System and method for data center security enhancements leveraging managed server SOCs
A data center security system and method are provided that leverage server systems on a chip (SOCs) and/or server fabrics. In more detail, server interconnect fabrics may be leveraged and extended to dramatically improve security within a data center.
1. A method comprising:
interconnecting nodes in a network, wherein each of the nodes includes a management processor, an application processor, and a routing header unit;
generating management information by the management processors in the interconnected nodes;
attaching a routing header to the management information to form a management information routing frame, wherein the routing header includes a management processor domain indicator which specifies that the management information routing frame is to remain within a management processor domain during routing,
determining a node in the network requires isolation from other nodes in the network; and
isolating the node determined to require isolation by a management processor corresponding to the node powering off an application processor for the node.
2. The method of claim 1 , wherein the management processor domain comprises the management processors but not the application processors.
3. The method of claim 1 , further comprising:
running the management processors within a security zone; and
running the application processors within a normal security zone.
4. The method of claim 1 , further comprising running, by the management processors, verified code.
5. The method of claim 1 , further comprising communicating, by the management processors, sensitive information with one another.
6. The method of claim 1 , further comprising providing, by the management processors, out-of-band security for the nodes.
7. A system on a chip (SoC) node comprising:
a management processor configured to generate management information;
an application processor coupled to the management processor;
a routing header unit configured to attach a routing header to the management information to form a management information routing frame, wherein the routing header includes a management processor domain indicator which specifies that the management information routing frame is to remain within a management processor domain during routing;
determine a node in the network requires isolation from other nodes in the network; and
isolate the node determined to require isolation by a management processor corresponding to the node powering off an application processor for the node.
8. The SoC node of claim 7 , wherein the management processor is further configured to run within a security zone, and wherein the application processor is configured to run within a normal security zone.
9. The SoC node of claim 7 , further comprising a media access control (MAC) associated with the management processor, wherein the MAC is configured to form a MAC packet for the management information, and wherein the routing header unit is further configured to attach the routing header to the MAC packet.
10. The SoC node of claim 7 , wherein the management processor runs an embedded operating system (OS), and wherein the application processor runs a standard OS.
11. The SoC node of claim 7 , wherein the management processor domain indicator is one bit.
12. The SoC node of claim 7 , wherein the management processor is in the management processor domain, and wherein the application processor is not in the management processor domain.
13. A system on a chip (SoC) node fabric comprising:
nodes interconnected to each other to form a fabric, wherein each node includes:
a management processor configured to generate management information;
an application processor coupled to the management processor; and
a routing header unit configured to attach a routing header to the management information to form a management information routing frame, wherein the routing header comprises a management processor domain indicator which specifies that the management information routing frame is to remain within a management processor domain during routing;
determine a node in the network requires isolation from other nodes in the network; and
isolate the node determined to require isolation by a management processor corresponding to the node powering off an application processor for the node.
14. The SoC node fabric of claim 13 , wherein the management processors run within a security zone, and wherein the application processors run within a normal security zone.
15. The SoC node fabric of claim 13 , wherein the management processor domain comprises the management processors but not the application processors.
16. The SoC node fabric of claim 13 , wherein the management processors are further configured to run verified code thereon.
17. The SoC node fabric of claim 13 , wherein the management processors provide out-of-band security for the nodes.
18. The SoC node fabric of claim 13 , wherein the management processor domain comprises a gateway media access control (MAC).