Embedded Controller I/O Governance Against Application DoS Attacks
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Information handling systems face denial-of-service (DOS) attacks due to excessive I/O requests from applications, which can starve other applications of EC availability and overload the embedded controller, leading to sluggish responses and failure of time-sensitive tasks.
Innovation Solution
Implementing an application handler on the EC processor to create records of I/O requests and times, and respond based on per-application policies, including verification, policy enforcement, and secure communication channels to manage and mitigate DOS attacks.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Adaptability or versatility
If applications are allowed to issue I/O requests without limit to the EC, then application flexibility and access to EC services are improved, but the EC becomes vulnerable to DOS attacks and performance degradation
Solution Approach 1:
The patent implements preliminary action by establishing per-application policies and rate limiting rules before DOS attacks occur. The EC processor is pre-configured with policies that define maximum I/O request rates, burst limits, and allocation weights for different applications. When the system is under normal operation, these policies are enforced automatically, preventing any single application from overwhelming the EC before a attack can occur, thus maintaining both flexibility and reliability.
2Productivity
If the EC processes excessive I/O requests, then application functionality is maintained, but other applications are starved of EC availability and time-sensitive tasks fail
Solution Approach 1:
The patent applies segmentation by dividing EC resource allocation into separate, manageable segments for each application. The EC processor implements per-application policy enforcement that creates distinct resource pools and I/O request queues for different applications. This segmentation allows the system to process I/O requests from multiple applications simultaneously while ensuring that no single application can consume excessive resources, thereby preventing starvation of other applications and maintaining overall system reliability.
Solution Approach 2:
The patent implements local quality by applying different resource allocation characteristics to different applications based on their specific needs. The per-application policies allow the system to assign different rate limits, priority levels, and allocation weights to different applications. For example, time-sensitive applications can be granted higher priority and more generous rate limits, while less critical applications receive standard allocation. This localized resource management ensures that each application receives appropriate EC services without compromising the availability for other applications.
3Speed
If the EC handles excessive SMI interrupts, then application responsiveness is maintained, but audio/video glitching occurs and other OS tasks fail
Solution Approach 1:
The patent applies periodic action by implementing rate limiting mechanisms that regulate the frequency of I/O requests and SMI interrupts from each application. The EC processor enforces maximum request rates and burst limits that prevent any single application from generating excessive interrupts in a short time period. By spacing out and regulating the periodicity of I/O requests, the system maintains EC response time for legitimate tasks while preventing the excessive SMI interrupt storms that cause audio/video glitching and OS task failures.
Data Source
AI summary
An information handling system may include at least one host processor and an embedded controller (EC) including an EC processor. The information handling system may be configured to: execute an application on the at least one host processor; provide a communication channel between the application and the EC, wherein the application is configured to issue input/output (I/O) requests to the EC; execute an application handler on the EC processor, wherein the application handler is configured to: create records indicating the I/O requests and times associated with the I/O requests; and respond to the I/O requests based on the records and based on a per-application policy.