Administrator Guide

Technical support and resources
ID 483
lockdown is not supported. These actions depend on the third party devices that are detected as part of the
iDRAC discovery process.
3.2.8 Domain Isolation
14th and 15th generation PowerEdge servers provide additional security using Domain Isolation, an important
feature for multitenant hosting environments. In order to secure the server hardware configuration, hosting
providers may want to block any reconfiguration by tenants. Domain isolation ensures that management
applications in the host operating system have no access to the out-of-band iDRAC. This isolation includes
Intel chipset functions, such as Management Engine (ME) or Innovation Engine (IE).
3.3 Signed Firmware Updates
PowerEdge servers have used digital signatures on firmware updates for several generations to assure that
only authentic firmware is running on the server platform. Dell EMC digitally signs all firmware packages using
SHA-256 hashing with 2048-bit RSA encryption for the signature for all key server components. These
components include firmware for iDRAC, BIOS, PowerEdge RAID Controller (PERC), I/O adapters and
LOMs, PSUs, storage drives, CPLD, and backplane controllers. iDRAC scans firmware updates and
compares their signatures to what is expected using the silicon-based Root of Trust. Any firmware package
that fails validation is aborted and an error message is logged into the Lifecycle Log (LCL) to alert IT
administrators.
Enhanced firmware authentication is embedded within many third-party devices which provide signature
validation using their own Root of Trust mechanisms. This authentication prevents the use of a compromised
third-party tool to load malicious firmware which bypasses the signed update package. Many of the third-party
PCIe and storage devices that are shipped with PowerEdge servers use a hardware Root of Trust to validate
their respective firmware updates.
If device firmware is suspected of malicious tampering, IT administrators can roll back the firmware images to
a prior trusted version stored in iDRAC. iDRAC keeps two versions of device firmware on the server – the
existing production version (“N”) and a prior trusted version (“N-1”).
3.4 Encrypted Data Storage
Encrypted data storage is built on the foundation of Signed Firmware Updates. The following diagram shows
the levels. The following sections discuss these levels.