Systems and methods of executing a chain of trust with an embedded controller to secure functionalities of an integrated subscriber identification module (iSIM)
A method of securing functionalities of an integrated subscriber identification module (iSIM) on an information handling system may include with an embedded controller (EC), detecting a powering-up process at the information handling system and determine a chain of trust access keys during bootup; with the execution of the EC, detecting and activating a wireless wide area network (WWAN) module; with the execution of the EC, detecting and accessing an integrated subscriber identity module (iSIM); with the execution of the EC, authenticating access to iSIM content including authorization information and carrier profile information with the chain of trust access keys generated from encryption keys based on digital signatures; and sending the authorization information and carrier profile information form the iSIM to the WWAN module for authentication, wirelessly, with a switched multimegabit data service (SM-DS) server associated with the carrier profile.
1. A method of securing functionalities of an integrated subscriber identification module (iSIM) on an information handling system, comprising:
with an embedded controller (EC), detecting a powering-up process at the information handling system and determine chain of trust access keys during bootup;
with the execution of the EC, detecting and activating a wireless wide area network (WWAN) module;
with the execution of the EC, detecting and accessing an integrated subscriber identity module (iSIM);
with the execution of the EC, authenticating access to iSIM content including authorization information and carrier profile information with the chain of trust access keys from generated encryption keys based on digital signatures; and
sending the authorization information and carrier profile information from the iSIM to the WWAN module of a network interface device for authentication, wirelessly, with a switched multimegabit data service (SM-DS) server associated with the carrier profile.
2. The method of claim 1 further comprising:
receiving, from the SM-DS server at the WWAN module, authentication of the authorization information and carrier profile information and initiating an operating system (OS) of the information handling system to manage operations of the WWAN module to communicate data to and from WWAN base station.
3. The method of claim 1 further comprising:
periodically responding to pings from the SM-DS server associated with the carrier during communication with the SM-DS server by, via execution of the EC, requesting authentication from the SM-DS server at the WWAN module.
4. The method of claim 1 , wherein determining the chain of trust access keys during bootup includes determining a sequence of microcontrollers used to create a chain of trust with the EC as the root of trust and generating the encryption keys based on the digital signatures created from one microcontroller to another microcontroller of the sequence of microcontrollers.
5. The method of claim 1 further comprising:
determining a sequence of microcontrollers used to create a chain of trust and selecting among the microcontrollers among the sequence of microcontrollers to generate the encryption keys based on the digital signatures created from the selected microcontrollers.
6. The method of claim 1 , wherein the EC includes instructions for a sequence of microcontrollers to create a chain of trust prior to the booting of a BIOS firmware/software.
7. The method of claim 1 , wherein the iSIM is integrated into a dedicated flash module in the information handling system.
8. The method of claim 1 , wherein the iSIM is integrated into the EC and includes SIM control logic to communicate with the WWAN.
9. An information handling system operating an integrated subscriber identification module (iSIM) chain of trust system comprising:
a secured memory including an iSIM and SIM control logic;
a power management unit (PMU);
an embedded controller (EC) to:
detect a powering-up process at the PMU of the information handling system;
determine a chain of trust for a boot up sequence of at least one controller prior to boot of a BIOS and creating chain of trust access keys;
detect and access the iSIM with the chain of trust access keys to receive authorization information and carrier profile information;
detect and activate a wireless wide area network (WWAN) module; and
a network interface device (NID) to receive instructions from the EC to send the authorization information and carrier profile information to a switched multimegabit data service (SM-DS) server associated with the carrier profile to authenticate access to a carrier network.
10. The information handling system of claim 9 , wherein the NID receives a connection request from the SM-DS server via authentication of the authorization information and carrier profile information and initiates an operating system (OS) of the information handling system to manage operations of the NID to communicate data to and from the carrier network.
11. The information handling system of claim 9 , wherein the EC periodically responds to pings from the SM-DS server associated with the carrier during communication with the SM-DS server by requesting authentication from the SM-DS server.
12. The information handling system of claim 9 , further comprising:
preventing, with the EC, the boot up of a basic input/output system (BIOS) until the subscription confirmation with the WWAN carrier is initiated by the EC.
13. The information handling system of claim 9 , wherein the EC ensures a chain of trust is maintained from the EC to the OS boot as the EC sends the chain of trust access keys to the iSIM to access carrier profile information for use by the NID for authentication with the SM-DS server.
14. The information handling system of claim 9 , wherein determining the chain of trust for a boot up sequence includes determining a sequence of microcontrollers used to create a chain of trust with the EC as the root of trust and generating the encryption keys based on the digital signatures created from one microcontroller to another microcontroller of the sequence of microcontrollers.
15. The information handling system of claim 9 wherein determining a chain of trust for a boot up sequence includes determining a sequence of microcontrollers used to create a chain of trust and selecting among the microcontrollers among the sequence of microcontrollers to generate the encryption keys based on the digital signatures created from the selected microcontrollers.
16. The information handling system of claim 15 wherein determining a sequence of microcontrollers used to create a chain of trust and selecting among the microcontrollers among the sequence of microcontrollers to generate the encryption keys is based on the digital signatures created from the selected microcontrollers.
17. The information handling system of claim 15 wherein the secured iSIM memory location is a memory on the NID and is accessed by the EC via the chain of trust access keys.
18. A method of securing a chain of trust during the operation of an integrated subscriber identification module (iSIM) on an information handling system, comprising:
with an embedded controller (EC), detecting a powering-up process at the information handling system and booting firmware associated with a network interface device (NID);
determine chain of trust access keys during boot up process of plural controllers before BIOS boot up;
with the EC, detecting the integration of the iSIM on a memory associated with the EC and accessing with the chain of trust access keys carrier authorization profiles associated with one or more wireless carrier networks in a secured iSIM memory location;
with the execution of the NID by the EC, sending the carrier authorization profiles for authentication with wireless carrier services associated with the one or more carrier authorization profiles; and
initiating the boot-up of a basic input/output system (BIOS) and an operating system (OS) of the information handling system to manage operations of the NID to communicate data to and from the wireless carrier services upon confirmation of the chain of trust form the EC and authorization from the wireless carrier services.
19. The information handling system of claim 18 further comprising:
periodically responding to pings from the wireless carrier services associated with the one or more carrier authorization profiles during communication with the wireless carriers by, via execution of the EC, requesting re-authentication from the wireless carrier services.
20. The information handling system of claim 18 wherein determining the chain of trust access keys during bootup includes determining a sequence of microcontrollers used to create a chain of trust with the EC as the root of trust and generating the encryption keys is based on the digital signatures created from one microcontroller to another microcontroller of the sequence of microcontrollers.