Systems and methods for BMC firmware identity based access control
AssigneeDell Products L.P.
InventorsSreeram Veluthakkal, Marshal F. Savage, Eugene David Cho
Life of this patent
Estimating the term…
Abstract
Embodiments of systems and methods to provide a firmware update to devices configured in a redundant configuration in an Information Handling System (IHS) are disclosed. In an illustrative, non-limiting embodiment, an IHS may include a Baseboard Management Controller (BMC) having computer-executable instructions to, during a boot sequence of the BMC, determine a type of a firmware that is to be booted on the BMC, and selectively restrict access to the resources based upon the determined type of firmware.
Claims16
An Information Handling System (IHS) that comprises:
- a plurality of resources;
- and
- a baseboard management controller (BMC) in communication with the plurality of resources, wherein the BMC comprises a plurality of BMC processors distinct from any IHS host processor, and one or more memory units that comprise instructions structured to, upon execution by a first BMC processor of the plurality of BMC processors, cause the BMC to perform operations that comprise:
- power the first BMC processor and boot the first BMC processor with a first BMC processor bootloader read from a Mask ROM (MROM) while any other BMC processors remain unpowered;
- determine, by the first BMC processor bootloader, based, at least in part, upon detection of a particular executable code sequence in a firmware that is to be booted by a second BMC processor of the plurality of BMC processors, a type of the firmware;
- in response to a determination by the first BMC processor, based, at least in part, upon the type of the firmware that a security key for the type of the firmware does not exist, generate the security key based upon the type of the firmware, wherein the type of the firmware comprises at least one of an IHS manufacturer's firmware, an open-source firmware, or a customer's do-it-yourself (DIY) firmware;
- and
- based at least in part on the security key, allow or disallow use of the plurality of resources by the second BMC.
A Baseboard Management Controller (BMC) firmware identity access control method comprising:
- during a boot sequence of a BMC configured in or coupled to an Information Handling System (IHS) that comprises a plurality of resources, wherein the BMC comprises a plurality of BMC processors distinct from any IHS host processor:
- powering a first BMC processor of the plurality of BMC processors and booting the first BMC processor with a first BMC processor bootloader read from a Mask ROM (MROM) while any other BMC processors remain unpowered;
- determining, using the first BMC processor bootloader, a type of a firmware that is to be booted by a second BMC processor of the plurality of BMC processors, based, at least in part, upon detecting a particular executable code sequence in the firmware;
- and
- in response to determining by the first BMC processor, based, at least in part, upon the type of the firmware, that a security key for the type of the firmware does not exist, generating the security key based upon the type of the firmware, wherein the type of the firmware comprises at least one of an IHS manufacturer's firmware, an open-source firmware, or a customer's do-it-yourself (DIY) firmware;
- and
- allowing or disallowing use of the plurality of resources by the second BMC based at least in part on the security key.
A memory storage device with program instructions stored thereon that, upon execution by a first Baseboard Management Controller (BMC) processor of a BMC configured in an Information Handling System (IHS) that comprises a plurality of resources, wherein the BMC comprises a plurality of BMC processors distinct from any IHS host processor, cause the BMC to perform operations that comprise:
- boot a first BMC processor of the plurality of BMC processors with a first BMC processor bootloader read from a Mask ROM (MROM) while any other BMC processors remain unpowered;
- while a boot sequence of the BMC is active on the first BMC processor, determine, by the first BMC processor bootloader, based, at least in part, upon detection of a particular executable code sequence in a firmware that is to be booted by a second BMC processor of the plurality of BMC processors, a type of the firmware;
- in response to a determination by the first BMC processor, based, at least in part, upon the type of the firmware, that a security key for the type of the firmware does not exist, generate the security key based upon the type of the firmware, wherein the type of the firmware comprises at least one of an IHS manufacturer's firmware, an open-source firmware, or a customer's do-it-yourself (DIY) firmware;
- and
- allow or disallow use of the plurality of resources by the second BMC based at least in part on the security key.
Dependencies are inferred from the claim text.