Patent Application
20200019708
The present disclosure relates generally to information handling systems, and more particularly to providing in-band access to a remote access controller in an information handling system.
As the value and use of information continues to increase, individuals and businesses seek additional ways to process and store information. One option available to users is information handling systems. An information handling system generally processes, compiles, stores, and/or communicates information or data for business, personal, or other purposes thereby allowing users to take advantage of the value of the information. Because technology and information handling needs and requirements vary between different users or applications, information handling systems may also vary regarding what information is handled, how the information is handled, how much information is processed, stored, or communicated, and how quickly and efficiently the information may be processed, stored, or communicated. The variations in information handling systems allow for information handling systems to be general or configured for a specific user or specific use such as financial transaction processing, airline reservations, enterprise data storage, or global communications. In addition, information handling systems may include a variety of hardware and software components that may be configured to process, store, and communicate information and may include one or more computer systems, data storage systems, and networking systems.
Information handling systems such as, for example, server devices, are typically managed in order to update firmware, restore platforms, retrieve server event/error logs, retrieve or update boot configuration data, and/or provide for a variety of other server management activities known in the art. In conventional systems, server devices include a remote access controller (e.g., a Dell Remote Access Controller (DRAC) or integrated DRAC (iDRAC) available from DELL® Inc. of Round Rock, Tex., United States) that performs much of the management for the server device, and management data (e.g., firmware image data, platform restore data, server event/error logs, boot configuration data, etc.) is used for performing out-of-band server management activities. In some situations, operating system (OS) applications may require in-band access to the remote access controller. However, there are security concerns associated with in-band access to the remote access controller, as current solutions of in-band access use implicit trust and/or temporary authorization techniques. This implicit trust/authorization makes the remote access controller accessible to any OS application once the authorization is exposed. For example, a recent specification from the Distributed Management Task Force (DMTF), Redfish Host Interface, defines a method to create an authenticated Redfish session from an OS kernal. However, this proposal has a security concern associated with legacy operating systems exposing temporary credentials to any OS application. Other authentication mechanisms for OS applications include using Intelligent Platform Management Interface (IPMI) commands. However, the remote access controller will be accessible to any OS application once the IPMI commands are exposed.
Accordingly, it would be desirable to provide an improved remote access controller in-band access system.
According to one embodiment, an information handling system (IHS) includes a remote access controller; a processing system coupled to the remote access controller; and a memory system that is coupled to the processing system and that includes instructions that, when executed by the processing system, cause the processing system to provide a runtime engine that is configured to: provide, to the remote access controller using at least one of a plurality of function definitions that are configured to provide for the management of an in-band communication session with the remote access controller and that were written to the memory system by a BIOS during a managed boot from a configuration table, application security information provided by an application requesting access to the remote access controller, and wherein the remote access controller is configured to: authenticate the application security information using boot security information stored in a secure storage system coupled to the remote access controller and, in response, establish a communication session with the application.
For purposes of this disclosure, an information handling system may include any instrumentality or aggregate of instrumentalities operable to compute, calculate, determine, classify, process, transmit, receive, retrieve, originate, switch, store, display, communicate, manifest, detect, record, reproduce, handle, or utilize any form of information, intelligence, or data for business, scientific, control, or other purposes. For example, an information handling system may be a personal computer (e.g., desktop or laptop), tablet computer, mobile device (e.g., personal digital assistant (PDA) or smart phone), server (e.g., blade server or rack server), a network storage device, or any other suitable device and may vary in size, shape, performance, functionality, and price. The information handling system may include random access memory (RAM), one or more processing resources such as a central processing unit (CPU) or hardware or software control logic, ROM, and/or other types of nonvolatile memory. Additional components of the information handling system may include one or more disk drives, one or more network ports for communicating with external devices as well as various input and output (I/O) devices, such as a keyboard, a mouse, touchscreen and/or a video display. The information handling system may also include one or more buses operable to transmit communications between the various hardware components.
In one embodiment, IHS 100,
Referring now to
Referring now to
The chassis 302 may also house a BIOS storage 306 that is coupled to the BIOS engine 304. While the BIOS storage 306 is illustrated as coupled to the BIOS engine 304 (e.g., via a coupling between the BIOS storage 306 and the BIOS processing system that provides the BIOS engine 304), the BIOS storage 306 may be part of a BIOS that includes the BIOS engine 304 while remaining within the scope of the present disclosure. In a specific example, the BIOS storage 306 may be provided by a Serial Peripheral Interface (SPI) flash device, although other storage devices may fall within the scope of the present disclosure as well. In the illustrated embodiment, the BIOS storage 306 is illustrated as storing configuration tables 308 that are used to perform a managed boot of the computing device. The configuration tables may include a remote access controller authorization configuration table 308a that includes function definitions that are configured to provide for the management of communication sessions between a remote access controller 314 and a runtime application. In the illustrated embodiment, the BIOS storage 306 also includes a BIOS key database 310 that is configured to store boot security information (e.g., keys such as the KEKs, a PK, and application public keys discussed herein) that are provided for a secure boot process and for authenticating an runtime applications, discussed in further detail below. While a few specific elements that may be stored in the BIOS storage 306 have been described, one of skill in the art in possession of the present disclosure recognize that the BIOS storage may store a variety other BIOS storage elements while remaining within the scope of the present disclosure.
The chassis 302 may also house a BIOS interface 312 that is coupled to the BIOS engine 304 (e.g., via a coupling with the BIOS processing system that provides the BIOS engine 304) and that may include a Remote Access Controller ADMinistrator (RACADM) interface, a Web Services MANagement (WSMAN) interface, and/or a variety of other BIOS interfaces that would be apparent to one of skill in the art in possession of the present disclosure. As illustrated, the chassis 302 may house a remote access controller 314 that is coupled to the BIOS interface 312 (e.g., via a coupling with the RACADM interface discussed above) and that may be provided by, for example, an integrated Dell Remote Access Controller (iDRAC) provided by DELL® Inc. of Round Rock, Tex., United States, a baseboard management controller (BMC), and/or any other out-of-band controller that would be apparent to one of skill in the art in possession of the present disclosure. The remote access controller 314 enables an out-of-band management path for the computing device 300 and uses resources that are separate from the computing device 300 to provide for management of the computing device 300 via, for example, a browser based interface or Command Line Interface (CLI) at the secure server system 206. As such, the remote access controller 314 may include a processing system (not illustrated, but which may include the processor 102 discussed above with reference to
The chassis 302 may also house a primary processing system (not illustrated, but which may include the processor 102 (e.g., a Central Processing Unit (CPU)) discussed above with reference to
Referring now to
The method 400 may begin at block 402 where application security information for a runtime application is provided to a secure storage system. In an embodiment of block 402, the runtime application 320b may be provided application security information and the BIOS key database 310 may be provided corresponding application security information. For example, the runtime application 320b may utilize code signing to verify its identity. Thus, the runtime application 320b may be signed by a certificate authority (CA) and be provided an application public key and an application private key. A corresponding application public key may then be provided as the corresponding application security information in the BIOS key database 310. The corresponding application security information provided in the BIOS key database 310 may be referred to below as boot security information (e.g., to distinguish it from the application security information provided for the runtime application.) In an embodiment, the entry of the corresponding application security information to the BIOS key database 310 may be performed during a build process of the remote access controller 314, during factory configuration of the computing device 300, and/or at any other time that would be apparent to one of skill in the art in possession of the present disclosure. In various embodiments, the computing device 202 may receive the corresponding application security information from the secure server system 206 via the remote access controller 314, and stores that corresponding application security information in the BIOS key database 310. For example, when the runtime applications 320b are installed after the factory build process, the corresponding application security information may be provided to the BIOS key database 310 from the secure server system 206 via the remote access controller 314 and/or locally through the BIOS engine 304.
While the corresponding application security information is described as being stored in the BIOS key database 310, one of skill in the art in possession of the present disclosure will recognize that the storage of the corresponding application security information in some other secure storage system in the computing device 300 will fall within the scope of the present disclosure as well. For example, the corresponding application security information may be stored in a trusted database located on the remote access controller 314. In yet other embodiments, the corresponding application security information may remain at the secure server system 206 for use in verifying certificates remotely. Thus, while a few examples of the provisioning and storage of application security information (such as public and private application keys) in different manners has been described, one of skill in the art in possession of the present disclosure will recognize that the application security information utilized by the systems and methods of the present disclosure may be provisioned and/or stored in a variety of other manners that will fall within the scope of the present disclosure.
The method 400 then proceeds to block 404 where function definitions to establish remote access controller sessions are provided to the runtime engine 316 by the BIOS engine 304 during a managed boot of the computing device. In an embodiment of block 404, the BIOS engine 304 may perform a managed boot of the computing device 300 to load the operating system 320a on the runtime engine 316 and enter a runtime environment. During the managed boot, a variety of security checks may be performed using cryptographic keys stored in the BIOS key database 310 such that the boot drivers and operating system 320a may be trusted. For example, the BIOS engine 304 may perform a managed boot (e.g., Secure Boot) using a Platform Key (PK) and/or Key Exchange Keys (KEKs) that are based off of the PK. During, the managed boot, the BIOS engine 304 may access a plurality of configuration tables 308 that are stored in the BIOS storage 306 and that are used in the managed boot process to initialize the computing device 300. As discussed above, the configuration tables 308 may include a remote access controller authorization configuration table 308a that includes function definitions to manage communication sessions between the remote access controller 314 and a runtime application 320b. For example, the remote access controller authorization configuration table 308a may be an Advanced Configuration and Power Interface (ACPI) table that may be defined and linked to an EFI System Resource Table (ESRT). The BIOS engine 304 may provide the function definitions to manage the communication sessions between the remote access controller 314 and any runtime application 320b to a reserved memory space on system memory of the processing system that provides the runtime engine 316.
Furthermore, during the managed boot of the computing device 300 and with reference to
The method 400 then proceeds to block 406 where a request to establish a communication session with the remote access controller is received from a runtime application. In an embodiment of block 406, the runtime application 320b may provide a request to the runtime engine 316 to access the remote access controller 314, and the runtime engine 316 may then retrieve the application security information from the runtime application 320b and provide that application security information in initial communications with the remote access controller 314. In an example, the runtime engine 316 may use an application private key of the runtime application 320b to encrypt a current timestamp of the request and a session identifier that may be randomly generated. A resulting hash of the current timestamp and the session identifier may be provided to a communication session creation function that is part of the functions definitions that are included in the remote access controller authorization configuration table 308a and that were provided to the runtime engine 316 from the BIOS engine 304 during the managed boot process. The public key of the runtime application 320b may also be provided to the remote access controller session creation function. For example, as illustrated by arrow 502 in
In an embodiment and with reference to
The method 400 then proceeds to block 408 where the application security information is provided to the remote access controller. In an embodiment of block 408, the runtime engine 316 may provide the application security information to the remote access controller 314. The communication session creation function that is part of the function definitions that are included in the remote access controller authorization configuration table 308a may rely on a management interface with the remote access controller 314 to provide the application security information to the remote access controller 314. For example, the management interface may be provided by Shared memory Access (SMA) via the RAC storage 317. As illustrated by the arrow 504 of
The method 400 then proceeds to decision block 410 where the remote access controller verifies the application security information. In an embodiment of block 410, the remote access controller 314 may determine whether the application security information is verifiable. For example, the remote access controller 314 may verify whether the boot security information stored at the BIOS key database 310 corresponds with the application security information. The remote access controller 314 may retrieve boot security information such as, for example, any corresponding application security information that was stored in the BIOS key database 310 as discussed above, and determine whether the application security information received at block 408 corresponds with that corresponding application security information. For example and as illustrated by arrow 506 of
However, if the application security information is verified at decision block 410, the method 400 then proceeds to block 414 where a communication session is established between the remote access controller and the runtime application. In an embodiment of block 414, the remote access controller 314 may provide a notification to the runtime application 320b that application security information was verified, and a communication session including the session identifier is established. For example, ACPI may provide a return code to indicate failure or success and/or remote access controller interfaces such as, for example, Redfish, CLI and/or other remote access controller interfaces that would be apparent to one of skill in the art in possession of the present disclosure may reject or accept requests. As illustrated by arrow 508 of
The method 400 may then proceed to decision block 416 where a determination is made as to whether a communication session end event has occurred. In an embodiment of block 416, the remote access controller 314 may determine whether a communication session end event that indicates the communication session should end has occurred. If a communication session end event has not occurred, then the remote access controller 314 may continue to provide communications between the remote access controller 314 and the runtime application 320b, as well as monitor the communication session at block 416. However, if the remote access controller 314 determines that a communication session end event has occurred, then the remote access controller 314 may prevent access by the runtime application 320b at block 418. For example, the remote access controller 314 may maintain an expiry timer that may indicate a time period for which the communication session between the remote access controller 314 and the runtime application 320b is to remain active, or may monitor for a time period of inactivity between the runtime application 320b and the remote access controller 314. If the expiry timer reaches the predetermined threshold, (e.g., a time period defined at the expiry timer), then the method 400 may proceed to block 418 where then the remote access controller 314 deletes the session identifier stored at the remote access controller 314 and/or marks the session identifier as expired. The remote access controller 314 may then deny any communication requests that include the expired session identifier. The runtime application 320b is then required to establish a new communication session with a new session identifier according to the steps discussed above if further communications are desired.
In another embodiment, the runtime application 320b may be finished accessing the remote access controller 314, and may encrypt the session identifier using the application security information (e.g., using the application private key) and call a communication session delete function included in the function definitions provided in the remote access controller authorization configuration table 308a. The application security information is provided to the remote access controller 314 using ACPI via RAC storage 317 using SMA. For example, the runtime engine 316 may provide the encrypted/signed session identifier and the application public key to the remote access controller, and the remote access controller 314 may verify the application security information as described above in block 410 (e.g., by verifying that a corresponding application public key stored in the BIOS key database 310 matches the application public key and verifying the hash generated from the session identifier and optionally a time stamp created using the application public key.) The decrypted session identifier is then deleted, a notification that the communication session has ended is provided to the runtime engine 316, and the remote access controller 314 prevents the runtime application 320b from accessing the remote access controller 314 in block 418.
Thus, systems and methods have been described that provide in-band access to a remote access controller. Runtime applications may include application security information that is also stored in a BIOS key database and/or other trusted storage device that is accessible by the remote access controller, and the operating system may use a session creation function defined by a BIOS configuration table during a managed boot to communicate with the remote access controller via a management interface. When a runtime application requests access to a remote access controller, the runtime application provides its application security information, which may include a session identifier, to the operating system. The remote access controller may verify the application security information and allow a communication session to be established between the remote access controller and the runtime application using the session identifier. The systems and methods of the present disclosure alleviate security concerns of other remote access controller in-band access systems in which credentials and commands are potentially exposed to other runtime applications that should not have access to the remote access controller. Thus, the communication sessions between each runtime application and the remote access controller are separate and distinct, preventing a runtime application from communicating with the remote access controller using another runtime application's communication session.
Although illustrative embodiments have been shown and described, a wide range of modification, change and substitution is contemplated in the foregoing disclosure and in some instances, some features of the embodiments may be employed without a corresponding use of other features. Accordingly, it is appropriate that the appended claims be construed broadly and in a manner consistent with the scope of the embodiments disclosed herein.
