Demand based USB proxy for data stores in service processor complex

• US 8,428,929 B2
• Filed: 09/30/2010
• Issued: 04/23/2013
• Est. Priority Date: 09/30/2010
• Status: Expired due to Fees

• Current Assignee: Intel Corporation
• Original Assignee: Intel Corporation
• Inventors: Sakthikumar, Palsamy, Rothman, Michael A., Zimmer, Vincent J., Swanson, Robert C., Bulusu, Mallik
• Primary Examiner(s): Rivas, Omar Fernandez
• Assistant Examiner(s): DAY, HERNG DER
• Application Number:
  US12/894,876
• Publication Number:
  US 20120084552A1
• Time in Patent Office: 936 Days
• Field of Search: None
• US Class Current: 703/24
• CPC Class Codes: G06F 13/105 where the programme performs an input/output emulation function
• CPC Class Codes: G06F 21/572 Secure firmware programming, e.g. of basic input output system [BIOS]
• CPC Class Codes: G06F 2221/2105 Dual mode as a secondary aspect
• CPC Class Codes: G06F 9/4812 by interrupt, e.g. masked

Abstract

A method, apparatus, system, and computer program product for secure server system management. A payload containing system software and/or firmware updates is distributed in an on-demand, secure I/O operation. The I/O operation is performed via a secured communication channel inaccessible by the server operating system to an emulated USB drive. The secure communication channel can be established for the I/O operation only after authenticating the recipient of the payload, and the payload can be protected from access by a potentially-infected server operating system. Furthermore, the payload can be delivered on demand rather than relying on a BIOS update schedule, and the payload can be delivered at speeds of a write operation to a USB drive.

Claims

1. A computer-implemented method comprising:

in a system having a platform controller coupled to an I/O controller capable of generating a System Management Interrupt (SMI), performing the following;

in response to an event requiring secure access to data, generating an SMI to cause the system to enter System Management Mode;

using a resource of the platform controller to create an emulated USB device, wherein the resource stores the data;

copying the data from the resource using the emulated USB device via a connection inaccessible by an operating system of the system; and

processing the data prior to exiting System Management Mode.

2. The method of claim 1, further comprising:

authenticating a recipient of the data while in System Management Mode.

3. The method of claim 1 wherein

the platform controller is a baseboard management controller.

4. The method of claim 1 wherein

the platform controller is provided by a manageability engine of a chipset of the system.

5. The method of claim 1 further comprising:

downloading the data from an enterprise server to the resource using the emulated USB device.

6. The method of claim 1 further comprising:

removing the emulated USB device from visibility by the operating system prior to exiting System Management Mode.

7. The method of claim 1 wherein

using the resource of the platform controller to create the emulated USB device is performed in response to a request to access the data.

8. A system comprising:

a processor;

a platform controller;

an I/O controller capable of generating a System Management Interrupt (SMI);

a memory coupled to the processor, the memory comprising instructions for performing the following;

in response to an event requiring secure access to data, generating an SMI to cause the system to enter System Management Mode;

using a resource of the platform controller to create an emulated USB device, wherein the resource stores the data;

copying the data from the resource using the emulated USB device via a connection inaccessible by an operating system of the system; and

processing the data prior to exiting System Management Mode.

9. The system of claim 8, wherein the instructions further perform the following:

authenticating a recipient of the data while in System Management Mode.

10. The system of claim 8 wherein

the platform controller is a baseboard management controller.

11. The system of claim 8 wherein

the platform controller is provided by a manageability engine of a chipset of the system.

12. The system of claim 8 wherein the instructions further perform the following:

downloading the data from an enterprise server to the resource using the emulated USB device.

13. The system of claim 8, wherein the instructions further perform the following:

removing the emulated USB device from visibility by the operating system prior to exiting System Management Mode.

14. The system of claim 8 wherein

using the resource of the platform controller to create the emulated USB device is performed in response to a request to access the data.

15. A computer program product comprising:

a non-transitory computer-readable storage medium; and

instructions in the non-transitory computer-readable storage medium, wherein the instructions, when executed in a processing system having a platform controller coupled to an I/O controller capable of generating a System Management Interrupt (SMI), cause the processing system to perform operations comprising;

in response to an event requiring secure access to data, generating an SMI to cause the system to enter System Management Mode;

using a resource of the platform controller to create an emulated USB device, wherein the resource stores the data;

copying the data from the resource using the emulated USB device via a connection inaccessible by an operating system of the system; and

processing the data prior to exiting System Management Mode.

16. The computer program product of claim 15, wherein the instructions further perform the following:

authenticating a recipient of the data while in System Management Mode.

17. The computer program product of claim 15 wherein

the platform controller is a baseboard management controller.

18. The computer program product of claim 15 wherein

the platform controller is provided by a manageability engine of a chipset of the system.

19. The computer program product of claim 15 wherein the instructions further perform the following:

downloading the data from an enterprise server to the resource using the emulated USB device.

20. The computer program product of claim 15, wherein the instructions further perform the following:

removing the emulated USB device from visibility by the operating system prior to exiting System Management Mode.

21. The computer program product of claim 15 wherein

using the resource of the platform controller to create the emulated USB device is performed in response to a request to access the data.