LCS vTPM Authentication for Secure Resource and Control Planes
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Conventional Logically Composed Systems (LCS) provisioning systems lack means for authenticating resources, control planes, and the use of LCSs with control planes to perform workloads, leading to unsecured and inefficient resource allocation.
Innovation Solution
An Information Handling System (IHS) with a System Control Processor (SCP) device that authenticates with a resource management system, a Basic Input/Output System (BIOS) providing authentication information, and an operating system signing and transmitting this information to create an authenticated Logically Composed System (LCS) using a virtual Trusted Platform Module (vTPM) for secure resource and control plane authentication.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If conventional LCS provisioning systems are used, then resource allocation is simple and fast, but security authentication is lacking
Solution Approach 1:
The patent implements nested authentication by embedding multiple authentication layers within the LCS provisioning process. The resource system authentication, control plane authentication, and LCS instance authentication are nested sequentially, with each layer building upon the previous one. This nested structure allows comprehensive security verification while maintaining a clear hierarchical process flow that manages complexity through organized layering.
Solution Approach 2:
The authentication process is segmented into three distinct phases: (1) resource system authentication between the SCP device and resource management system, (2) control plane authentication for the LCS control plane, and (3) LCS instance authentication for the composed LCS. This segmentation allows each authentication step to be independently implemented and verified, reducing overall system complexity while enhancing security through multiple discrete verification points.
2Reliability
If authentication mechanisms are added to LCS provisioning, then security is improved, but provisioning efficiency decreases
Solution Approach 1:
The patent implements preliminary authentication actions by pre-establishing trust relationships between the SCP device, resource management system, and control plane before LCS composition. Authentication credentials and verification mechanisms are prepared in advance, allowing the actual LCS provisioning process to proceed efficiently once preliminary security checks are complete. This preliminary action separates security verification from the core provisioning workflow, minimizing efficiency impact.
3Reliability
If multiple authentication layers are implemented, then security is enhanced, but system complexity increases
Solution Approach 1:
The patent employs universal authentication mechanisms that serve multiple functions across different authentication layers. The same cryptographic verification methods and trust establishment protocols are reused for resource system authentication, control plane authentication, and LCS instance authentication. This multi-functionality reduces system complexity by avoiding redundant authentication implementations while maintaining enhanced security through multiple application layers of the same proven mechanisms.
Data Source
AI summary
A resource/control plane/LCS authentication system includes a resource system coupled to a resource management system. The resource system includes an SCP device that authenticates with the resource management system to provide an authenticated LCS control plane. An operating system in the resource system signs operating system authentication information and transmits the signed operating system authentication information to the resource management system to provide an authenticated resource system. The operating system creates an LCS vTPM for an LCS that was composed by the resource management system, and stores an LCS vTPM payload from the resource management system in the LCS vTPM. The operating system then provides the LCS using the LCS vTPM payload, with the LCS authenticating itself and the operating system to provide an authenticated LCS. The operating system then performs a workload using the authenticated LCS, the authenticated resource system, and the authenticated LCS control plane.