Method, apparatus, and system for manageability and secure routing and endpoint access
A solution is presented to securing endpoints without the need for a separate bus or communication path. The solution allows for controlling access to endpoints by utilizing a management protocol by overlapping with existing interconnect communication paths in a packet format and utilizing a PCI address BDF (Bus number, Device number, and Function number) for verification.
1. A method for managing a secure endpoint comprising:
defining a first class and a second class of Management Component Transport Protocol (MCTP) endpoints;
assigning a Bus number, Device number, and Function number to the first class of MCTP endpoints; and
verifying a request from a device of the first class of MCTP endpoints based at least in part on the assigned Bus number, Device number, and Function number of the first class of MCTP endpoints and an access control list maintained by the second class of MCTP endpoints, wherein the request is included in a Vendor Defined Message packet.
2. The method of claim 1 wherein the first class of MCTP endpoints is a Privileged MCTP Endpoint (PME).
3. The method of claim 1 wherein the first class of MCTP endpoints is a Service Provider MCTP Endpoint (SPME).
4. The method of claim 1 further comprising maintaining an Address Validation List to prevent spoofing of the first class of MCTP endpoints.
5. The method of claim 1 wherein the first class of MCTP endpoints is a Baseboard Management Controller.
6. The method of claim 1 wherein the first class of MCTP endpoints is a trusted embedded controller.
7. The method of claim 1 wherein the second class of MCTP endpoints is a Network Interface Card), graphics controller, a storage controller, a Central Processing Unit.
8. The method of claim 1 wherein the second class of MCTP endpoints is a graphics controller.
9. The method of claim 1 wherein the second class of MCTP endpoints is a storage controller.
10. The method of claim 1 wherein the second class of MCTP endpoints is a Central Processing Unit.
11. A logic circuit to manage secure endpoints comprising:
a decode circuit to receive a packet including a Management Component Transport Protocol (MCTP) packet from an endpoint and to decode a source field of the packet that contains a Bus number, Device number, and Function number; and
an enable circuit to allow a request to be processed based at least in part on the Bus number, Device number, Function number of the source field of the packet and a list of secure endpoints.
12. The logic circuit of claim 11 wherein the endpoint is a Baseboard Management Controller.
13. A method for managing a secure endpoint comprising:
defining a first class and a second class of Management Component Transport Protocol (MCTP) endpoints;
assigning a Bus number, Device number, and Function number to the first class of MCTP endpoints;
verifying a request from a device of the first class of MCTP endpoints based at least in part on the assigned Bus number, Device Number, and Function number to the first class MCTP endpoints and a configurable access control list maintained by the second class of MCTP endpoints, wherein the request is included in a Vendor Defined Message (VDM) packet.
14. The method of claim 13 further comprising maintaining an address validation list to prevent spoofing of the first class of MCTP endpoints.
15. The method of claim 13 wherein the configurable access control list is a static Privileged MCTP Endpoint (PME) list and contains a management engine BDF.
16. The method of claim 15 wherein the configurable access control list is a boot time programmable Privileged MCTP Endpoint (PME) list that has a Baseboard Management Controller (BMC) that may change the respective physical location and bus number from one platform to another and allows for a trusted embedded controller to obtain this information from the BMC.
17. The method of claim 15 wherein the configurable access control list is a runtime programmable Privileged MCTP Endpoint (PME) list that utilizes a bus renumbering flow to allow for runtime changes to the PME list.
18. The method of claim 16 wherein the address validation list is maintained by Address Validation Filter logic in a root port or switch port.
19. The method of claim 18 wherein the trusted embedded controller is a Management Engine (ME).
20. A system comprising:
a processor,
a first class and a second class of Management Component Transport Protocol (MCTP) endpoints, coupled to the processor, the first class of MCTP endpoints assigned a Bus number, Device number, and Function number;
an address validation filter logic, coupled to the processor, to verify a request from a device of the first class of MCTP endpoints based at least in part on the assigned Bus number, Device number, and Function number and a configurable access control list maintained by the second class of MCTP endpoints.
21. The system of claim 20 wherein the address validation filter logic is in a root port.
22. The system of claim 20 wherein the address validation filter logic is in a switch.