Integrated infrastructure secure communication system
An integrated infrastructure secure communication system includes at least one chassis, and a plurality of computing devices that are located in the at least one chassis and that are coupled to each other. A first computing device included in the plurality of computing device receives a communication from a first component in the first computing device, retrieves a vendor-based key, and encrypts the communication using the vendor-based key to provide a first-level encrypted communication. The first computing device also generates a first random key, encrypts the first-level encrypted communication with the first random key to provide a second-level encrypted communication, and transmits the second-level encrypted communication to a second computing device that is included in the plurality of computing devices.
1. An integrated infrastructure secure communication system, comprising:
at least one chassis; and
a plurality of computing devices that are located in the at least one chassis and that are coupled to each other, wherein a first computing device that is included in the plurality of computing devices is configured to:
receive a communication from a first component in the first computing device;
retrieve a vendor-based key;
encrypt the communication using the vendor-based key to provide a first-level encrypted communication;
generate a first random key;
encrypt the first-level encrypted communication with the first random key to provide a second-level encrypted communication;
transmit the second-level encrypted communication to a second computing device that is included in the plurality of computing devices;
receive, from the second computing device, an encrypted second-level encrypted communication provided by encrypting the second-level encrypted communication with a second random key;
decrypt the encrypted second-level encrypted communication based on the first random key to provide an encrypted first-level encrypted communication; and
transmit the encrypted first-level encrypted communication to the second computing device.
2. The system of claim 1 , wherein the first computing device includes a Physical Unclonable Function (PUF) module that is used to generate the first random key.
3. The system of claim 2 , wherein the first computing device includes a smart Network Interface Controller (SmartNIC) that is configured to use the PUF module to generate the first random key.
4. The system of claim 1 , wherein the second computing device is configured to:
receive the second-level encrypted communication from the first computing device;
generate the second random key;
encrypt the second-level encrypted communication with the second random key to provide the encrypted second-level encrypted communication; and
transmit the encrypted second-level encrypted communication to the first computing device.
5. The system of claim 1 , wherein the second computing device is configured to:
validate, in response to receiving the second-level encrypted communication from the first computing device, a signature provided with the second-level encrypted communication by the first computing device.
6. The system of claim 1 , wherein the first computing device includes a Baseboard Management Controller (BMC) that is configured to encrypt the communication using the vendor-based key to provide the first-level encrypted communication and.
7. The system of claim 1 , wherein the second computing device is configured to:
receive the encrypted first-level encrypted communication from the first computing device;
decrypt the encrypted first-level encrypted communication based on the second random key to provide the first-level encrypted communication;
retrieve the vendor-based key; and
decrypt the first-level encrypted communication using the vendor-based key to provide the communication; and
transmit the communication to a second component in the second computing device.
8. The system of claim 1 , further comprising:
a certificate database storing a vendor-based certificate, where in the vendor-based key is retrieved using the vendor-based certificate.
9. An Information Handling System (IHS), comprising:
a processing system; and
a memory system that is coupled to the processing system and that includes instructions that, when executed by the processing system, cause the processing system to provide an integrated infrastructure secure communication engine that is configured to:
receive a communication from a component that is coupled to the processing system;
retrieve a vendor-based key;
encrypt the communication using the vendor-based key to provide a first-level encrypted communication;
generate a first random key;
encrypt the first-level encrypted communication with the first random key to provide a second-level encrypted communication;
transmit the second-level encrypted communication to a computing device;
receive, from the computing device, an encrypted second-level encrypted communication provided by encrypting the second-level encrypted communication with a second random key;
decrypt the encrypted second-level encrypted communication based on the first random key to provide an encrypted first-level encrypted communication; and
transmit the encrypted first-level encrypted communication to the computing device.
10. The IHS of claim 9 , further comprising:
a Physical Unclonable Function (PUF) module that is coupled to the processing system and that is used to generate the first random key.
11. The IHS of claim 10 , further comprising:
a smart Network Interface Controller (SmartNIC) that is coupled to the processing system and that is configured to use the PUF module to generate the first random key.
12. The IHS of claim 9 , wherein the processing system is included in a Baseboard Management Controller (BMC) that configured to encrypt the communication using the vendor-based key to provide the first-level encrypted communication.
13. The IHS of claim 9 , further comprising:
a certificate database storing a vendor-based certificate, where in the vendor-based key is retrieved using the vendor-based certificate.
14. A method for securing communications in an integrated infrastructure system, comprising:
receiving, by a first computing device, a communication from a first component in the first computing device;
retrieving, by the first computing device, a vendor-based key;
encrypting, by the first computing device, the communication using the vendor-based key to provide a first-level encrypted communication;
generating, by the first computing device, a first random key;
encrypting, by the first computing device, the first-level encrypted communication with the first random key to provide a second-level encrypted communication;
transmitting, by the first computing device, the second-level encrypted communication to a second computing device;
receiving, by the first computing device from the second computing device, an encrypted second-level encrypted communication provided by encrypting the second-level encrypted communication with a second random key;
decrypting, by the first computing device, the encrypted second-level encrypted communication based on the first random key to provide an encrypted first-level encrypted communication; and
transmitting, by the first computing device, the encrypted first-level encrypted communication to the second computing device.
15. The method of claim 14 , wherein the first computing device includes a Physical Unclonable Function (PUF) module that is used to generate the first random key.
16. The method of claim 15 , wherein the first computing device includes a smart Network Interface Controller (SmartNIC) that is configured to use the PUF module to generate the first random key.
17. The method of claim 14 , further comprising:
receiving, by the second computing device, the second-level encrypted communication from the first computing device;
generating, by the second computing device, the second random key;
encrypting, by the second computing device, the second-level encrypted communication with the second random key to provide an the encrypted second-level encrypted communication; and
transmitting, by the second computing device, the encrypted second-level encrypted communication to the first computing device.
18. The method of claim 14 , wherein the first computing device includes a Baseboard Management Controller (BMC) that is configured to encrypt the communication using the vendor-based key to provide the first-level encrypted communication.
19. The method of claim 14 , further comprising:
receiving, by the second computing device, the encrypted first-level encrypted communication from the first computing device;
decrypting, by the second computing device, decrypt the encrypted first-level encrypted communication based on the second random key to provide the first-level encrypted communication;
retrieving, by the second computing device, the vendor-based key;
decrypting, by the second computing device, the first-level encrypted communication using the vendor-based key to provide the communication; and
transmitting, by the second computing device, the communication to a second component in the second computing device.
20. The method of claim 14 , wherein the vendor-based key is retrieved using a vendor-based certificate that is stored in a certificate database in the first computing device.