Encryption key management system and methods thereof
During execution of BIOS at an information handling system, a processor communicates with the storage controller via a command line protocol (CLP) communications channel. Via the channel, the processor obtains identification information for storage devices associated with the storage controller. The processor communicates the identification information to a key management client, which obtains encryption keys based on the identification information from a key management server. The processor receives the encryption keys, and communicates them to the storage controller via the CLP communications channel. The CLP communications channel thus provides a convenient and flexible interface for communication of security information prior to execution of an operating system.
1. A method, comprising:
executing Basic Input Output System (BIOS) code by a processor during a boot process, thereby determining a first command line protocol (CLP) entry point of an option read-only memory (ROM) and thereby generating data;
storing the data in an outgoing CLP buffer;
executing by the processor code at the first CLP entry point of the option ROM, the executing including reading the data stored in the outgoing CLP buffer;
storing by the option ROM in an incoming CLP buffer a first request for a first security parameter, the first request generated as a result of executing the code at the first CLP entry point, wherein the incoming CLP buffer may be the same buffer as the outgoing CLP buffer and wherein the first security parameter comprises an encryption key associated with a storage device, the storage device associated with a storage controller;
returning control of the processor to BIOS;
receiving by BIOS the first request for the first security parameter via the incoming CLP buffer;
determining the first security parameter based on the first request, comprising:
communicating by BIOS a second request to a key management server, the second request based on the first request; and
receiving the encryption key in response to the second request; and
communicating the first security parameter to the option ROM during the boot process via placing the first security parameter in the outgoing CLP buffer.
2. The method of claim 1 , wherein receiving the first request comprises receiving the first request in response to communicating a first memory address to a storage controller, the first memory address associated with the first CLP entry point of the option ROM.
3. The method of claim 1 , wherein communicating the second request comprises communicating the second request to a baseboard management controller (BMC).
4. The method of claim 1 , wherein the first security parameter comprises a plurality of encryption keys associated with a plurality of storage devices, each storage device associated with a storage controller.
5. The method of claim 1 , wherein:
the option ROM is associated with a storage controller;
the first request for the first security parameter is a request by the storage controller; and
the method further comprises:
communicating a second request, the second request for authentication information, to the storage controller via the outgoing CLP buffer;
receiving the authentication information from the storage controller in response to the second request; and
communicating the first security parameter in response to authenticating the authentication information.
6. The method of claim 1 , wherein:
the option ROM is associated with a storage controller;
the first request for the first security parameter is a request by the storage controller; and
the method further comprises:
receiving by BIOS from the storage controller a second request, the second request for authentication information via the incoming CLP buffer; and
communicating the authentication information in response to the second request.
7. The method of claim 1 , further comprising:
communicating a security request to a storage controller via the incoming CLP buffer, the security request comprising a request to change an encryption key.
8. The method of claim 1 , further comprising:
communicating a security request to a storage controller via the incoming CLP buffer, the security request comprising a request to erase a portion of encrypted information stored at a storage device associated with the storage controller.
9. The method of claim 1 , wherein:
the option ROM is associated with a storage controller;
the first request for the first security parameter is a request by the storage controller; and
the method further comprises:
receiving a second request from a second storage controller for a second security parameter via the incoming CLP buffer;
determining the second security parameter based on the second request; and
communicating the second security parameter to the second storage controller via the outgoing CLP buffer.
10. An information handling system, comprising:
an option read-only memory (ROM) comprising a command line protocol (CLP) entry point;
an outgoing CLP buffer;
an incoming CLP buffer; and
a processor coupled to a CLP communications channel, the processor configured to:
store data in the outgoing CLP buffer during a boot process;
provide a first call to the CLP entry point in response to a boot request;
execute code at the CLP entry point, the execution to include reading the stored data;
receive in the incoming CLP buffer a first request for a first security parameter from the option ROM in response to providing the first call, wherein the first security parameter comprises an encryption key associated with a storage device, the storage device associated with a storage controller;
determine the first security parameter based on the first request;
provide a second call to another CLP entry point of the option ROM during the boot process in response to determining the first security parameter; and
communicate a second request to the storage controller via the incoming CLP buffer, the second request comprising a request to change the encryption key.
11. The information handling system of claim 10 , wherein the first security parameter comprises an encryption key associated with a storage device, the storage device associated with a storage controller.
12. The method of claim 1 , further comprising:
requesting authentication information from BIOS as the result of executing the code at the first CLP entry point; and
checking authentication information transmitted by BIOS in response to the requesting of authentication information.
13. The method of claim 3 , further comprising:
receiving by BIOS from the BMC the encryption key; and
sending the key to the storage controller, wherein the storage controller is associated with the option ROM.
14. An information handling system, comprising:
an option read-only memory (ROM) comprising a command line protocol (CLP) entry point;
an outgoing CLP buffer;
an incoming CLP buffer; and
a processor coupled to a CLP communications channel, the processor configured to:
store data in the outgoing CLP buffer during a boot process;
provide a first call to the CLP entry point in response to a boot request;
receive in the incoming CLP buffer a first request for a first security parameter from the option ROM in response to providing the first call, wherein the first security parameter comprises an encryption key associated with a storage device, the storage device associated with a storage controller;
determine the first security parameter based on the first request, comprising:
communicating a second request to a key management server, the second request based on the first request; and
receiving the encryption key in response to the second request; and
provide a second call to another CLP entry point of the option ROM during the boot process in response to determining the first security parameter.
15. The information handling system of claim 14 wherein communicating the second request comprises communicating the second request to a baseboard management controller (BMC).
16. The information handling system of claim 14 wherein the storage device is one of a plurality of storage devices each associated with a storage controller and the first security parameter comprises a plurality of encryption keys associated with the plurality of storage devices.
17. The information handling system of claim 14 wherein the processor is to communicate a second request to the storage controller via the incoming CLP buffer, the second request comprising a request to erase a portion of encrypted information stored at the storage device associated with the storage controller.
18. The information handling system of claim 15 wherein the processor is to receive the encryption key from the BMC and to send the key to the storage controller.