Selective management controller authenticated access control to host mapped resources
An information handling system includes a host mapped general purpose input output (GPIO), a shared memory, a board management controller, and a cryptography engine. The host mapped GPIO includes a plurality of registers. The board management controller is in communication with the host mapped GPIO and with the shared memory, and is configured to control accessibility to the plurality of registers in the GPIO, and to control write accessibility of the shared memory based on a private key received from a basic input output system requesting accessibility to the plurality of registers and write accessibility of the shared memory. The cryptography engine is in communication with the board memory controller, and is configured to authenticate the private key received from the board management controller.
1. An information handling system comprising:
a host mapped general purpose input output (GPIO) including a plurality of registers, wherein a first register includes a system service tag associated with the information handling system;
a host processor in communication with the host mapped GPIO, the host processor including a basic input output system;
a board management controller separate from the host processor and in communication with the host mapped GPIO, the board management controller configured to control accessibility to the registers in the GPIO based on a private key received from the basic input output system requesting accessibility to the registers, wherein the private key is based on the system service tag; and
a cryptography engine in communication with the board management controller, the cryptography engine configured to authenticate the private key received from the board management controller.
2. The information handling system of claim 1 , further comprising:
a keyboard controller style in communication with the board management controller, the keyboard controller style configured to pass the private key from the basic input output system to the board management controller.
3. The information handling system of claim 1 , wherein the specific number of transactions of the basic input output system is a programmable number of transactions.
4. The information handling system of claim 1 , wherein the board management controller is further configured to provide accessibility to the host mapped GPIO for a specific number of transactions of the basic input output system when the private key is authenticated.
5. The information handling system of claim 4 , wherein the board management controller provides accessibility to the host mapped GPIO for a specific amount of time when the private key is authenticated.
6. The information handling system of claim 5 , wherein the specific amount of time is a programmable amount of time.
7. The information handling system of claim 1 , wherein the board management controller provides accessibility to the host mapped GPIO until the basic input output system explicitly locks the host mapped GPIO.
8. The information handling system of claim 1 , wherein the plurality of registers is locked upon an end of a power-on self-test of the system.
9. A method comprising:
detecting, at a host processor of an information handling system, at least one of an end of a power-on self-test and completion of a runtime write;
setting, by a board management controller of the information handling system, a host mapped general purpose input output (GPIO) register in a locked state in response to the end of the power-on self-test or to the completion of the runtime write, wherein the GPIO register includes a system service tag associated with the information handling system, and wherein the board management controller is separate from the host processor;
receiving a request to change an input/output state of the host mapped GPIO register;
receiving, at the board management controller, a private key with the request, wherein the private key is received from a basic input output system of the host processor and is generated based upon the system service tag;
passing the private key to a cryptography engine;
receiving an indication that the private key is authenticated from the cryptography engine; and
setting, by the board management controller, the host mapped GPIO register to an unlock state when the private key is authenticated.
10. The method of claim 9 , further comprising:
determining that a specific number of transactions have occurred; and
setting the host mapped GPIO register in the locked state when the specific number of transactions have occurred.
11. The method of claim 9 , further comprising:
determining that a specific amount of time has occurred; and
setting the host mapped GPIO register in the locked state when the specific amount of time has occurred.
12. The method of claim 9 , wherein the host mapped GPIO register is located on a remote access controller.
13. The method of claim 9 , wherein the authentication of the private key is performed on a remote access controller.
14. The method of claim 9 , wherein the request is received from the basic input output system.
15. A non-transitory computer-readable medium including code for performing a method, the method comprising:
detecting, at a host processor of an information handling system, at least one of an end of a power-on self-test and completion of a runtime write;
setting, by a board management controller of the information handling system, a host mapped general purpose input output (GPIO) register in a locked state in response to the end of the power-on self-test or to the completion of the runtime write, wherein the GPIO register includes a system service tag associated with the information handling system, and wherein the board management controller is separate from the host processor;
receiving a request to change an input/output state of the host mapped GPIO register;
receiving, at the board management controller, a private key with the request, wherein the private key is received from a basic input output system of the host processor and is generated based upon the system service tag;
passing the private key to a cryptography engine;
receiving an indication that the private key is authenticated from the cryptography engine; and
setting, by the board management controller, the host mapped GPIO register to an unlock state when the private key is authenticated.
16. The computer-readable medium of claim 15 , the method further comprising:
determining that a specific number of transactions have occurred; and
setting the host mapped GPIO register in the locked state when the specific number of transactions have occurred.
17. The computer-readable medium of claim 15 , the method further comprising:
determining that a specific amount of time has occurred; and
setting the host mapped GPIO register in the locked state when the specific amount of time has occurred.
18. The computer-readable medium of claim 15 , wherein the host mapped GPIO register is located on a remote access controller.
19. The computer-readable medium of claim 15 , wherein the authentication of the private key is performed on a remote access controller.
20. The computer-readable medium of claim 15 , wherein the request is received from the basic input output system.