BaselineWatch
Desk
Your fleet and your work Fleetyour releases and the hardware they run onTriagewhat needs a decisionWatchlistthe products and platforms you runSaved searchesthe lists you come back to
This instance Sourceswhat is read, how often, under what termsDigestthe daily or weekly summary, and alerts
How it is drawn Appearancethe look and the colour schemeBrandingthe mark this instance wears
Owner sign-in

5.1 Service Processor as a Root of Trust

NIST platform security: roots of trust, firmware and secure enclaves SP 800-147B
All changes in this version
first version loaded 5 The RTU ensures that the BIOS flash memory is locked prior to transferring control to code part of 5

Title

Service Processor as a Root of Trust

Control

Service Processors in managed and blade servers might have the ability to directly update the BIOS flash memory, the BIOS execution memory, or their own flash or other storage media. In these cases, some or all of the Service Processor environment may be employed as an RTU for the system BIOS. This applies to Service Processors that are capable of updating BIOS flash on systems that use BIOS flash protection mechanisms to prevent unauthorized modifications to BIOS code (e.g., those that employ update mechanism 1 or 2, as described in Section 4). It also applies to Service Processors that are capable of modifying the RTU used to verify BIOS code in systems that verify BIOS code prior to execution (e.g., those that employ update mechanism 3).

In these situations, the execution environment of the Service Processor (SP) must be protected from malicious code that could update the BIOS or the SP flash. To comply with the BIOS security principles in Section 3, Service Processors employed as a Root of Trust to protect BIOS shall meet the following guidelines: