Secure Server Profile Cloning via SPDM Encryption
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Conventional server profile cloning methods store configurations in plain text, compromising security and integrity, and require manual application in clustered environments, leading to vulnerabilities and management challenges.
Innovation Solution
A firmware cloning system using Security Protocol and Data Model (SPDM)-enabled devices for mutual authentication to generate shared security keys, encrypt, and decrypt server profiles, ensuring secure and automated configuration transfer between source and target Information Handling Systems (IHS).
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Productivity
If server profiles are stored in plain text for cloning, then the cloning process is simple and fast, but security and integrity are compromised
Solution Approach 1:
The patent creates an encrypted copy of the server profile data structure from the source system. Instead of copying plain text configurations, the system serializes the profile data, encrypts it using AES-256-CBC mode with a shared secret key derived from mutual authentication, and transfers the encrypted blob to the target system for decryption and application.
Solution Approach 2:
The patent introduces an intermediary encryption layer between the source and target systems. A shared secret key, established through mutual authentication using SPDM or TLS protocols, acts as the intermediary that secures the profile transfer. The encryption scheme includes the shared key, random salt, and initialization vector to ensure secure transmission without exposing plain text configurations.
2Adaptability or versatility
If manual application of server profiles is used in clustered environments, then customization is possible, but management overhead and time consumption increase
Solution Approach 1:
The patent automates the profile application process by copying the encrypted profile data structure from a source system to multiple target systems in a cluster. The target system automatically decrypts the profile using the shared secret key and applies the configuration without manual intervention, significantly reducing management time while maintaining the ability to customize individual target systems if needed.
Solution Approach 2:
The patent enables self-service automation where the target system automatically receives, decrypts, and applies the server profile without requiring manual configuration. The system performs mutual authentication, decrypts the encrypted profile blob, and configures itself based on the serialized profile data, eliminating the need for administrators to manually apply configurations to each cluster member.
3Reliability
If encryption is implemented for server profile transfer, then security is enhanced, but system complexity increases
Solution Approach 1:
The patent implements a universal encryption framework that works across different authentication protocols (SPDM and TLS). The same encryption scheme (AES-256-CBC) and data structure are used regardless of which authentication method is employed, simplifying the overall system architecture. The encryption layer is integrated into the existing profile management workflow, adding security without requiring separate complex systems for different scenarios.
Solution Approach 2:
The patent changes the parameter of the profile data from plain text to encrypted format, while maintaining the same underlying data structure and serialization format. This parameter change enables security enhancement without fundamentally altering the system architecture. The encryption is applied transparently to the existing profile data, and the target system automatically handles decryption using the shared secret key, minimizing the operational complexity introduced by encryption.
Data Source
AI summary
According to embodiments of the present disclosure, a firmware cloning system and method provided using Security Protocol and Data Model (SPDM)-enabled devices. The firmware cloning system and method include program instructions that may be executed on a processing system to mutually authenticate with a source IHS to generate shared security keys, and end a request to the source IHS to generate a server profile comprising information associated with a configuration of the source HIS. A source HIS is configured to generate the server profile in response to the request, encrypt the server profile using one of the security keys, and send the encrypted server profile to the target HIS. The target HIS then is configured to receive the encrypted server profile, decrypt the encrypted server profile using a source of the shared security keys, and configure the target IHS according to the decrypted server profile.