Cross Authentication for Host CPU and BMC Security
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Conventional computer systems face security risks where a compromised Baseboard Management Controller (BMC) or host CPU can lead to exposure of the other component, allowing unauthorized access and potential hacking.
Innovation Solution
A cross-authentication method is implemented where the host CPU module and BMC exchange digital signatures using public keys stored in secure boot storages, verifying authenticity before allowing access, thereby enhancing system security by preventing unsecured hardware or firmware usage.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Ease of operation
If the BMC is allowed to access the host CPU module without verification, then the ease of operation is improved, but the security and reliability deteriorate due to potential hacking and unauthorized access
Solution Approach 1:
The patent implements preliminary verification actions by requiring the BMC to provide a digital signature before accessing the host CPU module, and requiring the host CPU module to verify the BMC's public key before allowing access. This preliminary authentication prevents unauthorized access while maintaining ease of operation for legitimate components.
2Reliability
If digital signature verification is implemented between BMC and host CPU module, then the reliability and security are improved, but the device complexity and operational steps increase
Solution Approach 1:
The patent uses digital signatures and public key infrastructure as intermediaries to enable secure verification between the BMC and host CPU module. The digital signature acts as a trusted mediator that proves authenticity without requiring direct complex verification mechanisms, thus improving security while managing complexity through standardized cryptographic protocols.
Data Source
AI summary
A cross authentication method includes steps of: a host central processing unit (CPU) module sending to a baseboard management controller (BIC) a request for BMC signature; the host CPU module receiving BMC signature data from the BMC; the host CPU module determining whether the received BMC signature data is authentic based on a BMC public key stored in the host CPU module; and the host CPU module allowing the BMC to access the host CPU module when it is determined that the BMC signature data is authentic.