Patent Application
20190286825
The present disclosure relates in general to information handling systems, and more particularly to methods and systems for managing information handling systems in a datacenter environment.
As the value and use of information continues to increase, individuals and businesses seek additional ways to process and store information. One option available to users is information handling systems. An information handling system generally processes, compiles, stores, and/or communicates information or data for business, personal, or other purposes thereby allowing users to take advantage of the value of the information. Because technology and information handling needs and requirements vary between different users or applications, information handling systems may also vary regarding what information is handled, how the information is handled, how much information is processed, stored, or communicated, and how quickly and efficiently the information may be processed, stored, or communicated. The variations in information handling systems allow for information handling systems to be general or configured for a specific user or specific use such as financial transaction processing, airline reservations, enterprise data storage, or global communications. In addition, information handling systems may include a variety of hardware and software components that may be configured to process, store, and communicate information and may include one or more computer systems, data storage systems, and networking systems.
In some situations, a datacenter or other environment may have one or more compliance regimes that must be satisfied by the information handling systems therein. For example, security compliance requirements may be requested or required by governments, regulatory boards, customers, and/or internal company processes. Ensuring compliance typically requires administrative, physical, and technical safeguards to be put in place. Of these, the technical or IT-related safeguards may be the most difficult to monitor and control, due in part to the dynamic nature of hardware and software components of information handling systems in a datacenter.
Meeting security compliance policies has typically required organizations to conduct manual certification exercises at frequent intervals, which is costly in terms of both time and resources. Hardware, firmware, and software changes exacerbate the need for frequent manual certification exercises, as do any changes in the compliance requirements themselves. The lack of a standardized and automated compliance verification framework also leads to frequent non-compliance scenarios.
This disclosure provides techniques that may be employed to assist management of information handling systems in these and other situations.
It should be noted that the discussion of a technique in the Background section of this disclosure does not constitute an admission of prior-art status. No such admissions are made herein, unless clearly and unambiguously identified as such.
In accordance with the teachings of the present disclosure, the disadvantages and problems associated with managing information handling systems in a datacenter environment may be reduced or eliminated.
In accordance with embodiments of the present disclosure, an information handling system may include at least one processor, a non-transitory memory coupled to the at least one processor, and an information handling resource coupled to the at least one processor. The information handling system may have an encryption key associated therewith. The information handling system may be configured to receive a compliance template that includes security attributes of the information handling resource, the security attributes including information regarding the encryption key. The information handling system may further be configured to, based on the compliance template and a compliance standard, determine a set of compliance tests for the information handling resource. The information handling system may be further configured to execute the set of compliance tests, and, in response to a failure of at least one test of the set of compliance tests, provide an indication of the failure.
In these and other embodiments, a method may include, at an information handling system that includes an information handling resource, receiving a compliance template that includes security attributes of the information handling resource. The method may further include, based on the compliance template and a compliance standard, the information handling system determining a set of compliance tests for the information handling resource. The method may further include the information handling system executing the set of compliance tests, and, in response to a failure of at least one test of the set of compliance tests, the information handling system providing an indication of the failure.
In these and other embodiments, an article of manufacture may include a non-transitory, computer-readable medium having instructions store thereon, the instructions being executable by at least one processor of an information handling system. The instructions may be executable for receiving a compliance template that includes security attributes of an information handling resource of the information handling system; based on the compliance template and a compliance standard, determining a set of compliance tests for the information handling resource; executing the set of compliance tests; and in response to a failure of at least one test of the set of compliance tests, the information handling system providing an indication of the failure.
Technical advantages of the present disclosure may be readily apparent to one skilled in the art from the figures, description and claims included herein. The objects and advantages of the embodiments will be realized and achieved at least by the elements, features, and combinations particularly pointed out in the claims.
It is to be understood that both the foregoing general description and the following detailed description are examples and explanatory and are not restrictive of the claims set forth in this disclosure.
A more complete understanding of the present embodiments and advantages thereof may be acquired by referring to the following description taken in conjunction with the accompanying drawings, in which like reference numbers indicate like features, and wherein:
Preferred embodiments and their advantages are best understood by reference to
For the purposes of this disclosure, an information handling system may include any instrumentality or aggregate of instrumentalities operable to compute, classify, process, transmit, receive, retrieve, originate, switch, store, display, manifest, detect, record, reproduce, handle, or utilize any form of information, intelligence, or data for business, scientific, control, entertainment, or other purposes. For example, an information handling system may be a personal computer, a personal digital assistant (PDA), a consumer electronic device, a network storage device, or any other suitable device and may vary in size, shape, performance, functionality, and price. The information handling system may include memory, one or more processing resources such as a central processing unit (“CPU”) or hardware or software control logic. Additional components of the information handling system may include one or more storage devices, one or more communications ports for communicating with external devices as well as various input/output (“I/O”) devices, such as a keyboard, a mouse, and a video display. The information handling system may also include one or more buses operable to transmit communication between the various hardware components.
For purposes of this disclosure, when two or more elements are referred to as “coupled” to one another, such term indicates that such two or more elements are in electronic communication or mechanical communication, as applicable, whether connected indirectly or directly, with or without intervening elements. When two or more elements are referred to as “coupleable” to one another, such term indicates that they are capable of being coupled together.
For the purposes of this disclosure, computer-readable media (e.g., transitory or non-transitory computer-readable media) may include any instrumentality or aggregation of instrumentalities that may retain data and/or instructions for a period of time. Computer-readable media may include, without limitation, storage media such as a direct access storage device (e.g., a hard disk drive or floppy disk), a sequential access storage device (e.g., a tape disk drive), compact disk, CD-ROM, DVD, random access memory (RAM), read-only memory (ROM), electrically erasable programmable read-only memory (EEPROM), and/or flash memory; as well as communications media such as wires, optical fibers, microwaves, radio waves, and other electromagnetic and/or optical carriers; and/or any combination of the foregoing.
For the purposes of this disclosure, information handling resources may broadly refer to any component system, device or apparatus of an information handling system, including without limitation processors, service processors, basic input/output systems, buses, memories, I/O devices and/or interfaces, storage resources, network interfaces, motherboards, and/or any other components and/or elements of an information handling system.
Information handling system 102 may also include one or more information handling resources 114 communicatively coupled to processor 103. As described in further detail below, the operational state of information handling resources 114 may implicate any of various compliance standards. Thus, the ability to determine such operational states and how they relate to the compliance standards of interest may be beneficial.
Processor 103 may include any system, device, or apparatus configured to interpret and/or execute program instructions and/or process data, and may include, without limitation, a microprocessor, microcontroller, digital signal processor (DSP), application specific integrated circuit (ASIC), or any other digital or analog circuitry configured to interpret and/or execute program instructions and/or process data. In some embodiments, processor 103 may interpret and/or execute program instructions and/or process data stored in memory 104 and/or another component of information handling system 102.
Memory 104 may be communicatively coupled to processor 103 and may include any system, device, or apparatus configured to retain program instructions and/or data for a period of time (e.g., computer-readable media). Memory 104 may include RAM, EEPROM, a PCMCIA card, flash memory, magnetic storage, opto-magnetic storage, or any suitable selection and/or array of volatile or non-volatile memory that retains data after power to information handling system 102 is turned off.
As shown in
BIOS 105 may include any system, device, or apparatus configured to identify, test, and/or initialize information handling resources of information handling system 102, and/or initialize interoperation of information handling system 102 with other information handling systems. “BIOS” may broadly refer to any system, device, or apparatus configured to perform such functionality, including without limitation, a Unified Extensible Firmware Interface (UEFI). In some embodiments, BIOS 105 may be implemented as a program of instructions that may be read by and executed on processor 103 to carry out the functionality of BIOS 105. In these and other embodiments, BIOS 105 may comprise boot firmware configured to be the first code executed by processor 103 when information handling system 102 is booted and/or powered on. As part of its initialization functionality, code for BIOS 105 may be configured to set components of information handling system 102 into a known state, so that one or more applications (e.g., an operating system or other application programs) stored on compatible media (e.g., disk drives) may be executed by processor 103 and given control of information handling system 102. In some embodiments, BIOS 105 may be used for network booting of a client information handling system from a server information handling system (e.g., via network interface 108).
Network interface 108 may comprise one or more suitable systems, apparatuses, or devices operable to serve as an interface between information handling system 102 and one or more other information handling systems via an in-band network. Network interface 108 may enable information handling system 102 to communicate using any suitable transmission protocol and/or standard. In these and other embodiments, network interface 108 may comprise a network interface card, or “NIC.” In these and other embodiments, network interface 108 may be enabled as a local area network (LAN)-on-motherboard (LOM) card.
In operation, processor 103, memory 104, BIOS 105, and network interface 108 may comprise at least a portion of a host system 98 of information handling system 102.
Management controller 112 may be configured to provide management facilities for management of information handling system 102. Such management may be made by management controller 112 even if information handling system 102 and/or host system 98 are powered off or powered to a standby state. Management controller 112 may include a processor 113, memory, and a management network interface 118 separate from and physically isolated from data network interface 108. In certain embodiments, management controller 112 may include or may be an integral part of a baseboard management controller (BMC), a chassis management controller (CMC), or a remote access controller (e.g., a Dell Remote Access Controller or Integrated Dell Remote Access Controller). In some embodiments, a plurality of host systems 98 may be present in information handling system 102, and management controller 112 may provide management of any or all of such host systems 98.
As shown in
Network interface 118 of management controller 112 may comprise any suitable system, apparatus, or device operable to serve as an interface between management controller 112 and one or more other information handling systems via an out-of-band management network. Network interface 118 may enable management controller 112 to communicate using any suitable transmission protocol and/or standard. In these and other embodiments, network interface 118 may comprise a network interface card, or “NIC.” Network interface 118 may be the same type of device as network 108, or in other embodiments it may be a device of a different type.
In operation, information handing system 102 or any information handling resource thereof may be subject to one or more compliance standards, which typically set out requirements related to security practices, software versions, cryptographic algorithms, etc. Compliance standards are most typically applied to server computers and other hardware in datacenters (e.g., routers, switches, etc.), but one of ordinary skill with the benefit of this disclosure will understand that the techniques herein may be applied in other contexts as well.
The techniques disclosed herein may be applied in the context of any of various compliance standards. In some instances, a single information handling system may be subject to more than one compliance standard, e.g., as a multi-function server or due to virtualization. Non-limiting examples of such standards may include those specified by the Payment Card Industry Data Security Standard (PCI DSS), the Health Insurance Portability and Accountability Act (HIPAA), the International Traffic in Arms Regulations (ITAR), the Federal Information Processing Standard (FIPS), and the National Institute of Standards and Technology (NIST). Other terms and acronyms used herein will be understood by one of ordinary skill in the art with the benefit of this disclosure, and may include Open Vulnerability and Assessment Language (OVAL), Security Content Automation Protocol (SCAP), and Extensible Configuration Checklist Description Format (XCCDF).
As one example of a compliance standard, FIPS Publication 140-2 is attached as Appendix A to the specification and is incorporated by reference in its entirety. An excerpt of FIPS Publication 140-2 is also shown below at Table 1 for purposes of general context and understanding of the types of requirements that a particular compliance standard might impose on an information handling system or information handling resource.
Turning now to
Security functions 202 may describe a comprehensive list of the various security-related capabilities of an information handling system. For example, security functions 202 may include functions available via host system 98 and/or functions available via management controller 112. Security functions 202 may be accessible via a Trusted Platform Module (TPM), BIOS or other firmware, drivers, an operating system, application programs, or any other suitable manner. Test strategies 204 describe interface details and available testing methods that may be used in mapping security functions 202 with system management capabilities. Test strategies 204 may in some embodiments be implemented via existing administration tools, including standard operating system commands. For example, commands may be executed on a host system or a management controller, relevant registry entries may be read to determine software versions, etc. In some embodiments, management controller 112 may be a chassis management controller that may be configured to provide out-of-band management and compliance testing for a plurality of host systems.
As shown in
Templates in security compliance knowledge base 206 may be implemented as a set of rules that may subsequently be executed by a rules engine in performing compliance testing. As one example, a template may include rules specifying how to test whether a particular cryptographic function or cryptographic key in use at an information handling system or information handling resource is subject to any known vulnerabilities. For example, the rule might indicate an internet address which contains up-to-date information regarding cryptographic flaws, affected versions of known implementations, etc. In this way, the rule may specify a test strategy for verifying the security properties of such a cryptographic system.
In some embodiments, the templates in security compliance knowledge base 206 may be created manually by security experts and/or systems management experts. In other embodiments, automated tools may be used. In yet other embodiments, templates may be created manually, and tools may be used to automatically update such templates in response to changes (e.g., minor changes) in compliance standards.
Security compliance knowledge base 206 and the templates therein may be used at step 208 for automatic compliance monitoring and auditing. For example, compliances may be monitored over time as firmware updates, driver updates, etc. create changes in the information handling system. Such monitoring may occur on demand, periodically, in response to a hardware or software change, or based on any other desired schedule. The results of the automatic compliance monitoring and auditing may be used for alerts and/or mitigation at step 212. For example, if an information handling resource fails a test during automatic compliance monitoring and auditing, an alert may be sent to a system administrator; alternatively or in addition, mitigation may automatically be initiated. For example, if a test failed based on an out-of-date firmware being detected, the firmware may be automatically updated in some embodiments to bring it into compliance.
In some embodiments, alternatively or in addition, the templates of security compliance knowledge base 206 may be transformed at step 210 into a format usable by existing tools. A transformation utility may provide a method to generate code according to various industry-standard security compliance formats (XCCDF, OVAL, etc.) from the templates in security compliance knowledge base 206. At step 214, such existing tools may be used to analyze the information handling system based on the transformed template.
Turning now to
Turning now to
At step 402, a compliance template is received which includes security attributes for an information handling system. Security attributes in the compliance template may include information regarding security functions implemented at the information handling system and/or test strategies available at the information handling system, as discussed above with regard to
At step 404, a set of compliance tests may be determined. The tests may be determined in accordance with the security attributes, as well as a particular compliance standard for which compliance is to be tested.
At step 406, the compliance tests in the set of compliance tests are run, and the results are indicated. For example, notifications of failure or success may be sent to a system administrator. In some embodiments of a failing test, an automatic mitigation procedure may also be initiated (e.g., a software or firmware update may be downloaded and/or installed).
After step 406, method 400 may end.
Although
Method 400 may be implemented using information handling system 102 or any other system operable to implement method 400. In certain embodiments, method 400 may be implemented partially or fully in software and/or firmware embodied in computer-readable media.
Various embodiments of the present disclosure have been described above. In these and other embodiments, additional features may also be present. For example, in some embodiments, a “base” compliance template may be generated at the factory when an information handling system is built. Such a base template may be generated based on key security functions such as cryptographic algorithms, ciphers, TPM attributes, BIOS security attributes, firmware versions etc. In some embodiments, the base template may be generated via pre-configured meta-data. Each function may also be complemented with a “test” or a checking strategy that can be used to validate compliance at a later point of time, when required. Examples may include specific RACADM, Redfish/WSMAN commands, etc.
In these and other embodiments, at the time of OS deployment, the “base” compliance template that dealt with hardware-related security compliance aspects may be extended to include OS-specific requirements, such as key driver versions, available SSL and cryptographic algorithms, SELinux enablement, etc. Validation functions as part of this step may be executing OS-specific commands, application (Ex. OpenSSL) specific security APIs, OMSA OMCLI commands, etc.
In these and other embodiments, a “library” of templates for key security compliances may be published, capturing required attributes to be validated, for some of the common certifications in use. These templates may be modified at the customer site, for example based on unique or additional checks to be performed, hardware customizations, etc. Such modifications may typically be done in consultation with a security expert and an IT administrator, to create a version of the template that is unique to the datacenter setup being certified.
In these and other embodiments, the “specialized” version of a template can be interpreted by a management controller and executed to capture current values of specified attributes, e.g., via the management controller, the BIOS, and/or the host. Current values of these attributes may be evaluated against expected values to check and report for adherence to or deviations from a certification.
In these and other embodiments, 1×N consoles may be used to manage compliance templates, and run periodic compliance checks against monitored devices by pushing them to the corresponding management controller. For host systems that may not have a management controller, the console may execute “remote” commands to validate key compliance requirements, provided such commands exist and are captured in the template. Alternatively, templates may also be used with industry-standard SCAP tools to monitor compliances periodically against changes in system configurations (firmware, hardware component replacements, software security functions, etc.).
In these and other embodiments, this disclosure also provides for transformation mechanisms to various U.S. government standards such as NIST-approved SCAP compliance XCCDF, OVAL format, etc., allowing the templates to run on governmentally approved tools or scanners.
This disclosure encompasses all changes, substitutions, variations, alterations, and modifications to the exemplary embodiments herein that a person having ordinary skill in the art would comprehend. Similarly, where appropriate, the appended claims encompass all changes, substitutions, variations, alterations, and modifications to the exemplary embodiments herein that a person having ordinary skill in the art would comprehend. Moreover, reference in the appended claims to an apparatus or system or a component of an apparatus or system being adapted to, arranged to, capable of, configured to, enabled to, operable to, or operative to perform a particular function encompasses that apparatus, system, or component, whether or not it or that particular function is activated, turned on, or unlocked, as long as that apparatus, system, or component is so adapted, arranged, capable, configured, enabled, operable, or operative.
All examples and conditional language recited herein are intended for pedagogical objects to aid the reader in understanding the invention and the concepts contributed by the inventor to furthering the art, and are construed as being without limitation to such specifically recited examples and conditions. Although embodiments of the present inventions have been described in detail, it should be understood that various changes, substitutions, and alterations could be made hereto without departing from the spirit and scope of the disclosure.
