Apparatus, system, and method for deploying iSCSI parameters to a diskless computing device

• US 7,882,562 B2
• Filed: 12/15/2005
• Issued: 02/01/2011
• Est. Priority Date: 12/15/2005
• Status: Expired due to Fees

• Current Assignee: International Business Machines Corporation
• Original Assignee: International Business Machines Corporation
• Inventors: Vojnovich, Theodore Brian, Cors, Josep, Bolan, Joseph Edward, Arroyo, Jesse Paul, Dake, Gregory William, Holland, William Gavin, Dunham, Scott Neil, Brey, Thomas M.
• Primary Examiner(s): Dinh; Minh
• Application Number:
  US11/300,961
• Publication Number:
  US 20070143611A1
• Time in Patent Office: 1,874 Days
• Field of Search: None
• US Class Current: 726/26
• CPC Class Codes: G06F 3/0601 Interfaces specially adapted for storage systems
• CPC Class Codes: G06F 3/0673 Single storage device
• CPC Class Codes: H04L 63/0428 wherein the data content is protected, e.g. by encrypting or encapsulating the payload
• CPC Class Codes: H04L 63/06 for supporting key management in a packet data network cryptographic mechanisms or cryptographic arrangements for key management H04L9/08
• CPC Class Codes: H04L 63/08 for authentication of entities cryptographic mechanisms or cryptographic arrangements for entity authentication H04L9/32

Abstract

An apparatus, system, and method are disclosed for deploying sensitive communication parameters to a diskless computing device. A parameter structure module is included to store one or more Internet Small Computer System Interface (“iSCSI”) communication parameters in an extendable data structure configured to store a set of basic parameter settings and a set of extended parameter settings. A link module is included to establish a secure link to a diskless computing device over a physically secure connection. A deployment module is included to deploy the extendable data structure over the secure connection to a non-volatile memory in the diskless computing device. The non-volatile memory is configured to provide sensitive iSCSI communication parameters provided by the extendable data structure to a CPU of the diskless computing device during a boot sequence.

Claims

1. An apparatus to deploy sensitive communication parameters to a diskless computing device, the apparatus comprising:

a parameter structure module configured to store one or more Internet Small Computer System Interface (“

iSCSI”

) communication parameters in an extendable data structure configured to store a set of basic parameter settings and a set of extended parameter settings;

a link module configured to establish a secure link between a computer and a diskless computing device over a physically secure connection comprising an out-of-band connection, wherein the computer and the diskless computing device are further connected with an additional connection comprising an in-band connection; and

a deployment module configured to deploy the extendable data structure over the secure connection to a non-volatile memory in the diskless computing device, wherein the non-volatile memory is configured to provide sensitive iSCSI communication parameters provided by the extendable data structure to a CPU of the diskless computing device during a boot sequence,

wherein all or a portion of the parameter structure module, the link module, and the deployment module comprise one or more of logic hardware and executable code, the executable code stored on one or more computer readable storage media.

2. The apparatus of claim 1, wherein the deployment module is configured to deploy the extendable data structure independent of operation of an operating system of the diskless computing device.

3. The apparatus of claim 1, further comprising a public path module configured to transmit an extendable data structure with one or more non-sensitive iSCSI communication parameters through a non-secure connection to the diskless computing device.

4. The apparatus of claim 3, wherein the public path module further comprises a DHCP module configured to transmit the extendable data structure having non-sensitive iSCSI communication parameters to a Dynamic Host Configuration Protocol (“

DHCP”

) server configured to send the extendable data structure to the diskless computing device.

5. The apparatus of claim 3, wherein the public path module is configured to transmit the extendable data structure having non-sensitive iSCSI communication parameters to the diskless computing device during an initialization sequence.

6. The apparatus of claim 1, wherein the secure connection comprises a monitor module configured to also communicate environmental factors with a plurality of diskless computing devices.

7. The apparatus of claim 1, wherein the secure connection comprises a Remote Supervisor Adaptor (“

RSA II”

) configured to also communicate environmental data with a plurality of diskless computing devices.

8. The apparatus of claim 1, further comprising a memory allocation module configured to deploy an extended version of the extendable data structure having a parameter setting to reallocate the non-volatile memory.

9. The apparatus of claim 8, wherein the memory allocation module is further configured to transmit a digital certificate configured for storage within the reallocated non-volatile memory.

10. An apparatus to deploy sensitive communication parameters to a diskless computing device, the apparatus comprising:

a secure link module configured to establish a secure link between a diskless computing device and a computer over a physically secure connection comprising an out-of-band connection, wherein the computer and the diskless computing device are further connected with an additional connection comprising an in-band connection;

a receive module configured to receive one or more sensitive Internet Small Computer System Interface (“

iSCSI”

) communication parameters in an extendable data structure comprising a set of basic parameter settings and a set of extended parameter settings; and

a storage module configured to store the one or more sensitive iSCSI communication parameters in a non-volatile memory in the diskless computing device, wherein the non-volatile memory is configured to provide the one or more sensitive iSCSI communication parameters provided by the extendable data structure to a CPU in the diskless computing device during a boot sequence,

wherein all or a portion of the secure link module, the receive module, and the storage module comprise one or more of logic hardware and executable code, the executable code stored on one or more computer readable storage media.

11. The apparatus of claim 10, further comprising an iSCSI communication module configured to receive the sensitive iSCSI communication parameters from the CPU to establish a secure iSCSI communication session between the diskless computing device and an iSCSI target.

12. The apparatus of claim 11, wherein the iSCSI communication module is further configured to receive non-sensitive iSCSI communications parameters transmitted from a DHCP server.

13. The apparatus of claim 11, wherein the iSCSI target device is a data storage device having an operating system for the diskless computing device.

14. The apparatus of claim 10, further comprising a bios module configured to retrieve the one or more iSCSI communication parameters from the non-volatile memory during a boot sequence.

15. A system to deploy sensitive communication parameters to a diskless computing device, the system comprising:

a computer;

a diskless computing device;

an Internet Small Computer System Interface (“

iSCSI”

) target device;

a storage area network connecting the diskless computing device and the iSCSI target device, wherein the storage area network at least partially communicates using iSCSI;

a parameter structure module configured to store one or more iSCSI communication parameters in an extendable data structure configured to store a set of basic parameter settings and a set of extended parameter settings;

a link module configured to establish a secure link between the computer and the diskless computing device over a physically secure connection comprising an out-of-band connection, wherein the computer and the diskless computing device are further connected with an additional connection comprising an in-band network connection;

a deployment module configured to deploy the extendable data structure from the computer to the diskless computing device over the secure connection; and

a storage module configured to store the one or more sensitive iSCSI communication parameters of the extendable data structure in a non-volatile memory in the diskless computing device, wherein the non-volatile memory is configured to provide the sensitive iSCSI communication parameters provided by the extendable data structure to a CPU in the diskless computing device during a boot sequence.

16. The system of claim 15, further comprising an iSCSI communication module configured to receive the sensitive iSCSI communication parameters to establish a secure iSCSI communication session between the diskless computing device and an iSCSI target device.

17. The system of claim 16, wherein the iSCSI communication module is further configured to receive non-sensitive iSCSI communications parameters transmitted from a DHCP server.

18. The system of claim 15, further comprising a public path module configured to transmit an extendable data structure with one or more iSCSI communication parameters through a non-secure connection to the diskless computing device.

19. The system of claim 15, further comprising a baseboard management controller (“

BMC”

) in the diskless computing device configured to receive the extendable data structure and store the one or more sensitive iSCSI communication parameters of the extendable data structure in the non-volatile memory.

20. The system of claim 15, wherein the communication parameters of the extendable data structure comprise parameters compatible with secure communication using one of a Challenge Handshake Authentication Protocol (“

CHAP”

), a Secure Remote Password (“

SRP”

) protocol, and an Internet Protocol Security (“

IPSec”

) protocol.

21. The system of claim 15, wherein the diskless computing device is a blade server in a blade center.

22. The system of claim 15, wherein the iSCSI target comprises a general purpose data storage device.

23. A non-transitory computer readable storage medium tangibly embodying a program of machine-readable instructions executable by a digital processing apparatus to perform an operation to deploy sensitive communication parameters to a diskless computing device, the operation comprising:

storing one or more Internet Small Computer System Interface (“

iSCSI”

) communication parameters in a data structure;

establishing a secure link between a computer and a diskless computing device over a physically secure connection comprising an out-of-band connection, wherein the computer and the diskless computing device are further connected with an additional connection comprising an in-band connection; and

deploying the data structure over the secure connection to a non-volatile memory in the diskless computing device, wherein the non-volatile memory is configured to provide sensitive iSCSI communication parameters provided by the data structure to a CPU of the diskless computing device during a boot sequence.

24. The non-transitory computer readable storage medium of claim 23, wherein deploying the data structure is independent of operation of an operating system of the diskless computing device.

25. The non-transitory computer readable storage medium of claim 23, wherein the instructions further comprise an operation to transmit a data structure with one or more non-sensitive iSCSI communication parameters through a non-secure connection to the diskless computing device.

26. The non-transitory computer readable storage medium of claim 25, further comprising an operation to transmit the data structure having non-sensitive iSCSI communication parameters to a DHCP server configured to send the data structure to one or more diskless computing device.

27. The non-transitory computer readable storage medium of claim 25, further comprising an operation to transmit the data structure having non-sensitive iSCSI communication parameters to the diskless computing device during an initialization sequence.

28. The non-transitory computer readable storage medium of claim 23, further comprising an operation to receive the iSCSI communication parameters from the CPU to establish a secure iSCSI communication between the diskless computing device and an iSCSI target.

29. The non-transitory computer readable storage medium of claim 28, further comprising an operation to receive non-sensitive iSCSI communications parameters transmitted from a DHCP server.

30. The non-transitory computer readable storage medium of claim 23, wherein the iSCSI communication parameters of the data structure comprise parameters compatible with secure communication using one of a Challenge Handshake Authentication Protocol (“

CHAP”

), a Secure Remote Password (“

SRP”

) protocol, and an Internet Protocol Security (“

IPSec”

) protocol.

31. The non-transitory computer readable storage medium of claim 23, wherein the instructions further comprise an operation to deploy an extended version of the data structure having a parameter setting to reallocate the non-volatile memory to store a digital certificate.

32. The non-transitory computer readable storage medium of claim 23, wherein the instructions further comprise an operation to retrieve the one or more iSCSI communication parameters from the non-volatile memory during a boot sequence.

33. The non-transitory computer readable storage medium of claim 23, further comprising an operation to establish the secure connection through authentication and verification of security credentials.

34. A method for configuring an Internet Small Computer System Interface (“

iSCSI”

) network of a diskless computing device, the method comprising;

determining an iSCSI parameter security profile of a customer having a plurality of diskless computing devices;

defining an extendable data structure configured to store a set of basic parameter settings and a set of extended parameter settings that satisfies the iSCSI parameter security profile; and

executing configuration software configured to;

store one or more iSCSI communication parameters in the extendable data structure;

establish a link to each diskless computing device being configured in a network over a physically secure connection; and

deploy the extendable data structure over the secure connection to a non-volatile memory in each diskless computing device being configured, wherein the non-volatile memory is configured to provide sensitive iSCSI communication parameters provided by the extendable data structure to a CPU of the diskless computing device during a boot sequence.

35. The method of claim 34, further comprising testing the boot sequence for each diskless computing device to ensure conformity with the iSCSI parameter security profile.