DEMAND BASED USB PROXY FOR DATA STORES IN SERVICE PROCESSOR COMPLEX

• US 20120084552A1
• Filed: 09/30/2010
• Published: 04/05/2012
• Est. Priority Date: 09/30/2010
• Status: Active Grant

• Current Assignee: Intel Corporation
• Original Assignee: Intel Corporation
• Inventors: Sakthikumar, Palsamy, Rothman, Michael A., Zimmer, Vincent J., Swanson, Robert C., Bulusu, Mallik
• Granted Patent: US 8,428,929 B2
• Time in Patent Office: Days
• US Class Current: 713/100
• CPC Class Codes: G06F 13/105 where the programme performs an input/output emulation function
• CPC Class Codes: G06F 21/572 Secure firmware programming, e.g. of basic input output system [BIOS]
• CPC Class Codes: G06F 2221/2105 Dual mode as a secondary aspect
• CPC Class Codes: G06F 9/4812 by interrupt, e.g. masked

Abstract

A method, apparatus, system, and computer program product for secure server system management. A payload containing system software and/or firmware updates is distributed in an on-demand, secure I/O operation. The I/O operation is performed via a secured communication channel inaccessible by the server operating system to an emulated USB drive. The secure communication channel can be established for the I/O operation only after authenticating the recipient of the payload, and the payload can be protected from access by a potentially-infected server operating system. Furthermore, the payload can be delivered on demand rather than relying on a BIOS update schedule, and the payload can be delivered at speeds of a write operation to a USB drive.

Claims

1. A computer-implemented method comprising:

in a system having a platform controller coupled to an I/O controller capable of generating a System Management Interrupt (SMI), performing the following;

in response to an event requiring secure access to data, generating an SMI to cause the system to enter System Management Mode;

using a resource of the platform controller to create an emulated USB device, wherein the resource stores the data;

copying the data from the emulated USB device via a connection inaccessible by an operating system of the system; and

processing the data prior to exiting System Management Mode.

2. The method of claim 1, further comprising:

authenticating a recipient of the data while in System Management Mode.

3. The method of claim 1 wherein

the platform controller is a baseboard management controller.

4. The method of claim 1 wherein

the platform controller is provided by a manageability engine of a chipset of the system.

5. The method of claim 1 further comprising:

downloading the data from an enterprise server to the emulated USB drive.

6. The method of claim 1 further comprising:

removing the emulated USB drive from visibility by the operating system prior to exiting System Management Mode.

7. The method of claim 1 wherein

using the resource of the platform controller to create the emulated USB device is performed in response to a request to access the emulated USB device.

8. A system comprising:

a processor;

a platform controller;

an I/O controller capable of generating a System Management Interrupt (SMI);

a memory coupled to the processor, the memory comprising instructions for performing the following;

in response to an event requiring secure access to data, generating an SMI to cause the system to enter System Management Mode;

using a resource of the platform controller to create an emulated USB device, wherein the resource stores the data;

copying the data from the emulated USB device via a connection inaccessible by an operating system of the system; and

processing the data prior to exiting System Management Mode.

9. The system of claim 8, wherein the instructions further perform the following:

authenticating a recipient of the data while in System Management Mode.

10. The system of claim 8 wherein

the platform controller is a baseboard management controller.

11. The system of claim 8 wherein

the platform controller is provided by a manageability engine of a chipset of the system.

12. The system of claim 8 wherein the instructions further perform the following:

downloading the data from an enterprise server to the emulated USB drive.

13. The system of claim 8, wherein the instructions further perform the following:

removing the emulated USB drive from visibility by the operating system prior to exiting System Management Mode.

14. The system of claim 8 wherein

using the resource of the platform controller to create the emulated USB device is performed in response to a request to access the emulated USB device.

15. A computer program product comprising:

a computer-readable storage medium; and

instructions in the computer-readable storage medium, wherein the instructions, when executed in a processing system having a platform controller coupled to an I/O controller capable of generating a System Management Interrupt (SMI), cause the processing system to perform operations comprising;

in response to an event requiring secure access to data, generating an SMI to cause the system to enter System Management Mode;

using a resource of the platform controller to create an emulated USB device, wherein the resource stores the data;

copying the data from the emulated USB device via a connection inaccessible by an operating system of the system; and

processing the data prior to exiting System Management Mode.

16. The computer program product of claim 15, wherein the instructions further perform the following:

authenticating a recipient of the data while in System Management Mode.

17. The computer program product of claim 15 wherein

the platform controller is a baseboard management controller.

18. The computer program product of claim 15 wherein the platform controller is provided by a manageability engine of a chipset of the system.

19. The computer program product of claim 15 wherein the instructions further perform the following:

downloading the data from an enterprise server to the emulated USB drive.

20. The computer program product of claim 15, wherein the instructions further perform the following:

removing the emulated USB drive from visibility by the operating system prior to exiting System Management Mode.

21. The computer program product of claim 15 wherein

using the resource of the platform controller to create the emulated USB device is performed in response to a request to access the emulated USB device.