System and method for data center security enhancements leveraging server SOCs or server fabrics

• US 10,050,970 B2
• Filed: 08/09/2017
• Issued: 08/14/2018
• Est. Priority Date: 10/30/2009
• Status: Active Grant

• Current Assignee: III Holdings 2, LLC (Intellectual Ventures LLC)
• Original Assignee: III Holdings 2, LLC (Intellectual Ventures LLC)
• Inventors: Davis, Mark, Borland, David, Hobbs, Jason, Marquette, Danny, Volpe, Thomas A., Goss, Ken
• Primary Examiner(s): Towfighi, Afshawn M
• Application Number:
  US15/672,418
• Publication Number:
  US 20170359347A1
• Time in Patent Office: 370 Days
• CPC Class Codes: H04L 41/046 comprising network management agents or mobile agents therefor
• CPC Class Codes: H04L 45/60 Router architectures
• CPC Class Codes: H04L 45/74 Address processing for routing
• CPC Class Codes: H04L 49/109 Integrated on microchip, e.g. switch-on-chip
• CPC Class Codes: H04L 49/3009 Header conversion, routing tables or routing tags
• CPC Class Codes: H04L 49/351 for local area network [LAN], e.g. Ethernet switches
• CPC Class Codes: H04L 49/356 for storage area networks
• CPC Class Codes: H04L 63/10 for controlling access to devices or network resources
• CPC Class Codes: H04L 63/164 at the network layer
• CPC Class Codes: H04L 67/60 Scheduling or organising the servicing of application requests, e.g. requests for application data transmissions using the analysis and optimisation of the required network resources admission control or resource allocation H04L47/70

Abstract

A data center security system and method are provided that leverage server systems on a chip (SOCs) and/or server fabrics. In more detail, server interconnect fabrics may be leveraged and extended to dramatically improve security within a data center.

Claims

1. A system comprising:

a routing header unit configured to set a management domain bit in a routing header of one or more frames, wherein the management domain bit comprises an identifier that indicates a particular network domain for which the routing header unit belongs and indicates access to a management domain; and

a fabric switch connected to the routing header unit and to a plurality of external ports, wherein the fabric switch is configured to perform packet processing based, at least in part, on the management domain bit.

2. The system of claim 1, further comprising a management processor configured to transmit the one or more frames.

3. The system of claim 2, wherein the management domain bit is set within the routing header unit.

4. The system of claim 3, further comprising assigning the particular network domain to zero.

5. The system of claim 2, wherein the management processor only accepts routing headers marked with the management domain bit.

6. The system of claim 2, wherein the application processors for nodes coupled to the fabric switch do not have the management domain bit set.

7. The system of claim 1, further comprising a media access control (MAC) unit connected to the fabric switch, wherein the MAC unit is configured to only accept frames having the management domain bit.

8. The system of claim 7, wherein the routing header unit is configured to prepend routing heads to packets generated by an associated MAC unit, and wherein the routing heads include the management domain identifier associated with the associated MAC unit.

9. The system of claim 7, further comprising another routing header unit associated with an outgoing MAC unit, wherein the other routing header unit is configured to tag and only accept frames having management domain bits that indicate the fabric domain of zero.

10. The system of claim 1, wherein the fabric switch is further configured to stop a packet that has been assigned a default domain identifier.

11. A method comprising:

interconnecting a plurality of nodes with a plurality of links to form a server fabric, wherein each of the plurality of nodes includes;

a routing header unit configured to set a management domain bit in a routing header of one or more frames, wherein the management domain bit comprises an identifier that indicates a particular network domain for which the routing header unit belongs and indicates access to a management domain; and

a fabric switch connected to the routing header unit and to a plurality of external ports, wherein the fabric switch is configured to perform packet processing based, at least in part, on the management domain bit;

generating data packets at a media access control (MAC) unit associated with a management processor; and

routing, by the fabric switch, the data packets in the server fabric based, at least in part, on the identifier.

12. The method of claim 11, wherein routing the data packets comprises routing the data packets to another MAC unit, and wherein the other MAC unit is configured to only accept data packets having a header with the management domain bit.

13. The method of claim 12, wherein the management domain bit further indicates a fabric domain, and wherein the MAC unit is assigned the fabric domain.

14. The method of claim 13, wherein the fabric domain is set to zero.

15. The method of claim 14, further comprising tagging and only accepting, by another routing header unit, frames having management domain bits that indicate the fabric domain of zero.

16. The method of claim 11, further comprising prepending, by the routing header unit, routing heads to the data packets, wherein the routing heads include the identifier associated with the MAC unit.

17. The method of claim 11, further comprising stopping, by the fabric switch, a packet that has been assigned a default domain identifier.

18. A device comprising:

a routing header unit configured to set a management domain bit in a routing header of one or more frames, wherein the management domain bit comprises an identifier that indicates a particular network domain for which the routing header unit belongs and indicates access to a management domain; and

a fabric switch connected to the routing header unit and to a plurality of external ports, wherein the fabric switch is configured to perform packet processing based, at least in part, on the management domain bit.

19. The device of claim 18, further comprising a media access control (MAC) unit connected to the fabric switch, and wherein the MAC unit is configured to only accept frames having the management domain bit.

20. The system of claim 18, wherein the management domain bit further indicates a fabric domain, and wherein the MAC unit is assigned the fabric domain.