Proxy authentication for resource-constrained device
A system and method are disclosed for delegating, by a resource-constrained device, a privilege to a basic input/output system, wherein the privilege allows the basic input/output system to authenticate an endpoint device on behalf of the resource-constrained device. The system and method also includes generating an asymmetric security key that includes a private key and a public key and transmitting the public key to the basic input/output system, wherein the public key is included in a proxy certificate generated by the basic input/output system. In addition, the system and method includes establishing a secure session between the basic input/output system and the endpoint device using the private key and the proxy certificate, wherein the secure session is used by the basic input/output system to authenticate and verify that the endpoint device is authorized to perform an operation.
1. A method comprising:
delegating, by a resource-constrained device, a privilege to a basic input/output system, wherein the privilege allows the basic input/output system to authenticate an endpoint device on behalf of the resource-constrained device;
generating an asymmetric security key that includes a private key and a public key;
transmitting the public key to the basic input/output system, wherein the public key is included in a proxy certificate generated by the basic input/output system; and
establishing a secure session between the basic input/output system and the endpoint device using the private key and the proxy certificate, wherein the secure session is used by the basic input/output system to authenticate and verify that the endpoint device is authorized to perform an operation.
2. The method of claim 1 , wherein the privilege is a temporary privilege.
3. The method of claim 1 , wherein the privilege includes provisioning the endpoint device.
4. The method of claim 1 , further comprising using the private key to authenticate the proxy certificate.
5. The method of claim 1 , further comprising terminating the secure session.
6. The method of claim 1 , wherein the delegating the privilege to the basic input/output system is performed at power-on.
7. The method of claim 1 , further comprising sending a response that includes a provisioning status of the endpoint device.
8. An information handling system, comprising:
a requester configured to:
determine if delegation is enabled in a resource-constrained device;
generate a proxy certificate; and
authenticate and verify whether an endpoint device is authorized; and
the resource-constrained device configured to:
delegate a privilege to the requester, wherein the privilege allows the requester to authenticate the endpoint device on behalf of the resource-constrained device;
generate an asymmetric security key that includes a private key and a public key;
transmit the public key to the request, wherein the public key is included in the proxy certificate; and
establish a secure session between the requester and the endpoint device using the private key and the proxy certificate, wherein the secure session is used by the requester to authenticate and verify that the endpoint device is authorized.
9. The information handling system of claim 8 , wherein the requester is a basic input/output system.
10. The information handling system of claim 8 , wherein the requester is a baseboard management controller.
11. The information handling system of claim 8 , wherein the requester is further configured to determine whether a firmware hash of the endpoint device is authorized based on a trust policy.
12. The information handling system of claim 8 , wherein the requester is further configured to provision and configure the endpoint device.
13. The information handling system of claim 8 , wherein the requester is further configured to determine whether a security flag of the resource-constrained device is enabled.
14. A method comprising:
delegating, by a resource-constrained device, a privilege to a baseboard management controller, wherein the privilege allows the baseboard management controller to authenticate and verify an endpoint device on behalf of the resource-constrained device;
generating an asymmetric security key that includes a private key and public key;
transmitting the public key to the baseboard management controller, wherein the public key is included in a proxy certificate generated by the baseboard management controller; and
establishing a secure session between the baseboard management controller and the endpoint device, wherein the secure session is used by the baseboard management controller to authenticate and provision the endpoint device.
15. The method of claim 14 , wherein the privilege is a temporary privilege.
16. The method of claim 14 , wherein the privilege includes provisioning the endpoint device.
17. The method of claim 14 , further comprising using the private key to authenticate the proxy certificate.
18. The method of claim 14 , further comprising terminating the secure session.
19. The method of claim 14 , wherein the delegating the privilege to the baseboard management controller is performed at runtime.
20. The method of claim 14 , further comprising sending a response that includes a provisioning status of the endpoint device.