Secure Sideband Communication via Shared Memory Passphrase
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Information handling systems face challenges in securing sideband communication between a service processor and an endpoint device, particularly in ensuring data integrity and authenticity over unencrypted and unauthenticated sideband interfaces, which can lead to potential data breaches and unauthorized access.
Innovation Solution
The implementation of a shared memory architecture transfer mechanism to share a passphrase between the endpoint device and the service processor, enabling encryption and decryption of messages using a symmetric key encryption scheme, with a nonce value to authenticate and verify the authenticity of messages, ensuring only new, valid messages are accepted.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Productivity
If sideband communication is implemented between service processor and endpoint device, then data transmission capability is improved, but security and data integrity deteriorate due to unencrypted and unauthenticated interface
Solution Approach 1:
A passphrase is pre-shared between the endpoint device and service processor via shared memory architecture before sideband communication begins. This preliminary establishment of cryptographic material enables subsequent encryption and authentication of all messages transmitted over the unsecured sideband interface, resolving the security vulnerability while maintaining transmission capability.
2Reliability
If encryption is added to sideband communication, then security is improved, but device complexity increases due to additional cryptographic operations
Solution Approach 1:
The endpoint device and service processor perform their own encryption and decryption operations using the pre-shared passphrase. Each device independently generates cryptographic primitives (nonce, hash) and applies symmetric encryption to outgoing messages and verification to incoming messages, eliminating the need for external cryptographic hardware or services and minimizing additional complexity.
3Reliability
If nonce verification is implemented, then authentication and data integrity are improved, but processing time increases due to additional verification steps
Solution Approach 1:
The patent replaces complex cryptographic verification mechanisms with simpler, more efficient operations. Instead of full message authentication codes or digital signatures, the system uses lightweight nonce comparison and hash verification. The nonce is checked for uniqueness against a counter, and the hash is verified through simple comparison, significantly reducing processing overhead while maintaining strong authentication and integrity guarantees.
Data Source
AI summary
An information handling system includes an endpoint device and a service processor. The endpoint device is configured to share a passphrase with the service processor via shared memory architecture transfer mechanism. The service processor is configured generate the sent hash of a message; encrypt the message, the sent hash, and the nonce value using the passphrase to form an encrypted message; and transmit the encrypted message to the endpoint device over a sideband interface. The storage controller is further configured to decrypt the encrypted message using the passphrase to obtain the message, the sent hash, and the nonce value; compare the nonce value to a counter to determine if the nonce value is an old nonce value; calculate an observed hash of the message; and accept the message when the nonce value is not an old nonce value and the observed hash matches the received hash.