Systems and methods for key distribution of low end SPDM devices
According to embodiments of the present disclosure, a dynamic key distribution system is provided. The dynamic key distribution includes computer-executable instructions to encrypt, using a first Security Protocol and Data Model (SPDM)-enabled device conforming to a SPDM specification, an original Pre-Shared Key (PSK) with a SPDM identity certificate of the first SPDM-enabled device, wherein the original PSK is associated with a second SPDM-enabled device. The instructions are also configured to provision the encrypted PSK in the second SPDM-enabled device, and authenticate the second SPDM-enabled device by decrypting the encrypted PSK to obtain the original PSK using an SPDM protocol.
1. An Information Handling System (IHS) comprising:
a first Security Protocol and Data Model (SPDM)-enabled device conforming to a SPDM specification; and
at least one memory coupled to at least one processor, the at least one memory having program instructions stored thereon that, upon execution by the at least one processor, cause the IHS to:
encrypt an original Pre-Shared Key (PSK) with a SPDM identity certificate of the first SPDM-enabled device, wherein the original PSK is associated with a second SPDM-enabled device;
provision the encrypted PSK in the second SPDM-enabled device; and
authenticate, using an SPDM protocol, the second SPDM-enabled device by decrypting the encrypted PSK to obtain the original PSK.
2. The IHS of claim 1 , wherein the PSK is distributed out-of-band relative to how the second SPDM-enabled device is distributed to the IHS.
3. The IHS of claim 2 , wherein the PSK is distributed via an e-mail message.
4. The IHS of claim 2 , wherein the act of encrypting the PSK, provisioning the encrypted PSK, and authenticating the second SPDM-enabled device is performed by a provider of the IHS.
5. The IHS of claim 1 , wherein the SPDM identity certificate comprises a public identity key of the first SPDM-enabled device.
6. The IHS of claim 1 , wherein the act of encrypting the PSK and provisioning the encrypted PSK is performed by a vendor of the second SPDM-enabled device, and the act of authenticating the second SPDM-enabled device is performed by a provider of the IHS.
7. The IHS of claim 6 , wherein the act of encrypting the PSK is performed using the SPDM identity certificate received from a user of the IHS.
8. The IHS of claim 1 , wherein the first SPDM-enabled device comprises a Baseboard Management Controller (BMC) configured in the IHS, and the second SPDM-enabled device comprises a component of the IHS.
9. A dynamic key distribution method comprising:
encrypting, using a first Security Protocol and Data Model (SPDM)-enabled device conforming to a SPDM specification, an original Pre-Shared Key (PSK) with a SPDM identity certificate of the first SPDM-enabled device, wherein the original PSK is associated with a second SPDM-enabled device;
provisioning, using the first SPDM-enabled device, the encrypted PSK in the second SPDM-enabled device; and
authenticating, using the first SPDM-enabled device, the second SPDM-enabled device by decrypting the encrypted PSK to obtain the original PSK using a SPDM protocol.
10. The dynamic key distribution method of claim 9 , further comprising distributing the PSK out-of-band relative to how the second SPDM-enabled device is distributed to an Information Handling System (HIS).
11. The dynamic key distribution method of claim 10 , further comprising distributing the PSK via an e-mail message.
12. The dynamic key distribution method of claim 10 , further comprising encrypting the PSK, provisioning the encrypted PSK, and authenticating the second SPDM-enabled device by a provider of the IHS.
13. The dynamic key distribution method of claim 9 , further comprising encrypting the PSK and provisioning the encrypted PSK by a vendor of the second SPDM-enabled device, and authenticating the second SPDM-enabled device by a provider of the IHS.
14. The dynamic key distribution method of claim 13 , further comprising encrypting the PSK using the SPDM identity certificate received from a user of the IHS.
15. A computer program product comprising a computer readable storage medium having program instructions stored thereon that, upon execution by an Information Handling System (IHS), cause the IHS to:
encrypt, using a first Security Protocol and Data Model (SPDM)-enabled device conforming to a SPDM specification, an original Pre-Shared Key (PSK) with a SPDM identity certificate of the first SPDM-enabled device, wherein the original PSK is associated with a second SPDM-enabled device;
provision, using the first SPDM-enabled device, the encrypted PSK in the second SPDM-enabled device; and
authenticate, using the first SPDM-enabled device, the second SPDM-enabled device by decrypting the encrypted PSK to obtain the original PSK using an SPDM protocol.
16. The computer program product of claim 15 , wherein the act of encrypting the PSK, provisioning the encrypted PSK, and authenticating the second SPDM-enabled device is performed by a provider of the IHS.
17. The computer program product of claim 15 , wherein the SPDM identity certificate comprises a public identity key of the first SPDM-enabled device.
18. The computer program product of claim 15 , wherein the act of encrypting the PSK and provisioning the encrypted PSK is performed by a vendor of the second SPDM-enabled device, and the act of authenticating the second SPDM-enabled device is performed by a provider of the IHS.
19. The computer program product of claim 18 , wherein the act of encrypting the PSK is performed using the SPDM identity certificate received from a user of the IHS.
20. The computer program product of claim 15 , wherein the first SPDM-enabled device comprises a Baseboard Management Controller (BMC) configured in the IHS, and the second SPDM-enabled device comprises a component of the IHS.