Leveraging SPDM for Secure In-Band and Out-of-Band Communication in Data Center Platforms

Data centers of our modern era are repositories of enormous ecosystems of related hardware and software which engage in exchange of control, management, and telemetry information always. The responsibility of end-to-end trust in such communication paths is very important with increasing number of devices, firmware modules and interfaces. Old-fashioned security systems tend to be independent and not based on a common trust system and thus there are often weak points that can be used by spoofing, malicious firmware injection or tampering. This paper will discuss how the Data Model and Security Protocol (SPDM) which is established by the DMTF can be integrated to develop a unified security architecture of both in-band and out-of-band communication channels. This method provides a secure device identity validation, message confidentiality, and integrity assurance by enabling PCIe devices, Baseboard Management Controllers (BMCs) and CPUs to perform authentication and encryption of the device identities, message confidentiality, and integrity respectively. Experimental findings about a prototype on multi-node demonstrate that SPDM is able to improve platform trust without significantly affecting performance. This paper shows that SPDM is capable of being a scalable, hardware-based framework of security of next-generation data centers.