【已评审】新增导入固件加密密钥IPMI命令评审

评审背景:
下一代BMC芯片需要支持运行固件加密,需要在装备阶段导入对称密钥,BMC需提供导出非对称公钥(用于加密对称密钥)与导入对称密钥密文的IPMI接口

决策点一:
导出非对称公钥与导入固件加密密钥密文的IPMI接口形式

方案一:
复用文件动作(File Action)ipmi接口

IPMI命令字:netfn:30h,cmd:93h
变化类型:新增参数取值
应用场景:装备阶段调用接口导出非对称公钥,导入固件加密密钥
操作类型: SET
操作角色:Administrator
操作权限:ReadOnly


方案二:

  1. 新增导出非对称公钥IPMI命令
IPMI命令字:netfn:30h,cmd:93h
变化类型:新增参数取值
应用场景:装备阶段调用,导出非对称公钥操作类型: GET
操作角色:Administrator
操作权限:SecurityMgmt


  1. 新增导入固件加密密钥IPMI命令
IPMI命令字:netfn:30h,cmd:94h
变化类型:新增参数取值
应用场景:装备阶段调用,导入固件加密密钥
操作类型: SET
操作角色:Administrator
操作权限:SecurityMgmt

决策点二:
新增错误引擎接口说明:

错误引擎标识 变化类型 错误描述 错误信息 参数类型 处理建议 严重程度 HTTPCode IPMICode SNMPCode
KeyFormatError 新增 Indicates that the operation failed because the key is not in the correct format. The key operation failed because the key %1 is incorrect. string Resubmit the request with a correct key. Warning 400 0x85 5
KeyProcessError 新增 Indicates that an error occurred during the key processing. The operation cannot be properly processed due to errors at %1. string Resubmit the request. If the problem persists, consider resetting the service. Warning 500 0x86 5
KeyAlreadyExists 新增 Indicates that the operation failed because the key already exists and cannot overwrite. The key already exists. Do not repeat the operation as the key already exists. Warning 400 0x87 5

评审结论:
评审点一:
同意方案一:
1.复用文件操作ipmi接口,文件操作类型新增导出非对称密钥与导入对称密钥参数
2. 新增完成码:
0x85:密钥格式错误
0x86:密钥处理错误
0x87:密钥已存在

评审点二:

  1. 新增错误引擎说明:
    KeyProcessError表示内部错误
错误引擎标识 变化类型 错误描述 错误信息 参数类型 处理建议 严重程度 HTTPCode IPMICode SNMPCode
KeyFormatError 新增 Indicates that the operation failed because the key is not in the correct format. The key operation failed because the key %1 is incorrect. string Resubmit the request with a correct key. Warning 400 0x85 5
KeyProcessError 新增 Indicates that an error occurred during the key processing. The operation cannot be properly processed due to errors at %1. string Resubmit the request. If the problem persists, consider resetting the service. Warning 500 0x86 5
KeyAlreadyExists 新增 Indicates that the operation failed because the key already exists and cannot overwrite. The key already exists. Do not repeat the operation as the key already exists. Warning 400 0x87 5