Remote access controller in-band access system
View Patent ↗An in-band remote access controller access system includes a remote access controller. A Basic Input/Output System (BIOS) that is coupled to the remote access controller and includes a BIOS storage that stores a configuration table including a plurality of function definitions that are configured to provide for the management of an in-band communication session with the remote access controller. A secure storage system includes boot security information that is configured to provide for the performance of a managed boot of the BIOS. A processing system provides, to the remote access controller using at least one of the plurality of function definitions, application security information provided by an application requesting access to the remote access controller. The remote access controller authenticates the application security information using the boot security information and, in response, establishes a communication session with the application.
1. An in-band remote access controller access system, comprising:
a chassis;
a remote access controller that is located in the chassis and that is configured to provide out-of-band access through a network to a computing device;
a Basic Input/Output System (BIOS) that is located in the chassis and coupled to the remote access controller, wherein the BIOS includes a BIOS storage that stores a configuration table including a plurality of function definitions that are configured to provide for management of an in-band communication session with the remote access controller;
a secure storage system coupled to the BIOS and the remote access controller, wherein the secure storage system includes boot security information that is configured to provide for performance of a managed boot of the BIOS; and
a processing system that is located in the chassis and coupled to the BIOS and the remote access controller, wherein the processing system is configured to:
provide, to the remote access controller using at least one of the plurality of function definitions that was written to a system memory by the BIOS during the managed boot, application security information provided by an application requesting access to the remote access controller, and wherein the remote access controller is configured to:
authenticate the application security information using the boot security information and, in response, establish a communication session with the application.
2. The system of claim 1 , wherein the BIOS is configured to provide the plurality of function definitions to the processing system during the managed boot in order to provide for the management of an in-band communication session with the remote access controller.
3. The system of claim 1 , wherein the configuration table is an Advanced Configuration and Power Interface (ACPI) table.
4. The system of claim 1 , wherein the application security information includes an application public key, and a session identifier and a time stamp that are encrypted by an application private key.
5. The system of claim 4 , wherein the authenticating the application security information using the boot security information includes:
verifying, by the remote access controller, that the application public key is present in the boot security information; and
decrypting, by the remote access controller, the time stamp and the session identifier using the application public key.
6. The system of claim 4 , wherein the remote access controller is configured to validate the time stamp for a predetermined timeout threshold.
7. The system of claim 1 , wherein the providing the remote access controller the application security information provided by the application requesting access to the remote access controller includes:
using Shared Memory Access (SMA) to provide the application security information to the remote access controller.
8. An information handling system (IHS), comprising:
a remote access controller;
a processing system coupled to the remote access controller; and
a memory system that is coupled to the processing system and that includes instructions that, when executed by the processing system, cause the processing system to provide a runtime engine that is configured to:
provide, to the remote access controller using at least one of a plurality of function definitions that are configured to provide for management of an in-band communication session with the remote access controller and that were written to the memory system by a BIOS during a managed boot from a configuration table, application security information provided by an application requesting access to the remote access controller, and wherein the remote access controller is configured to:
authenticate the application security information using boot security information stored in a secure storage system coupled to the remote access controller and, in response, establish a communication session with the application.
9. The IHS of claim 8 , wherein the memory system receives the plurality of function definitions from the BIOS during the managed boot in order to provide for the management of an in-band communication session with the remote access controller.
10. The IHS of claim 8 , wherein the configuration table is an Advanced Configuration and Power Interface (ACPI) table.
11. The IHS of claim 8 , wherein the application security information includes an application public key, and a session identifier and a time stamp that are encrypted by an application private key.
12. The IHS of claim 11 , wherein the authenticating the application security information using the boot security information includes:
verifying, by the remote access controller, that the application public key is present in the boot security information; and
decrypting, by the remote access controller, the time stamp and the session identifier using the application public key.
13. The IHS of claim 11 , wherein the remote access controller is configured to validate the time stamp for a predetermined timeout threshold.
14. The IHS of claim 8 , wherein the providing the remote access controller the application security information provided by the application requesting access to the remote access controller includes:
using Shared Memory Access (SMA) to provide the application security information to the remote access controller.
15. A method of providing in-band access to a remote access controller, comprising:
providing, by a processing system to a remote access controller using at least one of a plurality of function definitions that are configured to provide for management of an in-band communication session with the remote access controller and that were provided to a processing system by a BIOS during a managed boot from a configuration table, application security information provided by an application requesting access to the remote access controller;
receiving, by the processing system, a notification that the remote access controller has authenticated the application security information using boot security information stored in a secure storage system coupled to the remote access controller and in response, established a communication session with the application; and
providing, by the processing system, communications between the remote access controller and the application.
16. The method of claim 15 , wherein the configuration table is an Advanced Configuration and Power Interface (ACPI) table.
17. The method of claim 15 , wherein the application security information includes an application public key, and a session identifier and a time stamp that are encrypted by an application private key.
18. The method of claim 17 , wherein the authenticating the application security information using the boot security information by the remote access controller includes:
verifying, by the remote access controller, that the application public key is present in the boot security information; and
decrypting, by the remote access controller, the time stamp and the session identifier using the application public key.
19. The method of claim 17 , wherein the authenticating the application security information using the boot security information by the remote access controller includes:
validating, by the remote access controller, the time stamp for a predetermined timeout threshold.
20. The method of claim 15 , wherein the providing the remote access controller the application security information provided by the application requesting access to the remote access controller includes:
using, by the processing system, Shared Memory Access (SMA) to provide the application security information to the remote access controller.