System and method for platform session management using device integrity measurements

An information handling system, comprising:

• a device managed by a management controller;
• and
• the management controller configured to communicate with the device, and to:
• send a first firmware measurement request to the device to verify integrity of the device, wherein the first firmware measurement request is sent at initial power on of the device, wherein the first firmware measurement request is sent subsequent to negotiating a secure session between the management controller and the device and wherein the management controller and the device are components of a platform system;
• verify a first firmware measurement in a first firmware measurement response to the first firmware measurement request prior to storing the first firmware measurement in a measurement manifest;
• send a heartbeat request to the device to monitor for a device state change;
• receive a heartbeat acknowledgement from the device in response to the heartbeat request, wherein the heartbeat acknowledgement includes an indication of the device state change;
• in response to the receipt of the heartbeat acknowledgment that includes the device state change, sending a second firmware measurement request to the device during the secure session between the management controller and the device;
• verify a second firmware measurement included in a second firmware measurement response to the second firmware measurement request that includes a comparison of the first firmware measurement and the second firmware measurement according to the measurement manifest;
• and
• apply a security policy to the device based on the device state change.

A non-transitory computer-readable medium including code that when executed performs a method, the method comprising:

• sending a first firmware measurement request to a device to verify integrity of the device, wherein the first firmware measurement request is sent to the device at initial power on of the device, and wherein the sending the first firmware measurement request is subsequent to negotiating a secure session between a management controller and the device, wherein the management controller and the device are components of a platform subsystem;
• verifying a first firmware measurement included in a first firmware measurement response to the first firmware measurement request prior to storing the first firmware measurement in a measurement manifest;
• monitoring the device to detect a device state change by sending a heartbeat request to the device periodically;
• receiving a heartbeat acknowledgement response from the device in response to the heartbeat request, wherein the heartbeat acknowledgement response includes an indication of the device state change during the secure session between the management controller and the device;
• in response to the receiving the heartbeat acknowledgment response that include the indication of the device state change, sending a second firmware measurement request to the device;
• verifying a second firmware measurement included in a second firmware measurement response to the second firmware measurement request, wherein the verifying includes comparing the second firmware measurement with the first firmware measurement according to the measurement manifest;
• and
• applying a security policy to the device based on the device state change.