Multi-path zero trust boot method to support context-specific OEM rebranding
Disclosed methods enable a mutable OEM identity to dynamically perform context-specific rebranding as part of a zero trust platform boot. This zero trust rebrand (ZTR) boot may implement an OEM security context identity method to fully ensure trusted rebrand boot paths against tampered, vulnerable, or corrupted payloads while leveraging existing customer-agnostic secure boot flow. Disclosed platforms may implement context-specific mutable entities via multiple boot paths to support the dynamic rebranding. A factory deploy engine may perform a bare metal deploy with a disclosed OEM security identity protocol, initialized by enumerating, for each of one or more OEMs, all OEM context attributes required for dynamic rebrand support. The rebrand protocol may create a protected namespace in non-volatile storage, e.g., a serial peripheral interface (SPI) flash area, to perform a once-only store of all OEM-specific mutable entities.
1. A method, comprising:
for each of one or more original equipment manufacturers (OEMs), enumerating all OEM context (OC) attributes associated with a dynamic rebrand protocol and storing OEM-specific mutable entities for each of the OEM context attributes in an OEM context (OC) namespace;
storing one or more OC-specific signatures per OEM in a platform store;
applying an OEM-specific index key determined based on a current boot context; and
loading one or more of the OEM-specific mutable entities based on the current boot context before continuing in regular secure boot path.
2. The method of claim 1 , wherein the storing of the one or more mutable entities comprises performing a one-time-only factory mode storing of the one or more mutable entities.
3. The method of claim 1 , wherein the platform store comprises a platform nonvolatile (NV) store.
4. The method of claim 3 , wherein the platform NV store comprises a serial peripheral interface (SPI) flash memory store.
5. The method of claim 4 , wherein the OC namespace comprises a protected namespace.
6. The method of claim 1 , further comprising:
publishing an OEM context boot policy to ensure an existing secure boot path is unaltered.
7. The method of claim 1 , further comprising:
performing a customer agnostic secure boot flow to boot a customer agnostic firmware image.
8. An information handling system, comprising:
a central processing unit (CPU);
a computer readable memory, accessible to the CPU, including processor executable instructions that, when executed by the CPU, cause the system to perform operations comprising:
for each of one or more original equipment manufacturers (OEMs), enumerating all OEM context (OC) attributes associated with a dynamic rebrand protocol and storing OEM-specific mutable entities for each of the OC attributes in an OEM context (OC) namespace;
storing one or more OC specific signatures per OEM in a platform store;
applying an OEM-specific index key determined based on a current boot context; and
loading one or more of the OEM-specific mutable entities based on the current boot context before continuing in regular secure boot path.
9. The information handling system of claim 8 , wherein the storing of the one or more mutable entities comprises performing a one-time-only factory mode storing of the one or more mutable entities.
10. The information handling system of claim 8 , wherein the platform store comprises a platform nonvolatile (NV) store.
11. The information handling system of claim 10 , wherein the platform NV store comprises a serial peripheral interface (SPI) flash memory store.
12. The information handling system of claim 11 , wherein the OC namespace comprises a protected namespace.
13. The information handling system of claim 8 , wherein the operations further comprise:
publishing an OEM context boot policy to ensure an existing secure boot path is unaltered.
14. The information handling system of claim 8 , wherein the operations further comprise:
performing a customer agnostic secure boot flow to boot a customer agnostic firmware image.