Secure Server Execution Environment via Firmware Verification
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
In multi-tenant compute service systems, maintaining a secure execution environment for servers is challenging due to potential security threats from previous clients or untrusted components, especially when clients have access to modify firmware, which can compromise data security for subsequent users.
Innovation Solution
Implementing a programmable security logic coupled with non-volatile memories and a processor, controlled by an adapter device, to verify firmware, scrub volatile memory, control access to non-volatile memories, and manage connectivity, ensuring secure boot sequences and isolating untrusted components in a secure mode.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Adaptability or versatility
If clients are allowed to modify firmware for customization, then adaptability is improved, but security reliability deteriorates due to potential unauthorized modifications
Solution Approach 1:
The patent divides the firmware into multiple segments: a secure boot firmware stored in protected non-volatile memory that cannot be modified, and a customizable firmware that can be updated. The secure boot firmware acts as a trusted root that verifies the integrity of customizable portions, allowing adaptation while maintaining security boundaries.
Solution Approach 2:
The patent introduces a firmware authentication mechanism as an intermediary between the client's customization needs and the system's security requirements. This authentication layer verifies firmware integrity before execution, mediating between adaptability and security by allowing only verified modifications.
2Productivity
If servers are reused across multiple clients, then productivity is improved, but security risk increases due to persistent threats from previous users
Solution Approach 1:
The patent implements preliminary security actions before server reuse: volatile memory is cleared and non-volatile memory is put into read-only mode before a new client session begins. This preliminary protection prevents persistent threats from affecting subsequent users while maintaining efficient server reuse.
Solution Approach 2:
The patent discards volatile memory contents between clients to eliminate persistent threats, then recovers the server resources for new usage. The non-volatile memory is protected in read-only mode during client sessions, allowing efficient resource reuse while preventing contamination from previous users.
3Reliability
If access control to non-volatile memory is restricted for security, then security reliability is improved, but ease of operation deteriorates due to limited firmware updates
Solution Approach 1:
The patent makes the access control to non-volatile memory dynamic rather than static. The memory can switch between read-only mode during client sessions (for security) and writable mode during maintenance periods (for updates). This dynamic control resolves the contradiction by adapting access permissions to operational context.
Data Source
Figure 1
Figure 2
Figure 3
AI summary
Disclosed herein are techniques for maintaining a secure execution environment on a server. In one embodiment, the server includes a non-volatile memory storing firmware, a programmable security logic coupled to the non-volatile memory, an adapter device coupled to the programmable security logic, and a processor communicatively coupled to the non-volatile memory via the programmable security logic. The adapter device and/or the programmable security logic can verify the firmware in the non-volatile memory while holding the processor and/or a baseboard management controller (BMC) in power reset, release the processor and the BMC from reset to boot the processor and the BMC after the firmware is verified, and then disable communications between the processor and the BMC and deny at least some requests to write to the non-volatile memory by the processor or the BMC.