Method, apparatus, and system for manageability and secure routing and endpoint access
A solution is presented to securing endpoints without the need for a separate bus or communication path. The solution allows for controlling access to endpoints by utilizing a management protocol by overlapping with existing interconnect communication paths in a packet format and utilizing a PCI address BDF (Bus number, Device number, and Function number) for verification.
1. A method for managing a secure endpoint comprising:
defining a first class and a second class of Management Component Transport Protocol (MCTP) endpoints;
assigning a Bus number, Device number, and Function number to the first class of MCTP endpoints;
verifying, in a device of the second class of MCTP endpoints, a request from a device of the first class of MCTP endpoints based at least in part on the BDF of the device of the first class of MCTP endpoints and an access control list maintained by the second class of MCTP endpoints, wherein the request is included in a Vendor Defined Message packet.
2. The method of claim 1 wherein the device of the first class of MCTP endpoints is a Privileged MCTP Endpoint (PME).
3. The method of claim 1 wherein the device of the second class of MCTP endpoints is a Service Provider MCTP Endpoint (SPME).
4. The method of claim 1 further comprising maintaining, in the device of the second class of MCTP endpoints, an Address Validation List to prevent spoofing of the first class of MCTP endpoints.
5. The method of claim 1 wherein the device of the first class of MCTP endpoints is a Baseboard Management Controller.
6. The method of claim 1 wherein the device of the first class of MCTP endpoints is a trusted embedded controller.
7. The method of claim 1 wherein the second class of MCTP endpoints includes one or more of a Network Interface Card), graphics controller, a storage controller, a Central Processing Unit.
8. The method of claim 1 wherein the device of the second class of MCTP endpoints is a graphics controller.
9. The method of claim 1 wherein the device of the second class of MCTP endpoints is a storage controller.
10. The method of claim 1 wherein the device of the second class of MCTP endpoints includes a Central Processing Unit.
11. A logic circuit to manage secure endpoints comprising:
a decode circuit to receive a packet including a Management Component Transport Protocol (MCTP) packet from an endpoint in a first class of MCTP endpoints and to decode, in an endpoint in a second class of MCTP endpoints, a source field of the packet that contains a Bus number, Device number, and Function number (BDF); and
an enable circuit, in the endpoint in the second class of MCTP endpoints, to allow the request to be processed based at least in part on the BDF of the device of the first class of MCTP endpoints and a list of secure endpoints maintained in the endpoint in the second class of MCTP endpoints.
12. The logic circuit of claim 11 wherein the endpoint in the first class of MCTP endpoints is a Baseboard Management Controller.
13. A method for managing a secure endpoint comprising:
defining a first class and a second class of Management Component Transport Protocol (MCTP) endpoints;
assigning a Bus number, Device number, and Function number (BDF) to the first class of MCTP endpoints; and
verifying, in a device of the second class of MCTP endpoints, a request from a device of the first class of MCTP endpoints based at least in part on the BDF of the device of the first class of MCTP endpoints and a configurable access control list maintained by the second class of MCTP endpoints, wherein the request is included in a Vendor Defined Message (VDM) packet.
14. The method of claim 13 further comprising maintaining an address validation list to prevent spoofing of the first class of MCTP endpoints.
15. The method of claim 14 wherein the address validation list is maintained by Address Validation Filter logic in a root port or switch port.
16. The method of claim 13 wherein the configurable access control list is a static Privileged MCTP Endpoint (PME) list and contains a management engine BDF.
17. The method of claim 13 wherein the configurable access control list is a boot time programmable Privileged MCTP Endpoint (PME) list that has a Baseboard Management Controller (BMC) that may change the respective physical location and bus number from one platform to another and allows for a trusted embedded controller to obtain this information from the BMC.
18. The method of claim 13 wherein the configurable access control list is a runtime programmable Privileged MCTP Endpoint (PME) list that utilizes a bus renumbering flow to allow for runtime changes to the PME list.
19. The method of claim 13 wherein the configurable access control list is programmable by a trusted embedded controller that is a Management Engine (ME).