Secure Shared Memory Access for OS Runtime via BMC Authentication
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Conventional information handling systems limit shared memory access to the pre-boot phase, preventing secure access during operating system runtime, which hinders communication and data exchange between operating system applications and Baseboard Management Controller (BMC) devices.
Innovation Solution
The implementation of a secure shared memory access method using ACPI runtime services, which enables secure runtime access to shared memory locations within the BMC by authenticating requests and establishing a secure session, allowing OS applications to communicate securely with the BMC during OS runtime without exposing the SMA channel to OS drivers.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If shared memory access is limited to pre-boot phase, then security is maintained, but communication between OS applications and BMC devices is prevented
Solution Approach 1:
The patent segments the shared memory access control into multiple phases: pre-boot phase with traditional security constraints, and post-boot phase with authenticated access. The BMC firmware separates authentication logic from memory access logic, allowing OS applications to be authenticated individually before granting shared memory access, thus enabling communication while maintaining security through phased control.
Solution Approach 2:
The patent introduces an authentication intermediary layer between OS applications and BMC shared memory. The BMC firmware acts as a mediator that receives authentication requests from OS applications, verifies credentials, and then grants or denies access to shared memory locations. This intermediary mechanism enables secure communication by mediating access control without exposing the entire shared memory space.
2Productivity
If shared memory access is enabled during OS runtime, then data exchange is improved, but security risks increase
Solution Approach 1:
The patent implements preliminary authentication action before granting shared memory access during OS runtime. The BMC firmware requires OS applications to present valid credentials and establish authenticated sessions before accessing shared memory locations. This preliminary security check ensures that only authorized applications can exchange data, maintaining security while enabling productive data exchange during runtime.
Solution Approach 2:
The patent changes the access control parameters from static pre-boot restrictions to dynamic runtime authentication. The BMC firmware modifies access permissions based on authentication status, application identity, and session validity. This parameter change allows the system to grant fine-grained access rights during OS runtime, improving data exchange efficiency while maintaining security through adaptive parameter control.
3Reliability
If authenticated access is implemented for shared memory, then security is enhanced, but system complexity increases
Solution Approach 1:
The patent implements a universal authentication framework in the BMC firmware that handles multiple authentication scenarios through a single integrated mechanism. The authentication subsystem serves multiple functions: verifying OS application credentials, managing session states, controlling shared memory access permissions, and logging authentication events. This multi-functional approach enhances security without proportionally increasing firmware complexity, as one authentication module serves multiple security purposes.
Data Source
AI summary
The present disclosure provides an information handling system (IHS) and related methods that provide secure shared memory access (SMA) to shared memory locations within a Peripheral Component Interconnect (PCI) device of an IHS. The IHS and methods disclosed herein provide secure SMA to one or more operating system (OS) applications that are granted access to the shared memory. According to one embodiment, the disclosed method provides secure SMA to one or more OS applications by receiving a secure runtime request from at least one OS application to access shared memory locations within a PCI device, authenticating the secure runtime request received from the OS application, creating a secure session for communicating with the OS application, and providing the OS application secure runtime access to the shared memory locations within the PCI device.