OCP S.A.F.E. Program
- Project Leads
- Bryan Kelly, Jeff Andersen
The OCP Security Appraisal Framework and Enablement (S.A.F.E.) Program
Modern data centers are composed of a wide variety of processing devices (CPU, GPU, FPGA, etc.) and peripheral components (network controllers, accelerators, storage devices, etc.). These devices typically run updatable software, firmware or microcode, which can reside internally or externally to the device.
The provenance, code quality and software supply chain for firmware releases and patches that run on these devices requires a strong degree of security assurance.
Goals: The OCP S.A.F.E. Recognition Program is designed to address the challenges of currently faced by device vendors, end users and third party security review providers including:
- Reduce overhead and redundancy of security audits.
- Provide security conformance assurance to device consumers.
- Decrease competitive objections that prevent source code sharing for the purpose of robust independent security testing and the dissemination of findings and reports.
- Increase the number of devices whose firmware and associated updates are reviewed on a continuous basis.
- Through iterative refinement of review areas, testing scopes and reporting requirements, progressively advance the security posture of hardware and firmware components across the supply chain.
How to Participate
If you are a Device Vendor
Step 1
- Become an OCP Member and join the OCP Solution Provider Program
Step 2
- Review the Framework and Review Areas documentation.
- Choose from a list of approved OCP Security Review Providers (SRP's) to conduct a security conformance review
Step 3
- The device will be designated an OCP S.A.F.E. approved product and listed on the OCP Marketplace once the OCP SRP submits the security conformance report to the OCP (sample report link)
- The OCP will issue the appropriate OCP S.A.F.E. logos to use with the device
- Leverage the OCP go-to-market activities and begin promoting the device as OCP S.A.F.E.
If your company would like to become an OCP Security Review Provider (SRP) Solution Provider (i.e. third-party auditor):
Step 1
- Review the SRP Framework and Criteria documentation.
- Reach out to the OCP Community S.A.F.E. Project Leads to discuss submitting an SRP application.
Step 2
- OCP Foundation and Security Project Leads will review SRP Criteria Assessment
- Sign the relevant agreements and pay corresponding fees
- If approved, the SRP will be designated as an OCP S.A.F.E. SRP
Step 3
- SRP will be listed on the OCP Membership and Solution Provider (SP) Directories.
Scope
The Security Project will focus on the following:
- Standard hardware interface and protocols for ensuring boot code integrity
- Open-source firmware for dedicated security hardware
- Security firmware APIs and protocols
- Change of ownership of the IT gear (e.g., resale)
- Firmware Security provisioning methodologies
- Secure boot of firmware and operating system
- Recovery from a compromised or untrusted state
- Securing and verifying all mutable storage (flash for BIOS, BMC, microcontroller(s), CPLD, etc)
- Secure updates to mutable storage with versatile rollback-protection options