Distributed key management system

An Information Handling System (IHS), comprising:

• a first processing subsystem;
• a first memory subsystem that is coupled to the first processing subsystem and that includes instructions that, when executed by the first processing subsystem, cause the first processing subsystem to provide an enabling key utilization engine;
• a second processing subsystem that is coupled to the first processing subsystem;
• a second memory subsystem that is coupled to the second processing subsystem and that includes instructions that, when executed by the second processing subsystem, cause the second processing subsystem to provide a key management engine that is configured to:
• retrieve, from a key management subsystem in one of a plurality of second System Control Processor (SCP) subsystems, at least one enabling key for communicating via respective secure communication channels with each of the plurality of second SCP subsystems;
• store the at least one enabling key in a key management database that is coupled to the second processing subsystem;
• receive, from the enabling key utilization engine, a first enabling key request;
• determine whether the IHS is trusted;
• erase, in response to receiving the first enabling key request and determining that the IHS is not trusted, the at least one enabling key from the key management database;
• determine, subsequent to erasing the at least one enabling key from the key management database, that the IHS is trusted;
• retrieve, in response to determining that the IHS is trusted subsequent to erasing the at least one enabling key from the key management database, the at least one enabling key from the key management subsystem in one of the plurality of second SCP subsystems;
• and
• store, in response to retrieving the at least one enabling key after determining that the IHS is trusted subsequent to erasing the at least one enabling key from the key management database, the at least one enabling key in the key management database.

A method for providing distributed key management, comprising:

• retrieving, by a first key management subsystem in a first System Control Processor (SCP) subsystem from a second key management subsystem in one of a plurality of second SCP subsystems, at least one enabling key for communicating via respective secure communication channels with each of the plurality of second SCP subsystems;
• storing, by the first key management subsystem, the at least one enabling key in the first key management subsystem;
• receiving, by the first key management subsystem from the first SCP subsystem, a first enabling key request;
• determining, by the first key management subsystem, whether the first SCP subsystem is trusted;
• erasing, by the first key management subsystem in response to receiving the first enabling key request and determining that the first SCP subsystem is not trusted, the at least one enabling key from the first key management subsystem;
• determining, by the first key management subsystem subsequent to erasing the at least one enabling key from the first key management database, that the first SCP subsystem is trusted;
• retrieving, by the first key management subsystem in response to determining that the first SCP subsystem is trusted subsequent to erasing the at least one enabling key from the first key management database, the at least one enabling key from a second key management subsystem in one of the plurality of second SCP subsystems;
• and
• storing, by the first key management subsystem in response to retrieving the at least one enabling key after determining that the first SCP subsystem is trusted subsequent to erasing the at least one enabling key from the first key management database, the at least one enabling key in the first key management database.