Endorsement of devices in a processing system
A firmware executes upon power on of a processing system and identifies any memory devices present in the processing system. The firmware then obtains uniquely identifying information for the memory devices such as, for example, part numbers and serial numbers. If the boot is the first boot of the processing system, the firmware transmits the uniquely identifying information for the memory devices to an endorsement service. The endorsement service, in turn, receives the identifying information and consults inventory data to determine if the memory devices are authorized for use in the processing system. The endorsement service then returns a response to the processing system that identifies any of the memory devices that are not authorized for use with the processing system. Upon receiving the response, the firmware disables any memory devices identified by the endorsement service as not being authorized for use with the processing system.
1 . A computer-implemented method, comprising:
executing a firmware on a processing system;
identifying, by way of the firmware, one or more memory devices present in the processing system;
retrieving, by way of the firmware, uniquely identifying information for each of the identified one or more memory devices present in the processing system;
upon a first boot of the processing system,
transmitting, by way of the firmware, the uniquely identifying information from the firmware to an endorsement service,
receiving a response from the endorsement service at the firmware, the response identifying any of the one or more memory devices that are not authorized for use with the processing system,
disabling, by way of the firmware, the one or more memory devices that are not authorized for use with the processing system,
generating cryptographic hashes, by way of the firmware, for the one or more memory devices that are authorized for use with the processing system,
storing, by way of the firmware, the cryptographic hashes at the processing system, and
permitting, by way of the firmware, the processing system to boot; and
upon a boot of the processing system subsequent to the first boot:
generating, by way of the firmware, cryptographic hashes for the one or more memory devices present in the processing system at a time of the boot of the processing system subsequent to the first boot,
determining, by way of the firmware, if the cryptographic hashes for the one or more memory devices present in the processing system match the stored cryptographic hashes for the one or more memory devices that are authorized for use with the processing system, and
responsive to determining that the cryptographic hashes for the one or more memory devices present in the processing system do not match the stored cryptographic hashes for the one or more memory devices that are authorized for use with the processing system,
transmitting, by way of the firmware, the uniquely identifying information for memory devices not having matching previously stored cryptographic hashes from the firmware to the endorsement service,
receiving a response from the endorsement service at the firmware, the response identifying any of the memory devices not having matching previously stored cryptographic hashes that are not authorized for use with the processing system, and
disabling, by way of the firmware, the one or more memory devices not having matching previously stored cryptographic hashes that are not authorized for use with the processing system.
2 . The computer-implemented method of claim 1 , wherein the memory devices comprise dual in-line memory modules (“DIMMs”).
3 . The computer-implemented method of claim 2 , wherein the uniquely identifying information comprises part numbers and serial numbers for the DIMMs.
4 . The computer-implemented method of claim 3 , wherein the firmware retrieves the uniquely identifying information from serial presence detect (“SPD”) data stored in the DIMMs.
5 . The computer-implemented method of claim 4 , wherein the firmware stores the cryptographic hashes in a non-volatile memory (“NVM”) of a trusted platform module (“TPM”).
6 . The computer-implemented method of claim 1 , further comprising upon the boot of the processing system subsequent to the first boot:
generating, by way of the firmware, cryptographic hashes for memory devices not having matching previously stored cryptographic hashes that are authorized for use with the processing system;
storing, by way of the firmware, the cryptographic hashes for memory devices not having matching previously stored cryptographic hashes that are authorized for use with the processing system at the processing system; and
permitting, by way of the firmware, the processing system to boot.
7 . At least one non-transitory computer-readable storage medium having computer-executable instructions stored thereupon which, when executed by a processing system, cause the processing system to:
execute a firmware on a processing system;
identify, by way of the firmware, one or more memory devices present in the processing system;
retrieve, by way of the firmware, uniquely identifying information for each of the identified one or more memory devices present in the processing system;
upon a first boot of the processing system,
transmit, by way of the firmware, the uniquely identifying information from the firmware to an endorsement service,
receive a response from the endorsement service at the firmware, the response identifying any of the one or more memory devices that are not authorized for use with the processing system,
disable, by way of the firmware, the one or more memory devices that are not authorized for use with the processing system,
generate cryptographic hashes, by way of the firmware, for the one or more memory devices that are authorized for use with the processing system,
store, by way of the firmware, the cryptographic hashes at the processing system, and
permit, by way of the firmware, the processing system to boot; and
upon a boot of the processing system subsequent to the first boot,
generate, by way of the firmware, cryptographic hashes for the one or more memory devices present in the processing system at a time of the boot of the processing system subsequent to the first boot,
determine, by way of the firmware, if the cryptographic hashes for the one or more memory devices present in the processing system match the stored cryptographic hashes for the one or more memory devices that are authorized for use with the processing system, and
responsive to determining that the cryptographic hashes for the one or more memory devices present in the processing system do not match the stored cryptographic hashes for the one or more memory devices that are authorized for use with the processing system,
transmit, by way of the firmware, the uniquely identifying information for memory devices not having matching previously stored cryptographic hashes from the firmware to the endorsement service,
receive a response from the endorsement service at the firmware, the response identifying any of the memory devices not having matching previously stored cryptographic hashes that are not authorized for use with the processing system, and
disable, by way of the firmware, the one or more memory devices not having matching previously stored cryptographic hashes that are not authorized for use with the processing system.
8 . The non-transitory computer-readable storage medium of claim 7 , wherein the memory devices comprise dual in-line memory modules (“DIMMs”).
9 . The non-transitory computer-readable storage medium of claim 8 , wherein the uniquely identifying information comprises part numbers and serial numbers for the DIMMs.
10 . The non-transitory computer-readable storage medium of claim 9 , wherein the firmware retrieves the uniquely identifying information from serial presence detect (“SPD”) data stored in the DIMMs.
11 . The non-transitory computer-readable storage medium of claim 10 , wherein the firmware stores the cryptographic hashes in a non-volatile memory (“NVM”) of a trusted platform module (“TPM”).
12 . The non-transitory computer-readable storage medium of claim 7 , having further computer-executable instructions stored thereupon which, when executed by the processing system, cause the processing system to:
generate, by way of the firmware, cryptographic hashes for memory devices not having matching previously stored cryptographic hashes that are authorized for use with the processing system;
store, by way of the firmware, the cryptographic hashes for memory devices not having matching previously stored cryptographic hashes that are authorized for use with the processing system at the processing system; and
permit, by way of the firmware, the processing system to boot.
13 . A processing system, comprising:
one or more processors;
one or more memory devices; and
one or more non-transitory computer-readable storage medium having computer-executable instructions stored thereupon which, when executed by the one or more processors, cause the processing system to:
execute a firmware on the one or more processors;
identify, by way of the firmware, the one or more memory devices in the processing system;
retrieve, by way of the firmware, uniquely identifying information for each of the identified one or more memory devices present in the processing system;
upon a first boot of the processing system,
transmit, by way of the firmware, the uniquely identifying information from the firmware to an endorsement service,
receive a response from the endorsement service at the firmware, the response identifying any of the one or more memory devices that are not authorized for use with the processing system,
disable, by way of the firmware, the one or more memory devices that are not authorized for use with the processing system,
generate, by way of the firmware, cryptographic hashes for the one or more memory devices that are authorized for use with the processing system,
store, by way of the firmware, the cryptographic hashes at the processing system, and
permit, by way of the firmware, the processing system to boot; and
upon a boot of the processing system subsequent to the first boot,
generate, by way of the firmware, cryptographic hashes for the one or more memory devices present in the processing system at a time of the boot of the processing system subsequent to the first boot,
determine, by way of the firmware, if the cryptographic hashes for the one or more memory devices present in the processing system match the stored cryptographic hashes for the one or more memory devices that are authorized for use with the processing system, and
responsive to determining that the cryptographic hashes for the one or more memory devices present in the processing system do not match the stored cryptographic hashes for the one or more memory devices that are authorized for use with the processing system,
transmit, by way of the firmware, the uniquely identifying information for memory devices not having matching previously stored cryptographic hashes from the firmware to the endorsement service,
receive a response from the endorsement service at the firmware, the response identifying any of the memory devices not having matching previously stored cryptographic hashes that are not authorized for use with the processing system,
disable, by way of the firmware, the one or more memory devices not having matching previously stored cryptographic hashes that are not authorized for use with the processing system,
generate, by way of the firmware, cryptographic hashes for memory devices not having matching previously stored cryptographic hashes that are authorized for use with the processing system,
store, by way of the firmware, the cryptographic hashes for memory devices not having matching previously stored cryptographic hashes that are authorized for use with the processing system at the processing system, and
permit, by way of the firmware, the processing system to boot.
14 . The computing system of claim 13 , wherein the memory devices comprise dual in-line memory modules (“DIMMs”).
15 . The computing system of claim 14 , wherein the uniquely identifying information comprises part numbers and serial numbers for the DIMMs.
16 . The computing system of claim 15 , wherein the firmware retrieves the uniquely identifying information from serial presence detect (“SPD”) data stored in the DIMMs.
17 . The computing system of claim 16 , wherein the firmware stores the cryptographic hashes in a non-volatile memory (“NVM”) of a trusted platform module (“TPM”).