Hardware device mutual authentication system and method for a baseboard management controller (BMC)
An Information Handling System (IHS) includes multiple hardware devices, and a baseboard Management Controller (BMC) in communication with multiple hardware devices of the IHS. The BMC includes executable instructions for transmitting a broadcast message to the hardware devices in which the broadcast message has a block of data including a digital signature of the BMC. Each of the hardware devices that receive the broadcast message are configured to transmit a broadcast acknowledgment message to the BMC. Using the block of data, the BMC and hardware devices may perform a mutual consensus procedure with other using a cryptographic hash function of the block of data.
1. An Information Handling System (IHS), comprising:
a plurality of Security Protocol and Data Model (SPDM)-enabled hardware devices; and
a Baseboard Management Controller (BMC) in communication with the plurality of SPDM-enabled hardware devices, the BMC comprising one or more processors and one or more memory units including instructions that, upon execution by the processors, are executed to:
transmit a broadcast message to the plurality of SPDM-enabled hardware devices through a root complex of a PCIe bus using a SPDM-based protocol, wherein the broadcast message comprises a block of data including a digital signature of the BMC, and wherein each of the SPDM-enabled hardware devices that receive the broadcast message are configured to transmit a broadcast acknowledgment message to the BMC; and
perform a first consensus procedure with each of those SPDM-enabled hardware devices that responded to the broadcast message using a cryptographic hash function of the block of data, wherein each of the SPDM-enabled hardware devices perform a second consensus procedure with the BMC using the cryptographic hash function of the block of data.
2. The IHS of claim 1 , wherein the instructions are further executed to transmit an event notification to an administrator computer when one of the SPDM-enabled hardware devices receives a request to perform consensus procedure with another SPDM-enabled hardware device other than the BMC.
3. The IHS of claim 1 , wherein the SPDM-enabled hardware devices are each inhibited from transmitting the broadcast message.
4. The IHS of claim 1 , wherein the instructions are further executed to derive the digital signature of the BMC from a bus device function (BDF) of the BMC.
5. The IHS of claim 1 , wherein the instructions are further executed to store the block of data in a ledger in the BMC.
6. The IHS of claim 1 , wherein each of the SPDM-enabled hardware devices are only allowed to perform the second consensus procedure when the block of data has been validated by the SPDM-enabled hardware device.
7. The IHS of claim 1 , wherein the instructions are further executed to:
perform a discovery process to discover the SPDM-enabled hardware devices in the IHS; and
transmit the broadcast message to only those SPDM-enabled hardware devices that were discovered during the discovery process.
8. The IHS of claim 1 , wherein at least one of the SPDM-enabled hardware devices comprise one or more processors and one or more memory units including hardware device instructions that, upon execution by the processors, are executed to:
transmit a second broadcast message to a plurality of second SPDM-enabled hardware devices, wherein the second broadcast message comprises a second block of data including a digital signature of the one hardware device, and wherein each of the second SPDM-enabled hardware devices that receive the second broadcast message are configured to transmit a broadcast acknowledgment message to the BMC; and
perform a third consensus with each of those second SPDM-enabled hardware devices that responded to the second broadcast message using a second cryptographic hash function of the second block of data, wherein each of the second SPDM-enabled hardware devices perform a fourth consensus procedure with the BMC using the second cryptographic hash function of the block of data.
9. The IHS of claim 1 , wherein the block of data further includes at least one of a public key of the BMC and a previous hash value generated from the cryptographic hash function of a previous block of data.
10. A mutual consensus method comprising:
transmitting, using instructions stored in at least one memory and executed by at least one processor, a broadcast message to a plurality of Security Protocol and Data Model (SPDM)-enabled hardware devices of an information handling system (IHS) from a baseboard management controller (BMC) through a root complex of a PCIe bus using a SPDM-based protocol, wherein the broadcast message comprises a block of data including a digital signature of the BMC, and wherein each of the SPDM-enabled hardware devices that receive the broadcast message are configured to transmit a broadcast acknowledgment message to the BMC; and
performing, using the instructions, a first consensus procedure with each of those SPDM-enabled hardware devices that responded to the broadcast message using a cryptographic hash function of the block of data, wherein each of the SPDM-enabled hardware devices perform a second consensus procedure with the BMC using the cryptographic hash function of the block of data.
11. The mutual consensus method of claim 10 , further comprising:
inhibiting the SPDM-enabled hardware devices from transmitting the broadcast message.
12. The mutual consensus method of claim 10 , further comprising deriving the digital signature of the BMC from a bus device function (BDF) of the BMC.
13. The mutual consensus method of claim 10 , further comprising only allowing the SPDM-enabled hardware devices to perform the second consensus procedure when the block of data has been validated by the hardware device.
14. The mutual consensus method of claim 10 , further comprising:
transmitting a second broadcast message to a plurality of second SPDM-enabled hardware devices, wherein the second broadcast message comprises a second block of data including a digital signature of the one hardware device, and wherein each of the second SPDM-enabled hardware devices that receive the second broadcast message are configured to transmit a broadcast acknowledgment message to the BMC; and
performing a third consensus procedure with each of those second SPDM-enabled hardware devices that responded to the second broadcast message using a second cryptographic hash function of the second block of data, wherein each of the second SPDM-enabled hardware devices perform a fourth consensus procedure with the BMC using the second cryptographic hash function of the block of data.
15. A Baseboard Management Controller (BMC) comprising:
one or more processors and one or more memory units including instructions that, upon execution by the processors, are executed to:
transmit a broadcast message to a plurality of Security Protocol and Data Model (SPDM)-enabled hardware devices of an information handling system (IHS) through a root complex of a PCIe bus using a SPDM-based protocol, wherein the broadcast message comprises a block of data including a digital signature of the BMC, and wherein each of the SPDM-enabled hardware devices that receive the broadcast message are configured to transmit a broadcast acknowledgment message to the BMC; and
perform a first consensus procedure with each of those SPDM-enabled hardware devices that responded to the broadcast message using a cryptographic hash function of the block of data, wherein each of the SPDM-enabled hardware devices perform a second consensus procedure with the BMC using the cryptographic hash function of the block of data.
16. The BMC of claim 15 , wherein the SPDM-enabled hardware devices are each inhibited from transmitting the broadcast message.
17. The BMC of claim 15 , wherein the instructions are further executed to derive the digital signature of the BMC from a bus device function (BDF) of the BMC.
18. The BMC of claim 15 , wherein at least one of the SPDM-enabled hardware devices comprise one or more processors and one or more memory units including hardware device instructions that, upon execution by the processors, are executed to:
transmit a second broadcast message to a plurality of second SPDM-enabled hardware devices, wherein the second broadcast message comprises a second block of data including a digital signature of the one hardware device, and wherein each of the second SPDM-enabled hardware devices that receive the second broadcast message are configured to transmit a broadcast acknowledgment message to the BMC; and
perform a third consensus procedure with each of those second SPDM-enabled hardware devices that responded to the second broadcast message using a second cryptographic hash function of the second block of data, wherein each of the second SPDM-enabled hardware devices perform a fourth consensus procedure with the BMC using the second cryptographic hash function of the block of data.
19. The BMC of claim 15 , wherein the instructions are further executed to:
perform a discovery process to discover the SPDM-enabled hardware devices in the IHS; and
transmit the broadcast message to only those SPDM-enabled hardware devices that were discovered during the discovery process.