Out of band management of basic input/output system secure boot variables
A method is provided in one example embodiment and includes storing secure boot variables in a baseboard management controller; and sending the secure boot variables to a basic input/output system (BIOS) during a power on self-test, where the BIOS utilizes the secure boot variables during runtime to authenticate drivers and an operating system loader execution. In particular embodiments, the secure boot variables may be included in a white list, a black list, or a key list and, further, stored in erasable programmable read only memory.
1. A method for updating secure boot variables for authenticating operating system components and drivers, comprising:
storing secure boot variables in a remote management server for one or more managed servers;
sending the secure boot variables from the remote management server to an out-of band management controller installed in a managed server;
writing, by the out-of-band management controller, the secure boot variables to a non-volatile random access memory (NVRAM) accessible to a basic input/output system (BIOS) of the managed server; and
authenticating operating system components and drivers, by the BIOS, using the secure boot variables.
2. The method of claim 1 , wherein the secure boot variables are accessible to the BIOS via a secure channel.
3. The method of claim 1 , wherein the secure boot variables are included in a whitelist, a blacklist, and a key list.
4. The method of claim 1 , wherein the secure boot variables are Unified Extensible Firmware Interface boot variables.
5. The method of claim 1 , further comprising:
receiving, at the out-of-band management controller, changes to the secure boot variables made during runtime by the BIOS.
6. The method of claim 1 , further comprising:
modifying, by the management server, the secure boot variables.
7. The method of claim 1 , wherein the secure boot variables are Unified Extensible Firmware Interface boot variables stored in the NVRAM, and wherein the secure boot variables are included in a whitelist, a blacklist, and a key list.
8. The method of claim 1 , further comprising:
modifying, by the management server, the secure boot variables per deployment requirements, wherein a signed blob is created statically in an off-line secure environment using secure signing services and passed, through an update at provisioning time, to the managed server that includes the out-of-band management controller.
9. The method of claim 1 , further comprising storing the secure boot variables in the NVRAM as a signed blob at a provisioning time of the managed server that includes the out-of-band management controller.
10. A managed server, comprising:
a processor,
a Basic Input/Output System (BIOS); and
an out-of band management controller, wherein the out-of-band management controller is operative to:
establish a connection to a remote management server storing secure boot variables for one or more managed servers;
receive the secure boot variables from the remote management server; and
write the secure boot variables to a non-volatile random access memory (NVRAM) accessible to the basic input/output system (BIOS) of the managed server; and
wherein the BIOS is operative to authenticate operating system components and drivers installed on the managed server using the secure boot variables.
11. The managed server of claim 10 , wherein the secure boot variables are accessible to the BIOS via a secure channel.
12. The managed server of claim 10 , wherein the secure boot variables are included in a whitelist, a blacklist, and a key list.
13. The managed server of claim 10 , wherein the secure boot variables are Unified Extensible Firmware Interface boot variables.
14. The managed server of claim 10 , wherein the out-of-band management controller is further operative to receive changes to the secure boot variables made during runtime by the BIOS.
15. The managed server of claim 10 , wherein the secure boot variables are Unified Extensible Firmware Interface boot variables stored in the NVRAM, and wherein the secure boot variables are included in a whitelist, a blacklist, and a key list.
16. The managed server of claim 10 , wherein the out-of-band management controller is operative to store the secure boot variables as a signed blob at a provisioning time of the managed server that includes the out-of-band management controller.
17. A system comprising:
a managed server comprising a processor, a Basic Input/Output System (BIOS), and an out-of band management controller, wherein the out-of-band management controller is operative to:
establish a connection to a remote management server storing secure boot variables for one or more managed servers;
receive the secure boot variables from the remote management server; and
write the secure boot variables to a non-volatile random access memory (NVRAM) accessible to the basic input/output system (BIOS) of the managed server;
wherein the BIOS is operative to authenticate operating system components and drivers installed on the managed server using the secure boot variables; and
a management server operative to modify the secure boot variables.
18. The system of claim 17 , wherein the management server is operative to modify the secure boot variables per deployment requirements, wherein a signed blob is created statically in an off-line secure environment using secure signing services and passed, through an update at provisioning time, to the managed server that includes the out-of-band management controller.