Security content over a management band
View Patent ↗There is disclosed in one example, a computing apparatus, having: first one or more logic elements comprising at least a processor and a memory to provide an operational environment; and second one or more logic elements providing an out-of-band management engine to function independently of the operational environment, and to: provide an out-of-band communication driver; determine that the operational environment has encountered an error that inhibits network communication; receive security content from a server via the out-of-band communication driver into a third-party storage area; and apply the security content to the computing apparatus. There is also disclosed a method of providing an out-of-band management engine, and one or more tangible, non-transitory computer-readable storage mediums having stored instructions for providing an out-of-band management engine.
1. A computing apparatus, comprising:
first one or more logic elements comprising at least a processor and a memory to provide an operating system;
second one or more logic elements comprising an out-of-band management engine to function independently of the operating system, and to:
provide an out-of-band communication driver;
determine that the operating system has encountered an error that inhibits network communication;
communicate with a security update service via the communication driver;
determine that the security update service has available an update to correct the error, and that the update exceeds in size a dedicated memory area for the out-of-band management engine;
receive the update from the security service via the out-of-band communication driver into a third-party storage area; and
apply the update to the computing apparatus; and
a trusted execution environment (TEE) to write the blocks out to the external memory.
2. The computing apparatus of claim 1 , wherein the operating system is further to provide a notification of the error.
3. The computing apparatus of claim 1 , wherein the operating system is to detect the error, and to provide a notification to the out-of-band management engine.
4. The computing apparatus of claim 3 , wherein providing a notification comprises setting or clearing a flag.
5. The computing apparatus of claim 3 , wherein providing a notification comprises sending a network message via the out-of-band communication driver.
6. The computing apparatus of claim 3 , wherein providing a notification comprises sending a cloud notification message.
7. The computing apparatus of claim 1 , wherein the update from the security service exceeds an available size of the third-party storage area, and wherein receiving the update from the security service comprises writing blocks out to an external memory.
8. The computing apparatus of claim 7 , wherein the external memory is nonvolatile memory.
9. The computing apparatus of claim 7 , wherein the external memory is protected.
10. The computing apparatus of claim 1 , wherein the security service is a healthy peer system.
11. One or more tangible, non-transitory computer-readable mediums for providing out-of-band communication via a third-party storage area of an out-of-band management engine, the instructions to instruct a processor to:
provide a security agent within an operating system;
provide the out-of-band management engine to function independently of the operating system, and to:
provide an out-of-band communication driver;
determine that the security agent has encountered an error that inhibits network communication;
communicate with a security update service via the communication driver;
determine that the security update service has available an update to correct the error, and that the update exceeds in size a dedicated memory area for the out-of-band management engine;
receive the update from the security service via the out-of-band communication driver into a third-party storage area;
apply the update to the computing apparatus; and
provision a trusted execution environment (TEE) to write the blocks out to the external memory.
12. The one or more tangible, non-transitory computer-readable mediums of claim 11 , wherein the security agent is further to provide a notification of the error.
13. The one or more tangible, non-transitory computer-readable mediums of claim 11 , wherein the security agent is to detect the error, and to provide a notification to the out-of-band management engine.
14. The one or more tangible, non-transitory computer-readable mediums of claim 13 , wherein providing a notification comprises setting or clearing a flag.
15. The one or more tangible, non-transitory computer-readable mediums of claim 13 , wherein providing a notification comprises sending a network message via the out-of-band communication driver.
16. The one or more tangible, non-transitory computer-readable mediums of claim 13 , wherein providing a notification comprises sending a cloud notification message.
17. The one or more tangible, non-transitory computer-readable mediums of claim 11 , wherein the update exceeds an available size of the third-party storage area, and wherein receiving the update comprises writing blocks out to an external memory.
18. The one or more tangible, non-transitory computer-readable mediums of claim 17 , wherein the external memory is nonvolatile memory.
19. The one or more tangible, non-transitory computer-readable mediums of claim 17 , wherein the external memory is protected.
20. The one or more tangible, non-transitory computer-readable mediums of claim 17 , wherein the security service is a healthy peer system.
21. A computer-implemented method for providing out-of-band communication via a third-party storage area of an out-of-band management engine, comprising:
providing an operating system;
providing the out-of-band management engine to function independently of the operating system;
providing an out-of-band communication driver;
determining that the operating system has encountered an error that inhibits network communication;
communicating with a security update service via the communication driver;
determining that the security update service has available an update to correct the error, and that the update exceeds in size a dedicated memory area for the out-of-band management engine;
receiving the update from the security service via the out-of-band communication driver into the third-party storage area;
applying the update to the computing apparatus; and
write the blocks out to the external memory via a trusted execution environment (TEE).
22. The method of claim 21 , wherein the operating system is further to provide a notification of the error.
23. The method of claim 21 , wherein the update exceeds an available size of the third-party storage area, and wherein receiving the update comprises writing blocks out to an external memory.
24. The method of claim 21 , wherein the security service is a healthy peer system.