Bare Metal Server Clearance via Trusted Portion Segmentation
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Cloud providers face challenges in maintaining security and efficiently managing bare-metal servers without a virtualization layer, particularly in isolating hardware from attacks and efficiently wiping servers after use.
Innovation Solution
A system with a trusted infrastructure device and a bare metal resource, where the bare metal resource is divided into a trusted and untrusted portion, with the trusted portion performing a clearance process to restore the server to a known good state, including loading known good images and wiping tenant data, and the untrusted portion being configurable by tenants.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Productivity
If bare-metal access is provided to tenants for high-performance workloads, then performance and hardware accessibility are improved, but security isolation and ease of server management deteriorate
Solution Approach 1:
The system divides the bare-metal server into trusted and untrusted portions, with the trusted portion containing security-critical components (firmware, BIOS, cryptographic keys) that are protected from tenant access, while the untrusted portion provides full hardware access to tenants for high-performance workloads. This segmentation allows simultaneous achievement of both performance and security.
Solution Approach 2:
The system introduces a trusted execution environment and automated clearance mechanisms as intermediaries between the tenant and the hardware. These intermediaries enforce security policies, manage cryptographic keys, and automatically wipe data when tenants depart, providing security isolation without preventing bare-metal performance.
2Productivity
If bare-metal servers are used without virtualization, then hardware performance and direct access are improved, but automated security management and server wiping capability deteriorate
Solution Approach 1:
The system implements self-service automated clearance mechanisms that automatically wipe tenant data and restore servers to a known good state when tenants depart or security events occur. The trusted portion of the system autonomously manages security policies and executes wiping operations without requiring manual intervention, combining bare-metal performance with automated security management.
3Adaptability or versatility
If tenants can install custom firmware and drivers on bare-metal servers, then adaptability and hardware utilization are improved, but security control and system stability deteriorate
Solution Approach 1:
The system applies different quality controls to different portions of the hardware. The trusted portion maintains strict control over critical system components (BIOS, firmware, cryptographic keys) to ensure stability and security, while the untrusted portion allows tenants full configurability for their applications. This local differentiation of control policies enables both adaptability and stability.
Data Source
Figure 1
Figure 2
Figure 3
AI summary
A bare metal resource includes a trusted portion and an untrusted portion. The trusted portion includes trusted hardware, an image repository, and a clearance manager. The clearance manager is executable during bootup of the bare metal resource to perform a clearance process on the untrusted portion, including deleting the BIOS in the untrusted portion and loading a trusted BIOS from the image repository on the untrusted hardware, to place the untrusted portion in a trusted state. The bare metal resource may be provisioned to a tenant of a cloud provider after being placed in the trusted state.