UNAUTHORIZED ACCESS AND/OR INSTRUCTION PREVENTION, DETECTION, AND/OR REMEDIATION, AT LEAST IN PART, BY STORAGE PROCESSOR

• US 20140109170A1
• Filed: 10/17/2012
• Published: 04/17/2014
• Est. Priority Date: 10/17/2012
• Status: Active Grant

• Current Assignee: Intel Corporation
• Original Assignee: Intel Corporation
• Inventors: Nemiroff, Daniel, Thadikaran, Paul J., Saxena, Paritosh, Triantafillou, Nicholas D., Gafken, Andrew H.
• Granted Patent: US 9,158,916 B2
• Time in Patent Office: Days
• US Class Current: 726/1
• CPC Class Codes: G06F 21/55 Detecting local intrusion or implementing counter-measures
• CPC Class Codes: G06F 21/554 involving event detection and direct action
• CPC Class Codes: G06F 21/568 eliminating virus, restoring damaged files
• CPC Class Codes: G06F 21/78 to assure secure storage of data address-based protection against unauthorised use of memory G06F12/14; record carriers for use with machines and with at least a part designed to carry digital markings G06K19/00

Abstract

An embodiment may include a storage processor that may be comprised, at least in part, in a host. The host may include at least one host central processing unit (CPU) to execute at least one host operating system (OS). The storage processor may execute at least one operation in isolation from interference from and control by the at least one host CPU and the at least one host OS. The at least one operation may facilitate, at least in part: (1) prevention, at least in part, of unauthorized access to storage, (2) prevention, at least in part, of execution by the at least one host CPU of at least one unauthorized instruction, (3) detection, at least in part, of the at least one unauthorized instruction, and/or (4) remediation, at least in part, of at least one condition associated, at least in part, with the at least unauthorized instruction.

Claims

1-27. -27. (canceled)

28. An apparatus comprising:

a storage processor to be comprised, at least in part, in a host, the host including at least one host central processing unit (CPU) to execute at least one host operating system (OS), the storage processor to execute at least one operation in isolation from interference from and control by the at least one host CPU and the at least one host OS, the at least one operation being to facilitate, at least in part, one or more of the following;

prevention, at least in part, of unauthorized access to storage;

prevention, at least in part, of execution by the at least one host CPU of at least one unauthorized instruction;

detection, at least in part, of the at least one unauthorized instruction; and

remediation, at least in part, of at least one condition associated, at least in part, with the at least unauthorized instruction.

29. The apparatus of claim 28, wherein:

the host also comprises a circuit board that comprises the at least one host CPU and host system memory in which the at least one host OS is to reside;

a circuit card comprises the storage processor;

the circuit card is to be coupled to the circuit board;

the storage processor comprises an embedded controller, a network interface, and local memory; and

the embedded controller is to execute one or more instructions stored in the local memory that result, at least in part, in the embedded controller communicating with another host via the network interface to facilitate, at least in part, the at least one operation, the communicating being in a manner that is isolated from host CPU network traffic and host OS traffic.

30. The apparatus of claim 28, wherein:

the at least one operation comprises examining, at least in part, contents of memory of the host to detect, at least in part, the at least one unauthorized instruction;

the contents comprises, at least in part, the at least one host OS and basic input/output system (BIOS) settings.

31. The apparatus of claim 28, wherein:

the storage processor is to intercept attempted access by the at least one host CPU and the at least one host OS to and from the storage;

the storage processor is to establish at least one portion of the storage that is hidden from and inaccessible to both the at least one host CPU and the at least one host OS, the at least one portion being to store information to facilitate, at least in part, the at least one operation.

32. The apparatus of claim 28, wherein:

the storage processor is to establish, at least in part, at least one secure communication channel with an agent, the at least one secure communication channel being to permit trusted command and data exchange to be carried out between the agent and the storage processor, the exchange being related to at least one storage operation to be carried out, at least in part, by the storage.

33. The apparatus of claim 28, wherein:

in response, at least in part, to detection by the storage processor of at least one corrupted partition of the storage, the storage processor is to;

perform at least one network download of at least one current OS recovery image to update at least one previously stored OS recovery image;

establish a boot device based at least in part upon the at least one current OS recovery image; and

issue one or more commands that result in the at least one host CPU rebooting the host based at least in part upon the boot device and the at least one current OS recovery image;

in response, at least in part, to the rebooting, the at least one current OS recovery image is to;

mount, at least in part, the at least one corrupted partition as secondary storage;

determine, at least in part, and remedy, at least in part, at least one source of corruption of the at least one corrupted partition; and

obtain, via at least one other network download, information to facilitate, at least in part, recovery of user data from the at least one corrupted partition.

34. The apparatus of claim 28, wherein:

the storage processor is to intercept and store, at least temporarily, at least one storage access request from least one of the at least one host CPU and the at least one host OS; and

after the at least one storage access request has been stored at least temporarily, the storage processor is to examine, at least in part, the at least one storage access request to make a determination whether to permit the at least one storage access request to proceed to be executed, the determination being based at least in part upon whether the at least one storage access request is associated, at least in part, with;

at least one currently locked address; and

an unauthorized requesting entity.

35. The apparatus of claim 28, wherein:

the storage comprises a host protected area (HPA) region;

in response, at least in part, to an indication that the storage is idle and in a relatively higher power state, the storage processor is to;

issue one or more HPA commands that result, at least in part, in unlocking of the region to permit the storage processor to access the region, and after the storage processor has accessed the region, also result, at least in part, in locking of the region;

determine whether any files in the region are corrupted;

if one or more files in the region are corrupted,

inform a software agent of the one or more files to permit the software agent to request exclusive file lock to prevent host input/output (I/O) directed to the one or more files;

unlock the region;

remedy corruption of the one or more files; and

relock the region;

permit the storage to enter the relatively lower power state, the relatively lower power state being relatively lower than the relatively higher power state.

36. The apparatus of claim 28, wherein:

the storage processor is to execute a firmware agent that is to periodically determine, based at least in part upon one or more policies stored at least in part in one or more secure locations of the storage, whether to examine, at least in part, one or more files in the storage for possible corruption;

if the firmware agent determines that the one or more files are to be examined, at least in part;

at least one embedded process in the storage processor is to issue at least one read request to at least one block of the storage, the at least one block corresponding, at least in part, to the one or more files; and

the firmware agent is to examine, at least in part, the one or more files for the possible corruption; and

if the firmware agent determines, at least in part, that the corruption is present, at least in part, in the one or more files;

the firmware agent is to lock at least one address range associated with the one or more files to prevent the at least one host CPU and the at least one host 0/S from accessing the one or more files;

the firmware agent is to remedy the corruption by overwriting, at least in part, the one or more files in the storage; and

after remedying the corruption, the firmware agent is to unlock the at least one address range.

37. A method comprising:

executing, at least in part, by a storage processor at least one operation, the storage processor to be comprised, at least in part, in a host, the host including at least one host central processing unit (CPU) to execute at least one host operating system (OS), the at least one operation being executed, at least in part, in isolation from interference from and control by the at least one host CPU and the at least one host OS, the at least one operation being to facilitate, at least in part, one or more of the following;

prevention, at least in part, of unauthorized access to storage;

prevention, at least in part, of execution by the at least one host CPU of at least one unauthorized instruction;

detection, at least in part, of the at least one unauthorized instruction; and

remediation, at least in part, of at least one condition associated, at least in part, with the at least unauthorized instruction.

38. The method of claim 37, wherein:

the host also comprises a circuit board that comprises the at least one host CPU and host system memory in which the at least one host OS is to reside;

a circuit card comprises the storage processor;

the circuit card is to be coupled to the circuit board;

the storage processor comprises an embedded controller, a network interface, and local memory; and

the embedded controller is to execute one or more instructions stored in the local memory that result, at least in part, in the embedded controller communicating with another host via the network interface to facilitate, at least in part, the at least one operation, the communicating being in a manner that is isolated from host CPU network traffic and host OS traffic.

39. The method of claim 37, wherein:

the at least one operation comprises examining, at least in part, contents of memory of the host to detect, at least in part, the at least one unauthorized instruction;

the contents comprises, at least in part, the at least one host OS and basic input/output system (BIOS) settings.

40. The method of claim 37, wherein:

the storage processor is to intercept attempted access by the at least one host CPU and the at least one host OS to and from the storage;

the storage processor is to establish at least one portion of the storage that is hidden from and inaccessible to both the at least one host CPU and the at least one host OS, the at least one portion being to store information to facilitate, at least in part, the at least one operation.

41. The method of claim 37, wherein:

the storage processor is to establish, at least in part, at least one secure communication channel with an agent, the at least one secure communication channel being to permit trusted command and data exchange to be carried out between the agent and the storage processor, the exchange being related to at least one storage operation to be carried out, at least in part, by the storage.

42. The method of claim 37, wherein:

in response, at least in part, to detection by the storage processor of at least one corrupted partition of the storage, the storage processor is to;

perform at least one network download of at least one current OS recovery image to update at least one previously stored OS recovery image;

establish a boot device based at least in part upon the at least one current OS recovery image; and

issue one or more commands that result in the at least one host CPU rebooting the host based at least in part upon the boot device and the at least one current OS recovery image;

in response, at least in part, to the rebooting, the at least one current OS recovery image is to;

mount, at least in part, the at least one corrupted partition as secondary storage;

determine, at least in part, and remedy, at least in part, at least one source of corruption of the at least one corrupted partition; and

obtain, via at least one other network download, information to facilitate, at least in part, recovery of user data from the at least one corrupted partition.

43. The method of claim 37, wherein:

the storage processor is to intercept and store, at least temporarily, at least one storage access request from least one of the at least one host CPU and the at least one host OS; and

after the at least one storage access request has been stored at least temporarily, the storage processor is to examine, at least in part, the at least one storage access request to make a determination whether to permit the at least one storage access request to proceed to be executed, the determination being based at least in part upon whether the at least one storage access request is associated, at least in part, with;

at least one currently locked address; and

an unauthorized requesting entity.

44. Computer-readable memory storing one or more instructions that when executed by a machine result in performance of operations comprising:

executing, at least in part, by a storage processor at least one operation, the storage processor to be comprised, at least in part, in a host, the host including at least one host central processing unit (CPU) to execute at least one host operating system (OS), the at least one operation being executed, at least in part, in isolation from interference from and control by the at least one host CPU and the at least one host OS, the at least one operation being to facilitate, at least in part, one or more of the following;

prevention, at least in part, of unauthorized access to storage;

prevention, at least in part, of execution by the at least one host CPU of at least one unauthorized instruction;

detection, at least in part, of the at least one unauthorized instruction; and

remediation, at least in part, of at least one condition associated, at least in part, with the at least unauthorized instruction.

45. The computer-readable memory of claim 44, wherein:

the host also comprises a circuit board that comprises the at least one host CPU and host system memory in which the at least one host OS is to reside;

a circuit card comprises the storage processor;

the circuit card is to be coupled to the circuit board;

the storage processor comprises an embedded controller, a network interface, and local memory; and

the embedded controller is to execute one or more instructions stored in the local memory that result, at least in part, in the embedded controller communicating with another host via the network interface to facilitate, at least in part, the at least one operation, the communicating being in a manner that is isolated from host CPU network traffic and host OS traffic.

46. The computer-readable memory of claim 44, wherein:

the at least one operation comprises examining, at least in part, contents of memory of the host to detect, at least in part, the at least one unauthorized instruction;

the contents comprises, at least in part, the at least one host OS and basic input/output system (BIOS) settings.

47. The computer-readable memory of claim 44, wherein:

the storage processor is to intercept attempted access by the at least one host CPU and the at least one host OS to and from the storage;

the storage processor is to establish at least one portion of the storage that is hidden from and inaccessible to both the at least one host CPU and the at least one host OS, the at least one portion being to store information to facilitate, at least in part, the at least one operation.

48. The computer-readable memory of claim 44, wherein:

the storage processor is to establish, at least in part, at least one secure communication channel with an agent, the at least one secure communication channel being to permit trusted command and data exchange to be carried out between the agent and the storage processor, the exchange being related to at least one storage operation to be carried out, at least in part, by the storage.

49. The computer-readable memory of claim 44, wherein:

in response, at least in part, to detection by the storage processor of at least one corrupted partition of the storage, the storage processor is to;

perform at least one network download of at least one current OS recovery image to update at least one previously stored OS recovery image;

establish a boot device based at least in part upon the at least one current OS recovery image; and

issue one or more commands that result in the at least one host CPU rebooting the host based at least in part upon the boot device and the at least one current OS recovery image;

in response, at least in part, to the rebooting, the at least one current OS recovery image is to;

mount, at least in part, the at least one corrupted partition as secondary storage;

determine, at least in part, and remedy, at least in part, at least one source of corruption of the at least one corrupted partition; and

obtain, via at least one other network download, information to facilitate, at least in part, recovery of user data from the at least one corrupted partition.

50. The computer-readable memory of claim 44, wherein:

the storage processor is to intercept and store, at least temporarily, at least one storage access request from least one of the at least one host CPU and the at least one host OS; and

after the at least one storage access request has been stored at least temporarily, the storage processor is to examine, at least in part, the at least one storage access request to make a determination whether to permit the at least one storage access request to proceed to be executed, the determination being based at least in part upon whether the at least one storage access request is associated, at least in part, with;

at least one currently locked address; and

an unauthorized requesting entity.

51. The computer-readable memory of claim 44, wherein:

the storage comprises a host protected area (HPA) region;

in response, at least in part, to an indication that the storage is idle and in a relatively higher power state, the storage processor is to;

issue one or more HPA commands that result, at least in part, in unlocking of the region to permit the storage processor to access the region, and after the storage processor has accessed the region, also result, at least in part, in locking of the region;

determine whether any files in the region are corrupted;

if one or more files in the region are corrupted,

inform a software agent of the one or more files to permit the software agent to request exclusive file lock to prevent host input/output (I/O) directed to the one or more files;

unlock the region;

remedy corruption of the one or more files; and

relock the region;

permit the storage to enter a relatively lower power state, the relatively lower power state being relatively lower than the relatively higher power state.

52. The computer-readable memory of claim 44, wherein:

the storage processor is to execute a firmware agent that is to periodically determine, based at least in part upon one or more policies stored at least in part in one or more secure locations of the storage, whether to examine, at least in part, one or more files in the storage for possible corruption;

if the firmware agent determines that the one or more files are to be examined, at least in part;

at least one embedded process in the storage processor is to issue at least one read request to at least one block of the storage, the at least one block corresponding, at least in part, to the one or more files; and

the firmware agent is to examine, at least in part, the one or more files for the possible corruption; and

if the firmware agent determines, at least in part, that the corruption is present, at least in part, in the one or more files;

the firmware agent is to lock at least one address range associated with the one or more files to prevent the at least one host CPU and the at least one host 0/S from accessing the one or more files;

the firmware agent is to remedy the corruption by overwriting, at least in part, the one or more files in the storage; and

after remedying the corruption, the firmware agent is to unlock the at least one address range.