Workspace-based fixed pass-through monitoring system and method for hardware devices using a baseboard management controller (BMC)
An Information Handling System (IHS) includes multiple hardware devices, and a baseboard Management Controller (BMC) in communication with the plurality of hardware devices. The BMC includes executable instructions for monitoring the operating characteristics a hardware device that is operating in a fixed pass-through configuration with a workspace in which the workspace has been instantiated by a workspace orchestration service executed on the IHS. The executable instructions may determine that the operating characteristics are indicative of a security breach of the fixed pass-through configuration, and as such, may perform an operation to quarantine the one hardware device when the fixed pass-through configuration is determined to possess the security breach.
1. An Information Handling System (IHS), comprising:
a plurality of hardware devices; and
a Baseboard Management Controller (BMC) in communication with the plurality of hard ware devices, the BMC comprising instructions that are executable by at least one processor to:
monitor one or more operating characteristics of at least one hardware device of the plurality of hardware devices to determine whether or not a fault comprising the one or more operating characteristics has been occurring at a rate that exceeds a specified threshold, wherein the at least one hardware device is operating in a fixed pass-through configuration with a workspace, wherein the workspace has been instantiated by a workspace orchestration service executed on the IHS, and wherein the one or more operating characteristics comprise at least one of: an input/output (I/O) device fault, a correctable error, an uncorrectable error, an improper memory access request, or a page fault, and wherein the at least one hardware device comprises a Security Protocol and Data Model (SPDM)-enabled hardware device;
perform a mutual authentication procedure with the SPDM-enabled hardware device to form a SPDM-based trusted network between the SPDM-enabled hardware device and the BMC;
determine that the operating characteristics are indicative of a security breach of the fixed pass-through configuration; and
perform an operation to quarantine the at least one SPDM-enabled hardware device when the fixed pass-through configuration is determined to possess the security breach by maintaining the quarantined at least one SPDM-enabled hardware device in a quarantine state until a firmware update procedure has been performed on the at least one SPDM-enabled hardware device.
2. The IHS of claim 1 , wherein the instructions are further executed to perform the operation to quarantine the at least one hardware device by removing the SPDM-enabled hardware device from the SPDM-based trusted network.
3. The IHS of claim 1 , wherein the instructions are further executed to perform the operation to quarantine the at least one hardware device by performing a device detach operation on the SPDM-enabled hardware device.
4. The IHS of claim 1 , wherein the instructions are further executed to perform the operation to quarantine the at least one hardware device by setting an Advanced Configuration and Power Interface (ACPI) state of the SPDM-enabled hardware device to an off state.
5. The IHS of claim 1 , wherein the fixed pass-through configuration comprises a Peripheral Component Interconnect Express (PCIe) pass-through configuration.
6. The IHS of claim 1 , wherein the fault comprises at least one of an input/output memory management unit (IOMMU) page fault, a VT-d page fault, or a Peripheral Component Interconnect Express (PCIe) uncorrectable error.
7. A fixed pass-through monitoring method comprising:
monitoring, using instructions stored in at least one memory and executed by at least one processor, one or more operating characteristics of at least one hardware device of a plurality of hardware devices to determine whether or not a fault comprising the one or more operating characteristics has been occurring at a rate that exceeds a specified threshold, wherein the at least one hardware device is operating in a fixed pass-through configuration with a workspace using a Baseboard Management Controller (BMC) in communication with the plurality of hardware devices of an Information Handling System (IHS), wherein the workspace has been instantiated by a workspace orchestration service executed on the IHS, wherein the one or more operating characteristics comprise at least one of: an input/output (I/O) device fault, an improper memory access request, or a page fault, and wherein the at least one hardware device comprises a Security Protocol and Data Model (SPDM)-enabled hardware device;
performing a mutual authentication procedure with the SPDM-enabled hardware device to form a SPDM-based trusted network between the SPDM-enabled hardware device and the BMC;
determining, using the instructions, that the one or more operating characteristics are indicative of a security breach of the fixed pass-through configuration, based at least in part on determining that at least one of the one or more operating characteristics represents an uncorrectable error; and
performing, using the instructions, an operation to quarantine the at least one SPDM-enabled hardware device when the fixed pass-through configuration is determined to possess the security breach by maintaining the quarantined at least one SPDM-enabled hardware device in a quarantine state until a firmware update procedure has been performed on the at least one SPDM-enabled hardware device.
8. The fixed pass-through monitoring method of claim 7 , further comprising performing the operation to quarantine the at least one hardware device by removing the SPDM-enabled hardware device from the SPDM-based trusted network.
9. The fixed pass-through monitoring method of claim 7 , further comprising performing the operation to quarantine the at least one hardware device by performing a device detach operation on the SPDM-enabled hardware device.
10. The fixed pass-through monitoring method of claim 7 , further comprising performing the operation to quarantine the at least one hardware device by setting an Advanced Configuration and Power Interface (ACPI) state of the SPDM-enabled hardware device to an off state.
11. An Information Handling System (IHS), comprising:
first and second Security Protocol and Data Model (SPDM)-enabled hardware devices, the first SPDM-enabled hardware device comprising instructions that are executable by at least one processor to:
monitor one or more operating characteristics of the second SPDM-enabled hardware device, to determine whether or not a fault comprising one or more operating characteristics has been occurring at a rate that exceeds a specified threshold, wherein the second SPDM-enabled hardware device is operating in a fixed pass-through configuration with a workspace, wherein the workspace has been instantiated by a workspace orchestration service executed on the IHS, and wherein the one or more operating characteristics comprise at least one of: an input/output (I/O) device fault, an improper memory access request, or a page fault;
perform a mutual authentication procedure with the second SPDM-enabled hardware device to form a SPDM-based trusted network between the second SPDM-enabled hardware device and the BMC;
determine that the operating characteristics are indicative of a security breach of the fixed pass-through configuration, wherein the determination is based at least in part on determining that at least one of the one or more operating characteristics represents an uncorrectable error, using error severity information obtained from an interface bus configured to be coupled with the second hardware device; and
perform an operation to quarantine the second SPDM-enabled hardware device when the fixed pass-through configuration is determined to possess the security breach by maintaining the quarantined second SPDM-enabled hardware device in a quarantine state until a firmware update procedure has been performed on the second SPDM-enabled hardware device.
12. The IHS of claim 11 , wherein the instructions are further executed to perform the operation to quarantine the second SPDM-enabled hardware device by at least one of removing the second SPDM-enabled hardware device from the SPDM-based trusted network, performing a device detach operation on the second SPDM-enabled hardware device, or by setting an Advanced Configuration and Power Interface (ACPI) state of the second SPDM-enabled hardware device to an off state.