System level root of trust (ROT) binding and trust establishment
Systems and methods provide an Information Handling System (IHS), comprising a host processor module and a secure control module. A baseboard management controller executes a process that binds the host processor module to the secure control module using a hash value calculated from characteristics of components of the first host processor module. The process to bind the first host processor module to the secure control module comprises retrieving hardware identity certificates from all SPDM-capable hardware devices in the first host processor module, retrieving firmware measurements from all SPDM-capable hardware devices in the first host processor module, calculating an initial hash value from the hardware identity certificates and the firmware measurements, and storing the initial hash value either in the baseboard management controller or in the security processor.
1. An Information Handling System (IHS), comprising:
a first host processor module configured to host one or more processors and at least one memory device;
a secure control module configured to host a baseboard management controller and a security processor; and
wherein the baseboard management controller comprises at least one processor coupled to at least one storage device, the at least one storage device having program instructions stored thereon that, upon execution by the at least one processor, cause the baseboard management controller to:
execute a process to bind the first host processor module to the secure control module using a hash value calculated from characteristics of components of the first host processor module, the process to bind the first host processor module to the secure control module comprising:
retrieving hardware identity certificates from all Security Protocol and Data Model (SPDM)-capable hardware devices in the first host processor module;
retrieving firmware measurements from all SPDM-capable hardware devices in the first host processor module;
calculating an initial hash value from the hardware identity certificates and the firmware measurements; and
storing the initial hash value either in the baseboard management controller or in the security processor.
2. The IHS of claim 1 , wherein the hardware identity certificates are retrieved using an SPDM Get_Certificate request message sent by the baseboard management controller; and
the firmware measurements are retrieved using an SPDM Get_Measurements request message sent by the baseboard management controller.
3. The IHS of claim 1 , wherein execution of the program instructions further cause the baseboard management controller to:
after calculating the initial hash value, set a bound mode indicating that the secure control module is bound to the first host processor module.
4. The IHS of claim 1 , wherein execution of the program instructions further cause the baseboard management controller to:
upon power-on of the IHS at a user site, retrieve hardware identity certificates and firmware measurements from SPDM-capable hardware devices in a current host processor module;
recalculate a new hash value from the hardware identity certificates and the firmware measurements;
retrieve the stored initial hash value from the baseboard management controller or the security processor; and
determine whether the new hash value and the initial hash value match.
5. The IHS of claim 4 , wherein execution of the program instructions further cause the baseboard management controller to:
if the new hash value and the initial hash value do match, then allow a host operating system of the IHS to boot.
6. The IHS of claim 4 , wherein execution of the program instructions further cause the baseboard management controller to:
if the new hash value and the initial hash value do not match, then
set an unbound mode indicating that the secure control module is not bound to a known host processor module; and
perform recovery actions.
7. The IHS of claim 6 , wherein the recovery actions are based on a user-configured security policy.
8. The IHS of claim 4 , wherein execution of the program instructions further cause the baseboard management controller to:
if the new hash value and the initial hash value do not match, then perform one or more of the following actions: prevent the IHS from booting, clear an assigned IHS license, set a base IHS license, erase some or all memory devices, clear server configuration settings, and clear identity module contents.
9. The IHS of claim 1 , wherein the SPDM-capable hardware devices in the first host processor module comprise one or more of: a processor, a memory, and a smart device.
10. The IHS of claim 6 , wherein execution of the program instructions further cause the baseboard management controller to perform the following recovery actions:
encrypt current internal configuration data using a hardware identity certificate; and
store encrypted configuration data at the baseboard management controller or at the security processor.
11. The IHS of claim 10 , wherein execution of the program instructions further cause the baseboard management controller to:
store the encrypted configuration data in an internal hidden memory partition of the baseboard management controller.
12. The IHS of claim 10 , wherein the internal configuration data comprises one or more of credentials, licenses, personality modules, and security certificates.
13. The IHS of claim 10 , wherein execution of the program instructions further cause the baseboard management controller to:
clear all internal configuration data; and
reset baseboard management controller configurations to default values.
14. The IHS of claim 10 , wherein execution of the program instructions further cause the baseboard management controller to, upon power-on of the IHS after the secure control module has been reattached to the first host processor module:
retrieve stored encrypted configuration data;
decrypt the encrypted configuration data using the hardware identity certificate;
restore the decrypted configuration data to hardware devices; and
reset the bound mode indicating that the secure control module is bound to the first host processor module.
15. The IHS of claim 10 , wherein the baseboard management controller determines that the secure control module has been reattached to the first host processor module if the new hash value matches the initial hash value.
16. An Information Handling System (IHS) comprising:
a first Security Protocol and Data Model (SPDM)-enabled device conforming to a SPDM specification, wherein the first SPDM-enabled device comprises at least one processor coupled to at least one storage device, the at least one storage device having program instructions stored thereon that, upon execution by the at least one processor, cause the IHS to:
upon power-on of the IHS, retrieve hardware identity certificates and firmware measurements from SPDM-capable hardware devices in a current host processor module;
calculate a new hash value from the hardware identity certificates and the firmware measurements;
retrieve a stored initial hash value;
determine whether the new hash value and the initial hash value match;
if the new hash value and the initial hash value do match, then allow a host operating system to boot; and
if the new hash value and the initial hash value do not match, then:
set an unbound mode indicating that a secure control module is not bound to a known host processor module; and
perform recovery actions.
17. The IHS of claim 16 , wherein execution of the program instructions further cause the IHS to:
encrypt current internal configuration data using a hardware identity certificate;
store encrypted configuration data in an internal hidden memory partition of a baseboard management controller or a security processor;
clear all internal configuration data; and
reset baseboard management controller configurations to default values.
18. An Information Handling System (IHS) comprising:
a first Security Protocol and Data Model (SPDM)-enabled device conforming to a SPDM specification, wherein the first SPDM-enabled device comprises at least one processor coupled to at least one memory, the at least one memory having program instructions stored thereon that, upon execution by the at least one processor, cause the IHS to:
determine that a secure control module has been attached to a known host processor module based upon a calculated hardware-based hash value matching a stored hash value;
retrieve stored encrypted configuration data;
decrypt the encrypted configuration data using a hardware identity certificate;
restore the decrypted configuration data to hardware devices; and
reset a bound mode indicating that the secure control module is bound to the known host processor module.