Binding Customer-Signed Firmware to Hardware via MAC and HRK
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Existing information handling systems face challenges in preventing customer-signed firmware images from being used in different systems, particularly when a motherboard is moved to another chassis, compromising the security of immutable root-of-trust implementations.
Innovation Solution
Incorporating a hidden root key (HRK) embedded in the processor and using front panel SPI flash to store an encrypted data structure comprising the customer public key and MAC address, ensuring that the firmware can only be used in its intended system by validating the MAC address and public key during boot.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Adaptability or versatility
If customer-signed firmware is enabled to allow customers to build and sign their own BMC images, then customer flexibility and control are improved, but the security assurance of immutable root-of-trust implementations deteriorates because the vendor can no longer exclusively sign and release BMC code
Solution Approach 1:
The solution segments the trust verification process into two independent components: (1) vendor-signed boot loader that establishes initial trust, and (2) customer-signed BMC image that provides flexibility. The boot loader and BMC image are separated such that the boot loader signs and releases the BMC image, creating distinct security zones where each component verifies the other independently
Solution Approach 2:
The vendor-signed boot loader acts as an intermediary between the hardware root-of-trust and the customer-signed BMC image. It mediates the trust relationship by using its own vendor signature to verify and chain-load the customer BMC image, thereby bridging the gap between immutable hardware trust and flexible customer-signed software
2Adaptability or versatility
If the customer's public key is stored in the vendor-signed boot loader to enable customer signing, then customer-signed BMC images can be loaded, but the ability to prevent key migration to other information handling systems deteriorates
Solution Approach 1:
The solution extracts the customer public key from the boot loader and stores it separately in a dedicated customer key storage area within the BMC image. This separation allows the boot loader to verify the customer key without containing it, preventing key extraction or migration while maintaining verification capability
Solution Approach 2:
The customer public key is预先 stored in the BMC image during the image building process, before the BMC needs to verify signatures. This preliminary placement ensures the key is bound to the specific BMC image and hardware configuration, preventing later migration or reuse in different systems
Data Source
AI summary
An information handling system may include a circuit board; a processor disposed on the circuit board, wherein the processor includes a media access control (MAC) address and a hidden root key (HRK) encoded therein; and a memory not disposed on the circuit board. The information handling system may be configured to: determine a customer public key (CPK); create a data structure comprising the CPK and the MAC address; encrypt the data structure using the HRK to generate an encrypted structure; and store the encrypted structure in the memory.