Network Booting via Platform Management Coprocessor
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Current network booting technologies, such as PXE and Intel AMT, lack collaboration during the pre-boot stage, leading to inefficient and insecure boot processes due to limited networking capabilities and flash space constraints, resulting in slow and insecure authentication.
Innovation Solution
A combined BIOS and platform management coprocessor code approach, where the PXE code executes on the host CPU for fast booting and the PMC code on a co-processor for secure network access, collaborates to establish a secure interface with the boot server, enabling bulk downloads of the operating system and implementing security measures like SSL/TLS.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Speed
If PXE code is used for network booting, then boot speed is improved, but security and networking capabilities deteriorate due to limited flash space and inability to support full SSL/TLS stacks
Solution Approach 1:
The system divides the boot process into two phases: Phase 1 uses PXE code on the host CPU for fast initial boot, and Phase 2 transitions to PMC code on the coprocessor for secure network operations. This segmentation allows each component to specialize - PXE for speed, PMC for security - resolving the contradiction between boot speed and security capabilities.
Solution Approach 2:
The patent introduces a coprocessor with PMC code as an intermediary between the PXE boot environment and secure network operations. This coprocessor hosts a full SSL/TLS stack and network authentication protocols, mediating secure communications without requiring the host PXE code to carry these heavy security components, thus enabling security without sacrificing boot speed.
2Reliability
If PXE code carries full SSL/TLS stack for secure authentication, then security is improved, but flash space requirements increase and boot process is delayed
Solution Approach 1:
The patent extracts the heavy SSL/TLS stack and full network authentication protocols from the host PXE code and relocates them to the coprocessor's PMC code. This extraction allows the host system to maintain minimal flash space requirements while the coprocessor provides comprehensive security capabilities independently.
3Stability of the object's composition
If PXE boot waits for main memory initialization and I/O bus resource balancing, then system stability is improved, but boot time increases due to required timeouts and protocol delays
Solution Approach 1:
The patent implements preliminary network configuration and authentication actions through the coprocessor before the host PXE boot process completes its initialization. The coprocessor can perform network stack setup, server name requests, and authentication handshakes in advance, eliminating the need for PXE to wait for memory initialization and I/O bus balancing, thus reducing boot time while maintaining stability.
Data Source
AI summary
Embodiments of a system and method for enabling a target computer to download a boot image and operating system from a boot server computer over a network are described. The target computer system includes a host processor environment and a platform management coprocessor subsystem that includes a microcontroller for providing manageability of the target computer platform. During a network boot procedure, the platform management coprocessor code employs a network access channel to retrieve the boot server name and a network address for the target computer. The platform management coprocessor code implements security measures to help ensure secure interaction between the boot server and the target computer. Once the secure association is established, the network boot process uses the BIOS code for the successive bulk downloads of the operating system to be loaded onto the target computer. Other embodiments are described and claimed.