System and method of configuring information handling systems

• US 10,713,363 B2
• Filed: 04/27/2018
• Issued: 07/14/2020
• Est. Priority Date: 04/27/2018
• Status: Active Grant

• Current Assignee: Dell Products LP (Dell Technologies Inc.)
• Original Assignee: Dell Products LP (Dell Technologies Inc.)
• Inventors: Savage, Marshal F., Young, Jason Matthew
• Primary Examiner(s): Misiura, Brian T
• Application Number:
  US15/964,595
• Publication Number:
  US 20190332775A1
• Time in Patent Office: 809 Days
• Field of Search: 713 1
• CPC Class Codes: G06F 21/572 Secure firmware programming, e.g. of basic input output system [BIOS]
• CPC Class Codes: G06F 21/6218 to a system of files or objects, e.g. local or distributed file system or database
• CPC Class Codes: H04L 41/0806 for initial configuration or provisioning, e.g. plug-and-play
• CPC Class Codes: H04L 63/0823 using certificates cryptographic mechanisms or cryptographic arrangements for entity authentication involving certificates H04L9/3263
• CPC Class Codes: H04L 63/10 for controlling access to devices or network resources
• CPC Class Codes: H04L 63/126 the source of the received data
• CPC Class Codes: H04L 9/006 involving public key infrastructure [PKI] trust models network architecture or network communication protocol for supporting authentication of entities using certificates in a packet data network H04L63/0823
• CPC Class Codes: H04L 9/0897 involving additional devices, e.g. trusted platform module [TPM], smartcard or USB
• CPC Class Codes: H04L 9/321 involving a third party or a trusted authority
• CPC Class Codes: H04L 9/3247 involving digital signatures
• CPC Class Codes: H04L 9/3268 using certificate validation, registration, distribution or revocation, e.g. certificate revocation list [CRL]

Abstract

In one or more embodiments, one or more systems, methods, and/or processes may receive a digital signature, signed by a signing authority, for a request for utilization of an information handling system firmware application programming interface (API) of the information handling system firmware, signed based at least on information associated with a certificate signed by a certificate authority; may determine that the signing authority is authorized for the request for utilization of the information handling system firmware API; may determine that the signing authority is authorized for the request for utilization of the information handling system firmware API on a platform model of the information handling system; may determine that the certificate is not on a certificate revocation list; and may permit utilization of the information handling system firmware API.

Claims

1. An information handling system, comprising:

at least one processor;

a memory medium that is coupled to the at least one processor and that stores information handling system firmware, executable by the at least one processor; and

a remote access controller that is coupled to the at least one processor;

wherein the remote access controller is configured to;

receive a digital signature, signed by a signing authority, for a request for utilization of an information handling system firmware application programming interface (API) of the information handling system firmware, signed based at least on information associated with a certificate signed by a certificate authority;

decrypt the digital signature, utilizing a public key associated with the certificate, to determine a first hash value;

determine a second hash value of the request for utilization of the information handling system firmware API;

determine that the first hash value matches the second hash value;

determine that the signing authority is authorized for the request for utilization of the information handling system firmware API;

determine that the signing authority is authorized for the request for utilization of the information handling system firmware API on a platform model of the information handling system;

permit utilization of the information handling system firmware API; and

permit, without authentication, utilization of another information handling system firmware API.

2. The information handling system of claim 1, wherein the remote access controller is further configured to determine that the certificate is not on a certificate revocation list.

3. The information handling system of claim 2,

wherein firmware of the remote access controller includes the certificate revocation list;

and

wherein, to determine that the certificate is not on the certificate revocation list, the remote access controller is further configured to access the firmware of the remote access controller for the certificate revocation list.

4. The information handling system of claim 1, wherein, to determine that the signing authority is authorized for the request for utilization of the information handling system firmware API, the remote access controller is further configured to:

determine one or more scope qualifiers from the certificate; and

determine that at least one of the one or more scope qualifiers is associated with utilization of the information handling system firmware API.

5. The information handling system of claim 1, wherein the information handling system firmware API is configured to configure at least a portion of the information handling system.

6. The information handling system of claim 1, wherein the remote access controller is further configured to:

determine a current time; and

determine that the current time satisfies a timing constraint of the certificate.

16. The remote access controller of claim 1, wherein, to determine that the signing authority is authorized for the request for utilization of the information handling system firmware API, the instructions further cause the remote access controller:

determine one or more scope qualifiers from the certificate; and

determine that at least one of the one or more scope qualifiers is associated with utilization of the information handling system firmware API.

7. A method, comprising:

a remote access controller, of an information handling system, receiving a digital signature, signed by a signing authority, for a request for utilization of an information handling system firmware application programming interface (API), signed based at least on information associated with a certificate signed by a certificate authority;

the remote access controller decrypting the digital signature, utilizing a public key associated with the certificate, to determine a first hash value;

the remote access controller determining a second hash value of the request for utilization of the information handling system firmware API;

the remote access controller determining that the first hash value matches the second hash value;

the remote access controller determining that the signing authority is authorized for the request for utilization of the information handling system firmware API;

the remote access controller determining that the signing authority is authorized for the request for utilization of the information handling system firmware API on a platform model of the information handling system;

the remote access controller permitting utilization of the information handling system firmware API; and

the remote access controller permitting, without authorization, utilization of another information handling system firmware API.

8. The method of claim 7, further comprising:

the remote access controller determining that the certificate is not on a certificate revocation list.

9. The method of claim 8,

wherein firmware of the remote access controller includes the certificate revocation list;

and

wherein the remote access controller determining that the certificate is not on the certificate revocation list includes the remote access controller accessing the firmware of the remote access controller for the certificate revocation list.

10. The method of claim 7, wherein the remote access controller determining that the signing authority is authorized for the request for utilization of the information handling system firmware API includes:

determining one or more scope qualifiers from the certificate; and

determining that at least one of the one or more scope qualifiers is associated with utilization of the information handling system firmware API.

11. The method of claim 7, wherein the information handling system firmware API is configured to configure at least a portion of the information handling system.

12. The method of claim 7, further comprising:

the remote access controller determining a current time; and

the remote access controller determining that the current time satisfies a timing constraint of the certificate.

13. A remote access controller, comprising:

at least one processor;

a memory medium that is coupled to the at least one processor and that stores firmware that includes instructions, which when executed by the at least one processor, cause the remote access controller to;

receive a digital signature, signed by a signing authority, for a request for utilization of an information handling system firmware application programming interface (API) of the information handling system firmware, signed based at least on information associated with a certificate signed by a certificate authority;

decrypt the digital signature, utilizing a public key associated with the certificate, to determine a first hash value;

determine a second hash value of the request for utilization of the information handling system firmware API;

determine that the first hash value matches the second hash value;

determine that the signing authority is authorized for the request for utilization of the information handling system firmware API;

determine that the signing authority is authorized for the request for utilization of the information handling system firmware API on a platform model of the information handling system;

determine that the certificate is not on a certificate revocation list;

permit utilization of the information handling system firmware API; and

permit, without authentication, utilization of another information handling system firmware API.

14. The remote access controller of claim 13, wherein the instructions further cause the remote access controller to determine that the certificate is not on a certificate revocation list.

15. The remote access controller of claim 14,

wherein firmware of the remote access controller includes the certificate revocation list;

and

wherein, to determine that the certificate is not on the certificate revocation list, the instructions further cause the remote access controller to access the firmware of the remote access controller for the certificate revocation list.

17. The remote access controller of claim 13, wherein the information handling system firmware API is configured to configure at least a portion of the information handling system.

18. The remote access controller of claim 13, wherein the instructions further cause the remote access controller to:

determine a current time; and

determine that the current time satisfies a timing constraint of the certificate.