies between the detected hardware components of the IHS and the hardware components installed during factory assembly of the IHS.
9. An IHS (Information Handling System) comprising:
a plurality of hardware components, wherein during factory provisioning of the IHS an inventory certificate is uploaded to a non-removeable, persistent memory of the IHS, wherein the inventory certificate includes a signed inventory that identifies a plurality of hardware components installed during factory assembly of the IHS, and wherein the inventory certificate is a public key identity certificate generated in response to a CSR (Certificate Signing Request) generated by the IHS during the factory provisioning of the IHS, and wherein the plurality of hardware components comprise:
one or more processors; and
one or more memory devices coupled to the processors, the memory devices storing computer-readable instructions that, upon execution by the processors, cause the IHS to:
initiating, by the IHS, a pre-boot operating environment comprising a validation process that operates prior to booting an operating system of the IHS;
retrieve, by the validation process of the IHS, the inventory certificate uploaded to the non-removeable, persistent memory of the IHS during factory provisioning of the IHS;
utilize, by the validation process of the IHS, a public key included in the inventory certificate to validate the signed inventory was cryptographically signed by the IHS;
collect, by the validation process of the IHS, an inventory of the plurality of detected hardware components of the IHS; and
compare, by the validation process of the IHS, the collected inventory of detected hardware components against the signed inventory from the inventory certificate uploaded to the IHS during factory provisioning of the IHS in order to validate the detected hardware components of the IHS as the same hardware components installed during factory assembly of the IHS.
10. The IHS of claim 9 , wherein the signed inventory included in the inventory certificate is based on a manifest of uniquely identifiable hardware components installed during the factory assembly of the IHS.
11. The IHS of claim 9 , wherein the inventory certificate, including the inventory signed by the IHS being provisioned, is signed during the factory provisioning of the IHS via operations by a factory certificate authority, and wherein execution of the instructions by the processors further causes the IHS to validate, using a public key associated with the factory certificate authority, that the inventory certificate was signed by the factory certificate authority.
12. The IHS of claim 9 , wherein the inventory certificate is uploaded to the persistent memory via operations by a remote access controller of the IHS, and wherein the signed inventory is signed by the remote access controller of the IHS.
13. The IHS of claim 9 , wherein the validation of the secure assembly and delivery of the IHS is conducted by a pre-boot validation process of the IHS.
14. The IHS of claim 9 , wherein the public key included in the inventory certificate used to validate the signed inventory comprises a public key of a private keypair generated by the IHS during factory provisioning of the IHS.
15. A computer-readable storage device having instructions stored thereon for validating secure assembly and delivery of an IHS (Information Handling System), wherein execution of the instructions by one or more processors of the IHS causes a validation process of the IHS to:
initiate, by the IHS, a pre-boot operating environment comprising a validation process that operates prior to booting an operating system of the IHS;
retrieve, by the validation process of the IHS, an inventory certificate uploaded to a non-removeable, persistent memory of the IHS during factory provisioning of the IHS, wherein the inventory certificate includes a signed inventory that identifies factory installed hardware components of the IHS, and wherein the inventory certificate is a public key identity certificate generated in response to a CSR (Certificate Signing Request) generated by the IHS during the factory provisioning of the IHS;
utilize, by the validation process of the IHS, a public key included in the inventory certificate to validate the signed inventory was cryptographically signed by the IHS;
collect, by the validation process of the IHS, an inventory of detected hardware components of the IHS; and
compare, by the validation process of the IHS, the collected inventory of detected hardware components against the signed inventory from the inventory certificate uploaded to the IHS during factory provisioning of the IHS in order to validate the detected hardware components of the IHS as the same hardware components installed during factory assembly of the IHS.
16. The storage device of claim 15 , where wherein the signed inventory certificate is uploaded to the persistent memory via operations by a remote access controller of the IHS.
17. The storage device of claim 16 , wherein the validation process is a pre-boot validation process implemented by the remote access controller.
18. The storage device of claim 15 , wherein the comparison of the collected inventory against the signed inventory from the inventory certificate identifies any discrepancies between the detected hardware components of the IHS and the hardware components installed during factory assembly of the IHS.