Bus Owner Authentication for Rogue Endpoint Detection
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Information Handling Systems (IHSs) face vulnerabilities due to rogue bus endpoints that exploit bus protocols, leading to denial-of-service attacks by flooding bus bandwidth, compromising operations and effective management.
Innovation Solution
A system and method that detect rogue devices on a device management bus by a communications controller acting as a bus owner, generating unique identifiers, authenticating senders, and disabling unauthorized endpoints, utilizing a PCIe VDM bus for MCTP messages, and including a remote access controller to query configuration registers and reinitialize the communications controller as needed.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Adaptability or versatility
If bus protocols allow transmissions by all bus endpoints, then bus communication flexibility is improved, but vulnerability to rogue endpoint attacks increases
Solution Approach 1:
The system performs preliminary actions by having the bus owner pre-generate unique identifiers for all managed devices before they can be compromised. These identifiers are stored in the devices during a secure discovery phase, enabling subsequent authentication of all bus messages without restricting communication flexibility
Solution Approach 2:
The patent introduces an intermediary authentication mechanism where each message on the bus must contain a valid unique identifier that devices verify against their stored identifiers. This intermediary check prevents rogue endpoints from injecting malicious messages while allowing legitimate communication between all authorized endpoints
2Reliability
If authentication mechanisms are implemented on bus endpoints, then security against rogue devices is improved, but message processing time increases
Solution Approach 1:
The authentication data (unique identifiers) is prepared in advance during the device discovery and configuration phase. This preliminary action allows endpoints to perform simple comparison operations rather than complex authentication computations during message processing, minimizing time loss
Solution Approach 2:
The patent changes the authentication parameter from complex cryptographic verification to simple identifier matching. By transforming the authentication mechanism into a straightforward comparison of pre-shared unique identifiers, the system achieves strong security with minimal processing overhead
3Measurement precision
If the bus owner generates and manages unique identifiers for all devices, then device authentication accuracy is improved, but controller complexity increases
Solution Approach 1:
The patent segments the authentication function by separating the bus owner's role (generating and distributing identifiers) from the endpoint devices' role (storing and verifying identifiers). This segmentation simplifies the controller's task to just generation and distribution, while devices handle verification, reducing overall system complexity
Data Source
AI summary
Embodiments provide methods and systems for detecting rogue endpoints on a device management bus. A communications controller configured as a bus owner initiates discovery of managed devices coupled to the bus and generate a unique identifier for each managed device. The communications controller transmits a bus configuration message to the managed devices, including the respective unique identifiers. The managed devices are configured as bus endpoints based on the bus configuration message. The managed devices also capture the bus address of the communications controller from the received bus configuration message. Messages received by a managed device are authenticated as originating from the communications controller if the messages include the unique identifier provided to that managed device. The messages may be further authenticated by comparing the bus address of the message sender against the captured bus address of the communications controller.