Managing control of a security processor in a supply chain
Embodiments of systems and methods for managing control of a security processor in a supply chain are described. In some embodiments, a security processor may include: a core; and a memory coupled to the core, the memory having program instructions stored thereon that, upon execution by the core, cause the security processor to: store a first public key usable to initiate a first secure boot process and unusable to initiate a second secure boot process; store a second public key usable to initiate the second secure boot process and unusable to initiate the first secure boot process; and in response to a first change of control or ownership of the security processor, render the first public key unusable to initiate the first secure boot process.
1. A security processor, comprising:
a core; and
a memory coupled to the core, the memory having program instructions stored thereon that, upon execution by the core, cause the security processor to:
store a first public key usable to initiate a first secure boot process and unusable to initiate a second secure boot process, wherein the first secure boot process excludes access to a first set of one or more selected controllers, and wherein the second secure boot process excludes access to a second set of one or more selected controllers;
store a second public key usable to initiate the second secure boot process and unusable to initiate the first secure boot process; and
in response to a first change of control or ownership of the security processor, render the first public key unusable to initiate the first secure boot process.
2. The security processor of claim 1 , wherein the first set of one or more selected controllers comprises a fuse controller, and wherein the second set of one or more selected controllers excludes the fuse controller.
3. The security processor of claim 2 , wherein the second set of one or more controllers comprises at least one of: a Universal Serial Bus (USB) controller, a network controller, or a storage controller.
4. The security processor of claim 1 , wherein the first and second public keys are fused into the security processor.
5. The security processor of claim 1 , wherein a first entity is associated with the first secure boot public key, wherein a second entity is associated with the second secure boot public key, and wherein the first change of control or ownership is from the first entity to the second entity.
6. The security processor of claim 5 , wherein the first entity is an Original Equipment Manufacturing (OEM) entity, and wherein the second entity is a customer or brand of the OEM entity.
7. The security processor of claim 5 , further comprising a first counter configured to be incremented in response to the first change of control or ownership and a second counter configured to be incremented in response to a second change of control or ownership of the security processor from the second entity to the first entity, wherein to render the first public key unusable to initiate the first secure boot processes, the program instructions, upon execution by the core, further cause the security processor to read the first and second counters.
8. The security processor of claim 7 , wherein the program instructions, upon execution by the core, further cause the security processor to, in response to the second change of control or ownership:
render the second public key unusable to initiate the second secure boot process; and
render the first public key usable to initiate the first secure boot process.
9. The security processor of claim 8 , wherein the second change of control or ownership is associated with an equipment return, service, or warranty claim.
10. The security processor of claim 8 , wherein to render the first or second public keys usable or unusable to initiate the first or second secure boot processes, the program instructions, upon execution by the core, further cause the security processor to read the first and second counters.
11. The security processor of claim 10 , wherein the program instructions, upon execution by the core, further cause the security processor to:
store a third public key usable to initiate a third secure boot process and unusable to initiate the first and second secure boot processes; and
in response to a third change of control or ownership of the security processor from the first entity to a third entity, render the first public key unusable to initiate the first secure boot process.
12. The security processor of claim 11 , wherein the third entity is another customer or brand of the OEM entity.
13. The security processor of claim 11 , wherein the first counter increments in response to the third change of control or ownership, and wherein to render the first public key unusable to initiate the first secure boot process, the program instructions, upon execution by the core, further cause the security processor to read the first and second counters.
14. A non-transitory computer-readable storage medium having program instructions stored thereon that, upon execution by an Information Handling System (IHS) under control or ownership of an Original Equipment Manufacturer (OEM) entity, cause the IHS to:
initiate a first secure boot process using a first public key fused into a security processor, wherein the first public key is usable to initiate a first secure boot process, and wherein the first secure boot process excludes access to a first set of one or more controllers; and
in response to a change of control or ownership of the IHS from the OEM entity to a customer entity, increment a first one-way counter within the security processor, wherein the incremented first one-way counter renders: (i) the first public key unusable to initiate the first secure boot process, and (ii) a second public key fused into the security processor usable to initiate the second secure boot process, and wherein the second secure boot process excludes access to a second set of one or more controllers.
15. The non-transitory computer-readable storage medium of claim 14 , wherein the program instructions, upon execution, further cause the IHS to, in response to a change of control or ownership of the IHS from the customer entity to the OEM entity, increment a second one-way counter within the security processor, wherein the incremented second one-way counter renders the first public key usable to initiate the first secure boot process and the second public key unusable to initiate the second secure boot process.
16. The non-transitory computer-readable storage medium of claim 15 , wherein the program instructions, upon execution, further cause the IHS to, in response to another change of control or ownership of the IHS from the OEM entity to another entity, re-increment the first one-way counter within the security processor, wherein the re-incremented first one-way counter renders the first public key unusable to initiate the first secure boot process and a third public key fused into the security processor usable to initiate a third secure boot process.
17. A method, comprising:
initiating, by a second entity, a second secure boot process of an Information Handling System (IHS) using a second public key fused into a security processor of the IHS, wherein the second secure boot process excludes access to a second controller; and
in response to a change of control or ownership of from the second entity to a first entity, incrementing a second one-way counter within the security processor, wherein the incremented second one-way counter renders: (i) the second public key unusable to initiate the second secure boot process, and (ii) a first public key fused into the security processor usable to initiate a first secure boot process, wherein the first secure boot process excludes access to a first controller.
18. The method of claim 17 , wherein the first entity is an Original Equipment Manufacturing (OEM) entity, wherein the second entity is a customer or brand of the OEM entity, and wherein the change of control or ownership is associated with a return, service, or warranty claim.
19. The method of claim 17 , wherein the first controller comprises at least one of: a Universal Serial Bus (USB) controller, a network controller, or a storage controller, wherein the second controller comprises a fuse controller.