Current monitor for security
An apparatus includes an interface for an electronic device and a baseboard management controller (BMC). The BMC includes circuitry configured to, through the interface, monitor current usage by the electronic device, determine a security status of the electronic device based upon the current usage, and take a corrective action based upon the security status.
1. An apparatus, comprising:
an interface for an electronic device; and
a baseboard management controller (BMC) including circuitry configured to:
through the interface, monitor current usage by the electronic device;
determine a security status of the electronic device based upon the current usage; and
take a corrective action based upon the security status.
2. The apparatus of claim 1 , wherein determining the security status of the electronic device based upon the current usage includes evaluating the current usage and a temperature of the electronic device.
3. An apparatus, comprising:
an interface for an electronic device; and
a baseboard management controller (BMC) including circuitry configured to:
through the interface, monitor current usage by the electronic device;
determine a security status of the electronic device based upon the current usage through evaluating the current usage and usage load of a resource of the electronic device; and
take a corrective action based upon the security status.
4. The apparatus of claim 1 , wherein the BMC controller is further configured to retrieve logging data from a memory of the electronic device based upon a determination that the electronic device has been compromised in a security attack.
5. An apparatus, comprising:
an interface for an electronic device; and
a baseboard management controller (BMC) including circuitry configured to:
through the interface, monitor current usage by the electronic device;
determine a security status of the electronic device based upon the current usage;
determine an indication of malware or a security breach on the electronic device based on the security status;
selectively power down or reconfigure one or more components of the electronic device based on the determination of malware or the security breach;
isolate firmware and UEFI from a processor of the electronic device based on the determination of malware or the security breach; and
prevent reboot of the electronic device after a non-operational state detection based on the determination of malware or the security breach.
6. The apparatus of claim 1 , wherein the BMC controller is further configured to:
determine a security attack on the electronic device;
reboot the electronic device; and
perform a corrective action upon the reboot of the electronic device in response to the security attack.
7. The apparatus of claim 1 , wherein the BMC controller is further configured to:
determine that the current usage is above an expected value;
based on the determination that the current usage is above the expected value, determine that the security status of the electronic device is compromised.
8. The apparatus of claim 1 , wherein the BMC controller is further configured to:
evaluate current usage of a specific subcomponent of the electronic device; and
determine the security status of the electronic device based upon the current usage of the specific subcomponent of the electronic device.
9. The apparatus of claim 8 , wherein the specific subcomponent of the electronic device is a drive caddy and the BMC controller is further configured to determine that the current usage is above an expected value for the drive caddy and, as a result, determine that the security status of the electronic device is compromised.
10. The apparatus of claim 8 , wherein the specific subcomponent of the electronic device is a drive caddy and the BMC controller is further configured to determine that the current usage is above an expected value for the drive caddy and, as a result, determine that the security status of the electronic device is compromised by unauthorized data encryption.
11. An apparatus, comprising:
an interface for an electronic device; and
a baseboard management controller (BMC) including circuitry configured to:
through the interface, monitor current usage by the electronic device;
evaluate current usage of a specific subcomponent of the device; and
determine a security status of the electronic device based upon the current usage of the specific subcomponent of the device; wherein:
the specific subcomponent of the electronic device is a processor; and
the BMC controller is further configured to determine that the current usage is above an expected value for the processor and, as a result, determine that the security status of the electronic device is compromised by unauthorized computer intensive server operations.
12. An apparatus, comprising:
an interface for an electronic device; and
a baseboard management controller (BMC) including circuitry configured to:
through the interface, monitor current usage by the electronic device;
evaluate current usage of a specific subcomponent of the device; and
determine a security status of the electronic device based upon the current usage of the specific subcomponent of the device; wherein:
the specific subcomponent of the electronic device is a processor; and
the BMC controller is further configured to determine that the current usage is above an expected value for the processor and, as a result, determine that the security status of the electronic device is compromised by unauthorized server resource exhaustion.
13. The apparatus of claim 8 , wherein the specific subcomponent of the electronic device is a processor and the BMC controller is further configured to determine that the current usage is above an expected value for the processor and, as a result, determine that the security status of the electronic device is compromised by unauthorized server resource usage.
14. The apparatus of claim 8 , wherein the specific subcomponent of the electronic device is a processor and the BMC controller is further configured to determine that the current usage is below an expected value for the processor and, as a result, determine that the security status of the electronic device is compromised by a denial-of-service attack.
15. A method, comprising:
at a baseboard management controller (BMC) and through an interface for an electronic device, monitoring current usage by an electronic device;
determining a security status of the electronic device based upon the current usage;
determining an indication of malware or a security breach on the electronic device based on the security status;
selectively powering down or reconfiguring one or more components of the electronic device based on the determination of malware or the security breach;
isolating firmware and UEFI from a processor of the electronic device based on the determination of malware or the security breach; and
preventing reboot of the electronic device after a non-operational state detection based on the determination of malware or the security breach.
16. An article of manufacture including a non-transitory machine-readable medium, the medium including instructions, the instructions, when loaded and executed by a processor, cause the processor to, at a baseboard management controller:
access a server through a server interface;
through the interface, monitor current usage by an electronic device communicatively coupled to the server;
determine a security status of the electronic device based upon the current usage;
determine an indication of malware or a security breach on the electronic device based on the security status;
selectively power down or reconfigure one or more components of the electronic device based on the determination of malware or the security breach;
isolate firmware and UEFI from a processor of the electronic device based on the determination of malware or the security breach; and
prevent reboot of the electronic device after a non-operational state detection based on the determination of malware or the security breach.
17. A method, comprising:
at a baseboard management controller (BMC) and through an interface for an electronic device, monitoring current usage by an electronic device;
determining a security status of the electronic device based upon the current usage through evaluating the current usage and a usage load of a resource of the electronic device; and
taking a corrective action based upon the security status.
18. A method, comprising:
at a baseboard management controller (BMC) and through an interface for an electronic device, monitoring current usage by an electronic device;
monitoring current usage by the electronic device;
evaluating current usage of a specific subcomponent of the device; and
determining a security status of the electronic device based upon the current usage of the specific subcomponent of the device;
wherein:
the specific subcomponent of the electronic device is a processor; and
the method comprises determining that the current usage is above an expected value for the processor and, as a result, determining that the security status of the electronic device is compromised by unauthorized computer intensive server operations.
19. A method, comprising:
at a baseboard management controller (BMC) and through an interface for an electronic device, monitoring current usage by an electronic device;
monitoring current usage by the electronic device;
evaluating current usage of a specific subcomponent of the device; and
determining a security status of the electronic device based upon the current usage of the specific subcomponent of the device;
wherein:
the specific subcomponent of the electronic device is a processor; and
the method comprises determining that the current usage is above an expected value for the processor and, as a result, determining that the security status of the electronic device is compromised by unauthorized server resource exhaustion.
20. An article of manufacture including a non-transitory machine-readable medium, the medium including instructions, the instructions, when loaded and executed by a processor, cause the processor to, at a baseboard management controller:
access a server through a server interface;
through the interface, monitor current usage by an electronic device communicatively coupled to the server;
determine a security status of the electronic device based upon the current usage and usage load of a resource of the electronic device; and
take a corrective action based upon the security status.
21. An article of manufacture including a non-transitory machine-readable medium, the medium including instructions, the instructions, when loaded and executed by a processor, cause the processor to, at a baseboard management controller:
access a server through a server interface;
through the interface, monitor current usage by an electronic device communicatively coupled to the server;
evaluate current usage of a specific subcomponent of the device; and
determine a security status of the electronic device based upon the current usage of the specific subcomponent of the device; and
take a corrective action based upon the security status;
wherein:
the specific subcomponent of the electronic device is a processor; and
the processor is further caused to determine that the current usage is above an expected value for the processor and, as a result, determine that the security status of the electronic device is compromised by unauthorized computer intensive server operations.
22. An article of manufacture including a non-transitory machine-readable medium, the medium including instructions, the instructions, when loaded and executed by a processor, cause the processor to, at a baseboard management controller:
access a server through a server interface;
through the interface, monitor current usage by an electronic device communicatively coupled to the server;
evaluate current usage of a specific subcomponent of the device; and
determine a security status of the electronic device based upon the current usage of the specific subcomponent of the device; and
take a corrective action based upon the security status;
wherein:
the specific subcomponent of the electronic device is a processor; and
the processor is further caused to determine that the current usage is above an expected value for the processor and, as a result, determine that the security status of the electronic device is compromised by unauthorized server resource exhaustion.