Dell iDRAC7 Version 1.00.00 Manual
New Security Features in Integrated
Dell Remote Access Controller 7
The new Dell Integrated Dell Rem ot e Access Controller version 7 for
Dell PowerEdge 12
with comprehensive management and enhanced functionality.
th
generation servers delivers key security features
Dell │ OpenManage Systems
Management
New Security Features in the Integrated Dell Remote Access Controller 7
Contents
Introduction .............................................................................................................. 3
iDRAC7 firmware signing ............................................................................................... 3
The threat landscape ................................................................................................. 3
Keeping pace ......................................................................................................... 3
The build process: signing the firm wa r e .......................................................................... 4
Field update: verifying the firmware signature ................................................................ 4
Firmware downgrades ............................................................................................... 4
In the unlikely event of a compromised private key .......................................................... 4
Built-in unique Hidden Root Key ..................................................................................... 4
Hidden Root Key: keeping secrets confidential .................................................................. 5
Hidden Root Key: uniquely identifying a particular server ..................................................... 5
Summary: best features of the TPM ................................................................................ 5
Credential vault ......................................................................................................... 6
Protected storage ..................................................................................................... 6
Field Service Debug authorization facility.......................................................................... 6
Benefits .................................................................................................................. 6
Decommissioning and reprovisioning support ...................................................................... 7
Summary .................................................................................................................. 7
This document is for informational purposes only and may contain typographical errors and
technical inaccuracies. The content is provided as is, without express or implied warranties of any
kind.
© 2012 Dell Inc. All rights reserved. Dell and its affiliates cannot be responsible for errors or omissions
in typography or photography. Dell, the Dell logo and PowerEdge are trademarks of Dell Inc. Microsoft,
BitLocker, and Windows are either trademarks or registered trademarks of Microsoft Corporation in the
United States and/or other countries. Other trademarks and trade names may be used in this document
to refer to either the entities claiming the marks and names or their products. Dell disclaims
proprietary interest in the marks and names of others.
April 2012| Rev 1.0
ii
New Security Features in the Integrated Dell Remote Access Controller 7
Introduction
The Integrated Dell Remote Access Controller version 7 (iDRAC7) provides comprehensive management,
without relying on OS agents, for Dell™ PowerEdge™ 12
functional and ease-of-use features, iDRAC7 includes the following new key security features. For more
information, go to www.dell.com/idrac7
• Firmware code signing and verification
• Built-in Hidden Root Key (provides a number of Trusted Platform Model (TPM)-like features to
iDRAC)
• Credential Vault
• Field Service Debug Authorization Facility
• Lifecycle Controller wipe
th
generation servers. In addition to many new
.
iDRAC7 firmware signing
In response to a growing concern in the security industry and among security conscious customers about
the threat of malicious firmware, iDRAC7 firmware updates are signed and verified. Updates are signed
near the end of the firmware build process. The signatures are verified when firmware updates are
later applied by customers. The signature generation and verification processes are as specified by the
US Digital Signature Standard (FIPS-186-3). This verification results in a high level of assurance that
iDRAC7 only runs firmware designed and delivered by Dell.
The threat landscape
In the last few years, the threat of “phlash attacks” has gone from a theoretical concern to a real
phenomenon. From router rootkits, to hacked printers, to proofs of concepts of car hacks, to the many
instances of “open source firmware,” the viability of changing or replacing the manufacturer’s
firmware is well established.
While it would be both annoying and inconvenient to have a hacker ruin a home ink jet printer, a
phlash attack against a server management solution, such as iDRAC7, could have much more serious
consequences. Because iDRAC7 performs the important function of managing servers remotely, it can
also provide a ready vehicle for attacking servers. Using iDRAC7, server operation can be disrupted in a
large number of ways: from powering off the server all the way to erasing RAID configuration. Remote
access solutions even provide a way to remotely boot a server with the OS image of an attacker’s
choice.
Keeping pace
Dell server technology is keeping pace with the threat landscape by following a process of continuous
security improvement and innovation. Our focus is on good security features and on secure
development practices, while minimizing customer impact and providing high value. Firmware code
signing and verification exemplifies this approach.
3
Loading...