BMC system based on SO-DIMM module form

Abstract

The invention discloses a BMC (Baseboard Management Controller) system based on an SO-DIMM module form, which consists of hardware and software, realizes a four-layer security protection architecture through a software and hardware decoupling architecture, comprises a hardware security layer, a firmware security layer, a system security layer and an application security layer, supports five hardware-level encryption and decryption algorithms, namely SM2, SM3, SM4, AES and SHA2, and realizes complete trust chain verification based on a physical trusted root. A complete remote management control closed loop is constructed at different physical positions and logic levels, various functions of a BMC system are achieved, and the system further supports a two-factor authentication mechanism and a PID intelligent heat dissipation control algorithm and has enhanced safety and credibility and intelligent management characteristics.

Description

TECHNICAL FIELD

[0001] The application belongs to the technical field of server management, and is suitable for the management and maintenance of server equipment, and mainly relates to a BMC system based on an SO-DIMM module form. BACKGROUND

[0002] With the continuous development of servers, storage devices and data center infrastructures, the remote management capability of the system has become an important means to ensure the stable operation of the equipment, and the performance and security requirements of the server for the BMC system are higher and higher. The traditional server management scheme mainly relies on operating system level tools for monitoring and maintenance, but in the case of operating system crash or network interruption, it is difficult to guarantee the controllability and maintainability of the system. In order to solve the above problems, the industry widely uses Baseboard Management Controller (BMC) as an auxiliary management controller independent of the main processor. BMC is usually deployed on the server motherboard, equipped with an independent embedded processor, memory and network interface, and runs a complete embedded firmware system, which is used to realize remote monitoring, control, recovery, log recording, sensor management and other functions.

[0003] The traditional BMC solution such as ASPEED AST2500 / AST2600 series chip has been widely used in the industry, but such solution lacks flexibility and is not convenient for modular replacement or maintenance. And the support for secure boot process is not flexible enough. Therefore, there is an urgent need for a BMC solution that supports modular replacement and enhances security mechanisms to improve the controllability, maintainability and security of the server management system. SUMMARY

[0004] The present application is exactly aimed at the problems of the existing BMC scheme platform, such as fixed, poor expansibility, weak security capability, poor heat dissipation, etc. A BMC system based on SO-DIMM module form is provided, which is composed of hardware and software. Through the architecture of soft and hard decoupling, a four-layer security protection architecture is realized, including hardware security layer, firmware security layer, system security layer and application security layer, supporting 5 kinds of hardware level encryption and decryption algorithms of SM2, SM3, SM4, AES, SHA2, realizing complete trust chain verification based on physical trusted root. The present application realizes the functions of the BMC system by building a complete remote management control closed loop in different physical positions and logical levels. The system also supports two-factor authentication mechanism and PID intelligent heat dissipation control algorithm, and has enhanced security and trustworthiness and intelligent management characteristics.

[0005] To achieve the above objectives, the technical solution adopted by this invention is: a BMC system based on SO-DIMM modules, comprising at least a four-layer security architecture: a hardware security layer, a firmware security layer, a system security layer, and an application security layer. Each layer establishes a trust chain relationship through cryptographic methods, supporting a two-factor authentication mechanism of client certificate + password, thereby achieving secure storage and communication within the BMC system; wherein,

[0006] The hardware security layer: Based on the cryptographic algorithm engine built into the system chip, the cryptographic algorithm function is implemented in hardware.

[0007] The firmware security layer implements a complete trust chain verification from ROM code → BL1 (SPL) → BL2 (U-Boot) → Kernel → file system; each level performs digital signature verification on the next level, and stops the boot process if the verification fails.

[0008] The system security layer implements role-based access control, including but not limited to administrators, operators, and read-only users, with different permission levels set. Sensitive data is encrypted and stored using the SM4 algorithm, and the key is generated and managed through a hardware cryptographic algorithm engine.

[0009] The application security layer supports two-way SSL authentication, with the client and server mutually verifying certificates, and supports concurrent connection limits to prevent denial-of-service attacks.

[0010] As an improvement of the present invention, the system chip in the hardware security layer adopts Phytium E2000S, which integrates 64K bits OTP and has a built-in 64-bit unique chip ID as the hardware basis for device identification. The cryptographic algorithm engine supports multi-host access.

[0011] The firmware security layer includes a key certificate and a content certificate. The key certificate stores the hash value of the public key, and the content certificate stores the hash value of the image file. The firmware security layer supports encrypted storage of the image and uses the AES-256 algorithm to encrypt and protect critical firmware.

[0012] In the system security layer, all non-query operations are recorded in audit logs. The log content includes, but is not limited to, timestamps, operation interfaces, source IPs, user identities, and executed actions. It also supports at least IP address whitelists, MAC address filtering, and time window restrictions.

[0013] The application security layer uses the HTTPS protocol.

[0014] As an improvement to this invention, the cryptographic methods for establishing trust chains at each layer of the security architecture include at least the SM2 algorithm, SM3 algorithm, SM4 algorithm, AES algorithm, and SHA2 algorithm; wherein,

[0015] SM2 Algorithm: Elliptic Curve Cryptography, using a 256-bit key length, based on elliptic curves. To achieve this, key pair generation uses hardware-based true random numbers;

[0016] SM3 algorithm: a cryptographic hash algorithm that supports both Normal and HMAC working modes, outputs a 256-bit hash value, and supports hash operations on messages of arbitrary length;

[0017] SM4 algorithm: a block cipher algorithm that supports four working modes: ECB, CBC, CTR, and OFB, and uses a 128-bit block length and a 128-bit key length.

[0018] AES algorithm: Supports 128 / 192 / 256-bit key lengths, and working modes include ECB, CBC, CTR, and OFB;

[0019] SHA2 algorithm: Supports at least SHA-224, SHA-256, SHA-384, and SHA-512 output lengths.

[0020] As another improvement of the present invention, in the client certificate + password two-factor authentication mechanism,

[0021] Client certificate authentication: The key length is no less than 2048 bits. The certificate content includes the validity period, subject information, public key information, and digital signature. The BMC system maintains a list of trusted Certificate Authorities (CAs) and supports Certificate Revocation List (CRL) checks and Online Certificate Status Protocol (OCSP) verification. Connections are rejected and security logs are recorded when certificate verification fails.

[0022] Password authentication: Password length 8-32 characters, must contain uppercase and lowercase letters, numbers and special characters; custom configuration of password complexity strategy is supported.

[0023] As another improvement of the present invention, the authentication steps of the two-factor authentication mechanism include:

[0024] (1) The client presents a digital certificate, and the server verifies the validity of the certificate;

[0025] (2) The user enters the username and password, and the server verifies the identity information;

[0026] (3) After the two-factor authentication is successful, an encrypted session is established and a session token is generated;

[0027] (4) Assign corresponding operation permissions according to user roles;

[0028] (5) Refresh the session token regularly and automatically cancel it after the timeout to manage the session.

[0029] As another improvement of the present invention, the secure storage and communication of the BMC system includes at least the following steps:

[0030] S1. Sensitive data encrypted storage: User passwords are hashed using the PBKDF2 algorithm and then iteratively processed. Configuration files are encrypted using the SM4 algorithm. The key is generated by the hardware cryptographic engine.

[0031] S2. Secure communication protocol: HTTPS is mandatory, using the ECDHE-RSA-AES256-GCM-SHA384 strong cryptographic suite, supporting self-signed certificates and third-party CA certificates, and using temporary key exchange;

[0032] S3, Security Audit and Monitoring: Records all security events of the system and provides real-time alerts for abnormal events, supporting automatic blocking of abnormal IPs and temporary account locking.

[0033] As another improvement of the present invention, in step S1 of realizing secure storage and communication of the BMC system, when sensitive data is encrypted and stored, a dual-mirror backup mechanism is supported, with automatic synchronization and fault switching between primary and backup mirrors, and private key information is stored only in the hardware security area; in step S3 of comprehensive auditing records, the SM3 algorithm is used to verify the integrity of log files.

[0034] As a further improvement of the present invention, a heat dissipation management module is also included, which monitors the ambient temperature of the environment, devices, or components, monitors the ambient temperature of the system's intake and exhaust air, and manages the fan speed accordingly; specifically, the management involves incorporating a sampling period into a conventional incremental PID algorithm.

[0035]

[0036] in, , for time, Constant fan PWM value for Real-time fan PWM increment , , These are the proportional coefficient, integral coefficient, and differential coefficient. , , for time, time, Temperature at all times for The difference between the temperature sensor reading and the set value at any given time. This refers to the temperature sensing sampling period;

[0037] When system deviation ℃, That is, the fan speed remains constant; when ℃, calculated according to the incremental PID standard algorithm.

[0038] As a further improvement of the present invention, the heat dissipation management module also includes an over-temperature protection control strategy. If the system continuously monitors the temperatures of CPU0 and CPU1 and the air inlet temperature and maintains the CPU temperature ≥90℃ or the air inlet temperature ≥55℃ for 5 consecutive cycles, the power will be cut off immediately. If the air inlet temperature is ≥50℃ for 95% of the time within 24 hours, it will be observed for another 24 hours. If it is ≥50℃ for 5 consecutive cycles again thereafter, the power will be cut off. If none of the above situations occur, the server continues to operate normally.

[0039] Compared with the prior art, the present invention has the following beneficial effects:

[0040] (1) The system of the present invention uses the domestic Phytium E2000S processor to achieve the adaptation and isolation between the hardware platform and the software system, which not only ensures the flexible expansion of the system, but also facilitates upgrades and maintenance, and has good portability and platform compatibility.

[0041] (2) The present invention adopts the SO-DIMM form conforming to the JEDEC standard, which can be plugged into the motherboard slot to realize modular deployment, facilitate replacement and maintenance, and improve the assembly efficiency and maintainability of the whole machine product.

[0042] (3) The present invention simultaneously constructs a four-layer security protection architecture including a hardware security layer, a firmware security layer, a system security layer and an application security layer, supports national cryptographic algorithms such as SM2, SM3, and SM4 and a two-factor authentication mechanism, which greatly improves the security and reliability of the system.

[0043] (4) The system is specially equipped with a heat dissipation management module, which integrates the PID intelligent heat dissipation control algorithm and uses an over-temperature protection control strategy to further ensure the effectiveness and high safety of the system and realize intelligent management. Attached Figure Description

[0044] Figure 1 This is a schematic diagram of the four-layer security protection architecture in the system of this invention;

[0045] Figure 2 This is a flowchart illustrating the steps of the over-temperature protection control strategy in the thermal management module of the present invention. Detailed Implementation

[0046] The present invention will be further illustrated below with reference to the accompanying drawings and specific embodiments. It should be understood that the following specific embodiments are for illustrative purposes only and are not intended to limit the scope of the invention.

[0047] Example 1

[0048] A BMC system based on SO-DIMM modules adopts a centralized BMC management and hardware-software decoupling architecture, consisting of two main modules: hardware and software. The BMC system hardware features a modular design, with an overall structure that meets the JEDEC DDR4 SO-DIMM interface specification requirements. It can be installed via standard SO-DIMM slots, offering plug-and-play functionality, high interchangeability, and domestic substitutability. The software is deployed at different physical locations and logical levels, constructing a complete remote management and control closed loop. It is highly modular and implements all functions of the BMC system. This system employs a four-layer security protection architecture, such as... Figure 1 As shown, it includes a hardware security layer, a firmware security layer, a system security layer, and an application security layer. Each layer establishes a trust chain relationship through cryptographic methods, supports a two-factor authentication mechanism of client certificate + password, and realizes secure storage and communication.

[0049] The four-layer security architecture specifically includes:

[0050] Hardware security layer: Based on the cryptographic algorithm engine built into the Phytium E2000S chip, this engine implements cryptographic algorithm functions in hardware and has a dedicated physical random source; the chip integrates 64K bits of OTP (One-Time Programmable Memory) to store the root trust key ROTPK (Root of Trust Public Key); it has a built-in 64-bit unique chip ID as the hardware basis for device identification; it supports a true random number generator to provide a high-quality random number source for cryptographic operations; the cryptographic algorithm engine supports multi-host access to resolve conflicts caused by simultaneous access from different environments.

[0051] Firmware security layer: Implements a complete trust chain verification from ROM code → BL1 (SPL) → BL2 (U-Boot) → Kernel → file system; each level performs digital signature verification on the next level, and stops the boot process if the verification fails; adopts X.509 v3 standard certificates, which are divided into two types: key certificates and content certificates; the key certificate stores the hash value of the public key, and the content certificate stores the hash value of the image file; supports encrypted storage of the image, and uses the AES-256 algorithm to encrypt and protect critical firmware.

[0052] System security layer: Implements role-based access control (RBAC) and supports different permission levels such as administrator, operator, and read-only user; all non-query operations are logged in audit logs, including timestamp, operation interface, source IP, user identity, and executed action; supports multi-dimensional access control such as IP address whitelist, MAC address filtering, and time window restrictions; sensitive data is encrypted and stored using the SM4 algorithm, and the key is generated and managed through a hardware cryptographic algorithm engine.

[0053] Application security layer: Uses HTTPS protocol by default and supports TLS 1.2 and above; supports two-way SSL authentication, with the client and server mutually verifying certificates; implements session timeout management, automatically logging out after 60 minutes of inactivity by default; supports concurrent connection limits to prevent denial-of-service attacks.

[0054] The system in this embodiment supports five hardware-level encryption and decryption algorithms: SM2, SM3, SM4, AES, and SHA2, to achieve complete trust chain verification based on a physical root of trust; among them,

[0055] SM2 elliptic curve public-key cryptography algorithm: Supports complete functions such as signature verification, encryption, decryption, and key negotiation; conforms to the GM / T 0003-2012 national standard; uses a 256-bit key length and is based on elliptic curves. It supports digital signature generation time of <100ms and signature verification time of <80ms; key pair generation uses hardware true random numbers to ensure the unpredictability of keys.

[0056] SM3 cryptographic hash algorithm: Supports both Normal and HMAC working modes; conforms to the GM / T 0004-2012 national standard specification; outputs a 256-bit hash value with a processing efficiency >50MB / s; supports hash operations on messages of arbitrary length; used for scenarios such as integrity verification, digital signatures, and key derivation.

[0057] SM4 block cipher algorithm: supports four working modes: ECB, CBC, CTR, and OFB; conforms to the GM / T 0002-2012 national standard; adopts a 128-bit block length and a 128-bit key length; encryption and decryption processing speed >100MB / s; used for firmware image encryption, configuration data protection, and other scenarios.

[0058] It also includes compatibility with international standard algorithms. For example, the AES algorithm supports 128 / 192 / 256-bit key lengths and operating modes include ECB, CBC, CTR, and OFB; the SHA-2 algorithm supports multiple output lengths such as SHA-224, SHA-256, SHA-384, and SHA-512; and the RSA algorithm supports 1024 / 2048 / 3072 / 4096-bit key lengths for compatibility purposes.

[0059] The system supports two-factor authentication, including client certificate + password authentication; among which...

[0060] Client certificate authentication: Supports X.509 format client certificates with a key length of no less than 2048 bits; the certificate must include validity period, subject information, public key information, and digital signature; the BMC system maintains a list of trusted Certificate Authorities (CAs); supports Certificate Revocation List (CRL) checks and Online Certificate Status Protocol (OCSP) verification; connection is rejected and security logs are logged when certificate verification fails.

[0061] Enhanced password authentication: Password length 8-32 characters, must contain uppercase and lowercase letters, numbers, and special characters; supports password expiration setting, reminding users to change passwords 30 days before expiration; prohibits the use of 5 previous passwords to prevent password reuse; accounts are locked for 5 minutes after 5 consecutive failed login attempts, with lockout time increasing incrementally; supports custom configuration of password complexity policies.

[0062] Multi-factor authentication process:

[0063] First-factor authentication: The client presents a digital certificate, and the server verifies the validity of the certificate;

[0064] Second-factor authentication: The user enters their username and password, and the server verifies their identity information;

[0065] Session establishment: After successful two-factor authentication, an encrypted session is established and a session token is generated;

[0066] Permission allocation: Assign corresponding operation permissions based on user roles;

[0067] Session management: Refresh session tokens periodically and automatically cancel session upon timeout.

[0068] This system achieves secure storage and communication through the following steps:

[0069] Step S1: Encrypted storage of sensitive data: User passwords are hashed using the PBKDF2 algorithm with at least 10,000 iterations; configuration files are encrypted using the SM4 algorithm, with the key generated by a hardware cryptographic engine; key fields in log files are anonymized to prevent leakage of sensitive information; a dual-image backup mechanism is supported, with automatic synchronization and failover between primary and backup images; private key information is stored only in a hardware-secure area and cannot be exported.

[0070] Step S2, Secure Communication Protocol: HTTPS Forced Enable: TLS 1.2 and above are used by default, SSL 2.0 / 3.0 and TLS 1.0 / 1.1 are disabled; Cipher Suite Configuration: Strong cipher suites such as ECDHE-RSA-AES256-GCM-SHA384 are preferred; Certificate Management: Self-signed certificates and third-party CA certificates are supported, and automatic reminders are given before certificate expiration; Perfect Forward Secrecy: Temporary key exchange is used to ensure the security of historical communication data; HSTS Support: HTTP strict transport security is enabled to prevent protocol downgrade attacks.

[0071] Step S3, Security Audit and Monitoring: Comprehensive Audit Log: Records all security events such as configuration changes, user logins, and permission operations; Real-time Monitoring and Alarms: Provides real-time alarms for abnormal logins, privilege escalation, configuration tampering, and other behaviors; Log Integrity Protection: Uses the SM3 algorithm to verify the integrity of log files; Security Incident Response: Supports response measures such as automatically blocking abnormal IPs and temporarily locking accounts; Regulatory Compliance Support: Meets national security standards such as graded protection and commercial cryptography.

[0072] In addition to the above-mentioned four-layer security protection architecture, which includes a hardware security layer, a firmware security layer, a system security layer and an application security layer, and supports national cryptographic algorithms such as SM2, SM3 and SM4 and two-factor authentication mechanism, greatly improving the security and reliability of the system, the system of the present invention also includes a heat dissipation management module.

[0073] The server's cooling system primarily relies on fan control. Based on the temperature data obtained from sensors in key areas and core components of the chassis, intelligent algorithms optimize and select the most suitable fan speed for adjustment. This ensures that the temperature of the chassis and components is kept within a suitable range, guaranteeing the safe operation of the server.

[0074] The server's overall thermal management system acquires real-time temperatures of the environment, devices, and components through various methods such as temperature sensors or I2C (PMB / SMBUS) / OS. This data is used to monitor the system's intake and exhaust air temperatures, as well as the temperatures of critical components. The BMC device management controller integrated on the motherboard controls the fan speed to maintain appropriate chassis temperature conditions and critical component temperatures. When the temperature exceeds the set range, the fan speed is increased; when the temperature is low, the fan speed is decreased.

[0075] For high-load CPUs and GPUs, a PID closed-loop speed control algorithm is introduced to improve system speed control response efficiency and increase speed control accuracy. After incorporating the sampling period into the conventional incremental PID algorithm, the algorithm is as follows:

[0076]

[0077] In the formula, , for time, Constant fan PWM value for Real-time fan PWM increment , , These are the proportional coefficient, integral coefficient, and differential coefficient. , , for time, time, Temperature at all times for The difference between the temperature sensor reading and the set value at any given time. , This is the temperature sensing sampling period.

[0078] In this embodiment, the sampling period The typical sampling period is 1 second. For some temperature-sensitive devices, such as HDDs, a larger sampling period can be used because it can affect read / write performance and CPU utilization. The hysteresis buffer e0 is set to 1°C when the system deviates... ℃, That is, the fan speed remains constant; when ℃, calculated according to the incremental PID standard algorithm.

[0079] During PID fan speed control, the target temperature is first narrowed down to the integral (I) control range using proportional (P) and derivative (D) control. Integral (I) control is then used to fine-tune the target temperature. When the target temperature enters the dead zone (a very small temperature range, approximately 1 to 2°C), it is considered that the target temperature has been reached, and the fan speed remains unchanged within the dead zone. If the target temperature does not decrease significantly within a certain time after the fan speed reaches its upper limit, it is considered that the system's heat dissipation capacity is insufficient under this condition, and the target temperature is automatically increased.

[0080] During server operation, the cooling system is designed based on the product's configuration and characteristics to ensure the product maintains a suitable operating temperature within the application specifications. However, certain special factors, such as multiple fan failures or unbalanced cooling in data center air conditioning, can cause the cooling system to exceed its control range or fail. In such cases, the processor needs an over-temperature protection mechanism to prevent physical damage to the CPU. The over-temperature protection function compares the CPU junction temperature in real time with a set threshold and uses methods such as reducing CPU performance or shutting down due to high temperatures (including its corresponding recovery) to prevent physical damage to the CPU caused by high temperatures. The over-temperature protection control strategy in the thermal management module of this invention is as follows: Figure 2As shown, the system is used to determine whether overheating triggers power-off protection: It continuously monitors the temperatures of CPU0 and CPU1, as well as the inlet temperature. If the CPU temperature is ≥90℃ or the inlet temperature is ≥55℃ for five consecutive cycles, power is immediately cut off. If the inlet temperature is ≥50℃ for 95% of the time within 24 hours, the system observes for another 24 hours. If the temperature remains ≥50℃ for another five consecutive cycles, power is also cut off. If none of the above occurs, the server continues to operate normally. This process can be used to implement server overheat protection control strategies.

[0081] In summary, the BMC system based on SO-DIMM modules of the present invention includes at least a four-layer security protection architecture: a hardware security layer, a firmware security layer, a system security layer, and an application security layer. Each of these layers establishes a trust chain relationship through cryptographic methods, supports a two-factor authentication mechanism of client certificate + password, and realizes secure storage and communication of the BMC system. The system of the present invention has enhanced security and trustworthiness capabilities and intelligent management characteristics, excellent heat dissipation capabilities, and meets practical needs.

[0082] It should be noted that the above content merely illustrates the technical concept of the present invention and should not be construed as limiting the scope of protection of the present invention. For those skilled in the art, various improvements and modifications can be made without departing from the principle of the present invention, and all such improvements and modifications fall within the scope of protection of the claims of the present invention.

Claims

1. A BMC system based on SO-DIMM module form, characterized in that: The security architecture comprises at least four layers: hardware security, firmware security, system security, and application security. Each layer establishes a trust chain through cryptographic methods, supporting a two-factor authentication mechanism of client certificate + password to achieve secure storage and communication within the BMC system. The hardware security layer: Based on the cryptographic algorithm engine built into the system chip, the cryptographic algorithm function is implemented in hardware. The firmware security layer implements a complete trust chain verification from ROM code → BL1 (SPL) → BL2 (U-Boot) → Kernel → file system; each level performs digital signature verification on the next level, and stops the boot process if the verification fails. The system security layer implements role-based access control, including but not limited to administrators, operators, and read-only users, with different permission levels set. Sensitive data is encrypted and stored using the SM4 algorithm, and the key is generated and managed through a hardware cryptographic algorithm engine. The application security layer supports two-way SSL authentication, with the client and server mutually verifying certificates, and supports concurrent connection limits to prevent denial-of-service attacks.

2. The BMC system based on SO-DIMM module form as described in claim 1, characterized in that: The system chip in the hardware security layer uses Phytium E2000S, which integrates 64K bits OTP and has a built-in 64-bit unique chip ID as the hardware basis for device identification. The cryptographic algorithm engine supports multi-host access. The firmware security layer includes a key certificate and a content certificate. The key certificate stores the hash value of the public key, and the content certificate stores the hash value of the image file. The firmware security layer supports encrypted image storage and uses the AES-256 algorithm to encrypt and protect critical firmware. In the system security layer, all non-query operations are recorded in audit logs. The log content includes, but is not limited to, timestamps, operation interfaces, source IPs, user identities, and executed actions. It also supports at least IP address whitelists, MAC address filtering, and time window restrictions. The application security layer uses the HTTPS protocol.

3. A BMC system based on SO-DIMM module form as described in claim 1, characterized in that: Cryptographic methods for establishing trust chains at each layer of a security architecture include at least the SM2, SM3, SM4, AES, and SHA2 algorithms; among them, SM2 Algorithm: Elliptic Curve Cryptography, using a 256-bit key length, based on elliptic curves. To achieve this, key pair generation uses hardware-based true random numbers; SM3 algorithm: a cryptographic hash algorithm that supports both Normal and HMAC working modes, outputs a 256-bit hash value, and supports hash operations on messages of arbitrary length; SM4 algorithm: a block cipher algorithm that supports four working modes: ECB, CBC, CTR, and OFB, and uses a 128-bit block length and a 128-bit key length. AES algorithm: Supports 128 / 192 / 256-bit key lengths, and working modes include ECB, CBC, CTR, and OFB; SHA2 algorithm: Supports at least SHA-224, SHA-256, SHA-384, and SHA-512 output lengths.

4. A BMC system based on SO-DIMM module form as described in claim 1, characterized in that: In the aforementioned two-factor authentication mechanism of client certificate + password, Client certificate authentication: The key length is no less than 2048 bits. The certificate content includes the validity period, subject information, public key information, and digital signature. The BMC system maintains a list of trusted Certificate Authorities (CAs) and supports Certificate Revocation List (CRL) checks and Online Certificate Status Protocol (OCSP) verification. Connections are rejected and security logs are recorded when certificate verification fails. Password authentication: Password length 8-32 characters, must contain uppercase and lowercase letters, numbers and special characters; custom configuration of password complexity strategy is supported.

5. A BMC system based on SO-DIMM module form as described in claim 4, characterized in that: The authentication steps of the two-factor authentication mechanism include: (1) The client presents a digital certificate, and the server verifies the validity of the certificate; (2) The user enters the username and password, and the server verifies the identity information; (3) After the two-factor authentication is successful, an encrypted session is established and a session token is generated; (4) Assign corresponding operation permissions according to user roles; (5) Refresh the session token regularly and automatically cancel it after the timeout to manage the session.

6. A BMC system based on SO-DIMM module form as described in claim 3, characterized in that: The secure storage and communication of the BMC system includes at least the following steps: S1. Sensitive data encrypted storage: User passwords are hashed using the PBKDF2 algorithm and then iteratively processed. Configuration files are encrypted using the SM4 algorithm. The key is generated by the hardware cryptographic engine. S2. Secure communication protocol: HTTPS is mandatory, using the ECDHE-RSA-AES256-GCM-SHA384 strong cryptographic suite, supporting self-signed certificates and third-party CA certificates, and using temporary key exchange; S3, Security Audit and Monitoring: Records all security events of the system and provides real-time alerts for abnormal events, supporting automatic blocking of abnormal IPs and temporary account locking.

7. A BMC system based on SO-DIMM module form as described in claim 6, characterized in that: In step S1, which enables secure storage and communication in the BMC system, sensitive data is encrypted and stored with a dual-mirror backup mechanism, automatic synchronization and failover of primary and backup mirrors, and private key information is stored only in the hardware security area. In step S3, which involves comprehensive auditing of log records, the SM3 algorithm is used to verify the integrity of log files.

8. A BMC system based on SO-DIMM module form as described in claim 1, characterized in that: It also includes a heat dissipation management module, which monitors the ambient and component temperatures by acquiring real-time temperatures, and adjusts the fan speed accordingly. Specifically, this adjustment management involves incorporating sampling period considerations into a conventional incremental PID algorithm. ； in, , for time, Constant fan PWM value for Real-time fan PWM increment , , These are the proportional coefficient, integral coefficient, and differential coefficient. , , for time, time, Temperature at all times for The difference between the temperature sensor reading and the set value at any given time. This refers to the temperature sensing sampling period; When system deviation ℃, That is, the fan speed remains constant; when ℃, calculated according to the incremental PID standard algorithm.

9. A BMC system based on SO-DIMM module form as described in claim 8, characterized in that: The heat dissipation management module also includes an over-temperature protection control strategy. If the system continuously monitors the temperatures of CPU0 and CPU1 and the air inlet temperature and maintains the CPU temperature ≥90℃ or the air inlet temperature ≥55℃ for 5 consecutive cycles, the power will be cut off immediately. If the air inlet temperature is ≥50℃ for 95% of the time within 24 hours, it will be observed for another 24 hours. If it is ≥50℃ for 5 consecutive cycles after that, the power will be cut off. If none of the above situations occur, the server will continue to operate normally.

Images