DERIVING DEPENDENT SYMMETRIC ENCRYPTION KEYS BASED UPON A TYPE OF SECURE BOOT USING A SECURITY PROCESSOR
Embodiments of systems and methods for deriving dependent symmetric encryption keys based upon a type of secure boot using a security processor are described. In some embodiments, a security processor may include: a core; and a memory coupled to the core, the memory having program instructions stored thereon that, upon execution by the core, cause the security processor to: retrieve a first symmetric key based, at least in part, upon a type of secure boot performed to bootstrap an Information Handling System (IHS); and derive a second symmetric key based, at least in part, upon the first symmetric key.
1 . A security processor, comprising:
a core; and
a memory coupled to the core, the memory having program instructions stored thereon that, upon execution by the core, cause the security processor to:
retrieve a first symmetric key based, at least in part, upon a type of secure boot performed to bootstrap an Information Handling System (IHS); and
derive a second symmetric key based, at least in part, upon the first symmetric key.
2 . The security processor of claim 1 , wherein the type of secure boot performed comprises the type of secure boot last performed.
3 . The security processor of claim 1 , wherein the program instructions, upon execution by the core, further cause the security processor to identify the type of secure boot corresponding to a secure boot public key used to bootstrap the IHS.
4 . The security processor of claim 3 , wherein to identify the type of secure boot, the program instructions, upon execution, further cause the security processor to read a value of a counter configured to be incremented upon an eviction of a customer or brand of an Original Equipment Manufacturer (OEM) from the security processor.
5 . The security processor of claim 4 , wherein the eviction of the customer or brand is associated with a return, service, or warranty claim.
6 . The security processor of claim 4 , wherein the value of the counter is usable by the security processor to identify a number of times the security processor has been shipped to a plurality of customers or brands.
7 . The security processor of claim 4 , wherein the value of the counter is usable by the security processor to identify a number of times the IHS has been returned to the OEM.
8 . The security processor of claim 4 , wherein the value of the counter is usable by the security processor to identify or a number of times the security processor has been provisioned or reprovisioned by the OEM.
9 . The security processor of claim 1 , wherein the first symmetric key is usable by a first Advanced Encryption Standard (AES) hardware engine within a Baseboard Management Controller (BMC).
10 . The security processor of claim 9 , wherein the first symmetric key is fused into the security processor.
11 . The security processor of claim 9 , wherein the second symmetric key is usable by a second AES hardware engine within the security processor.
12 . The security processor of claim 11 , wherein the second symmetric key is fused into the security processor.
13 . The security processor of claim 11 , wherein the program instructions, upon execution by the core, further cause the security processor to encrypt and decrypt data usable to authenticate a user with the second symmetric key.
14 . The security processor of claim 1 , wherein the program instructions, upon execution by the core, further cause the security processor to, in response to a rekeying command from the customer or brand, derive the second symmetric key further based, at least in part, upon at least one additional input.
15 . A memory storage device having program instructions stored thereon that, upon execution by an Information Handling System (IHS), cause the IHS to:
retrieve a first symmetric key fused into a security processor based, at least in part, upon the value of a counter configured to be incremented upon eviction of a customer of an Original Equipment Manufacturer (OEM) from the security processor, wherein the first symmetric key is usable by a first encryption engine within an external processor; and
derive a second symmetric key based, at least in part, upon the first symmetric key, wherein the second symmetric key is usable by a second encryption engine within the security processor.
16 . The memory storage device of claim 15 , wherein the second symmetric key is further derived based, at least in part, upon a seed fused into the security processor, and wherein the seed is selected based upon the value of the counter.
17 . The memory storage device of claim 15 , wherein the program instructions, upon execution by the IHS, further cause the IHS to encrypt and decrypt data usable to authenticate a user with the second symmetric key.
18 . A method, comprising:
retrieving a first symmetric key based, at least in part, upon the value of a counter, wherein the first symmetric key is usable by a first encryption engine within a security processor; and
deriving a second symmetric key based, at least in part, upon the first symmetric key, wherein the second symmetric key is usable by a second encryption engine within an external processor.
19 . The method of claim 18 , wherein the second symmetric key is further derived based, at least in part, upon a seed selected based upon the value.
20 . The method of claim 18 , further comprising encrypting and decrypting data usable to authenticate a user with the second symmetric key.