Chassis internal device security

A system comprising a processor having access to memory media storing instructions executable by the processor to perform operations comprising:

• identifying a plurality of computing devices, each of the computing devices including at least a central processing unit (CPU), a flash memory, and a memory device;
• registering, by a first computing device of the plurality of computing devices, as a client of a second, differing computing device of the plurality of computing devices;
• in response to registering the first computing device as a client of the second computing device, authorizing the first computing device with the second computing device, the authorizing including:
• verifying, by a mask ROM of the CPU of the first computing device and with fused keys included by the CPU, a boot loader that is included by the flash memory of the first computing device;
• in response to verifying the boot loader, verifying, by the boot loader and with boot loader keys included by the flash memory, a kernel included by the memory device of the first computing device;
• in response to verifying the kernel, decrypting, by the kernel using a hidden root key (HRK) included by the CPU of the first computing device, a device unique certification (DUC) included by the flash memory;
• and
• in response to decrypting the DUC, generating, by the first computing device, the proof-of-possession of the DUC;
• providing, by the first computing device, the proof-of-possession to the second computing device to authorize the first computing device as a client of the second computing device;
• and
• in response to authorizing the first computing device as a client of the second computing device, establishing, by the first computing device, a secure communication channel with the second computing device.

A non-transitory computer-readable medium storing software comprising instructions executable by one or more computers which, upon such execution, cause the one or more computers to perform operations comprising:

• identifying a plurality of computing devices, each of the computing devices including at least a central processing unit (CPU), a flash memory, and a memory device;
• registering, by a first computing device of the plurality of computing devices, as a client of a second, differing computing device of the plurality of computing devices;
• in response to registering the first computing device as a client of the second computing device, authorizing the first computing device with the second computing device, the authorizing including:
• verifying, by a mask ROM of the CPU of the first computing device and with fused keys included by the CPU, a boot loader that is included by the flash memory of the first computing device;
• in response to verifying the boot loader, verifying, by the boot loader and with boot loader keys included by the flash memory, a kernel included by the memory device of the first computing device;
• in response to verifying the kernel, decrypting, by the kernel using a hidden root key (HRK) included by the CPU of the first computing device, a device unique certification (DUC) included by the flash memory;
• and
• in response to decrypting the DUC, generating, by the first computing device, the proof-of-possession of the DUC;
• providing, by the first computing device, the proof-of-possession to the second computing device to authorize the first computing device as a client of the second computing device;
• and
• in response to authorizing the first computing device as a client of the second computing device, establishing, by the first computing device, a secure communication channel with the second computing device.