Intel Active Management Technology Platform Details. Jon Downey Applications Engineering Manager

Transcription

1 Intel Active Management Technology Platform Details Jon Downey Applications Engineering Manager

2 Objectives This course is intended to meet the following objectives: 1. Provide an overview of the manageability & security usage models that are enabled with Intel AMT platforms. 2. Provide architectural details of the Intel AMT platform HW/FW/SW. 3. Provide functional details showing how the Intel AMT HW/FW/SW architecture is used to implement the usage models.

3 Agenda/Outline Using Intel AMT to Resolve IT Manageability Challenges Inventory (HW/SW) Remote Diagnostics & Repair Agent Presence System Defense Intel AMT Building Blocks Ecosystem Components HW Architecture Shared Flash Layout SW Ecosystem Intel AMT Functional Details Inventory Event Alerting & Logging Remote Control & Diagnostics System Defense

4 Intel AMT Usage Models

5 Intel Confidential

6 Intel Confidential

7 Intel Confidential

8 Intel Confidential

9 Intel Confidential

10 Intel Confidential

11 Intel Confidential

12 Intel Confidential

13 Intel Confidential

14 Intel Confidential

15 Intel Confidential

16 Intel Confidential

17 Intel Confidential

18 Intel Confidential

19 Intel Confidential

20 Intel Confidential

21 Usage Model Agent Presence Keep agents operating correctly PCs with Intel Active Management Technology 3 IT management console repairs non-working security agent PC alerts IT console that security agent is missing or non-functioning 4 IT Management Console 1 Management or security agent sends heartbeat to watchdog timer Agent Present? YES Agent Present? YES NO NO Intel AMT 1 1 Security Agent (( ( Mgmt. Agent (( ( 2 Security agent fails to check in Network Security agents in place reduce IT vulnerability Intel Confidential

22 Intel Confidential

23 Intel Confidential

24 Intel Confidential

25 Intel Confidential

26 Intel Confidential

27 Intel AMT Building Blocks

28 Intel AMT Environment - Components Component Ecosystem Comments Optional Intel AMT Client OEM No Management Console ISV No Provisioning Server ISV Yes Local Agent ISV Storage, AP Yes DHCP / DNS IT Network configuration Yes Certificate Authority IT Authentication and Encryption Yes Win with Technology Leadership. Leap Ahead Intel Confidential

29 Intel AMT Platform Architecture CPU SW Agents (G)MCH ICH8 OS ME * Sensors NOC Filters M-Link SPI DDR2 DDR2 RAM FLASH BIOS NVM Nineveh Nineveh LAN LAN Manageability Engine (ME) integrated in MCH Dedicated processor for executing firmware. Available in all system power states SPI Flash Shared flash stores compressed firmware and provides storage that is accessible in all system power states System Memory Dedicated RAM to run decompressed FW Network Outbreak Containment (NOC) Filters Integrated h/w filters to monitor inbound & outbound traffic SW Agents Agent Presence checks for vital applications, SW services for manageability Win with Technology Leadership. Leap Ahead Intel Confidential

30 Intel AMT Shared Flash Layout BIOS Region 1 ME Region 2 GbE Region 3 Flash Descriptor Region 0 Win with Technology Leadership. Leap Ahead Intel Confidential

31 Win with Technology Leadership. Leap Ahead Intel Confidential

32 Win with Technology Leadership. Leap Ahead Intel Confidential

33 Win with Technology Leadership. Leap Ahead Intel Confidential

34 SW Consoles & Agents - Development Ecosystem Development Tools Visual Studio Enterprise Consoles ISVs or OEMs Resource Managers Local Applications: OEM or 3 rd party S/W Platform Mgmt Interface XML/SOAP Firmware BIOS Network Intel Silicon Note: Microsoft Platform SDK required for development with Microsoft Visual Studio Win with Technology Leadership. Leap Ahead Intel Confidential

35 Expanding the Intel AMT Ecosystem New Intel Manageability Developer Community will launch online by October 1, 2006 Enables ISVs, IT shops, & developers to easily develop Intel AMT solutions Access to Intel AMT Software Development Kit (SDK), plus technical content & support Visit the Intel Manageability Developer Community at: Win with Technology Leadership. Leap Ahead Intel Confidential

36 Intel AMT Functional Details

37 Functional Details HW Inventory CPU BIOS Store inventory: BIOS extension sends SMBIOS, ACPI ASF!, PCI* device, and media device tables over Intel ME Interface Intel AMT FW processes tables, writes data into flash Retrieve inventory: BIOS Extension BIOS Extension Remote management app requests HW asset data Intel AMT FW reads data from flash and returns it <interface> ME Interface Management Console NV Store HW Asset Data ME Storage Mgr OOB HTTP Server SOAP/XML OOB IP Networking µstack (TCP/IP, HTTP, SOAP) SOAP/XML Transfer Data Collector Data Collector Win with Technology Leadership. Leap Ahead Intel Confidential

38 Functional Details SW Inventory CPU OS Store SW Data: SW Agent sends host data over ME Interface (SW Inventory, Local Agent Signature/Timestamp, ) Intel AMT FW writes data into flash Retrieve Data: SW Agent SW Agent Remote management app requests stored data Intel AMT FW reads data from flash and returns it <interface> ME Interface Management Console NV Store SW Data ME Storage Mgr OOB HTTP Server SOAP/XML OOB IP Networking µstack (TCP/IP, HTTP, SOAP) SOAP/XML Transfer Data Collector Data Collector Win with Technology Leadership. Leap Ahead Intel Confidential

39 Functional Details Event Alerting & Logging Sensors: Temp Voltage Fan Chassis AMT Event Security Alert* NV Store Event Log CPU ME Processor Chipset HW Monitor OS/BIOS Watchdog SMBus BIOS OOB Events Filter OOB Web Server HTTP/XML OOB IP Networking µstack (TCP/IP, HTTP, SOAP) Win with Technology Leadership. Leap Ahead Intel Confidential OS * Security Alert: such as dictionary attack or authentication failure PET ME keeps log of platform events ASF Sensor Events BIOS Events System Boot Failure BIOS Progress BIOS Error OS Events OS Hung Optionally send PET Alerts to Remote Event Collector Several Event filters can be defined Management Framework Event Event Collector

40 Functional Details Remote Control: (IDE-R) BIOS OS BIOS Boot option can be remotely set to indicate to BIOS that it should Boot from IDE-R Helpdesk connects to ME IDE-R Connection authenticated Separate PCI function supports standard IDE register set <interface> IDE Class Interface IDE Class Driver BIOS or OS software issues ATA and ATAPI commands 1. Firmware relays commands/data to helpdesk system 2. Helpdesk software resolves commands locally 3. Helpdesk software relays data/status back to Intel AMT FW Note: BIOS and ISV SW integration needed Intel supports both BIOS vendors and ISVs ME IDER/SOL OOB Network Stack TLS/TCP IDE-R performance limited to 7x CD Helpdesk PC IDER Service IDER Service Floppy Floppy or or CD CD image image Win with Technology Leadership. Leap Ahead Intel Confidential

41 Functional Details Remote Control: SOL BIOS Console Redirect Remote Control Application OS BIOS Boot option can be remotely set to indicate to that it should enable SOL Text based: BIOS configuration screens DOS console OS EMS redirection Helpdesk connects to ME Connection authenticated Separate PCI function supports standard Com port register set <interface> Serial Port BIOS or OS software issues serial writes and waits for serial input Display text and user input transacted with Management console ME IDER/SOL OOB Network Stack TLS/TCP Helpdesk PC SOL Service SOL Service Win with Technology Leadership. Leap Ahead Intel Confidential

42 Functional Details Agent Presence OS Management Policy transferred from Console to Intel AMT client Authenticated connection Prioritized Management Policy definitions Agent in User OS Reports Alive to ME ISV Agent Separate PCI function for HECI ME Interface ME Watchdog Timer OOB Network Stack ME implements Management Policy upon Agent failure Management Policy remediation can include: Block and/or limit traffic flow Move to isolated network Generate Alert TLS/TCP Management Console Management Client Client Configuration Policy Policy Win with Technology Leadership. Leap Ahead Intel Confidential

43 Functional Details System Defense ME applies policy to all inbound and/or outbound traffic Application requiring Network transactions OS Network Driver Management Policy transferred from Console to Intel AMT client Authenticated connection Prioritized Management Policy definitions Management Policy remediation can include: Block and/or limit traffic flow Move to isolated network Generate Alert ME Trigger generates remediation OOB Network Stack Comms NOC Filters controller PHY All network traffic subject to Management Policy TLS/TCP Management Console Management Policy Policy Win with Technology Leadership. Leap Ahead Intel Confidential

44 Network Outbreak Containment Filters Ethernet Header Ethernet Frame IP Packet TCP/UDP Packet IP Header TCP/UDP Header Data Ethernet Header Protocol type Wildcards supported IP Header Source Address Destination Address Protocol Type (TCP/UDP) 32 filters for in-bound and 32 filters for out-bound 16 total counters to collect statistics and rate-limit Win with Technology Leadership. Leap Ahead Intel Confidential TCP/UDP Header ICMP Filter Source Port Destination Port TCP Flags

45 Close/Q&A This course was intended to meet the following objectives: 1. Provide an overview of the manageability & security usage models that are enabled with Intel AMT platforms. 2. Provide architectural details of the Intel AMT platform HW/FW/SW. 3. Provide functional details showing how the Intel AMT HW/FW/SW architecture is used to implement the usage models.

46