DERIVING INDEPENDENT SYMMETRIC ENCRYPTION KEYS BASED UPON A TYPE OF SECURE BOOT USING A SECURITY PROCESSOR
Embodiments of systems and methods for deriving independent symmetric encryption keys based upon a type of secure boot using a security processor are described. In some embodiments, a security processor may include: a core; and a memory coupled to the core, the memory having program instructions stored thereon that, upon execution by the core, cause the security processor to: identify a type of secure boot performed to bootstrap an Information Handling System (IHS); and derive a symmetric encryption key based upon the type of secure boot.
1 . A security processor, comprising:
a core; and
a memory coupled to the core, the memory having program instructions stored thereon that, upon execution by the core, cause the security processor to:
identify a type of secure boot performed to bootstrap an Information Handling System (IHS); and
derive a symmetric encryption key based upon the type of secure boot.
2 . The security processor of claim 1 , wherein the type of secure boot performed comprises the type of secure boot last performed.
3 . The security processor of claim 1 , wherein to identify the type of secure boot, the program instructions, upon execution by the core, cause the security processor to identify an entity, a type of the entity, or an order of the entity associated with a secure boot public key used to initiate the bootstrap.
4 . The security processor of claim 3 , wherein the entity comprises a customer or brand of an Original Equipment Manufacturer (OEM).
5 . The security processor of claim 4 , wherein to identify the entity, the type of the entity, or the order of the entity, the program instructions, upon execution, further cause the security processor to read a value of a counter configured to be incremented upon an eviction of any customer or brand of the OEM from the security processor.
6 . The security processor of claim 5 , wherein the eviction of the customer or brand is associated with a return, service, or warranty claim.
7 . The security processor of claim 5 , wherein the value of the counter is usable by the security processor to identify a number of times the security processor has been shipped to a plurality of customers or brands.
8 . The security processor of claim 5 , wherein the value of the counter is usable by the security processor to identify a number of times the IHS has been returned to the OEM.
9 . The security processor of claim 5 , wherein the value of the counter is usable by the security processor to identify a number of times the security processor has been provisioned or reprovisioned by the OEM.
10 . The security processor of claim 5 , wherein to derive the symmetric encryption key, the program instructions, upon execution by the core, further cause the security processor to select one of a plurality of seeds usable by an Advanced Encryption Standard (AES) hardware engine within the security processor based, at least in part, upon the value of the counter.
11 . The security processor of claim 10 , wherein the plurality of seeds is fused into the security processor.
12 . The security processor of claim 5 , wherein to derive the symmetric encryption key, the program instructions, upon execution by the core, further cause the security processor to select one of a plurality of seeds usable by an Advanced Encryption Standard (AES) hardware engine within a Baseboard Management Controller (BMC) based, at least in part, upon the value of the counter.
13 . The security processor of claim 12 , wherein the plurality of seeds is fused into the security processor.
14 . The security processor of claim 5 , wherein the program instructions, upon execution by the core, further cause the security processor to, in response to a rekeying command from the customer or brand, derive the symmetric encryption key based, at least in part, upon at least one additional input.
15 . A memory storage device having program instructions stored thereon that, upon execution by an Information Handling System (IHS), cause the IHS to:
identify a type of secure boot last performed;
derive a symmetric encryption key based upon the type of secure boot; and
encrypt, with the symmetric encryption key, data configured not to leave the IHS.
16 . The memory storage device of claim 15 , wherein to identify the type of secure boot, the program instructions, upon execution by IHS, further cause IHS to read a value of a counter associated with a number of evicted customers of an Original Equipment Manufacturer (OEM).
17 . The memory storage device of claim 15 , wherein the data comprises data usable to authenticate a user locally with respect to the IHS.
18 . A method, comprising:
deriving an encryption key based upon a type of secure boot; and
encrypting data with the encryption key.
19 . The method of claim 18 , further comprising identifying the type of secure boot, at least in part, by reading a value of a counter associated with a customer or brand of an Original Equipment Manufacturer (OEM).
20 . The method of claim 18 , wherein the data comprises data usable to log a user into an Information Handling System (IHS).