Dell Products Inc.

Lee Eric Ballard

Deepaganesh Paulraj

Robert Talbott Stevens, Iv

Elie Antoun Jreij

Chandrashekar Nelogal

Rama Rao Bisa

Akkiah Choudary Maddukuri

Chandrasekhar Mugunda

Viswanath Ponnuru

Andrew Butcher

Jonathan Foster Lewis

Mukund Purshottam Khatri

Gaurav Chawla

Hendrich M Hernandez

Wade Andrew Butcher

Timothy Michael Lambert

Michael Emery Brown

Gregory H Aicklen

Kevin Warren Mundt

Shyamkumar Thiyagarajan Iyer

Bhavesh Govindbhai Patel

Manjunath Am

Santosh Kumar Bidaralli

Aniruddha Suresh Herekar

Stephen M Cohoon

Andy Butcher

Charles B Claggett

Jason B Kilpatrick

George Harris

Anusha Ghali

Sai Bale

Jon F Lewis

Balasubramanian Nagaiah

Systems and methods provide an Information Handling System (IHS) comprising a host processor module configured to host at least one smart device and a secure control module configured to host a Baseboard Management Controller (BMC). The BMC validates identities and determine capabilities of the at least one smart device using Security Protocol and Data Model (SPDM) messages. The BMC sends a network access identity to the at least one smart device using an SPDM message. The BMC receives a request for a network connection from the at least one smart device, wherein the request includes the network access identity. The BMC performs authentication server functions to approve the network connection request. The BMC then sends a message to the at least one smart device indicating that a port or NC-SI channel is authorized for network access.

Secure access via 802.1X port-based network access control (PNAC)

In one or more embodiments, a server may have a server operating system (OS) and a component with a component OS. During a boot process, embodiments may ensure the server OS does not boot until after the component OS boots. During a shutdown process, embodiments may ensure the server OS does not shut down until after the component OS shuts down. In systems with multiple Remote Access Controller, embodiments may synchronize processing between the two RACs.

System and method for boot and shutdown synchronization of server operating system and component operating system

In one or more embodiments, one or more systems may comprise a Remote Access Controller (RAC) configured with a minimum number of built-in features and a private cloud server (PCS) communicatively coupled to the RAC and storing a set of available services retrieved from an external cloud server. The RAC may be configured to communicate with a DHCP service, an onboarding service and a RAC proxy service to send a RAC hardware identity certificate and receive a RAC proxy service certificate. If the RAC hardware identity certificate and the RAC proxy service certificate are authenticated, the RAC proxy service may establish a binding with RAC firmware.

System and method for discovery and binding of remote access controller firmware to a proxy service

An information handling system may include a host system, a management controller configured to provide out-of-band management of the information handling system, and a network interface controller. The management controller may be configured to: determine an inventory of the network interface controller, the inventory indicating at least one component having a firmware; retrieve a firmware update image for updating the firmware; and cause the network interface controller to boot from the firmware update image, the firmware update image being configured to install an update to the firmware.

Secure smart network interface controller firmware update

An information handling system may include a processor, a management controller communicatively coupled to the processor and configured for out-of-band management of the information handling system, and a smart network interface card communicatively coupled to the processor and the management controller, and configured to obtain a secret for authenticating the smart network interface card to the management controller, request an access token reference from the management controller, the request including the secret and an identifier of the smart network interface card in order to authenticate the smart network interface card to the management controller, in response to the request for the access token reference, receive the access token reference, and communicate a management task request to the management controller using the access token reference.

Systems and methods for smart network interface card-initiated server management

Managing failover between information handling systems, including receiving, at an interface of a smart network interface card (smartNIC) of a primary information handling system, a packet, the primary information handling system communicatively couped to a secondary information handling system; determining whether the packet was transmitted by a network interface card (NIC) of the secondary information handling system; determining that the packet was transmitted by the NIC of the secondary information handling system, and in response, determining whether the packet is an address resolution protocol (ARP) request; determining that the packet is an ARP request, and in response, cloning a medium access control (MAC) address of the NIC of the secondary information handling system at the smartNIC of the primary information handling system; and forwarding the ARP request to a uplink connection.

Managing failover between information handling systems

An information handling system may include a management controller configured to provide out-of-band management of the information handling system, and a network interface controller comprising a network interface controller storage resource. The management controller may be configured to: receive an update bundle cryptographically signed by a manufacturer of the information handling system, wherein the update bundle includes at least one signature associated with a network interface controller operating system (OS) configured to be executed by the network interface controller; and transmit the at least one signature to the network interface controller. The network interface controller may be configured to install the network interface controller OS to the network interface controller storage resource based on the at least one signature.

Smart network interface controller signature database emulation

An information handling system may include a processor, a subsystem communicatively coupled to the processor, and a management controller communicatively coupled to the processor and the subsystem and configured for out-of-band management of the information handling system, the management controller further configured to, in response to an alternating current power cycle of the information handling system: cause a basic input/output system of the information handling system to pause its boot process prior to enumeration of functions of the subsystem; and upon completion of the boot process of the subsystem and initialization of virtual functions of the subsystem, cause the basic input/output system to unpause the boot process in order to enumerate the functions of the subsystem including the virtual functions.

Coordinated boot synchronization and startup of information handling system subsystems

A system for data processing, comprising a management controller operating on a processor and configured to load and execute one or more algorithms that provide the function of transmitting a request to a managed device using a Security Protocol and Data Model (SPDM) protocol and to receive a response from the managed device. A system management bus and security policy system operating on the processor is configured to execute one or more algorithms to process the response from the managed device to apply an SPDM security policy to the response.

Certificate authorization policy for security protocol and data model capable devices

An information handling system includes a basic input/output system configured to update an attribute of a system-wide firmware downgrade security policy prior to booting to an operating system of the information handling system. The attribute of the system-wide firmware downgrade security policy is used to determine whether to allow or to disallow downgrade of a firmware to a version. A processor may perform the downgrade of the firmware, wherein the downgrade of the firmware includes the processor further configured to check the attribute of the system-wide firmware downgrade security policy and to store a firmware image in a scratchpad. If the attribute of the system-wide firmware downgrade security policy allows the downgrade of the firmware to the version, then the processor may continue with the downgrade of the firmware otherwise discard the firmware image in the scratchpad.

System and method for system-wide firmware downgrade control

An information handling system includes a device capable of sending and receiving security protocol and data model messages. A management controller with an authorization role as a designated leader is configured to verify authenticity of the device, discover authorization capabilities of the device, and set the authorization role of the device as a follower.

System and method for authorization scope extension for security protocol and data model capable devices

Methods, systems, and devices for managing communications in a distributed system are disclosed. To improve the efficiency of communication, the system may implement the port extension protocol which may allow communication devices to utilize ports of other devices for communication purposes. To do so, the communication devices may instruct the other devices with respect to how the communication devices expect the other devices to process data units transmitted via networks (e.g., network data units). However, not all of the other devices that may process the network data units may include functionality to process and/or implement the instructions from the communication devices. To extend the functionality of such devices, a remote control plane for devices that lack this processing functionality may be provided.

System and method for distributed management of communication devices

An information handling system may include a host system, a management controller configured to provide out-of-band management of the information handling system, and a network interface controller including a network interface controller storage resource. The management controller may be configured to: receive, from the host system, a first identifier that is specific to an operating system (OS) of the host system; compare the first identifier to a second identifier provided by the network interface controller, wherein the second identifier is specific to an OS of the network interface controller that is stored on the network interface controller storage resource; and in response to a mismatch between the first identifier and the second identifier, prevent the network interface controller from operating.

Smart network interface controller operating system binding

An information handling system may include a processor, a data processing unit communicatively coupled to the processor, a logic device communicatively coupled to processor and configured to, responsive to a shutdown event associated with the information handling system, cause a power system of the information handling system to maintain delivery of electrical energy to the data processing unit until receiving a command to cause withdrawal of the electrical energy to the data processing unit, and a management controller communicatively coupled to the processor, the data processing unit, and the logic device, and configured for out-of-band management of the information handling system. The management controller may be further configured to, responsive to the shutdown event, cause a host operating system executing the processor to gracefully shutdown, cause a data processing unit operating system executing on the data processing unit to gracefully shutdown, and responsive to receiving an indication that the data processing unit operating system has gracefully shutdown, communicate the command to the logic device to cause withdrawal of the electrical energy to the data processing unit.

Synchronized shutdown of host operating system and data processing unit operating system

Embodiments of systems and methods for high-availability (HA) management networks for High Performance Computing (HPC) platforms are described. In some embodiments, an HPC platform may include a first Baseboard Management Controller (BMC) having a first network port; and a hardware accelerator comprising a second BMC having a second network port, where at least one of: (a) the first BMC is configured to share the first network port with the second BMC in response to a determination that the second network port has failed or has insufficient bandwidth, or (b) the second BMC is configured to share the second network port with the first BMC in response to a determination that the first network port has failed or has insufficient bandwidth.

Growing community of inventors

Georgetown, TX, United States of America

Lee Eric Ballard