Trusted platform module protection for non-volatile memory express (NVMe) recovery
An information handling system is configured to support first and second boot sequences, which invokes first and second bootloaders respectively. The bootloaders may be stored in an NVMe storage boot partition. Each bootloader may be associated with a corresponding encryption key generated by a trusted platform module, which may seal the first and second keys in accordance with one or more measurements taken during the respective boot sequences. The system determines whether a boot sequence in progress comprises is to invoke the first or second bootloader. The system then unseals the appropriate encryption key to access the appropriate bootloader. The first bootloader may be a host OS bootloader and the second bootloader may be for a recovery resource invoked when the host OS fails to load. The recovery resource may enables BIOS to connect to a remote store and download an image via a HTTP mechanism.
1. A method, comprising:
configuring an information handling system with a host operating system (OS) boot sequence and a recovery resource boot sequence wherein the host OS boot sequence invokes a host OS bootloader stored in a first part of NVMe storage and the recovery resource boot sequence invokes a recovery resource bootloader stored in a second part of NVMe storage;
associating the host OS boot sequence with a host OS encryption key and the recovery resource boot sequence with a recovery resource encryption key;
sealing, in accordance with a first platform configuration register (PCR) measurement unique to the host OS boot sequence, the host OS encryption key;
sealing, in accordance with a second PCR measurement unique to the recovery resource boot sequence, the recovery resource encryption key;
responsive to detecting execution of a boot sequence, determining whether the boot sequence invokes the host OS bootloader or the recovery resource bootloader; and
responsive to determining that the boot sequence invokes the first host OS bootloader, authenticating the host OS bootloader to unseal the host OS encryption key and access the first part of the NVMe storage to execute the host OS bootloader, wherein authenticating the host OS bootloader includes, extending a measurement of the host OS bootloader into the PCR prior to comparing a value of the PCR with a first predetermined value;
responsive to determining that the boot sequence invokes the recovery resource bootloader, authenticating the recovery resource bootloader to unseal the recovery resource encryption key and access the part of the NVMe storage to execute the recovery resource bootloader wherein authenticating the recovery resource bootloader includes, extending a measurement of the recovery resource bootloader into the PCR prior to comparing a value of the PCR with a second predetermined value.
2. The method of claim 1 , wherein the host OS and recovery resource encryption keys are sealed and unsealed by a trusted platform module (TPM) of the information handling system.
3. The method of claim 2 , wherein sealing the host OS encryption key comprises sealing the host OS encryption key to a storage resource of the TPM.
4. The method of claim 1 , wherein at least one of the host OS and recovery resource bootloaders is stored in an NVMe boot directory.
5. The method of claim 1 , wherein the recovery resource authentication key comprises a replay protected media block (RPMB) key.
6. The method of claim 1 , wherein the recovery resource enables BIOS to establish a network connection with a remote store and load from the remote store via the network connection an image of a recovery OS.
7. The method of claim 6 , wherein confidential information required to establish the network connection is stored in the second part of the NVMe storage.
8. An information handling system, comprising:
a central processing unit; and
a non-transitory computer readable medium including processor executable instructions for a host OS boot sequence, a recovery resource boot sequence, and additional instructions, wherein the host OS boot sequence invokes a host OS bootloader stored in a first part of NVMe storage and the recovery resource boot sequence invokes a recovery resource bootloader stored in a second part of the NVMe storage and wherein the additional instructions, when executed by the CPU cause the system to perform operations including:
associating the host OS boot sequence with a host OS encryption key and the recovery resource boot sequence with a recovery resource encryption key;
sealing, in accordance with a first platform configuration register (PCR) measurement unique to the host OS boot sequence, the host OS encryption key;
sealing, in accordance with a second PCR measurement unique to the recovery resource boot sequence, the recovery resource encryption key;
responsive to detecting execution of a boot sequence, determining whether the boot sequence invokes the host OS bootloader or the recovery resource bootloader; and
responsive to determining that the boot sequence invokes the host OS bootloader, authenticating the host OS bootloader to unseal the host OS encryption key and access the first part of the NVMe storage and execute the host OS bootloader, wherein authenticating the host OS bootloader includes, extending a measurement of the host OS bootloader into the PCR prior to comparing a value of the PCR with a first predetermined value;
responsive to determining that the boot sequence invokes the recovery resource bootloader, authenticating the recovery resource bootloader to unseal the recovery resource encryption key and access the second part of the NVMe storage and execute the recovery resource bootloader wherein authenticating the recovery resource bootloader includes, extending a measurement of the recovery resource bootloader into the PCR prior to comparing a value of the PCR with a second predetermined value.
9. The information handling system of claim 8 , wherein the host OS and recovery resource encryption keys are sealed and unsealed by a trusted platform module of the information handling system.
10. The information handling system of claim 9 , wherein sealing the host OS encryption key comprises sealing the host OS encryption key to a storage resource of the TPM.
11. The information handling system of claim 9 , wherein at least one of the host OS and recovery resource bootloaders is configured wherein the bootloader, when executed, validates values stored in one or more platform configuration registers (PCRs) of the trusted platform module.
12. The information handling system of claim 8 , wherein at least one of the host OS and recovery resource bootloaders is stored in an NVMe boot directory.
13. The information handling system of claim 8 , wherein an authentication key for the recovery resource bootloader is encrypted by the recovery resource encryption key and wherein the authentication key comprises a replay protected media block (RPMB) key.
14. The information handling system of claim 8 , wherein the recovery resource enables BIOS to establish a network connection with a remote store and load from the remote store via the network connection an image of a recovery OS.
15. The information handling system of claim 14 , wherein confidential information required to establish the network connection is stored in the second part of the NVMe storage.