PCIe/CXL FRU Function Mapping for SPDM Authentication
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Existing systems face challenges in authenticating multiple devices or Functions within a PCIe/CXL Field Replaceable Unit (FRU) using Security Protocol and Data Model (SPDM) due to the need for individual certificates for each component, leading to inefficiencies in managing and updating firmware without rebooting the system.
Innovation Solution
A multi-Function PCIe/CXL FRU representation system that includes computer-executable instructions to respond to SPDM requests with a list of Device/Function paths, enabling efficient authentication and management of multiple Functions within a single FRU without rebooting.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Measurement precision
If individual certificates are used for each device or Function within a PCIe/CXL FRU, then authentication accuracy is improved, but system complexity and management difficulty increase
Solution Approach 1:
The patent merges multiple individual device certificates into a single FRU-level certificate that encompasses all Functions within the FRU. This is achieved by creating a unified security context where the FRU certificate serves as a parent certificate that implicitly authorizes all child Functions, eliminating the need for separate certificate management for each component while maintaining authentication integrity
Solution Approach 2:
The FRU certificate is designed with universal applicability to represent multiple Functions within the same FRU. The certificate structure includes a list of Function paths that can be queried via SPDM, allowing a single certificate to serve multiple authentication purposes across different Functions without requiring individual certificates for each
2Reliability
If individual certificates are used for each Function, then authentication reliability is improved, but firmware update efficiency deteriorates
Solution Approach 1:
The patent combines multiple Function certificates under a single FRU certificate umbrella. When firmware updates are applied to the FRU, the unified certificate structure allows the updated FRU certificate to automatically encompass all Functions, enabling bulk updates without requiring individual certificate regeneration or system reboots for each Function
Solution Approach 2:
The FRU certificate is pre-configured with a list of Function paths during FRU initialization. This preliminary action allows the system to know in advance which Functions are covered by the FRU certificate, enabling efficient firmware updates where the updated FRU certificate can be applied once and automatically applies to all listed Functions without requiring individual certificate management
3Reliability
If traditional authentication methods are used, then security is maintained, but system availability deteriorates due to required reboots
Solution Approach 1:
The FRU certificate is pre-configured with a list of Function paths during FRU initialization. This preliminary action allows the system to know in advance which Functions are covered by the FRU certificate, enabling efficient firmware updates where the updated FRU certificate can be applied once and automatically applies to all listed Functions without requiring individual certificate management or system reboots
Data Source
AI summary
Embodiments of systems and methods to determine all of the Functions that are associated with a multi-Function Peripheral Component Interconnect/Compute Express Link (PCIe/CXL) Field Replaceable Unit (FRU) for use in SPDM authentication of a PCIe/CXL FRU are disclosed. According to one embodiment, a multi-Function PCIe/CXL FRU includes multiple Functions that each are represented by a unique Device/Function path. A PCIe/CXL FRU includes computer-executable program instructions that cause it to receive a request from a Security Protocol and Data Model (SPDM) requester to obtain information about a plurality of Functions associated with the PCIe/CXL FRU, and respond to the request by sending a list of Device/Function paths to the SPDM requester. Each Device/Function path indicates the Function and the path to the Function associated with the PCIe/CXL FRU.