Eviden (BullSequana SH) — High-performance computing
Strengthening HPC Platform Integrity with ProvenCore
The question we could never answer with code review alone was what happens on the next controller generation. Formal verification turned that into a property we carry forward, rather than an argument we have to rebuild every time the hardware moves.
Key outcome
A Formally Verified Root of Trust for Mission-Critical Workloads
The management controller is the one component that outlives every other piece of firmware on a supercomputing node — and the one an attacker most wants. Moving its trust decisions into a formally verified kernel makes platform integrity a property of the design rather than of the review process.
The challenge
Stringent Assurance Requirements Across Evolving Hardware
Hardening a controller by review scales with the size of the codebase, and the codebase kept growing. Each new controller generation reopened questions the previous review had already answered, because nothing in the architecture prevented untrusted code from reaching the parts that mattered.
What was needed was a boundary that held by construction across hardware revisions, rather than an audit repeated per generation.
The solution
ProvenCore as the Security Foundation
ProvenCore isolates the security-critical elements of the BMC from untrusted code paths, so the verified secure-boot chain and firmware integrity checks run in a minimal, mathematically proven environment rather than alongside the full OpenBMC stack.
The results
Measurable Gains Across Platform Generations
The isolation boundary now carries forward unchanged from one hardware revision to the next, so each generation inherits the previous evaluation instead of restarting it. Signed updates and anti-rollback protection sit inside that boundary rather than beside it.
The practical gain is schedule: security sign-off stopped being the step that decided when a platform generation could ship.
Security sign-off used to be the step that decided when a platform generation could ship. It is not any more.
