BMC Component Movement Authorization via Fully Homomorphic Encryption
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Existing information handling systems face challenges in securely managing and authorizing the movement of modular chassis components, as the current validation methods do not allow for individual component integrity monitoring, leading to difficulties in identifying and addressing tampering or changes within the system.
Innovation Solution
The implementation of a fully homomorphic encryption (FHE) engine and a component movement policy (CMP) table within the baseboard management controller (BMC) enables secure logging and binding of components, allowing for individual component validation and authorization, thereby isolating unauthorized components and ensuring system integrity.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If traditional validation methods are used for component movement, then system simplicity is maintained, but individual component integrity monitoring and authorization capability is lost
Solution Approach 1:
The patent introduces a Baseboard Management Controller (BMC) as an intermediary component that mediates between the component identifier and the validation system. The BMC receives component identifiers, queries the encoded component table, and executes validation actions, thereby enabling individual component monitoring without requiring complex validation logic throughout the entire system.
Solution Approach 2:
The patent uses an encoded component table that stores validated component information in an encrypted or coded format. This allows the system to maintain component integrity records without storing plain text sensitive data, enabling reliability through data protection while managing complexity through efficient data structure design.
2Productivity
If manual revalidation processes are used, then system security can be maintained, but productivity and operational efficiency decrease
Solution Approach 1:
The patent implements preliminary validation by encoding component information in advance and storing it in the encoded component table. When a component is installed or moved, the system can quickly query the pre-prepared table to validate the component without requiring time-consuming manual revalidation processes, thus improving productivity while maintaining security.
Solution Approach 2:
The validation system operates autonomously by automatically querying the encoded component table and executing validation actions without requiring manual intervention. The system self-validates component identifiers, determining actions to perform based on pre-stored encoded data, thereby eliminating manual revalidation steps and improving operational efficiency.
3Reliability
If component identifiers are stored in plain text, then ease of operation is maintained, but security and tampering detection capability are reduced
Solution Approach 1:
The patent transforms the storage parameter of component identifiers from plain text to encoded or encrypted format in the encoded component table. This parameter change enhances tampering detection capability by making unauthorized modifications detectable, while the system maintains ease of operation through automated decoding and validation processes that abstract the complexity from the user.
Data Source
AI summary
An information handling system includes an add-in slot and a baseboard management controller (BMC). The add-in slot receives components of a particular type. The BMC receives an identifier from a particular component installed into the add-in slot. The identifier uniquely identifies the component from any other component of the same type. The BMC further determines whether or not a first entry in an encoded component table includes the first identifier, determines an action to perform for the component in response to determining that the entry includes the identifier, and performs the action for the component. The first entry is associated with the first add-in slot.