BMC Sandbox for Secure Dynamic Logic Script Execution

Resolve Bottlenecks,
Find Innovative SolutionsGenerate Solutions

Solution Overview

Problem

There is a need for a mechanism to securely and dynamically push logic scripts to a Baseboard Management Controller (BMC) at runtime, enabling the introduction of new features and OEM extensions that can interact with the management platform without compromising system integrity.

Innovation Solution

A method where an initialization component of a host system obtains and sends process files to the BMC, which defines logic for dynamic creation of processing components, allowing secure execution within a sandbox environment, enabling OEM extensions to be dynamically pushed and run as native features, with access to BMC data storage through IPMI commands.

Engineering Contradictions & Design Principles

VSEngineering Contradiction Analysis

1Adaptability or versatility

If logic scripts are dynamically pushed to BMC at runtime, then adaptability and new feature introduction are improved, but system security and integrity may deteriorate

Engineering Contradiction:

Improvedynamic feature introductionVSAvoidsystem integrity

Core Design Contradiction:

Adaptability or versatilityVSReliability

Solution Approach 1:

The patent introduces a sandbox environment as an intermediary layer between the dynamically pushed logic scripts and the BMC management platform. This sandbox acts as a mediator that isolates untrusted code, allowing it to execute in a controlled environment without direct access to critical system resources, thus enabling dynamic feature introduction while preserving system integrity.

Inventive Principle:

Principle #24Intermediary (Mediator)

Solution Approach 2:

The patent segments the BMC architecture into distinct components: a trusted management platform, an isolated sandbox environment for executing dynamic scripts, and interfaces for secure communication. This segmentation allows dynamic logic to be introduced without compromising the core management platform, as the sandbox contains and isolates potential malicious code execution.

Inventive Principle:

Principle #1Segmentation

2Adaptability or versatility

If new logic scripts are introduced to BMC, then functionality and versatility are improved, but system complexity increases

Engineering Contradiction:

Improvenew featuresVSAvoidsystem architecture

Core Design Contradiction:

Adaptability or versatilityVSDevice complexity

Solution Approach 1:

The sandbox serves as an intermediary layer that simplifies the architecture by providing a standardized interface for script execution. Instead of integrating every possible dynamic feature directly into the BMC core, the sandbox provides a uniform environment where scripts can be loaded, executed, and managed, reducing the complexity of handling diverse new features.

Inventive Principle:

Principle #24Intermediary (Mediator)

Solution Approach 2:

The patent implements dynamic script loading and execution within the sandbox, allowing the system to adapt its functionality at runtime without requiring complex static architecture changes. The sandbox can dynamically load, execute, and unload scripts based on needs, providing flexibility without permanently increasing architectural complexity.

Inventive Principle:

Principle #15Dynamics

3Adaptability or versatility

If dynamic script execution is enabled, then adaptability is improved, but security risks increase

Engineering Contradiction:

Improveruntime logic pushVSAvoidmalware execution risk

Core Design Contradiction:

Adaptability or versatilityVSObject-affected harmful factors

Solution Approach 1:

The sandbox environment acts as a security intermediary that sits between externally introduced scripts and the BMC management platform. It provides a controlled execution environment with limited privileges, preventing malicious scripts from directly accessing or corrupting the management platform while still allowing legitimate dynamic features to be introduced.

Inventive Principle:

Principle #24Intermediary (Mediator)

Solution Approach 2:

The sandbox provides beforehand cushioning by pre-establishing isolation mechanisms and security boundaries before any script execution occurs. It prepares a contained environment with restricted access rights, ensuring that even if malicious code is introduced, it cannot escape the sandbox to harm the underlying system.

Inventive Principle:

Principle #11Beforehand cushioning (Prior cushioning)

4Adaptability or versatility

If process files are sent to BMC for processing, then functionality enhancement is improved, but data transmission requirements increase

Engineering Contradiction:

Improvelogic script deploymentVSAvoiddata transmission volume

Core Design Contradiction:

Adaptability or versatilityVSQuantity of substance

Solution Approach 1:

The patent uses lightweight process files that contain only the essential logic definitions needed for script execution. These files are designed to be small and transient, transmitting only the necessary information to the sandbox for execution, thereby minimizing data transmission volume while enabling functionality enhancement.

Inventive Principle:

Principle #27Cheap short-living objects (Disposable)

Data Source

PatentUS10642646B1Techniques of securely performing logic as service in BMC

Publication Date: 2020.05.05 AMERICAN MEGATRENDS

AI summary

In an aspect of the disclosure, a method, a computer-readable medium, and a computer system are provided. The computer system includes an initialization component of a host. The initialization component obtains a process file for dynamically creating a processing component on a management platform on a BMC of the host, the process file defining a logic to be implemented by the processing component, the initialization component operating to load an operating system of the host. The initialization component sends the process file to the BMC. The initialization component further sends a message to the BMC, the message including data to be processed by the processing component.