System and method for data center security enhancements leveraging managed server SOCs

• US 9,929,976 B2
• Filed: 09/20/2016
• Issued: 03/27/2018
• Est. Priority Date: 10/30/2009
• Status: Active Grant

• Current Assignee: III Holdings 2, LLC
• Original Assignee: III Holdings 2, LLC
• Inventors: Davis, Mark, Borland, David, Hobbs, Jason, Marquette, Danny, Volpe, Thomas A., Goss, Ken
• Primary Examiner(s): Traore, Fatoumata
• Application Number:
  US15/270,418
• Publication Number:
  US 20170012899A1
• Time in Patent Office: 553 Days
• Field of Search: None
• CPC Class Codes: H04L 41/28 Restricting access to network management systems or functions, e.g. using authorisation function to access network configuration
• CPC Class Codes: H04L 45/60 Router architectures
• CPC Class Codes: H04L 45/74 Address processing for routing
• CPC Class Codes: H04L 49/109 Integrated on microchip, e.g. switch-on-chip
• CPC Class Codes: H04L 49/3009 Header conversion, routing tables or routing tags
• CPC Class Codes: H04L 49/351 for local area network [LAN], e.g. Ethernet switches
• CPC Class Codes: H04L 49/356 for storage area networks
• CPC Class Codes: H04L 63/0209 Architectural arrangements, e.g. perimeter networks or demilitarized zones
• CPC Class Codes: H04L 63/0236 Filtering by address, protocol, port number or service, e.g. IP-address or URL
• CPC Class Codes: H04L 63/1416 Event detection, e.g. attack signature detection
• CPC Class Codes: H04L 63/1433 Vulnerability analysis
• CPC Class Codes: H04L 63/20 for managing network security; network security policies in general filtering policies H04L63/0227

Abstract

A data center security system and method are provided that leverage server systems on a chip (SOCs) and/or server fabrics. In more detail, server interconnect fabrics may be leveraged and extended to dramatically improve security within a data center.

Claims

1. A method comprising:

interconnecting nodes in a network, wherein each of the nodes includes a management processor, an application processor, and a routing header unit;

generating management information by the management processors in the interconnected nodes;

attaching a routing header to the management information to form a management information routing frame, wherein the routing header includes a management processor domain indicator which specifies that the management information routing frame is to remain within a management processor domain during routing,

determining a node in the network requires isolation from other nodes in the network; and

isolating the node determined to require isolation by a management processor corresponding to the node powering off an application processor for the node.

2. The method of claim 1, wherein the management processor domain comprises the management processors but not the application processors.

3. The method of claim 1, further comprising:

running the management processors within a security zone; and

running the application processors within a normal security zone.

4. The method of claim 1, further comprising running, by the management processors, verified code.

5. The method of claim 1, further comprising communicating, by the management processors, sensitive information with one another.

6. The method of claim 1, further comprising providing, by the management processors, out-of-band security for the nodes.

7. A system on a chip (SoC) node comprising:

a management processor configured to generate management information;

an application processor coupled to the management processor;

a routing header unit configured to attach a routing header to the management information to form a management information routing frame, wherein the routing header includes a management processor domain indicator which specifies that the management information routing frame is to remain within a management processor domain during routing;

determine a node in the network requires isolation from other nodes in the network; and

isolate the node determined to require isolation by a management processor corresponding to the node powering off an application processor for the node.

8. The SoC node of claim 7, wherein the management processor is further configured to run within a security zone, and wherein the application processor is configured to run within a normal security zone.

9. The SoC node of claim 7, further comprising a media access control (MAC) associated with the management processor, wherein the MAC is configured to form a MAC packet for the management information, and wherein the routing header unit is further configured to attach the routing header to the MAC packet.

10. The SoC node of claim 7, wherein the management processor runs an embedded operating system (OS), and wherein the application processor runs a standard OS.

11. The SoC node of claim 7, wherein the management processor domain indicator is one bit.

12. The SoC node of claim 7, wherein the management processor is in the management processor domain, and wherein the application processor is not in the management processor domain.

13. A system on a chip (SoC) node fabric comprising:

nodes interconnected to each other to form a fabric, wherein each node includes;

a management processor configured to generate management information;

an application processor coupled to the management processor; and

a routing header unit configured to attach a routing header to the management information to form a management information routing frame, wherein the routing header comprises a management processor domain indicator which specifies that the management information routing frame is to remain within a management processor domain during routing;

determine a node in the network requires isolation from other nodes in the network; and

isolate the node determined to require isolation by a management processor corresponding to the node powering off an application processor for the node.

14. The SoC node fabric of claim 13, wherein the management processors run within a security zone, and wherein the application processors run within a normal security zone.

15. The SoC node fabric of claim 13, wherein the management processor domain comprises the management processors but not the application processors.

16. The SoC node fabric of claim 13, wherein the management processors are further configured to run verified code thereon.

17. The SoC node fabric of claim 13, wherein the management processors provide out-of-band security for the nodes.

18. The SoC node fabric of claim 13, wherein the management processor domain comprises a gateway media access control (MAC).