System and Method for Managing UEFI Secure Boot Certificates

• US 20150193620A1
• Filed: 01/07/2014
• Published: 07/09/2015
• Est. Priority Date: 01/07/2014
• Status: Abandoned Application

• Current Assignee: Dell Products LP (Dell Technologies Inc.)
• Original Assignee: Dell Products LP (Dell Technologies Inc.)
• Inventors: Khatri, Mukund P., Liu, Wei, Rose, Charles E., Vidyadhara, Sumanth
• Application Number:
  US14/149,366
• Publication Number:
  US 20150193620A1
• Time in Patent Office: Days
• US Class Current: 1/1
• CPC Class Codes: G06F 21/575 Secure boot

Abstract

A service processor of an information handling system receives a Secure Boot database from a provisioning server coupled to the service processor by a data communication network. The Secure Boot database is stored at a memory device included at the service processor. The Secure Boot database is provided to a basic input output system (BIOS) at the information handling system in response to a request issued by intrinsic BIOS instructions executed during initialization of the information handling system.

Claims

1. A method comprising:

receiving at a service processor of an information handling system a Secure Boot database, the database provided by a provisioning server coupled to the service processor by a data communication network;

storing the Secure Boot database at a memory device included at the service processor; and

providing the Secure Boot database to a basic input output system (BIOS) at the information handling system in response to a request issued by intrinsic BIOS instructions executed during initialization of the information handling system.

2. The method of claim 1, wherein the Secure Boot database include a DB database, a DBX database, a PK database, and a KEK database.

3. The method of claim 1, further comprising validating device drivers included at the information handling system based on the Secure Boot database provided by the service processor.

4. The method of claim 1, wherein the receiving comprises receiving the Secure Boot database using a secure sockets layer protocol administered by a software client executing at the service processor.

5. The method of claim 1, wherein a master copy of the Secure Boot database is maintained at the provisioning server, and wherein the receiving further comprises receiving the Secure Boot database in response to a request initiated by the provisioning server.

6. The method of claim 1, further comprising updating the database at the BIOS memory in response to determining at the BIOS the Secure Boot database provided by the service processor include information different from a database presently stored at a BIOS memory.

7. The method of claim 1, wherein the receiving comprises receiving the Secure Boot database prior to a boot event at the information handling system.

8. A method comprising:

maintaining a Secure Boot database at a provisioning server coupled by a data communication network to a service processor included at a first information handling system; and

providing the Secure Boot database to the service processor for storage at a memory device included at the service processor.

9. The method of claim 8, further comprising providing the Secure Boot database to the information handling system for storage at a basic input output system (BIOS) firmware memory device in response to execution of intrinsic firmware instructions.

10. The method of claim 8, wherein the Secure Boot database include a DB database, a DBX database, a PK database, and a KEK database.

11. The method of claim 8, further comprising validating device drivers included at the information handling system based on the Secure Boot database provided by the service processor.

12. The method of claim 8, wherein the providing further comprises providing the Secure Boot database using a secure sockets layer protocol administered by a software client executing at the service processor.

13. The method of claim 8, wherein the providing comprises providing the Secure Boot database prior to a boot event at the information handling system.

15. The information handling system of claim 13, wherein the host server is configured to validate device drivers included at the information handling system based on the Secure Boot database provided by the service processor.

16. The information handling system of claim 13, wherein the receiving comprises receiving the Secure Boot databases using a secure sockets layer protocol administered by a software client executing at the service processor.

17. The information handling system of claim 13, wherein a master copy of the Secure Boot database is maintained at the provisioning server, and wherein the receiving further comprises receiving the Secure Boot database in response to a request initiated by the provisioning server.

18. The information handling system of claim 13, further comprising updating the databases at the BIOS memory in response to determining at the BIOS the Secure Boot database provided by the service processor include information different from a database currently stored at a BIOS memory.

19. The information handling system of claim 13, wherein the receiving comprises receiving the Secure Boot databases prior to a boot event at the information handling system.

20. The information handling system of claim 13, wherein the host processor further includes a BIOS firmware memory device and the host processor is configured to request the Secure Boot database from the provisioning server for storage at the BIOS firmware memory device in response to execution of intrinsic firmware instructions.

14. An information handling system comprising:

a provisioning server to store a Secure Boot signature database; and

a host server including a service processor, the service processor coupled to the provisioning server by a data communication network;

wherein the service processor is configured to;

receive the Secure Boot database from the provisioning server;

store the Secure Boot database at a memory device included at the service processor; and

provide the Secure Boot databases to a basic input output system (BIOS) at the host server in response to a request issued by intrinsic BIOS instructions executed during initialization of the host server.