Cyber security monitoring system and method for data center components
View Patent ↗A security monitoring system is disclosed which is adapted for use with a component having a service processor. The system may use a device configured to communicate with the component. A network may be used which is dedicated to communicating with the service processor for routing only data concerning performance or health of the component. The device may also use at least one subsystem for analyzing the data concerning health or performance of the component to determine if a security threat has affected operation of the component.
1. A security monitoring system adapted for use with a component, the system comprising:
a main processor disposed in the component for performing operational functions and communicating over a production network;
a second processor in the form of a service processor disposed in the component for communicating performance and health data, solely over a management network independent of the production network;
a device configured to communicate with the main processor of the component over only the production network, and with the service processor of the component over only the management network;
the management network being segregated from the production network and being utilized for communicating with the service processor to route only the performance and health data associated with the component to the device in real time, and the performance and health data concerning at least one of main processor utilization, electrical power usage and temperature; and
the device further a processor based complex event processing engine for performing real time pattern detection and analysis of the performance and health data, and to evaluate the performance and health data against at least one stored usage pattern of an aspect of the component to detect whether an anomaly is present in a usage pattern of the device, and wherein the detected anomaly indicates that a security threat has affected operation of the component.
2. The security monitoring system of claim 1 , wherein the device comprises a remote access appliance.
3. The security monitoring system of claim 1 , wherein the usage pattern is analyzed using a complex event processing algorithm.
4. The security monitoring system of claim 3 , wherein the performance and health data comprises a plurality of:
the temperature data associated with operation of the component;
the main processor utilization data associated with operation of the main processor of the component; and
the electrical power usage data associated with electrical power being drawn by the component;
and wherein the device analyzes the data to detect an anomalous operating condition of the component indicating that a potential security threat has affected operation of the component.
5. The security monitoring system of claim 1 , wherein the device includes a database for storing the data.
6. The security monitoring system of claim 1 , wherein the device includes an element library associated with the component, the element library including at least one of protocols and commands to enable the device to communicate with the component.
7. The security monitoring system of claim 1 , wherein the management network comprises an out of band network.
8. A method for security monitoring of a component communicating over a production network, and having a service processor, the method comprising:
using a device to communicate with a main processor of the component only over the production network;
using the device to communicate with the service processor of the component only over a management network, to receive health and performance related data of the component, the health and performance related data relating to at least one of power usage of the component, main processor utilization data for the main processor of the component, and temperature data of the component;
using a complex processing engine of the device configured to receive the health and performance related data using only the management network;
the management network being independent from the production network; and
using the complex processing engine of the device to analyze the performance data of the component in real time against a stored usage pattern relating to at least one performance aspect of the component, to determine if a usage anomaly is present, wherein the usage anomaly indicates that a security threat has affected operation of the component.
9. The method of claim 8 , wherein:
using the device comprises using the complex event processing engine to analyze two or more of the temperature data, the power usage and the main processor utilization data to identify the security threat.