SYSTEM AND METHOD FOR DATA CENTER SECURITY ENHANCEMENTS LEVERAGING MANAGED SERVER SOCs

• US 20120297043A1
• Filed: 05/18/2012
• Published: 11/22/2012
• Est. Priority Date: 10/30/2009
• Status: Active Grant

• Current Assignee: Calxeda Inc.
• Original Assignee: Calxeda Inc.
• Inventors: Davis, Mark, Borland, David, Hobbs, Jason, Marquette, Danny, Volpe, Tom, Goss, Ken
• Granted Patent: US 9,077,654 B2
• Time in Patent Office: Days
• US Class Current: 709/223
• CPC Class Codes: H04L 41/28 Restricting access to network management systems or functions, e.g. using authorisation function to access network configuration
• CPC Class Codes: H04L 45/60 Router architectures
• CPC Class Codes: H04L 45/74 Address processing for routing
• CPC Class Codes: H04L 49/109 Integrated on microchip, e.g. switch-on-chip
• CPC Class Codes: H04L 49/3009 Header conversion, routing tables or routing tags
• CPC Class Codes: H04L 49/351 for local area network [LAN], e.g. Ethernet switches
• CPC Class Codes: H04L 49/356 for storage area networks
• CPC Class Codes: H04L 63/0209 Architectural arrangements, e.g. perimeter networks or demilitarized zones
• CPC Class Codes: H04L 63/0236 Filtering by address, protocol, port number or service, e.g. IP-address or URL
• CPC Class Codes: H04L 63/1416 Event detection, e.g. attack signature detection
• CPC Class Codes: H04L 63/1433 Vulnerability analysis
• CPC Class Codes: H04L 63/20 for managing network security; network security policies in general filtering policies H04L63/0227

Abstract

A data center security system and method are provided that leverage server systems on a chip (SOCs) and/or server fabrics. In more detail, server interconnect fabrics may be leveraged and extended to dramatically improve security within a data center.

Claims

1. A method for secure communication in a data center using a server fabric with a plurality of nodes, the method comprising:

interconnecting the plurality of nodes using a plurality of links that interconnect each of the plurality of nodes to each other;

connecting at least one port to the plurality of nodes and to a network switch; and

providing a management domain in each node having a management processor core wherein the management domain is secure.

2. The method of claim 1 further comprising providing a memory associated with each node and comparing, by the management processor cores in the nodes, portions of memory associated with each node.

3. The method of claim 1 further comprising providing a memory associated with each node and capturing, by the management processor core, a live memory image of the node.

4. The method of claim 1 further comprising providing a second domain having an application processor, and performing, by the management processor core, application approval for the application processor.

5. The method of claim 1 further comprising isolating, by the management processor core, another node that'"'"'s security has been compromised or has failed.

6. The method of claim 1 further comprising providing a second domain having an application processor, and performing, by the management processor core, device virtualization for the application processor.

7. The method of claim 1 further comprising providing a second domain having an application processor, and performing, by the management processor core, secure logging.

8. The method of claim 7, wherein the secure logging is one of a log stored in a log server over a secure communication link, a log stored in storage in the management domain and a log to store not accessible by the application processor.

9. The method of claim 1 further comprising providing a second domain having an application processor, and performing, by the management processor core, secure auditing.

10. The method of claim 1 further comprising providing a second domain having an application processor, and performing, by the management processor core, NAT routing for the application processor.

11. The method of claim 1 further comprising providing a security zone register in the management domain for a direct memory access master and operating the direct memory access master in the security zone.

12. The method of claim 1 further comprising providing a second domain having an application processor, and performing, by the management processor core, a secure boot-loading of the application processor.

13. The method of claim 1 further comprising monitoring, by the management processor core, a rate of data packets through the node.

14. The method of claim 1 further comprising providing a network manager unit that manages the plurality of nodes and configuring, by the network manager unit, a topology of the plurality of links.

15. The method of claim 1 further comprising providing at least one node that has a management domain having a management processor core and performing, by the management processor core, packet processing.

16. The method of claim 15, wherein the packet processing is one of intrusion detection, intrusion prevention, sFlow monitoring, packet routing, deep packet inspection, packet logging, transparent virtual private network encapsulation, packet encryption and decryption, packet compression and decompression and IP reputation.

17. The method of claim 1 further comprising dynamically configuring a direct memory access unit to be one of coherent and non-coherent.

18. The method of claim 17 further comprising mapping, using a multiplexer, the direct memory access unit to a cache coherency controller when the direct memory access unit is configured to be coherent and mapping, using the multiplexer, the direct memory access unit to a memory system when the direct memory access unit is configured to be non-coherent.

19. The method of claim 17 further, wherein dynamically configuring a direct memory access unit further comprises controlling, using a register, the dynamic configuration of the direct memory access unit.

20. A system for a data center, comprising:

a plurality of nodes;

a plurality of links that interconnect each of the plurality of nodes to each other;

at least one port connected to the plurality of nodes and to a network switch; and

wherein each node has a management domain having a management processor core wherein the management domain is secure.

21. The system of claim 20 further comprising memory associated with each node and the management processor cores in the nodes compare portions of memory associated with each node.

22. The system of claim 20 further comprising memory associated with each node and the management processor core captures a live memory image of the node.

23. The system of claim 20 further comprising a second domain having an application processor and wherein the management processor core performs application approval for the application processor.

24. The system of claim 20 further comprising a second domain having an application processor and wherein the management processor core isolates another node that is one of compromised security and has failed.

25. The system of claim 20 further comprising a second domain having an application processor and wherein the management processor core performs device virtualization for the application processor.

26. The system of claim 20 further comprising a second domain having an application processor and wherein the management processor core performs secure logging.

27. The system of claim 26, wherein the secure logging is one of a log stored in a log server over a secure communication link, a log stored in storage in the management domain and a log to store not accessible by the application processor.

28. The system of claim 20, wherein the management processor core performs secure auditing.

29. The system of claim 20 further comprising a second domain having an application processor and wherein the management processor core performs NAT routing for the application processor.

30. The system of claim 20, wherein the management domain further comprises a security zone register for a direct memory access master and the direct memory access master that operates in the security zone.

31. The system of claim 20 further comprising a second domain having an application processor wherein the management processor securely boot-loads of the application processor.

32. The system of claim 20, wherein the management processor monitors a rate of data packets through the node.

33. The system of claim 20 further comprising a network manager unit that manages the plurality of nodes, wherein the network manager unit configures a topology of the plurality of links.

34. The system of claim 20, wherein the management processor performs packet processing.

35. The system of claim 34, wherein the packet processing is one of intrusion detection, intrusion prevention, sFlow monitoring, packet routing, deep packet inspection, packet logging, transparent virtual private network encapsulation, packet encryption and decryption, packet compression and decompression and IP reputation.

36. The system of claim 20 further comprising a direct memory access unit that is dynamically configured to be one of coherent and non-coherent.

37. The system of claim 36 further comprising a cache coherency unit and a multiplexer wherein the direct memory access unit is mapped to a port of the cache coherency unit when the direct memory access unit is configured to be coherent and the direct memory access unit is mapped to a port of a memory system when the direct memory access unit is configured to be non-coherent.

38. The system of claim 37, wherein the multiplexer has a register that controls the dynamic configuration of the direct memory access unit.