使用 eSFI 和 PCIe-MI 进行安全隔离.pdf

1、Brett Henning,Security Architect,Broadcom Inc.Austin Bolen,Server Engineering,Dell TechnologieseSFI and PCIe-MI for Security QuarantineUse of eSFI and PCIe-MI for Security QuarantineBrett HenningAustin BolenSECURITYEnhanced System Firmware Intermediary(eSFI)Standards-based BMC interface to control v

2、isibility of PCIe components to an in-band hostEnables BMCs to initialize PCIe components prior to exposing to an in-band hostPCIe Management Interface(PCIe-MI)Standards-based BMC interface to perform PCIe-specific management operationsEnables BMCs to perform PCIe initialization(e.g.,reading/writing

3、 configuration space)OverviewImprovement to existing SFIeSFI w/PCIe-MI enables a BMC-controlled SFI solutionNo runtime BIOS support requiredAdds PCIe quarantine modeBlock unauthenticated PCIe componentsTrigger quarantine due to system reset,PCIe component hot removal,or host-initiated commandEnhance

4、s Downstream Port traffic filteringFilter all traffic except out-of-band trafficEnhanced System Firmware Intermediary(eSFI)With SFI quarantine mode,the Link is disabled and presence is masked to:a)block access to unauthenticated PCIe Component A from the host OSb)prevent PCIe Component A from inject

5、ing traffic into the system PCIe-MI Component Protocol LayeringPCIe Management Interface(PCIe-MI)Management Controller Transport Protocol(MCTP)Base LayerMCTP over SMBus/I2CMCTP overUSBMCTP overI3CMCTP overMMBISMBus/I2CUSBI3CPCIeProtocol LayerTransport LayerPhysical LayerManagement Message Passthroug

6、h(MMPT)and MMIO Mailbox(MMB)MCTP overPCIe VDMTransport to Physical Layer BindingOut-of-BandIn-BandDiscover supported commandsGet PCIe-specific inventory dataNumber of ports(PCIe,USB,2-Wire)and details of each portNumber of PCIe Functions and details of each PCIe FunctionPCI Expre