Out-of-band Management Controller for Public Key Replacement
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Existing information handling systems face security risks due to compromised private keys, allowing malicious code to be mistakenly accepted as genuine firmware updates, which can prevent further updates and compromise device security.
Innovation Solution
An information handling system with a management controller that receives a message indicating a compromised private key, allowing for the replacement of the existing public key with a new one, ensuring secure firmware updates by using out-of-band management and secure communication channels.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Ease of operation
If the same public key is embedded in existing firmware and used to verify firmware updates, then firmware update authentication is simplified, but security is compromised if the private key is stolen
Solution Approach 1:
The system pre-embeds a first public key in the firmware that can verify signatures from both the original private key and a second private key. This preliminary configuration allows the firmware to be updated with a new key pair before any compromise occurs, enabling seamless key rotation without requiring firmware re-flashing or complex authentication changes.
Solution Approach 2:
The invention changes the authentication parameter from a single static public key to a public key list that includes multiple trusted keys. The firmware maintains a list of valid public keys and can verify signatures against any key in the list, allowing dynamic updates to the trusted key set without changing the fundamental authentication mechanism.
2Ease of manufacture
If a compromised private key is used to sign malicious firmware updates, then firmware updates can be forged, but detecting the compromise requires complex security monitoring
Solution Approach 1:
The system proactively replaces the private key pair before compromise occurs or is detected. The manufacturer can issue a firmware update with a new public key embedded in the list, invalidating the old private key. This preliminary action prevents malicious code signing without requiring complex monitoring systems to detect the compromise.
Solution Approach 2:
The invention extracts the compromised private key from the trusted authentication set by removing its corresponding public key from the firmware's public key list. This extraction isolates the security vulnerability without affecting the overall firmware update mechanism, allowing the system to continue functioning with updated keys.
3Ease of operation
If the public key is embedded in firmware to verify updates, then authentication is straightforward, but key replacement requires complete firmware re-flashing
Solution Approach 1:
The firmware is pre-configured with a public key list that includes both the original public key and a replacement public key. This preliminary setup allows the system to transition between keys by simply updating the public key list through a standard firmware update, avoiding the need for complete firmware re-flashing or complex key management operations.
Solution Approach 2:
The invention transforms the static public key embedded in firmware into a dynamic public key list that can be updated without changing the firmware structure. The system dynamically adjusts which keys are trusted by modifying the public key list through standard update procedures, making the key management process flexible and adaptable.
Data Source
AI summary
In accordance with embodiments of the present disclosure, an information handling system may include a processor, an information handling resource communicatively coupled to the processor, and a management controller communicatively coupled to the processor and the information handling resource and configured to provide out-of-band management of the information handling system. The management controller may further configured to receive a message indicating that an existing private key associated with the information handling resource is compromised, the message including a replacement public key for replacing an existing public key associated with the information handling resource and associated with the existing private key and responsive to the message, cause the existing public key associated with the information handling resource to be replaced with the replacement public key.