System and method for data center security enhancements leveraging managed server SOCs
View Patent ↗A data center security system and method are provided that leverage server systems on a chip (SOCs) and/or server fabrics. In more detail, server interconnect fabrics may be leveraged and extended to dramatically improve security within a data center.
1. A system on a chip (SoC) node comprising:
a management processor configured to generate management information;
an application processor coupled to the management processor; and
a routing header unit configured to prepend a routing header to the management information to form a management information routing frame, wherein the routing header includes a management processor domain indicator which specifies that the management information routing frame is to remain within a management processor domain during routing;
wherein the management processor is further configured to have access to a processor state of the application processor, access to a debug control of the application processor, and access to a memory and peripheral resources of the SoC node,
wherein the management processor is further configured to run within a secure world security zone, and wherein the application processor in the plurality of nodes is configured to run within a normal world security zone.
2. The SoC node of claim 1 , further comprising a media access control (MAC) that is associated with the management processor, wherein the MAC is configured to form a MAC packet for the management information, and wherein the routing header unit is further configured to prepend the routing header to the MAC packet.
3. The SoC node of claim 1 , wherein the management processor is further configured to run an embedded operating system (OS), and wherein the application processor is configured to run a standard OS.
4. The SoC node of claim 3 , wherein the standard OS is Linux.
5. The SoC node of claim 1 , wherein the management processor domain indicator is one bit.
6. The SoC node of claim 1 , wherein the management processor is in the management processor domain, and wherein the application processor is not in the management processor domain.
7. A system on a chip (SoC) node fabric comprising:
a plurality of SoC nodes interconnected to each other to form a fabric, wherein each of the plurality of SoC nodes includes:
a management processor configured to generate management information;
an application processor coupled to the management processor; and
a routing header unit configured to prepend a routing header to the management information to form a management information routing frame, wherein the routing header comprises a management processor domain indicator which specifies that the management information routing frame is to remain within a management processor domain during routing;
wherein the management processors are further configured to have access to a processor state of the application processors, access to a debug control of the application processors, and access to a memory and peripheral resources of the plurality of SoC nodes,
wherein the management processors are further configured to run within a secure world security zone, and wherein the application processors in the plurality of nodes are configured to run within a normal world security zone.
8. The SoC node fabric of claim 7 , wherein the management processor domain comprises the management processors but not the application processors.
9. The SoC node fabric of claim 7 , wherein the management processors are further configured to run verified code thereon.
10. The SoC node fabric of claim 7 , wherein the management processors are further configured to communicate commands or sensitive information with one another.
11. The SoC node fabric of claim 7 , wherein the management processors are further configured to provide out-of-band security for the plurality of SoC nodes.
12. The SoC node fabric of claim 7 , wherein the management processor domain comprises a gateway media access control (MAC).
13. A method comprising:
interconnecting a plurality of SoC nodes, wherein each of the plurality of SoC nodes comprises a management processor, an application processor, and a routing header unit;
generating, by the management processors in the plurality of SoC nodes, management information, wherein the management processors are configured to have access to a processor state of the application processors, access to a debug control of the application processors, and access to a memory and peripheral resources of the plurality of SoC nodes: and
prepending, by the routing header units in the SoC node, a routing header to the management information to form a management information routing frame, wherein the routing header includes a management processor domain indicator which specifies that the management information routing frame is to remain within a management processor domain during routing,
wherein the management processors are further configured to run within a secure world security zone, and wherein the application processors in the plurality of nodes are configured to run within a normal world security zone.
14. The method of claim 13 , wherein the management processor domain comprises the management processors but not the application processors.
15. The method of claim 13 , further comprising:
running the management processors within a secure world security zone; and
running the application processors within a normal world security zone.
16. The method of claim 13 , further comprising running, by the management processors in the plurality of SoC nodes, verified code.
17. The method of claim 13 , further comprising communicating, by the management processors in the plurality of SoC nodes, commands or sensitive information with one another.
18. The method of claim 13 , further comprising providing, by the management processors, out-of-band security for the plurality of SoC nodes.