Keyboard for provisioning security credentials

A method and data processing device for detecting connection of a second device at an interface of an IHS. The method includes receiving a request to modify at least one secure functionality associated with the IHS, the request comprising identification input. The method includes generating security credentials that correspond to a predetermined level of security that is assigned to the identification input. The method includes triggering the service processor to establish a secure communication link to the second device for communicatively connecting a digitally generated keyboard. The method includes autonomously inputting the security credentials to the digitally generated keyboard. The method includes signaling to the digitally generated keyboard to write the security credentials to the second device for use to obtain access to the IHS according to the predetermined level of security. Based on the predetermined level of security, the method includes enabling management of certain functionalities of the IHS.

BACKGROUND

1. Technical Field

The present disclosure relates in general to service processors of an information handling system (IHS), and more particularly to a method and system for provisioning security credentials to access a secure service processor.

2. Description of the Related Art

An IHS can include a service processor for monitoring the physical state of the IHS. The service processor autonomously monitors and manages operations of the HIS, independent of the host system's CPU, firmware, and operating system. The service processor, along with a computer interface, such as the Intelligent Platform Management Interface (IPMI), provides a way to manage a computer that may be powered off or otherwise unresponsive by utilizing a network connection to the hardware rather than a communicative connection to the operating system or login platform. Customers who utilize a service processor configuration have complete control of the operating system, the IPMI, and the service processor. Often, such customers prefer not to share service processor credentials with service providers. However, service providers are responsible for hardware serviceability, such as part replacement. In one example, a customer, such as a financial institution, becomes vulnerable to malicious attacks when service processor credentials are disclosed. In situations in which parts need to be replaced, service providers are able to replace the parts, but cannot restore and/or upgrade hardware and firmware configuration settings. Replacing and/or changing hardware parts without providing corresponding upgrades to the IHS system can cause the IHS to operate less than optimally. Further, operating new hardware using older software and/or firmware settings can cause wear on the hardware, eventually leading to early deterioration of the circuitry associated with the hardware.

BRIEF SUMMARY

Disclosed are a method and an information handling system for generating a digital keyboard to autonomously provision security credentials to a second device. The security credentials enable access to manage secure functionalities of an information handling system (IHS).

According to illustrative embodiments of the present disclosure, a method includes managing security credentials associated with a service processor of an IHS. The method also includes detecting a connection of a second device at an input/output interface of the IHS. The method includes receiving a request to modify at least one secure functionality associated with the IHS. The received request includes an identification input. In response to receiving the identification input, the method includes generating, by the service processor, security credentials that correspond to a predetermined level of security that is assigned to the identification input. The method includes triggering the service processor to establish a secure communication link to the second device. The secure communication link is provided to communicatively connect a digitally generated keyboard. The digitally generated keyboard enables unidirectional input by the service processor. The method also includes autonomously inputting the security credentials to the digitally generated keyboard. The method includes signaling to the digitally generated keyboard to write the security credentials to an open text editor of the second device. The security credentials can be utilized to obtain access to the IHS according to the predetermined level of security. Based on the predetermined level of security, the method includes enabling management of certain functionalities of the IHS by the second device.

The above presents a general summary of several aspects of the disclosure in order to provide a basic understanding of at least some aspects of the disclosure. The above summary contains simplifications, generalizations and omissions of detail and is not intended as a comprehensive description of the claimed subject matter but, rather, is intended to provide a brief overview of some of the functionality associated therewith. The summary is not intended to delineate the scope of the claims, and the summary merely presents some concepts of the disclosure in a general form as a prelude to the more detailed description that follows. Other systems, methods, functionality, features and advantages of the claimed subject matter will be or will become apparent to one with skill in the art upon examination of the following figures and detailed written description.

DETAILED DESCRIPTION

Disclosed are a method and an information handling system for generating a digital keyboard to autonomously provision security credentials to a second device. The security credentials enable access to manage secure functionalities of an information handling system (IHS). In accordance with embodiments of the present disclosure, an IHS includes a processor, a service processor, and a memory system. The service processor is communicatively coupled to the processor. The memory system is communicatively coupled to the processor and the service processor. A secure digital keyboard (SDK) utility is stored on the memory system. The SDK utility executes on the service processor to enable the service processor to detect a connection of a second device at an input/output interface of the IHS. The service processor receives a request to modify at least one secure functionality associated with the IHS. The request includes an identification input. In response to receiving the identification input, the SDK utility executes on the service processor to generate security credentials that correspond to a predetermined level of security that is assigned to the identification input. Further the SDK utility triggers the service processor to establish a secure unidirectional communication link to the second device in order to communicatively connect a digitally generated keyboard. The digitally generated keyboard receives unidirectional input from the service processor. The service processor autonomously inputs the security credentials to the digitally generated keyboard. The service processor signals to the digitally generated keyboard to write the security credentials to an open text editor of the second device for use to unlock access to the IHS according to the predetermined level of security. Based on the predetermined level of security, the service processor enables management of certain functionalities of the IHS by the second device.

FIG. 1illustrates a block diagram representation of an example IHS100that supports managing security credentials associated with a service processor of IHS100, according to one or more embodiments. Within the general context of IHSs, IHS100may include any instrumentality or an aggregate of instrumentalities operable to compute, classify, process, transmit, receive, retrieve, originate, switch, store, display, manifest, detect, record, reproduce, handle, or utilize any form of information, intelligence, or data for business, scientific, control, entertainment, or other purposes. For example, an IHS may be a personal computer, a personal digital assistant, a consumer electronic device, a network storage device, or any other suitable device and may vary in size, shape, performance, functionality, and price. The IHS may include random access memory (RAM), one or more processing resources such as a central processing unit (CPU) or hardware or software control logic, read-only memory (ROM), and/or other types of nonvolatile memory. Additional components of the IHS may include one or more disk drives, one or more network ports for communicating with external devices as well as various input and output (I/O) devices, such as a keyboard, a mouse, and a video display. The IHS may also include one or more buses operable to transmit communications between the various hardware components.

Referring again toFIG. 1, processor subsystem104is coupled to system memory106via system interconnect108. System interconnect108can be interchangeably referred to as a system bus, in one or more embodiments. System interconnect108may represent a variety of suitable types of bus structures, e.g., a memory bus, a peripheral bus, or a local bus using various bus architectures in selected embodiments. For example, such architectures may include, but are not limited to, Micro Channel Architecture (MCA) bus, Industry Standard Architecture (ISA) bus, Enhanced ISA (EISA) bus, Peripheral Component Interconnect (PCI) bus, PCI-Express bus, HyperTransport (HT) bus, and Video Electronics Standards Association (VESA) local bus. System interconnect108communicatively couples various system components including, for example, system interconnect108communicatively couples replaceable local storage resources110such as solid-state drives (SSDs) and hard disk drives (HDDs). One or more software and/or firmware modules can be stored within SDDs and HDDs, and one or more sets of data can be utilized during management operations of/for IHS100. Specifically, in one embodiment, system memory106can include therein a plurality of such modules stored in dynamic random-access memory (DRAM)134. These modules include one or more of application(s)112and operating system (OS)114. Application(s)112may include a word processing application, a presentation application, and a management station application, among other applications. The various applications having varying functionality when their corresponding program code is executed by processor subsystem104or other processing devices within IHS100. Further, firmware interface chipset115can be coupled to and/or within system memory106firmware interface chipset115. Firmware interface chipset115is hardware that includes firmware interface116and enables the implementation of firmware interface116. Firmware interface116may be, for example, Basic Input/Output System (BIOS) or Unified Extensible Firmware Interface (UEFI). BIOS is non-volatile firmware used to perform hardware initialization during the booting process (power-on startup), and to provide runtime services for operating systems and programs. UEFI is a specification for a software program that connects a computer's firmware to its operating system (OS). Alternatively, in one embodiment BIOS/BIOS drivers are utilized to provide runtime services to IHS100. In another embodiment, UEFI is utilized to perform runtime services to the IHS100. The BIOS and UEFI drivers are represented herein as BIOS/UEFI drivers117. The corresponding set of drivers are to be utilized with the corresponding firmware interface116. BIOS or UEFI has instructions for controlling input/output operations associated with IHS100. Additionally, firmware interface chipset115includes Advanced Configuration and Power Interface (ACPI) firmware118.

IHS100also includes one or more memory devices102aand102bcoupled to a processing subsystem, or “processor”104. Regions of memory devices102aand102bcan be configured as persistent memory. Memory devices102aand102bmay have a shared memory controller or separate memory controller. The memory controller connected to memory devices102aand102bis represented here as memory controller138. Although a same memory controller138is shown as a component of memory device102aand102b, IHS100can include more than one separate memory controller devices. Each of memory device102aand102bcan include non-volatile memory. For example, memory device102aincludes non-volatile memory136. IHS100can automatically update memory devices102aand102bwith a locally-accessible copy of a firmware image. Thereby, memory devices102aand102bcan operate using the same version of firmware image.

IHS100further includes one or more input/output (I/O) controllers121that support connection by and processing of signals from one or more connected input device/s122, such as a keyboard, mouse, touch screen, or microphone. I/O controllers120also support connection to and forwarding of output signals to one or more connected output devices124, such as a monitor or display device or audio speaker(s). Additionally, in one or more embodiments, one or more device interfaces126, such as an optical reader, a Universal Serial Bus (USB), a card reader, Personal Computer Memory Card International Association (PCMCIA) slot, and/or a high-definition multimedia interface (HDMI), can be associated with IHS100. Device interface(s)126can be utilized to enable data to be read from or be stored to corresponding removable storage device/s, such as a compact disk (CD), digital video disk (DVD), flash drive, or flash memory card. In one or more embodiments, device interface(s)126can further include general purpose I/O interfaces such as inter-integrated circuit (I2C), system management bus (SMB), and peripheral component interconnect (PCI) buses.

IHS100comprises network interface controller (NIC)130. NIC130enables IHS100and/or components within IHS100to communicate and/or interface with other devices, services, and components that are located external to IHS100, represented as network devices131. These devices, services, and components can interface with IHS100via an external network, such as example network132, using one or more communication protocols that include transport control protocol (TCP/IP) and network block device (NBD) protocol. Network132can be a local area network, wide area network, personal area network, and the like, and the connection to and/or between network, and IHS100can be wired, wireless, or a combination thereof. For purposes of discussion, network132is indicated as a single collective component for simplicity. However, it should be appreciated that network132can comprise one or more direct connections to other devices as well as a more complex set of interconnections as can exist within a local area network or a wide area network, such as the Internet.

Processor subsystem104can include a central processing unit (CPU)152that is augmented by a platform control hub (PCH)154. The PCH154interfaces to functional components of the IHS100such as service processor156. Service processor156operates as a system management interface that is capable of monitoring the physical state of IHS100. Service processor156is embedded within the main circuit board or motherboard of IHS100. Service processor156helps to monitor additional servers and/or devices remotely connected to IHS100. Service processor156may manage and/or monitor one or more virtual machine(s) associated with IHS100. Service processor156may include a network interface card that is separate from NIC130, for example service processor (SP) NIC133. In one embodiment, service processor156includes a direct feature that enables a service device, such as service device141, to connect at a supporting hardware interface. The supporting hardware interface can be a component associated with device interface(s)126, for example, service processor universal serial bus (SP USB) port127. SP USB port127enables service device141to interact directly with interfaces associated specifically with service processor156. For example, interfaces associated with service processor156can include a remote accessibility interface and/or a web services management interface.

Service processor156includes secure digital keyboard (SDK) utility160. SDK utility160includes credential generator162. In one embodiment, SDK utility160is a separate software utility that is stored within service processor156. Service processor selectively executes SDK utility160in response to detection of a second device coupled to/at SP USB port127. Service processor156detects connection of service device141at SP USB port127. Service device141may be connected via USB cable140, which includes two connector ends. The connector ends may be a same or different combination of connector ends. For example, USB cable140can be configured with a USB type A connector to USB type A connector, USB type A connector to USB type B connector, USB type A to USB mini-B connector, and USB type A connector to USB micro connector cable. In one embodiment, in response to detecting USB cable140connected at SP USB port127and concurrently detecting certain hardware input, service processor156emulates a network device to mimic remote access activities that may be associated with IHS100. The hardware input can be, for example, input of a key, biometric input, hardware button selection. The hardware button selection can be for a predetermined amount of time to operate as an input trigger, in one embodiment. In one embodiment, service processor156is connected to a dedicated network interface card, SP NIC133. SP NIC133enables service processor to connect to network132independent of the processor subsystem104for maintenance of IHS100.

In one embodiment, IHS100detects USB cable140at SP USB port127, and concurrently detects the certain hardware input. In response to detecting USB cable140at SP USB port127and the certain hardware input, IHS100activates a direct connection to service processor156. The direct connection to service processor156bypasses operations associated with other components, enabling service processor156to initiate an active connection to service device141. The direct, active connection is important when IHS100is experiencing hardware and/or software malfunctions, when IHS100requires updates, and/or when components of IHS100need replacement. Moreover, direct connection to service processor156circumvents exposure to confidential information that is stored on IHS100. Enabling service (of IHS100) via direct connection to service processor156, which prevents access to confidential information, is critical for institutions, such as government and/or financial institutions, that handle sensitive data daily.

One functionality provided by SDK utility160is that of generating digitally generated keyboard128. In one embodiment, utilizing USB cable140, service processor156initially enables a unidirectional connection to service device141. The unidirectional connection prevents malware and/or malicious applications from infiltrating IHS100, which would be possible via a bidirectional connection over device interface(s)126. Communicating over USB cable140, service processor156temporarily writes digitally generated keyboard128to a storage device of service device141. Service processor156enables digitally generated keyboard128to be displayed on a display of service device141. Service processor156generates security credentials utilizing credential generator162. The security credentials are forwarded to digitally generated keyboard128via USB cable140. As will be discussed herein, the security credentials enable access to manage certain features of IHS100. Additional aspects of SDK utility160and functionalities associated thereof, are presented within the description ofFIGS. 2-7, with each figure described with reference to components presented within the preceding figure(s).

FIG. 2illustrates an example security credential provisioning device layout200. Security credential provisioning device layout200includes example contents of an information handling system (100) and service processor156for generating a digital keyboard and provisioning security credentials, according to one or more embodiments. As illustrated, security credential provisioning device layout200includes IHS100and service device141.

Within IHS100, service processor156is communicatively connected to processor subsystem104, system memory106, firmware interface chipset118, and SP USB127. Service processor156includes SDK utility160, and a scriptable interface, such as graphical user interface/command line interface (GUI/CLI)208for displaying commands/information from service processor156. Further, service processor156includes remote accessibility interface and/or a web services management interface (WSMI)206. GUI/CLI208enables an operator to input security credentials and/or manage certain functionalities of IHS100. SDK utility160includes credentials generator162, which generates security credentials for accessing certain functionalities of IHS100. These functionalities can include, but are not limited to, managing software updates/restoration, firmware updates/restoration, restoration of hardware/firmware configuration settings, restoration/modification of service processor settings, restoration/modification of storage configurations, etc.

Service device141includes device interface226, display220, and applications222. Device interface226can be, for example, a USB port for receiving a connector of USB cable140, ofFIG. 1. Applications222may include a text editor for receiving security credentials for use to access certain functionalities of IHS100.

In operation, SDK utility160executes on service processor156to enable the service processor156to detect a connection of service device141to an input/output interface of IHS100, such as SP USB port127. Service device141connects to SP USB port127via a cable, such as USB cable140. The direct connection of USB cable140to SP USB port127triggers service processor to initiate a request to modify certain functionalities of IHS100. In one embodiment, service processor156receives an identification input concurrently with detecting the direct connection to SP USB port127. The identification input can be a hardware trigger, for example, an input of a key, a biometric input, a hardware button selection, or a combination thereof, that is connected to IHS100. The identification input helps identify a level of security to implement when generating security credentials for access to IHS100. For example, in response to a hardware button being engaged for a predetermined amount of time, a user receives a first level of access to IHS100. In response to a certain biometric input, a user receives a second level of access to IHS100. In response to a combination of hardware buttons and/or biometric input, the user is provided a third level of access to IHS100.

Service processor156detects the connection and receives the identification input via the connection. Service processor156interprets/identifies the connection as a request by service device141to modify at least one secure functionality associated with IHS100. In response to receiving the identification input, credentials generator162, of SDK utility160, maps the identification input to a predetermined level of security. SDK utility160generates security credentials that correspond to a predetermined level of security that is assigned to the identification input. The generated security credentials can be a global unique identification number (GUID), a user name and password, or a combination of the GUID and the username/password. In one embodiment, credentials generator162generates security credentials based on an identified problem that is associated with IHS100. For example, service processor156identifies that the BIOS settings are due for a reconfiguration/updates. Therefore, service processor156prompts credentials generator162to generate security credentials that enable modification of the BIOS settings.

Initially, SDK utility160triggers service processor156to establish a secure unidirectional communication link as a secure connection to service device141. The unidirectional communication link enables writes to be communicated to service device141via USB cable140, while preventing writes from service device141. Service processor156connects digitally generated keyboard128to service device141. Service processor156transmits digitally generated keyboard128to service device141via USB cable140. A storage device of service device141temporarily stores digitally generated keyboard128. Digitally generated keyboard128is graphically output to a display of service device141as a human interface device (HID) keyboard. However, instead of digitally generated keyboard128receiving human input (or input from the second device), digitally generated keyboard128receives unidirectional input from service processor156. Service processor156autonomously inputs the security credentials generated by credentials generator162to digitally generated keyboard128. A write operation inputs the security credentials directly to digitally generated keyboard128. In response to transmission of the security credentials, service processor156signals to digitally generated keyboard128to write the security credentials to an open text editor of service device141. The open text editor of service device141receives the security credentials for use by an operator to unlock access to certain functionalities of IHS100. Service processor156disconnects digitally generated keyboard128. The operator of service device141writes the security credentials to CLI/GUI208of service processor156to gain access to one or more functions of IHS100. The level of access obtained is based in part on a predetermined level of security associated with the particular security credentials. Based on the predetermined level of security, service processor156enables management by service device141of certain functionalities of IHS100.

In one or more embodiments, access to service processor156can be denied. For example, in response to the identification input being unrecognizable and/or unauthorized, access to service processor156is denied. In another example, in response to service processor156recognizing an attempt to override digitally generated keyboard128, access to service processor156is invalidated. As a third example, if the wrong security credentials are input to CLI/GUI208, access to service processor156is invalidated. As a fourth example, in response to service processor156identifying malware and/or a malicious application/software on service device141, access to service processor156is invalidated.

To access and/or manage certain functionalities of IHS100, service device141has to receive authorization from service processor156. Access to IHS100and/or functions thereof via service processor156is important because functionalities of IHS100can be inoperative or operating improperly. Further, direct access to service IHS100via service processor156minimizes a chance of a security breach of IHS100. The write operation of the security credentials to digitally generated keyboard128is advantageous because service processor156does not have to rely on service device141having any particular software to receive the security credentials. Further, by inputting the security credentials to digitally generated keyboard128, service processor156is writing to a known device. Additionally, with the present implementation, the security credentials do not have to be verbally transferred and/or physically transferred to the onsite service operator/provider. Also, the owner/manager of IHS100is also not required to keep track of yet another password/security credentials to provide to an onsite service operator.

FIG. 3Aillustrates an example IHS service environment300having information handling system301with an information screen (304) communicatively coupled to a second device (341), according to one or more embodiments. IHS service environment300also includes digitally generated keyboard328. IHS301is configured identically to IHS100. Herein, components associated with IHS100will be referenced to as components of IHS301. IHS301includes hardware input302, information screen304, and input/output device interfaces, micro USB port306and USB port308. IHS301is similar in components and functionality to IHS100and connects to service device341via USB cable340.FIG. 3Billustrates text editor350for displaying information352associated with IHS100.

Information screen304of IHS301can output current status of hardware/software, internet protocol (IP) address, and/or media access control (MAC) address associated with IHS301. Output display304displays status, inoperative functions, suggested updates, or other information associated with IHS301. In one embodiment, the predetermined level of security is based on the hardware/software status displayed on output display304. Accordingly, service processor156generates security credentials based on the status of IHS100, as displayed on output display304. For example, the information of output display304reads “BIOS update required”. Service processor156detects a connection of service device141to SP USB port127and identification input. Responsively, service processor156generates security credentials that correspond to managing the BIOS update.

In one embodiment, IHS301authenticates identification input received at hardware input302. In response to authenticating identification input, service processor156engenders digitally generated keyboard128as a functional component of IHS301. USB cable connects to IHS301at micro USB port306or USB port308. Service processor156forms a secure communication link via USB cable340by providing a unidirectional write path to service device341. In one embodiment, service processor establishes a secure digital handshake between service processor156and service device341as a prerequisite to communicatively connecting digitally generated keyboard328to service device341. Digitally generated keyboard328emulates a hardwired keyboard connected to service processor156via USB cable340. Service processor156outputs digitally generated keyboard328to a display of service device341.

According to one aspect, digitally generated keyboard128is solely accessible for input by service processor156. In one embodiment, service processor156generates security credentials associated with accessing certain functionalities of IHS301, and service processor156generates temporary security credentials to digitally generated keyboard328. Service processor156detects an open text editor at service device341. Open text editor can be text editor350ofFIG. 3B, for example. Service processor156establishes communication between digitally generated keyboard128and open text editor350on service device341, and service processor156enables digitally generated keyboard128to write the security credentials to open text editor350. In response to digitally generated keyboard128completing the write of the security credentials to the open text editor, service processor156disconnects digitally generated keyboard128from service device341.

In one embodiment, a user or operator of service device341utilizes the security credentials to access certain functionalities of IHS301. Service processor156enables selection of the security credentials from the open text editor350to input to a software interface that is associated with service processor156. The software interface is, for example, a select network interface that is specific to service processor156. In one embodiment, service processor156can utilize an interface that is not shared with the host operating system and routes the management of certain operations to a separate physical network. The rerouting of the operations to a separate physical network can be beneficial to the institution being serviced, as the management of the certain operations do not impede daily functionalities of the existing, daily utilized network. This rerouting is specifically beneficial when IHS301is active as a host machine to multiple virtual machines and/or hypervisors. Based on the provided security credentials, the select network interface that is specific to service processor156can enable commands that allow the service operator to perform certain functionalities that include, without limitation: view managed system information; perform power operations on the managed system; perform firmware updates; and/or configure settings. Responsively, service processor156invokes the system changes that correspond to the changes presented by service device341.

FIG. 4Aillustrates an example IHS service environment400having IHS (401) that does not include an information screen. IHS401is communicatively coupled to a second device (441), according to one or more embodiments. IHS service environment400includes IHS401, service device441, and digitally generated keyboard428. IHS401includes hardware input402and input/output device interfaces, micro USB port406and USB port408. IHS401is similar in components and functionality to IHS100and connects to service device441via USB cable440.FIG. 4Billustrates an example writeable text editor450, according to one or more embodiments.

In IHS service environment400, the operations and components of IHS401and service device441are substantially similar to the functionalities of IHS301and service device341within IHS service environment300. In one embodiment IHS401does not have an output display for providing the current status of hardware, IP address, MAC address, etc. In response to not detecting a writeable text editor at service device441, service processor156generates a prompt to service device441to open writeable text editor450. Service processor156outputs the prompt to service device441. Service processor156retrieves, from a command-line interface, information452associated with IHS401, and selectively outputs information452to writeable text editor450. Enabling service processor156to write information to writeable text editor450is an added advantage. Using writeable text editor450, IHS devices that do not include output displays can provide useable information about IHS401, and functions thereof, to a service provider during service operations. The information provided can also be beneficial in notifying the service operator of the level of security access granted. In this way, the service operator can prepare the proper updates and changes to settings for the IHS device.

FIGS. 5, 6, and 7illustrate flowcharts of an exemplary method500,600, and700by which service processor156(FIG. 1) performs different aspects of the processes that enable the one or more embodiments of the disclosure. Generally, methods500,600, and700represent computer-implemented methods. The description of methods500,600and700are provided with general reference to the specific components illustrated withinFIGS. 1-4.

FIG. 5illustrates a flow chart of a method500for generating a digital keyboard and provisioning security credentials to the digital keyboard, according to one or more embodiments. Method500is performed when SDK utility160is executed by service processor156. Method500begins at the start block and includes detecting, by a service processor, connection of a second device at an input/output interface of the IHS100(block502). Service processor156receives a request to modify at least one secure functionality associated with the IHS100, the request including an identification input (block504). A determination is made whether the identification input is authentic, i.e., is associated with a user/device that is permitted to modify or update certain functions of IHS (decision block506). In response to the identification input being authentic, service processor156generates security credentials that correspond to a predetermined level of security that is displayed on IHS301(block508). SDK utility160triggers service processor156to establish a secure communication link to the second device (service device141). The secure communication link is used to communicatively connect digitally generated keyboard128for unidirectional input by the service processor156(block510). Service processor156autonomously inputs the security credentials to digitally generated keyboard128(block512). Service processor156triggers digitally generated keyboard128to write the security credentials to an open text editor of the second device (service device141) for use to unlock access to IHS100. Service processor156generates the security credentials according to the predetermined level of security (block514). Based on the predetermined level of security, service processor156enables management by the second device (service device141) of certain functionalities of IHS100(block516). The process concludes at the end block.

FIG. 6illustrates a flow chart of a method600for providing the digital keyboard to a second device, according to one or more embodiments. Method600is performed by execution of SDK utility160by service processor156. Service processor156engenders the digitally generated keyboard as a functional component of service processor156(block602). Utilizing the secure communication link, service processor156establishes a secure digital handshake with the second device (141) as a prerequisite to communicatively connect the digitally generated keyboard to the second device (block604). Service processor156determines whether a secure digital handshake is detected (decision block606). In response to service processor156detecting a secure digital handshake, service processor156outputs a digitally generated keyboard to a display of the second device (608). In response to service processor156not detecting a secure digital handshake, the method ends. Service processor156establishes communication between the digitally generated keyboard and an open text editor (350) on the second device (141) (block610). Service processor156detects completion of the write of the security credentials to the open/writeable text editor (350) (block612). Service processor156disconnects the digitally generated keyboard from the second device (141) (block614). The method concludes at the end block.

FIG. 7illustrates a flow chart of a method700for generating security credentials to access the IHS, according to one or more embodiments. Method700is performed by SDK utility160executing on service processor156, and in part by credential generator162being executed by service processor156. Method700begins at the start block and includes receiving a signal indicating a hardware connection to a specified input/output interface (127) of IHS100. The specified input/output interface (127) enables direct access to service processor156(702). A determination is made whether service processor156detects an authentic identification input (decision block704). In response to not detecting authentic input, the method concludes at the end block. In response to detecting authentic identification input, service processor156determines the predetermined level of security assigned to the identification input. A determination is made whether the predetermined level of security is a “security level A” (decision block706). In response to the predetermined level of security being security level A, service processor156generates security credentials for level A access (block710). In response to the predetermined level not being security being “security level A”, a determination is made whether the security level assigned to the identification input is a “security level B” (decision block708). In response to the predetermined level of security not being security level B, the process ends. In response to the predetermined level of security being security level B, service processor156generates security credentials for level B access (block712). Service processor156forwards the security credentials to the requesting device (block714). Service processor156enables access to manage certain functionalities of IHS100(block716) based on the level of security access. Service processor156invokes system changes to IHS100that correspond to management of the certain functionalities (block718). The method concludes at the end block.

In the above described flow charts ofFIGS. 5, 6 and 7, one or more of the methods may be embodied in a controller that performs a series of functional processes. In some implementations, certain steps of the methods are combined, performed simultaneously or in a different order, or perhaps omitted, without deviating from the scope of the disclosure. Thus, while the method blocks are described and illustrated in a particular sequence, use of a specific sequence of functional processes represented by the blocks is not meant to imply any limitations on the disclosure. Changes may be made with regards to the sequence of processes without departing from the scope of the present disclosure. Use of a particular sequence is therefore, not to be taken in a limiting sense, and the scope of the present disclosure is defined only by the appended claims.

One or more of the embodiments of the disclosure described can be implementable, at least in part, using a software-controlled programmable processing device, such as a microprocessor, digital signal processor or other processing device, data processing apparatus or system. Thus, it is appreciated that a computer program for configuring a programmable device, apparatus or system to implement the foregoing described methods is envisaged as an aspect of the present disclosure. The computer program may be embodied as source code or undergo compilation for implementation on a processing device, apparatus, or system. Suitably, the computer program is stored on a carrier device in machine or device readable form, for example in solid-state memory, magnetic memory such as disk or tape, optically or magneto-optically readable memory such as compact disk or digital versatile disk, flash memory, etc. The processing device, apparatus or system utilizes the program or a part thereof to configure the processing device, apparatus, or system for operation.