Abstract:
A method for interlocking a plurality of servers to a server system is disclosed. The method comprises assigning an identifier to each of the plurality of servers, wherein the identifier associates each of the plurality of servers to the server system, thereby defining a plurality of interlocked servers.

Description:
FIELD OF THE INVENTION 
     The present invention relates generally to computer server systems and, more particularly, to a method for interlocking a server to a server system. 
     BACKGROUND OF THE INVENTION 
     In today&#39;s environment, a computing system often includes several components, such as servers, hard drives, and other peripheral devices. These components are generally stored in racks. For a large company, the storage racks can number in the hundreds and occupy huge amounts of floor space. Also, because the components are generally free standing components, i.e., they are not integrated, resources such as floppy drives, keyboards and monitors, cannot be shared. 
     A system has been developed by International Business Machines Corp. of Armonk, N.Y., that bundles the computing system described above into a compact operational unit. The system is known as an IBM eServer BladeCenter.™ The BladeCenter is a 7U modular chassis that is capable of housing up to 14 individual server blades. A server blade or blade is a computer component that provides the processor, memory, hard disk storage and firmware of an industry standard server. Each blade can be “hot-plugged” into a slot in the chassis. The chassis also houses supporting resources such as power, switch, management and blower modules. Thus, the chassis allows the individual blades to share the supporting resources. 
     In a dense server environment, multiple BladeCenter type products can be utilized. Because the server blades are highly mobile, i.e., they are easily removed from a chassis and easily reinstalled into the same or another chassis, there is a possibility that an unauthorized or hostile server blade can be placed in a chassis. In that case, the hostile server blade could have access to information on the other server blades in the chassis or be privy to information distributed to the authorized server blades in the chassis. Moreover, the hostile server blade could corrupt the other server blades, e.g., by introducing viruses into the system. Clearly, this raises serious security concerns. 
     Accordingly, a need exists for a method for securely interlocking servers to their respective server systems. The method should be able to detect and isolate a non-interlocked, i.e., unauthorized, server in the server system. The present invention addresses such a need. 
     SUMMARY OF THE INVENTION 
     The present invention is directed to a method for interlocking a plurality of servers to a server system and a computer system utilizing the same. In a first aspect, the method comprises assigning an identifier to each of the plurality of servers, wherein the identifier associates each of the plurality of servers to the server system, thereby defining a plurality of interlocked servers. 
     Through the aspects of the present invention, each server is interlocked to its respective server system via an identifier stored in its non-volatile storage. The identifier is unique to the server system. Thus, if an unauthorized server is placed in the server system, it will be identified immediately as such and isolated from the other servers in the system. In this manner, the server system is protected from intruders. 
    
    
     
       BRIEF DESCRIPTION OF THE DRAWINGS 
         FIG. 1  is a perspective view illustrating the front portion of a BladeCenter. 
         FIG. 2  is a perspective view of the rear portion of the BladeCenter. 
         FIG. 3  is a schematic block diagram of a server blade system according to a preferred embodiment of the present invention. 
         FIG. 4  is a flowchart illustrating a process by which a system administrator uses the interlock utility in accordance with a preferred embodiment of the present invention. 
         FIG. 5  is a flowchart illustrating the process by which the server system performs a power-up sequence according to a preferred embodiment of the present invention. 
     
    
    
     DETAILED DESCRIPTION 
     The present invention relates generally to computer server systems and, more particularly, to a method and system for interlocking a server to a server system. The following description is presented to enable one of ordinary skill in the art to make and use the invention and is provided in the context of a patent application and its requirements. Although the preferred embodiment of the present invention will be described in the context of a BladeCenter, various modifications to the preferred embodiment and the generic principles and features described herein will be readily apparent to those skilled in the art. Thus, the present invention is not intended to be limited to the embodiment shown but is to be accorded the widest scope consistent with the principles and features described herein. 
     According to a preferred embodiment of the present invention, an interlock mechanism allows an administrator to interlock each server in a server system (chassis) to the system by storing an identifier in each server&#39;s non-volatile storage. The identifier uniquely identifies the server system. Thus, at appropriate times, the interlock mechanism will autonomously check each server in the system to ensure that each server is interlocked to the server system. If an unauthorized server is detected, the interlock mechanism will take appropriate action to protect the server system from the unauthorized server. 
     To describe the features of the present invention, please refer to the following discussion and Figures, which describe a computer system, such as the BladeCenter, that can be utilized with the present invention.  FIG. 1  is an exploded perspective view of the BladeCenter system  100 . Referring to this figure, a main chassis  102  houses all the components of the system. Up to 14 server blades  104  (or other blades, such as storage blades) are optionally hot plugable into 14 corresponding slots  105   a - 105   n  in the front of chassis  102 . Blades  104  may be “hot swapped” without affecting the operation of other blades  104  in the system  100 . A server blade  104   a  can use any microprocessor technology so long as it is compliant with the mechanical and electrical interfaces, and the power and cooling requirements of the system  100 . 
     A midplane circuit board  106  is positioned approximately in the middle of chassis  102  and includes two rows of connectors  108 ,  108 ′. Each one of the 14 slots includes one pair of midplane connectors, e.g.,  108   a ,  108   a ′, located one above the other, and each pair of midplane connectors, e.g.,  108   a ,  108   a ′mates to a pair of connectors (not shown) at the rear edge of each server blade, e.g.,  104   a.    
       FIG. 2  is a perspective view of the rear portion of the BladeCenter system  100 , whereby similar components are identified with similar reference numerals. Referring to  FIGS. 1 and 2 , a second chassis  202  also houses various components for cooling, power, management and switching. The second chassis  202  slides and latches into the rear of main chassis  102 . 
     As is shown in  FIGS. 1 and 2 , two optionally hot plugable blowers  204   a ,  204   b  provide cooling to the blade system components. Four optionally hot plugable power modules  206  provide power for the server blades and other components. Management modules MM 1  and MM 2  ( 208   a ,  208   b ) provide basic management functions such as controlling, monitoring, alerting, restarting and diagnostics. Management modules  208  also provide other functions required to manage shared resources, such as multiplexing the keyboard/video/mouse (KVM) to provide a local console for the individual blade servers  104  and configuring the system  100  and switching modules  210 . 
     The management modules  208  communicate with all of the key components of the system  100  including the switch  210 , power  206 , and blower  204  modules as well as the blade servers  104  themselves. The management modules  208  detect the presence, absence, and condition of each of these components. When two management modules are installed, a first module, e.g., MM 1  ( 208   a ), will assume the active management role, while the second module MM 2  ( 208   b ) will serve as a standby module. 
     The second chassis  202  also houses up to four switching modules SM 1  through SM 4  ( 210   a - 210   d ). Each switch module includes several external data ports (not shown) for connection to the external network infrastructure. The primary purpose of the switch module  210  is to provide interconnectivity between the server blades ( 104   a - 104   n ), management modules ( 208   a ,  208   b ) and the outside network infrastructure. 
       FIG. 3  is a schematic block diagram of a server blade system  300  according to a preferred embodiment of the present invention. For the sake of clarity only, one management module  302  and three server blades ( 304   a - 304   c ) are illustrated. Referring to this figure, the management module  302  is coupled to the server blades ( 304   a - 304   c ) via at least one serial bus ( 310 ) for “out-of-band” communication between the management module ( 302 ) and the server blades ( 304   a - 304   c ). “Out-of-band” communications refer to secure internal communications between components in the server system. These communications are not accessible by external entities. 
     As is shown in  FIG. 3 , the management module  302  communicates with each server blade  304   a - 304   c  through a dedicated service processor  308   a - 308   c  in each server blade  304   a - 304   c . The management module  302  also includes a port  306  that is intended to be attached to a private, secure management server  314 . The management module  302  can send alerts to the management server  314  to indicate changes in status, such as removal or addition of a blade  304   a - 304   c  or module. 
     In general, the management module  302  can detect the presence, quantity, type, and revision level of each blade  304   a - 304   c , power module  206 , blower  204 , and midplane  106  in the system, and can detect invalid or unsupported configurations. The management module  302  will retrieve and monitor critical information about the chassis  102  and server blades  304   a - 304   c , such as temperature, voltages, power supply, memory, fan and hard drive status. If a problem is detected, the management module  302  can transmit a warning to a system administrator  315  via the port  306  coupled to the management server  314 . 
     Referring again to  FIG. 1 , up to 14 server blades  104   a -  104   n  can be hot-plugged into corresponding slots  105   a - 105   n  in the chassis  102  of a BladeCenter type server system  100 . Therefore, one advantage of the BladeCenter server system  100  is that server blades  104   a - 104   n  can be easily removed from and installed into the chassis  102 . Nevertheless if multiple server systems, i.e. more than one chassis, are utilized, keeping track of which chassis  102  a server blade, e.g.,  104   a , is associated with can become problematic if the server blade  104   a  is removed from its chassis  102 . Moreover, serious security concerns are presented because an unauthorized server blade, e.g.,  104   n , can easily be placed in the chassis  102 . The unauthorized server blade  104   n  could then have access to the other server blades  104   a - 104   m  in the chassis  102 . The present invention addresses these issues. 
     Referring again to  FIG. 3 , an interlock mechanism  316  is coupled to each of the blades  304   a - 304   c  via the management module  302 . In this embodiment, the interlock mechanism  316  utilizes the “out-of-band” serial bus  310  to communicate with each of the blades  304   a - 304   c  through each blade&#39;s dedicated service processor  308   a - 308   c . In another embodiment, the interlock mechanism  316  could be a stand alone module coupled to the service processors  308   a - 308   c . The interlock mechanism  316  includes a Blade Present Table  318 , which includes information about which server blade, e.g.,  304   a , occupies which slot  105   a  ( FIG. 1 ) in the chassis  102 . The interlock mechanism  316  also includes an interlocking utility  319 , which provides an interface between the system administrator  315  and the interlock mechanism  316 . 
     In a preferred embodiment of the present invention, the system administrator (or some other authorized entity) ( 315 ) invokes the interlock utility  319  via the management server  314  to interlock the server blades  304   a - 304   c  to the server system  300 . As used in this description, “interlocking” a server blade , e.g.,  304   a , refers to associating the server blade  304   a  to an entity, such as the server system  300  or chassis  102 . In an initializing session, the interlock mechanism  316  assigns to each server blade  304   a - 304   c  an identifier, hereinafter referred to as an interlock record  320   a - 320   c , that uniquely identifies the server system  300 . 
     Each server blade  304   a - 304   c  includes non-volatile storage (NVS)  312   a - 312   c , which is accessible by the associated service processor  308   a - 308   c . The NVS  312   a - 312   c  can be any storage medium known in the art, such as storage on a hard file partition or non-volatile memory (CMOS). The interlock record  320   a - 320   c  is stored in each blade&#39;s NVS  312   a - 312   c  as well as in the Blade Present Table  318 . Thus, at appropriate times, the interlock mechanism  316  will autonomously check each server blade  304   a - 304   c  in the system  300  to ensure that each server blade  304   a - 304   c  is interlocked to the server system  300 . If an unauthorized server blade, e.g.,  304   b  is detected, the interlock mechanism  316  will take appropriate action to protect the server system  300  from the unauthorized server blade  304   b.    
       FIG. 4  is a flowchart illustrating a process by which a system administrator  315  uses the interlocking utility  319  in accordance with a preferred embodiment of the present invention. As is shown, the interlocking utility  319  allows the system administrator  315  to perform interlocking actions such as interlocking, removing, adding and disassociating one or more server blades from the server blade system. The process begins when the administrator  315  invokes the interlocking utility  319  in step  402 . In a preferred embodiment, the interlocking utility  319  is password protected to restrict access only to authorized personnel. After the administrator has entered a valid password, the administrator  315  selects the type of action he or she would like to perform in step  404 . 
     If none of the server blades  304   a - 304   c  are interlocked to the server system  300 , the administrator can select an initial interlocking session (in step  406 ). In step  407 , the interlock mechanism  316  interlocks each server blade  304   a - 304   c  to the server system  300 . In a preferred embodiment, the interlocking process begins by building the Blade Present Table  318  (step  408 ) so that the table  318  includes an entry for each server blade  304   a - 304   c  present in the system  300 . The interlock mechanism  316  then generates the interlock record  320  and stores the interlock record  320  in each server blade&#39;s non-volatile storage  312   a - 312   c  in step  409 . In a preferred embodiment, the interlock mechanism  316  transfers the interlock record  320  to each server blade&#39;s non-volatile storage  312   a - 312   c  in the form of an enumeration, such as an ACPI enumeration. After each server blade  304   a - 304   c  has been interlocked, the interlocking utility  319  updates the Blade Present Table  318 . 
     In one preferred embodiment, the interlock record  320   a - 320   c  is some alphanumeric string that uniquely identifies the server system  300 . For example, the record  320   a for a server blade  304   a  could include the serial number for the management module  302 , the server blade&#39;s  304   a  serial number, and the date and time of the session. Moreover, if the server system  300  includes a second management module (not shown), e.g., a backup module, the record  320   a - 320   c  could also include the serial number of the second management module. Accordingly, if the second module is activated, the server blades  304   a - 304   c  remain automatically interlocked to the server system  300 . In this case, the Blade Present Table  318  is copied to the second management module. 
     If the initial interlocking session has been completed, the administrator  315  can choose to remove an entry in the Blade Present Table  318  (step  412 ). The administrator  315  might perform this action if he or she were removing one of the interlocked server blades, e.g.,  304   b , from the server system  300 . Here, in step  414 , the administrator  315  provides a slot number representing the slot (e.g.,  105   b ) from which the server blade  304   b  will be removed. The interlock mechanism  316  then disassociates the server blade  304   b  from the server system  300  in step  416  by erasing the interlock record  320   b  stored in the server&#39;s non-volatile storage  312   b . In step  410 , the interlock mechanism  316  removes the corresponding entry in the Blade Present Table. 
     If the administrator wishes to add an entry (step  418 ), i.e., add a new server blade ( 304   c ) into the server system  300 , the administrator  315  provides the slot number representing the slot (e.g.,  105   b ) into which the server blade  304   c  will be placed via step  420 . The interlock mechanism  316  then interlocks the server blade  304   c  to the server system  300  in step  422  by generating the interlock record  320   c  and storing it in the server&#39;s non-volatile storage  312   c . In step  410 , the interlock mechanism  316  adds the corresponding entry in the Blade Present Table. 
     If the administrator would like to disassociate each server blade  304   a - 304   c  from the server system  300  (step  426 ), the interlock mechanism  316  disassociates each server blade in step  428  by erasing each interlock record  320   a - 320   c  in each server blade&#39;s non-volatile storage  312   a - 312   c . In step  430 , all entries in the Blade Present Table  318  are cleared. 
     Once the administrator  315  has interlocked the server blades  304   a - 304   c  to the server system  300 , the interlock mechanism  316  can detect automatically the presence of a server blade that has not been authorized, i.e., interlocked, by the administrator  315 . As stated above, the interlock mechanism  316  checks each server blade  304   a - 304   c  in the system  300  to ensure that each server blade  304   a - 304   c  is interlocked to the server system  300 . Preferably, the interlock mechanism  316  checks each server blade  304   a - 304   c  during a power-up sequence for the server system  300 , and investigates if a server blade has been added to or removed from the server system  300 . 
       FIG. 5  is a flowchart illustrating the process by which the server system  300  performs a power-up sequence according to a preferred embodiment of the present invention. The process starts at the initial power up or reset sequence of the server system  300 , i.e., when the management module  302  is powered up (via step  502 ) or reset. The interlock mechanism  316  instructs the management module  302  to hold all of the blades  304   a - 304   c  in a powered off state (step  504 ). In step  506 , the interlock mechanism  316  checks a first blade&#39;s, e.g.,  304   a , non-volatile storage  312   a  to determine whether it has an existing interlock record  320   a (step  508 ). If the interlock mechanism  316  fails to find an interlock record  320   a in the first server blade  304   a , e.g., because the server blade  304   a  was placed in the server system  300  during a power-off state, then the interlock mechanism  316  instructs the management module  302  to maintain the power off state for that server blade  304   a  in step  510 . If more server blades need to be checked (step  518 ), then the interlock mechanism  316  continues by checking the next server blade&#39;s non-volatile storage  312   b  for an interlock record  320   b  via step  520 . 
     If the interlock mechanism  316  finds an existing interlock record  320   b  (step  508 ) in the server blade&#39;s non-volatile storage  312   b , the interlock mechanism  316  must determine whether the interlock record  320   b  is valid, i.e., not generated by another interlock mechanism, in step  512 . In one preferred embodiment, the interlock mechanism  316  will access the Blade Present Table  318  and compare the existing interlock record  320   b  to that stored in the table  318 . If the values do not match, i.e., the interlock record  320   b  is invalid, the interlock mechanism  316  erases the existing interlock record  320   b  in step  514  and instructs the management module  302  to maintain the power off state for that server blade  304   b  in step  510 . If the values do match, i.e., the interlock record  320   b  is valid, the interlock mechanism  316  instructs the management module  302  to power up the server blade  304   b  and to release it for booting in step  516 . In either case, the next step (step  518 ) involves determining whether the interlock mechanism  316  must check more blades. If there are more, steps  508 - 520  are repeated. 
     After the interlock mechanism  316  has checked each of the server blades  304   a - 304   c  in the server system  300  (step  518 ), it determines which, if any, of the server blades  304   a - 304   c  are not interlocked in step  522 . The server blades, e.g.,  304   a , that are held in the power-off state are not interlocked to the server system  300 . If there are any server blades that are not interlocked, the interlock mechanism  316  generates an alert and transmits it to the system administrator via the management server  314 , in step  524 . In a preferred embodiment, the alert includes the slot number into which the non-interlocked server blade(s)  304   a  is placed. 
     As stated above, a non-interlocked server blade, e.g.,  304   a , is not authorized to operate in the server system  300 . By holding the non-interlocked server blade  304   a  in a power-off state, the interlock mechanism  316  isolates the non-interlocked server blade  304   a  from the interlocked server blades, e.g.,  304   b ,  304   c . In another embodiment, the interlock mechanism  316  instructs the management module  302  to power off the entire server system  300  after transmitting the alert if any of the server blades  304   a - 304   c  are not interlocked to the server system  300 . In either embodiment, the interlock mechanism  316  protects the integrity of the server system  300  from any unauthorized, i.e., non-interlocked, server blades  304   a  coupled to the system  300 . 
     As mentioned above, the management module  302  and therefore the interlock mechanism  316  are sensitive to the addition or removal of a server blade to and from the server system  300 . In both instances, the interlock mechanism  31   6  ensures that the server system  300  is protected and that the administrator  315  is alerted of any potential security breach. 
     For instance, in a preferred embodiment, if the management module  302  detects that a blade server, e.g.,  304   c , is inserted into the server system  300 , the interlock mechanism  316  will instruct the management module  302  to hold the newly inserted blade server  304   c  in a power off state, while it checks the server blade  304   c  to determine whether it is interlocked to the server system  300  (process steps  506 - 516  in  FIG. 5 ). If the server blade is not interlocked, the interlock mechanism  316  instructs the management module  302  to maintain the power off state, and generates the alert indicating the slot number of the non-interlocked server blade  304   c . The interlock mechanism  316  then transmits the alert to the administrator  315 . 
     If the management module  302  detects that a server blade, e.g.,  304   b , has been removed or powered off, the interlock mechanism  316  marks the entry in the Blade Present Table  318  corresponding to the removed server blade  304   b  and generates the alert indicating the slot number of the removed server blade  304   b . The interlock mechanism  316  then transmits the alert to the administrator  315 . If the removed server blade  304   b  is reinserted into the slot, the management module  302  detects that a server blade  304   b  is inserted into the server system  300 , and the interlock mechanism  316  instructs the management module  302  to hold the reinserted server blade  304   b  in a power off state, while it checks the server blade  304   b  to determine whether it is interlocked to the server system  300  (process steps  506 - 514  in  FIG. 5 ). In this case, the interlock mechanism  316  notes the mark in the entry in the Blade Present Table  318  when it compares the identifiers. The interlock mechanism  316  instructs the management module  302  to maintain the power off state, and generates another alert indicating the slot number of the suspect server blade  304   b . The interlock mechanism  316  then transmits this alert to the administrator  315 . 
     The interlock mechanism  316  generates and transmits the alert to the administrator  315  only if a non-interlocked server blade has been detected or if a server blade has been removed, or if a removed server blade has been reinserted. In either case, the administrator  315  utilizes the alert to manage and maintain the server system  300 . For example, referring again to  FIG. 4 , if a server blade has been removed, the administrator receives an alert indicating the slot number of the removed server blade. After the administrator authorizes the removal, the administrator invokes the interlock utility (step  402 ) and selects the action of removing an entry (step  412 ). The administrator provides the slot number indicated in the alert (step  414 ) and the interlock mechanism  316  disassociates the server blade from the server system  300 . Similarly, if a non-interlocked server blade has been detected, the administrator receives an alert indicating the slot number of the non-interlocked server blade. After the administrator authorizes the server blade, the administrator invokes the interlock utility (step  402 ) and selects the “add an entry” action (step  418 ). The administrator provides the slot number indicated in the alert (step  420 ) and the interlock mechanism  316  interlocks the server blade to the server system  300 . 
     As stated above, the process of interlocking a server, e.g.,  304   c , to the server system  300  involves generating an interlock record  320   c  and storing it in the server&#39;s non-volatile storage  312   c . The interlock record  320   c  is preferably based on any combination of the serial number for the management module  302 , the server blade&#39;s  304   c  serial number, and the date and time of the session. For added security, the interlock mechanism  316  preferably utilizes a hashing algorithm to hash the interlock record  320   c  to form a nonce. The nonce is then stored in the Blade Present Table  318 . When the interlock mechanism  316  stores the nonce in the server blade&#39;s non-volatile storage  312   c , it instructs the server blade  304   c  to encrypt the nonce using the server blade&#39;s private key. Accordingly, the server blade  304   c  stores the encrypted nonce in its non-volatile storage  312   c.    
     When the interlock mechanism  316  attempts to validate the interlock record  320   c  in the server blade  304   c , e.g., during a system power up sequence, the interlock mechanism  316  obtains the server blade&#39;s public key via the “out-of-band” serial bus  310 . The interlock mechanism  316  uses the public key to decrypt the encrypted nonce and compares the nonce in the server blade  304   c  with that stored in the Blade Present Table  318 . 
     By creating a nonce to represent the interlock record  320  and then encrypting the nonce at the server blade, the interlock mechanism  316  adds several layers of security to the interlocking configuration of the server system  300 . Thus, unauthorized access to the server system  300  is further deterred. 
     Through aspects of the present invention, the interlock mechanism  316  allows an administrator  315  to interlock each server in a server system to the system by storing an interlock record in each server&#39;s non-volatile storage. The interlock record uniquely identifies the server system. Thus, at appropriate times, the interlock mechanism will autonomously check each server in the server system to ensure that each server is interlocked. If an unauthorized server is detected, the interlock mechanism will take appropriate action to protect the server system from the unauthorized server. 
     While the preferred embodiment of the present invention has been described in the context of a BladeCenter environment, the functionality of the interlock mechanism  316  could be implemented in any computer environment where the servers are closely coupled. Thus, although the present invention has been described in accordance with the embodiments shown, one of ordinary skill in the art will readily recognize that there could be variations to the embodiments and those variations would be within the spirit and scope of the present invention. Accordingly, many modifications may be made by one of ordinary skill in the art without departing from the spirit and scope of the appended claims.