BaselineWatch
Desk
Your fleet and your work Fleetyour releases and the hardware they run onTriagewhat needs a decisionWatchlistthe products and platforms you runSaved searchesthe lists you come back to
This instance Sourceswhat is read, how often, under what termsDigestthe daily or weekly summary, and alerts
How it is drawn Appearancethe look and the colour schemeBrandingthe mark this instance wears
Owner sign-in

2.2 Server Architectures

NIST platform security: roots of trust, firmware and secure enclaves SP 800-147B
All changes in this version
first version loaded 2 Background part of 2

Title

Server Architectures

Control

In this subsection, we differentiate servers into three classes: Basic Servers, Managed Servers, and Blade Servers. The distinctions made here have to do with the mechanisms employed to update the system BIOS. A Basic Server is architecturally similar to a client PC system with a single BIOS update mechanism. The requirements for protecting BIOS updates for a Basic Server can be satisfied by meeting the requirements listed in this document or those in Section 3.1 of NIST SP 800-147. Typically the Root of Trust for Update (RTU) on a Basic Server is part of the system BIOS (see Section 2.5 for more on RTUs).

A Managed Server is a computer system with a dedicated management channel used for device maintenance and additional server management features. In addition to host processors, a Managed Server may have a Service Processor (see below) capable of performing system management, possibly including BIOS updates. It is critical to prevent the execution of malicious or corrupt code on the Service Processor since it has direct control over other operational aspects of the server. As a potential BIOS update mechanism, the code executed on the Service Processor may contain an RTU and must be protected from unauthorized modification.

A Blade Server is a specialized server hardware platform design that is configured as a mounted device in a chassis/enclosure that can be installed in a rack system. These platforms often have shared power and cooling and a shared management interface. Blades function either autonomously in a chassis/enclosure/rack as a bank of servers or they may be controlled by a central bus manager. This system configuration also may have multiple paths for updating the BIOS used to run the individual blades. From the BIOS update perspective, a Blade Server is typically similar to a managed server. Industry also uses the term multi-node (or modular) servers which have the same requirements as the Blade Servers for BIOS protections.

Server architectures vary greatly. While most servers fit into one of the classes list above, in some cases it may be difficult to classify a server as strictly belonging to one of those classes. The classes are provided as examples to help clarify requirements, however the security guidelines in this document are intended to have broad applicability to any type of server.

A server may have a Service Processor, sometimes called a Baseboard Management Controller, which is a specialized microcontroller. The Service Processor is often a special add-in card or embedded on the server motherboard. The Service Processor microcontroller runs a specialized operating system typically stored in flash memory, and provides administrators with an interface to manage the host server. The Service Processor is typically a highly privileged component in modern servers, often capable of updating firmware and software on the system, changing configuration settings, and reading from system memory. This document assumes administrators will implement proper computer, network, and physical security controls to mitigate the unique risks to Service Processors. For instance, typically administrators interact with the Service Processor over a network interface. Security best practices dictate that the Service Processor should be on a private LAN accessible only to system administrators.

Service Processors are responsible for various features, depending on the implementation of the system. The Service Processor will typically monitor various sensors in the server, such as temperature and power sensors for thermal and power management. It might provide administrators with a mechanism to update software or firmware on the server and host operating system. Maintaining the security of the Service Processor is critical to maintaining the integrity and availability of the server. See Section 5 for security requirements for Service Processors.