Techniques to verify and authenticate resources in a data center computer environment

Patent metadata

Field	Value
Publication number	US-10489156-B2
Application number	US-201715656798-A
Country	US
Kind code	B2
Filing date	Jul 21, 2017
Priority date	Jul 22, 2016
Publication date	Nov 26, 2019
Grant date	Nov 26, 2019

Abstract

Embodiments are generally directed apparatuses, methods, techniques and so forth to receive a sled manifest comprising identifiers for physical resources of a sled, receive results of an authentication and validation operations performed to authenticate and validate the physical resources of the sled, determine whether the results of the authentication and validation operations indicate the physical resources are authenticate or not authenticate. Further and in response to the determination that the results indicate the physical resources are authenticated, permit the physical resources to process a workload, and in response to the determination that the results indicate the physical resources are not authenticated, prevent the physical resources from processing the workload.

First claim

What is claimed is:

1. An apparatus, comprising:
a processor; and
memory comprising instructions for a pod management controller that when executed by the processor cause the processor to:
determine whether a sled manifest and results are authentic and valid, the results generated by an authentication and validation operation performed to authenticate and validate physical resources of a sled, the authentication and validation operation to generate a nonce, communicate the nonce to at least one of the physical resources of the sled, and authenticate a signed version of the nonce received from the at least one physical resource in response;
determine whether the results of the authentication and validation operation indicate the physical resources are authentic and valid;
permit the physical resources to process a workload in response to a determination that the sled manifest and results are authentic and valid, and the results indicate the physical resources are authentic and valid; and
prevent the physical resources from processing the workload in response to a determination that at least one of the sled manifest is not authentic and valid, the results are not authentic and valid, and the results indicate the physical resources are not authentic and valid.

2. The apparatus of claim 1 , the memory comprising instructions for the pod management controller that when executed by the processor cause the processor to:
receive the sled manifest comprising identifiers for the physical resources from the sled; and
receive the results of the authentication and validation operation performed to authenticate and validate the physical resources from the sled.

3. The apparatus of claim 1 , the memory comprising instructions for the pod management controller that when executed by the processor cause the processor to authenticate the sled manifest using a public key, the public key obtained from an original manufacturer of the sled or a trusted third party.

4. The apparatus of claim 1 , the memory comprising instructions for the pod management controller that when executed by the processor cause the processor to:
generate a hash value based on the sled manifest;
compare the hash value with another hash value communicated with the results;
validate the sled manifest when the hash value and the other hash value match; and
invalidate the sled manifest when the hash value and the other hash value do not match.

5. The apparatus of claim 1 , the memory comprising instructions for the pod management controller that when executed by the processor cause the processor to authenticate the results using a public key, the public key obtained from the sled manifest.

6. The apparatus of claim 1 , the memory comprising instructions for the pod management controller that when executed by the processor cause the processor to add an indication of the physical resources in a database to permit the physical resources to process the workload.

7. The apparatus of claim 1 , the memory comprising instructions for the pod management controller that when executed by the processor cause the processor to receive the sled manifest and the results of the authentication and verification operations via a secure link with the sled.

8. The apparatus of claim 1 , the memory comprising instructions for the pod management controller that when executed by the processor cause the processor to generate a composed node comprising at least one of the physical resources of the sled.

9. The apparatus of claim 1 , the memory comprising instructions for the pod management controller that when executed by the processor cause the processor to:
send a platform certificate request to generate a platform certificate for a composed node to a certificate authority, the platform certificate to identify physical resources including the at least one of the physical resources used for the composed node; and
receive a signed platform certificate.

10. The apparatus of claim 9 , the memory comprising instructions for the pod management controller that when executed by the processor cause the processor to send the signed platform certificate for the composed node to a client device.

11. A non-transitory computer-readable storage medium, comprising a plurality of instructions, that when executed, enable processing circuitry to:
determine whether a sled manifest and results are authentic and valid, the results generated by an authentication and validation operation performed to authenticate and validate physical resources of a sled, the authentication and validation operation to generate a nonce, communicate the nonce to at least one of the physical resources of the sled, and authenticate a signed version of the nonce received from the at least one physical resource in response;
determine whether the results of the authentication and validation operation indicate the physical resources are authentic and valid;
permit the physical resources to process a workload in response to a determination that the sled manifest and results are authentic and valid, and the results indicate the physical resources are authentic and valid; and
prevent the physical resources from processing the workload in response to a determination that at least one of the sled manifest is not authentic and valid, the results are not authentic and valid, and the results indicate the physical resources are not authentic and valid.

12. The non-transitory computer-readable storage medium of claim 11 , comprising a plurality of instructions, that when executed, enable processing circuitry to:
receive the sled manifest comprising identifiers for the physical resources from the sled; and
receive the results of the authentication and validation operation performed to authenticate and validate the physical resources from the sled.

13. The non-transitory computer-readable storage medium of claim 11 , comprising a plurality of instructions, that when executed, enable processing circuitry to authenticate the sled manifest using a public key, the public key obtained from an original manufacturer of the sled or a trusted third party.

14. The non-transitory computer-readable storage medium of claim 11 , comprising a plurality of instructions, that when executed, enable processing circuitry to:
generate a hash value based on the sled manifest;
compare the hash value with another hash value communicated with the results;
validate the sled manifest when the hash value and the other hash value match; and
invalidate the sled manifest when the hash value and the other hash value do not match.

15. The non-transitory computer-readable storage medium of claim 11 , comprising a plurality of instructions, that when executed, enable processing circuitry to authenticate the results using a public key, the public key obtained from the sled manifest.

16. The non-transitory computer-readable storage medium of claim 11 , comprising a plurality of instructions, that when executed, enable processing circuitry to add an indication of the physical resources in a database to permit the physical resources to process the workload.

17. The non-transitory computer-readable storage medium of claim 11 , comprising a plurality of instructions, that when executed, enable processing circuitry to receive the sled manifest and the results of the authentication and verification operations via a secure link with the sled.

18. The non-transitory computer-readable storage medium of claim 11 , comprising a plurality of instructions, that when executed, enable processing circuitry to generate

Assignees

• Intel Corp

Inventors

• Munoz Alberto J
• Nachimuthu Murugasamy K
• Kumar Mohan J
• Powiertowski Wojciech
• Ghetie Sergiu D
• Upasani Neeraj S
• Dalvi Sagar V
• Nnebe Chukwunenye S
• Guillory Jeanne

Classifications

• G06F15/161 Primary

  Computing infrastructure, e.g. computer clusters, blade chassis or hardware partitioning (casings, cabinets, racks or drawers for data centers H05K5/00) · CPC title

• H04Q2213/13527

  protocols - X.25, TCAP etc. · CPC title

• G06F2209/5022

  Workload threshold · CPC title

• H04Q2213/13523

  bandwidth management, e.g. capacity management · CPC title

• H05K2201/066

  Heatsink mounted on the surface of the printed circuit board [PCB] · CPC title