Systems and methods to build a trusted hypertext transfer protocol secure session on a limited pre-boot basic input/output system environment
Systems and methods to build a trusted HTTPS session on a limited pre-boot BIOS environment in an information handling system. The information handling system may include a BIOS that may be stored in a secure read-only region of a flash storage. The BIOS may download signed certification authority (CA) information from a server based on a target location that may be stored at the secure read-only region. The BIOS may authenticate the signed CA information based on a public key that may be stored at the secure read-only region. The BIOS may, when the signed CA information is authenticated, download a root CA chain from the server and authenticate the root CA chain. The BIOS may, when the root CA chain is authenticated, establish a secure encrypted transport layer security (TLS) session with the server based the root CA chain.
1. An information handling system (IHS), comprising:
a processor;
a flash storage including a secure read-only region; and
a basic input/output system (BIOS) stored in the secure read-only region of the flash storage and executable by the processor, the BIOS configured to:
download first signed certification authority (CA) information from a first server based on a first target location stored at the secure read-only region of the flash storage via a network;
authenticate the first signed CA information based on a first public key stored at the secure read-only region of the flash storage; and
when the first signed CA information is authenticated:
download a first root CA chain from the first server;
authenticate the first root CA chain from the first server based on a first root CA chain of the authenticated first signed CA information; and
when the first root CA chain from the first server is authenticated, establish a first secure encrypted transport layer security (TLS) session with the first server based on one or more certificates of the first root CA chain from the first server.
2. The information handling system of claim 1 , wherein the first server configured to:
when an indicator received from the BIOS indicates that the first signed CA information from the server failed authentication and has been compromised, replace the compromised first signed CA information of the server with new signed CA information.
3. The information handling system of claim 1 , wherein the first server configured to:
when an indicator received from the BIOS indicates that the first root CA chain from the first server failed authentication and has been compromised:
replace the compromised first signed CA information of the server with new signed CA information; and
replace the compromised first root CA chain from the first server with a new root CA chain.
4. The information handling system of claim 1 , wherein the BIOS further configured to:
when at least one of the certificates of the first root CA chain from the server failed authentication and has been compromised, revoke the at least one of the certificates of the first root CA chain from the server that has been compromised.
5. The information handling system of claim 1 , wherein authentication of the first signed CA information further comprises:
authentication of the first root CA chain of the authenticated first signed CA information;
authentication of a first target location of the authenticated first signed CA information; and
authentication of a first digital signature of the authenticated first signed CA information used to sign the first signed CA information.
6. The information handling system of claim 1 , wherein the BIOS further configured to:
download second signed CA information from a second server based on a second target location stored at the secure read-only region of the flash storage;
authenticate the second signed CA information based on a second public key stored at the secure read-only region of the flash storage; and
when the second signed CA information is authenticated:
download a second root CA chain from the second server;
authenticate the second root CA chain from the second server based on a second root CA chain of the authenticated second signed CA information; and
when the second root CA chain from the second server is authenticated, establish a second secure encrypted TLS session with the second server based on one or more certificates of the second root CA chain from the second server.
7. The information handling system of claim 1 , wherein the authenticated first signed CA information was signed using a first digital signature based on the first public key.
8. The information handling system of claim 1 , wherein the authenticated first signed CA information was signed using a third digital signature based on a third public key, and wherein the authenticated first signed CA information comprises:
the third digital signature;
the third public key and the first target location signed with a first digital signature based on the first public key using an extended signing mechanism;
the first digital signature; and
the first root CA chain.
9. The information handling system of claim 1 , wherein the first target location comprises a server uniform resource locator (URL).
10. The information handling system of claim 1 , wherein the flash storage comprises a serial peripheral interface bus (SPI) flash storage.
11. A method, comprising:
downloading, by a basic input/output system (BIOS) stored in a secure read-only region of a flash storage of the information handling system and executable by a processor of the information handling system, first signed certification authority (CA) information from a first server based on a first target location stored at a secure read-only region of the flash storage via a network;
authenticating, by the BIOS, the first signed CA information based on a first public key stored at the secure read-only region of the flash storage; and
when the first signed CA information is authenticated:
downloading, by the BIOS, a first root CA chain from the first server;
authenticating, by the BIOS, the first root CA chain from the first server based on a first root CA chain of the authenticated first signed CA information; and
when the first root CA chain from the first server is authenticated, establishing a first secure encrypted transport layer security (TLS) session with the first server based on one or more certificates of the first root CA chain from the first server.
12. The method of claim 11 , wherein the method further comprising:
when an indicator received from the BIOS indicates that the first signed CA information from the server failed authentication and has been compromised, replacing, by the first server, the compromised first signed CA information of the server with new signed CA information.
13. The method of claim 11 , wherein the method further comprising:
when an indicator received from the BIOS indicates that the first root CA chain from the first server failed authentication and has been compromised:
replacing, by the first server, the compromised first signed CA information of the server with new signed CA information; and
replacing, by the first server, the compromised first root CA chain from the first server with a new root CA chain.
14. The method of claim 11 , wherein the further comprising:
when at least one of the certificates of the first root CA chain from the server failed authentication and has been compromised, revoking the at least one of the certificates of the first root CA chain from the server that has been compromised.
15. The method of claim 11 , wherein authenticating the first signed CA information further comprises:
authenticating of the first root CA chain of the authenticated first signed CA information;
authenticating of a first target location of the authenticated first signed CA information; and
authenticating of a first digital signature of the authenticated first signed CA information used to sign the first signed CA information.
16. The method of claim 11 , wherein the method further comprising:
downloading second signed CA information from a second server based on a second target location stored at the secure read-only region of the flash storage;
authenticating the second signed CA information based on a second public key stored at the secure read-only region of the flash storage; and
when the second signed CA information is authenticated:
downloading a second root CA chain from the second server;
authenticating the second root CA chain from the second server based on a second root CA chain of the authenticated second signed CA information; and
when the second root CA chain from the second server is authenticated, establishing a second secure encrypted TLS session with the second server based on one or more certificates of the second root CA chain from the second server.
17. The method of claim 11 , wherein the authenticated first signed CA information was signed using a first digital signature based on the first public key.
18. The method of claim 11 , wherein the authenticated first signed CA information was signed using a third digital signature based on a third public key, and wherein the authenticated first signed CA information comprises:
the third digital signature;
the third public key and the first target location signed with a first digital signature based on the first public key using an extended signing mechanism;
the first digital signature; and
the first root CA chain.
19. The method of claim 11 , wherein the first target location comprises a server uniform resource locator (URL).
20. The method of claim 11 , wherein the flash storage comprises a serial peripheral interface bus (SPI) flash storage.