System and method for authorization scope extension for security protocol and data model capable devices
An information handling system includes a device capable of sending and receiving security protocol and data model messages. A management controller with an authorization role as a designated leader is configured to verify authenticity of the device, discover authorization capabilities of the device, and set the authorization role of the device as a follower.
1. An information handling system, comprising:
a device capable of sending and receiving security protocol and data model (SPDM) messages using an SPDM protocol, wherein the device is managed by a management controller; and
the management controller in communication with the device and with an authorization role as a designated leader, the management controller configured to:
verify authenticity of the device;
subsequent to the verification of the authenticity of the device, discover authorization capabilities of the device;
set the authorization role of the device as a follower, including defining an authorization scope of the device based on the authorization role; and
deny a security operation if the security operation is requested by the device with the authorization role as the follower.
2. The information handling system of claim 1 , wherein the device is one of a Peripheral Component Interconnect-Express (PCIe) device, an inter-integrated circuit (I 2 C), a management component transport protocol (MCTP) device, or a platform level data model (PLDM) device.
3. The information handling system of claim 1 , wherein the authorization scope includes whether the management controller or the device is authorized to read/write to private information.
4. The information handling system of claim 1 , wherein the authorization scope includes whether the management controller or the device is authorized to read/write to public information.
5. The information handling system of claim 1 , wherein the authorization scope includes whether the management controller or the device is authorized to update firmware.
6. The information handling system of claim 1 , wherein the management controller and the device are included in a platform management subsystem of the information handling system.
7. The information handling system of claim 1 , wherein the follower adheres to security principles set by the management controller.
8. The information handling system of claim 1 , wherein the management controller maintains a list of devices that are followers of the management controller.
9. The information handling system of claim 1 , wherein the authorization role defines a set of allow/deny operations based on the authorization role.
10. The information handling system of claim 1 , wherein the device is further configured to determine the authorization scope of a requester subsequent to receipt of a request to perform an operation from the requester.
11. The information handling system of claim 10 , wherein the requester is one of the management controller or another device.
12. The information handling system of claim 10 , wherein the device is further configured to deny the request upon the determination that the authorization scope of the requester disallows the operation.
13. The information handling system of claim 10 , wherein the device is further configured to allow the operation upon the determination that the authorization scope of the requester allows the operation.
14. A method comprising:
verifying, by a management controller, authenticity of a device capable of sending and receiving security protocol and data model (SPDM) messages using an SPDM protocol, wherein the device is configured to communicate with the management controller, and wherein the device is managed by the management controller;
subsequent to the verifying of the authenticity of the device, discovering authorization capabilities of the device;
setting an authorization role of the device as a follower, including defining an authorization scope of the device based on the authorization role; and
denying a security operation if the security operation is requested by the device with the authorization role of the follower.
15. The method of claim 14 , wherein the authorization role defines a set of allow/deny operations based on the authorization role.
16. The method of claim 14 , wherein the device is further configured to determine the authorization scope of a requester subsequent to receipt of an operation from the requester.
17. The method of claim 16 , wherein the device is further configured to deny the operation upon the determination that the authorization scope of the requester disallows the operation.
18. A non-transitory computer-readable medium including code that when executed performs a method, the method comprising:
verifying authenticity of a device capable of sending and receiving security protocol and data model (SPDM) messages using an SPDM protocol, wherein the device is configured to communicate with a management controller, and wherein the device is managed by the management controller;
subsequent to the verifying of the authenticity of the device, discovering authorization capabilities of the device and setting an authorization role of the device as a follower, including defining an authorization scope of the device based on the authorization role; and
denying a security operation if the security operation is requested by the device with the authorization role of the follower.
19. The non-transitory computer-readable medium of claim 18 , wherein the device is one of a Peripheral Component Interconnect-Express device, an inter-integrated circuit, a management component transport protocol device, or a platform level data model device.
20. The non-transitory computer-readable medium of claim 18 , wherein the authorization role defines a set of allow/deny operations based on the authorization role.