Secure management controller enhancement with containerized applications

Patent metadata

Field	Value
Publication number	US-12450333-B2
Application number	US-202318365059-A
Country	US
Kind code	B2
Filing date	Aug 3, 2023
Priority date	Aug 3, 2023
Publication date	Oct 21, 2025
Grant date	Oct 21, 2025

Abstract

An information handling system may include a host system; and a management controller comprising at least one management controller processor and a management controller storage resource. The management controller may be configured to: install a firmware image onto the management controller storage resource; subsequent to installing the firmware image, receive a plugin application; cryptographically verify a source of the plugin application; install the plugin application onto the management controller storage resource; and execute the plugin application.

First claim

What is claimed is:

1. An information handling system comprising:
a host system; and
a management controller comprising at least one physical management controller processor and a physical management controller storage resource, wherein the management controller is configured to provide out-of-band management of the information handling system;
wherein the management controller is configured to:
install a firmware image onto the management controller storage resource;
subsequent to the installing of the firmware image, receive a plugin application, wherein the plugin application is configured to perform thermal management of at least one unsupported card inserted in the information handling system;
cryptographically verify a source of the plugin application;
install the plugin application onto the management controller storage resource; and
execute the plugin application.

2. The information handling system of claim 1 , wherein the plugin application is configured to execute in a sandboxed environment that is configured to limit access to other processes executing at the management controller.

3. The information handling system of claim 1 , wherein the management controller is configured to perform a first verification of the plugin application prior to executing the plugin application and a second verification of the plugin application during runtime of the plugin application.

4. The information handling system of claim 1 , wherein the plugin application is a cloud integration plugin configured to integrate with a cloud-based management controller.

5. The information handling system of claim 1 , wherein the plugin application is configured to implement at least one new software feature executable by the management controller.

6. A method comprising:
installing, by a management controller, a firmware image onto a storage resource thereof, wherein the management controller is configured to provide out-of-band management of an information handling system;
subsequent to the installing of the firmware image, receiving, by the management controller, a plugin application, wherein the plugin application is configured to perform thermal management of at least one unsupported card inserted in the information handling system;
cryptographically verifying, by the management controller, a source of the plugin application;
installing, by the management controller, the plugin application onto the storage resource; and
executing, by the management controller, the plugin application.

7. The method of claim 6 , wherein the plugin application is configured to execute in a sandboxed environment that is configured to limit access to other processes executing at the management controller.

8. The method of claim 6 , further comprising performing, by the management controller, a first verification of the plugin application prior to executing the plugin application and a second verification of the plugin application during runtime of the plugin application.

9. The method of claim 6 , wherein the installing of the plugin application does not include replacing the firmware image.

10. The method of claim 6 , wherein the plugin application is a cloud integration plugin configured to integrate with a cloud-based management controller.

11. An article of manufacture comprising a non-transitory, computer-readable medium having computer-executable instructions thereon that are executable by a processor of a management controller of an information handling system for:
installing a firmware image onto a storage resource of the management controller, wherein the management controller is configured to provide out-of-band management of the information handling system;
subsequent to the installing of the firmware image, receiving a plugin application, wherein the plugin application is configured to perform thermal management of at least one unsupported card inserted in the information handling system;
cryptographically verifying a source of the plugin application;
installing the plugin application onto the storage resource; and
executing the plugin application.

12. The article of claim 11 , wherein the plugin application is configured to execute in a sandboxed environment that is configured to limit access to other processes executing at the management controller.

13. The article of claim 11 , wherein the management controller is configured to perform a first verification of the plugin application prior to executing the plugin application and a second verification of the plugin application during runtime of the plugin application.

14. The article of claim 11 , wherein the management controller comprises a baseboard management controller (BMC).

Assignees

• Dell Products Lp

Inventors

• Jreij Elie Antoun
• Savage Marshal F
• Giri Prashanth
• Fewx Jack Elmer
• Jagasia Jitendra Gul
• Chang Ching-Jye
• Brown Michael
• Daniele Michael

Classifications

• G06F21/572

  Secure firmware programming, e.g. of basic input output system [BIOS] · CPC title

• G06F21/53 Primary

  by executing in a restricted environment, e.g. sandbox or secure virtual machine · CPC title