Abstract:
A system, method, and non-transitory computer-readable medium for a combination wireless and smartcard login authentication is disclosed. The method discloses validating a smartcard to yield a validation and establishing, based on the validation, a wireless connection with a remote device. The method can further include receiving a smartcard passcode verifying the smartcard passcode to yield a verification, and authorizing, based on the verification and at the server, the remote device access to a baseboard management controller of the server.

Description:
FIELD OF TECHNOLOGY 
       [0001]    The subject matter herein generally relates to server authentication. More specifically, the subject matter herein relates to a combination wireless and smartcard authentication of a baseboard management controller of a server. 
       BACKGROUND 
       [0002]    A baseboard management controller (BMC) is a specialized microcontroller, generally embedded on a motherboard of a server. The general purpose of the BMC is to: (1) manage the interface between the server hardware and the server management software, and (2) enable a system administrator to remotely monitor the server. The BMC can be in communication with different sensors to monitor server parameters (e.g., temperature, humidity, power supply voltage, fan speed, communication parameters, operating system functions, network status, etc.). The BMC can include a plurality of physical interfaces (e.g., system management bus (SMB), universal asynchronous receiver/transmitting (UART), universal serial bus (USB), RS-232 serial consoles, network adapters, etc.). System administrators can connect to the BMC by direct connection through a physical interface or by a network connection. Authentication for the connections is generally through username and password. Passwords are only as secure as their creators and can remain unchanged for long periods of time. Unauthorized access to the BMC can enable an unauthorized user complete access to the server. A more secure system and method of accessing the BMC is needed. 
       SUMMARY 
       [0003]    Additional features and advantages of the disclosure will be set forth in the description which follows, and in part will be obvious from the description, or can be learned by practice of the herein disclosed principles. The features and advantages of the disclosure can be realized and obtained by means of the instruments and combinations particularly pointed out in the appended claims. These and other features of the disclosure will become more fully apparent from the following description and appended claims, or can be learned by the practice of the principles set forth herein. 
         [0004]    In at least one embodiment, a method, system and non-transitory computer readable medium for a combination wireless and smartcard login authentication is disclosed. The method can include validating, at a server, a smartcard to yield a validation and establishing, based on the validation, a wireless connection with a remote device. The method can further include receiving a smartcard passcode and verifying the smartcard passcode to yield a verification. Finally, the method can include authorizing, based on the verification, the remote device access to a baseboard management controller of the server. 
         [0005]    In some embodiments, the method can include enabling, at the server, smartcard authorization, validating a smartcard to yield a validation, and transmitting, based on the validation, a random number. 
         [0006]    In some embodiments the method can include transmitting a random number and receiving, at the server, an encrypted passcode, wherein the encrypted passcode is an encrypted random number generated from the random number. The method can further include storing, at the server, as the smartcard passcode the encrypted passcode. 
         [0007]    In some embodiments the method can include the verifying including transmitting, from the server, the smartcard passcode, wherein the smartcard passcode is encrypted. The method can further include receiving, at the server, a successful verification when the decrypted smartcard passcode is equal to a previously stored random number. 
         [0008]    In some embodiments the method can include receiving, at the server, login credentials for a console session and authenticating, at the server, the login credentials. The method can further include transmitting, from the server, the smartcard passcode, wherein the smartcard passcode is encrypted. 
         [0009]    In some embodiments the method can include receiving, at a second server, login credentials for a console session and authenticating, at the second server, the login credentials. The method can further include receiving, at the second server, the encrypted smartcard passcode. 
         [0010]    In some embodiments the method can include establishing, at the server, a wireless connection with the remote device, receiving login credentials and authenticating the login credentials. The method can further include transmitting the smartcard passcode and enabling smartcard authorization. 
     
    
     
       BRIEF DESCRIPTION OF THE DRAWINGS 
         [0011]    Implementations of the present technology will now be described, by way of example only, with reference to the attached figures, wherein: 
           [0012]      FIG. 1  illustrates a block diagram of an example combination BMC authorization system; 
           [0013]      FIG. 2  is flow diagram of an example method of a traditional BMC login authentication; 
           [0014]      FIG. 3  is flow diagram of an example method of a BMC initialization of an improved BMC login authentication; 
           [0015]      FIG. 4  is flow diagram of an example method of a mobile device and smart card improved BMC login authentication; 
           [0016]      FIG. 5  is flow diagram of an example method of a mobile device and smart card improved BMC login authentication; 
           [0017]      FIG. 6  is flow diagram of an example method of a saving a passcode of an improved BMC login authentication; 
           [0018]      FIG. 7  is flow diagram of an example method of verifying a passcode of an improved BMC login authentication; 
           [0019]      FIG. 8  is flow diagram of an example method of exporting and importing a passcode of an improved BMC login authentication in a multi-node environment; and 
           [0020]      FIG. 9  is flow diagram of an example method of exporting and importing a passcode of an improved BMC login authentication in a mobile device. 
       
    
    
     DETAILED DESCRIPTION 
       [0021]    It will be appreciated that for simplicity and clarity of illustration, where appropriate, reference numerals have been repeated among the different figures to indicate corresponding or analogous elements. In addition, numerous specific details are set forth in order to provide a thorough understanding of the embodiments described herein. However, it will be understood by those of ordinary skill in the art that the embodiments described herein can be practiced without these specific details. In other instances, methods, procedures and components have not been described in detail so as not to obscure the related relevant feature being described. The drawings are not necessarily to scale and the proportions of certain parts may be exaggerated to better illustrate details and features. The description is not to be considered as limiting the scope of the embodiments described herein. 
         [0022]    Several definitions that apply throughout this disclosure will now be presented. 
         [0023]    The term “coupled” is defined as connected, whether directly or indirectly through intervening components, and is not necessarily limited to physical connections. The connection can be such that the objects are permanently connected or releasably connected. The term “substantially” is defined to be essentially conforming to the particular dimension, shape or other word that substantially modifies, such that the component need not be exact. For example, substantially cylindrical means that the object resembles a cylinder, but can have one or more deviations from a true cylinder. The term “comprising” means “including, but not necessarily limited to”; it specifically indicates open-ended inclusion or membership in a so-described combination, group, series and the like. 
         [0024]      FIG. 1  illustrates a block diagram of an example combination BMC authorization system  100 . Combination BMC authorization system  100  can include one or more servers  102 . The one or more servers  102  can include a baseboard management controller (BMC)  104 . The BMC  104  can be a specialized server processor coupled to one or more motherboards of server  102 . In some embodiments, the BMC can monitor the physical state (e.g., temperature, humidity, power supply voltage, fan speed, communication parameters, operating system functions, network status, etc.) of the server  102  by a plurality of sensors (not shown). The BMC  104  can run firmware  106 . BMC firmware  106  can be configured to control, monitor, and/or manipulate the hardware components of server  102 . Server  102  can also include one or more peripheral ports including a universal serial bus (USB) port  108  and a local area network (LAN) port  110 . 
         [0025]    Combination BMC authorization system  100  can include a LAN user  112 . LAN user  112  can be an electronic device (e.g., computing system, tablet, smartphone, etc.) configured to communicate with server  102  through web browser  114  by a system administrator. LAN user  112  can communicate with server  102  over a local area network using hypertext transport protocol (HTTP) or secure HTTP. Through web browser  114 , LAN user  112  can be configured to access a BMC web management console (i.e., to manage settings of the BMC). In some embodiments, LAN user  112  can enable and disable smart card authorization on BMC  104 . 
         [0026]    Server  102  of combination BMC authorization system  100  can be configured to accept a USB adapter  116  at USB port  108 . USB adapter  116  can include a USB hub  120 . USB hub  120  can expand a single USB port into one or more USB ports. USB hub  120  can couple to a short-range wireless adapter (SRW)  118  and a smartcard reader  122 . Server  102  can run chip card interface device (CCID) protocol that enables smartcard  124  to connect to server  102  by smartcard reader  122 . The CCID protocol enables smartcard  124  to be used as a security token for authentication and data encryption. 
         [0027]    Short-range wireless adapter  118  can be configured to transmit and receive data over short distances. For example, short-range wireless adapter  118  can be configured to use Bluetooth, Millimetre Wave Gigabit Wireless (Gifi), near field communication (NFC), ZigBee, etc. Mobile device  126  (e.g., smartphone, tablet, laptop, etc.) can be configured to couple with USB adapter  116  through short-range wireless adapter  118  (e.g., pairing, bonding, etc.). Smartcard reader  122  can be configured to accept smartcard  124 . Smartcard  124  can be embedded with an integrated circuit. Smartcard  124  can be contact or contactless. In some embodiments, smartcard  124  can be configured to store an encrypted passcode. In some embodiments, smartcard  124  can be configured to store authentication credentials (e.g., password, owner identification, etc.). 
         [0028]    The methods illustrated in  FIGS. 2-9  are provided by way of example, as there are a variety of ways to carry out the method. Additionally, while the example method is illustrated with a particular order of steps, those of ordinary skill in the art will appreciate that  FIGS. 2-9  and the steps illustrated therein can be executed in any order that accomplishes the technical advantages of the present disclosure and can include fewer or more steps than illustrated. 
         [0029]    Each step shown in  FIGS. 2-9  represents one or more processes, methods or subroutines, carried out in example method. The steps illustrated in  FIGS. 2-9  can be implemented in a system illustrated in  FIG. 1 . The flow charts illustrated in  FIG. 2-9  will be described in relation to and make reference to at least server  102 , USB adapter  116 , mobile device  126 , LAN user  112 , and smartcard  124  as illustrated in  FIG. 1 . 
         [0030]      FIG. 2  is flow diagram of an example method  200  of a traditional BMC login authentication  200 . A traditional BMC login authentication is password based (e.g., an administrator needs to remember a password to login to the BMC  104 ). Method  200  can begin at step  202 . At step  202 , a USB adapter  116  can be coupled to server  102  at port  108 . When the USB adapter  116  has been coupled to server  102 , method  200  can proceed to step  204 . 
         [0031]    At step  204 , mobile device  126  can communicatively couple (i.e., by short-range wireless) with USB adapter  116 . In some embodiments, mobile device  126  can pair with USB adapter  116 , by short-range wireless adapter  118 , using secure simple pairing (SSP). When mobile device  126  has successfully coupled to USB adapter  116 , method  200  can proceed to step  206 . 
         [0032]    At step  206 , mobile device  126  can establish a connection with BMC  104 . For example, mobile device  126  can access server  102  and BMC  104  through USB adapter  116 , after a successfully pairing in step  204 . When mobile device  126  has successfully established a connection with BMC  104 , method  200  can proceed to step  208 . 
         [0033]    At step  208 , mobile device  126  can transmit a login credentials to BMC  104 . For example, an administrator of mobile device  126  can enter a user name and password for BMC  104 . When login credentials have been transmitted to BMC  104 , the method  200  can proceed to step  210 . At step  210 , BMC  104  can receive the login credentials, authenticate the credentials, and return the results to mobile device  126 . For example, BMC  104  can receive a user name and password, authenticate the user name and password as valid, and return to the mobile device  126  an unsuccessful authentication (i.e., when the user name and password are incorrect) or a successful authentication (i.e., when the user name and password are correct). In some embodiments, the authentication is performed by a comparison of encrypted login credentials stored in a database. When the results of the login authentication have been returned to the mobile device  126 , method  200  can proceed to step  212 . At step  212 , when the returned login authentication is unsuccessful, method  200  can return to step  208 . When the returned login authentication is successful, the method  200  can enable management access of BMC  104  to mobile device  126  and method  200  can end. 
         [0034]      FIG. 3  is flow diagram of an example method  300  of a BMC initialization of an improved BMC login authentication. An improved BMC login authentication can add additional security for accessing BMC  104  of server  102 . For example, improved BMC login authentication can use a combination authentication of smartcard  124  and mobile device  126 , where traditional BMC login authentications are password based. Method  300  illustrates initializing an improved BMC login authentication on BMC  104 . 
         [0035]    Method  300  can begin at step  302 . At step  302  a USB adapter  116  can be coupled to server  102  at USB port  108 . When the USB adapter  116  has been coupled to server  102 , method  300  can proceed to step  304 . At step  304 , a smartcard  124  can be inserted into USB adapter  116 . When a smartcard  124  has been inserted into USB adapter  116 , the method  300  can proceed to step  306 . At step  306 , LAN user  112  can login to BMC  104  (e.g., through web browser  114  over LAN port  110 ). When LAN user  112  has logged in to BMC  104 , method  300  can proceed to step  308 . At step  308 , LAN user  112  can enable smartcard authorization on BMC  104 . For example, a system administrator can login into BMC  104  by a web management console. The system administrator can then enable or disable smartcard authorization for BMC  104  (i.e., allow smartcard authorization or not allow smartcard authorization). When smartcard authorization has been enabled, the method  300  can proceed to step  310 . 
         [0036]    At step  310 , BMC  104  can determine if smartcard  124  is valid. For example, smartcard  124  can have a validity period. Upon expiration of the validity period, smartcard  124  is no longer valid (i.e., smartcard  124  cannot be used for authentication). In one embodiment, smartcard  124  is valid for three years after issuance. When BMC  104  has been validated, method  300  can proceed to step  312 . 
         [0037]    At step  312 , a passcode can be saved on smartcard  124  (as illustrated in  FIG. 5 ). For example, smartcard  124  can include an integrated circuit. The integrated circuit can include a plurality of pinouts. One pinout of the integrated circuit can be configured to program a persistent memory (e.g., EEPROM). When the passcode has been saved on smartcard  124 , method  300  can end. 
         [0038]      FIG. 4  is flow diagram of an example method  400  of a mobile device and smart card improved BMC login authentication. When BMC  104  has been initialized (i.e., smartcard authentication has been enabled) a user can login to BMC by smartcard  124  and mobile device  126 . 
         [0039]    Method  400  can begin at step  402 . At step  402 , a USB adapter  116  can be coupled to server  102  at USB port  108 . When the USB adapter  116  has been coupled to server  102 , method  400  can proceed to step  404 . At step  404 , a smartcard  124  can be inserted into USB adapter  116  at smartcard reader  122 . When a smartcard  124  has been inserted into USB adapter  116 , the method  400  can proceed to step  406 . At step  406 , BMC  104  can determine if smartcard  124  is valid (as illustrated above). When BMC  104  has validated smartcard  124 , method  400  can proceed to step  408 . At step  408 , mobile device  126  can successfully pair (i.e., establish a connection) with USB adapter  116 . For example, mobile device  126  can access to server  102  and BMC  104  after a successfully pairing. When mobile device  126  has successfully paired with USB adapter  116 , method  400  can proceed to step  410 . At step  410 , the passcode of smartcard  124  can be transmitted to BMC  104  for authentication when smartcard authorization has been enabled (e.g., by short-range wireless connection established in step  408 ). When the passcode of smartcard  124  has been transmitted to BMC  104 , method  400  can proceed to step  412 . 
         [0040]    At step  412 , BMC  104  can authenticate (i.e., verify) the passcode of smartcard  124  (as illustrated in  FIG. 6 ). At step  414 , BMC can transmit the result of the authentication at step  412  to mobile device  126 . When the BMC has transmitted the results of the authentication to mobile device  126 , the method  400  can proceed to step  416 . 
         [0041]    At step  416 , mobile device  126  can receive the results of the passcode authentication. When the results of the authentication are unsuccessful, mobile device  126  is not authorized to manage BMC  104  and method  400  can end. When the results of the authentication are successful, mobile device  126  can begin management of BMC  104  (e.g., monitor server  102 ). When the results of the authentication are successful, method  400  can end. 
         [0042]      FIG. 5  is flow diagram of an example method  500  of a mobile device and smart card improved BMC login authentication. When BMC  104  has been initialized (i.e., smartcard authentication has been enabled) a user can login to BMC by smartcard  124  and mobile device  126 . 
         [0043]    Method  500  can begin at step  502 . At step  502 , BMC  104  can determine if smartcard  124  is valid (as illustrated above). When BMC  104  has been validated, method  500  can proceed to step  504 . At step  504 , mobile device  126  can successfully pair (i.e., establish a connection) with USB adapter  116  by short-range wireless adapter  118 . For example, mobile device  126  can access to server  102  and BMC  104  after a successfully pairing. When mobile device  126  has successfully paired with USB adapter  116 , method  500  can proceed to step  506 . At step  506 , the passcode of smartcard  124  can be transmitted to BMC  104  for authentication. When the passcode of smartcard  124  has been transmitted to BMC  104 , method  500  can proceed to step  508 . 
         [0044]    At step  508 , BMC  104  can authenticate (i.e., verify) the passcode of mobile device  126  (as illustrated in  FIG. 6 ). At step  510 , BMC  104  can transmit the result of the authentication at step  508  to mobile device  126 . When the results of the authentication are unsuccessful, mobile device  126  is not authorized to manage BMC  104  and method  500  can end. When the results of the authentication are successful, mobile device  126  can begin management of BMC  104  (e.g., monitor server  102 ). When the results of the authentication are successful, method  500  can end. 
         [0045]      FIG. 6  is flow diagram of an example method  600  of a saving a passcode of an improved BMC login authentication. Smartcard  124  can be configured to store a passcode. In some embodiments, the passcode can be a random number. In some embodiments, the passcode can be user-defined. In some embodiments, the passcode can be encrypted (e.g., secret key, private key, etc.). 
         [0046]    Method  600  can begin at step  602 . At step  602 , BMC  104  can generate a random number. The random number can be transferred, from BMC  104  to smartcard  124  through USB adapter  116  (by smartcard reader  122 ). Smartcard  124  can store the random number in memory (e.g., EEPROM). When the random number has been generated, transmitted, and stored the method can proceed to step  604 . 
         [0047]    At step  604 , smartcard  124  can encrypt the random number (e.g., with a secret key, private key, etc.). Smartcard  124  can include an encryption key (e.g., secret key, private key, etc.). After smartcard  124  has encrypted the random number, the encrypted random number can be transmitted to BMC  104 . The BMC  104  can store, in memory (e.g., flash ROM, etc.), the received encrypted random number as the smartcard  124  passcode. When the random number has been encrypted, transmitted, and stored as smartcard  124  passcode, method  600  can end. 
         [0048]      FIG. 7  is flow diagram of an example method  700  of verifying a passcode of an improved BMC login authentication. Smartcard  124  can be used to verify the authenticity of mobile device  126 . For example, an administrator can access BMC  104  by USB adapter  116 . The administrator can insert smartcard  124  into USB adapter  116  at smartcard reader  122  and wirelessly coupled mobile device  126  to USB adapter  116  by short-range wireless adapter  118 . Smartcard  124  can then authenticate the previously stored passcode in BMC  104  to verify mobile device  126  (and the administrator) have the appropriate credentials for accessing BMC  104 . 
         [0049]    Method  700  can begin at step  702 . At step  702 , BMC  104  can transmit, through USB adapter  116 , to smartcard  124  the encrypted smartcard passcode (i.e., as illustrated above in method  500 ). When BMC  104  has transmitted the encrypted smartcard passcode to smartcard  124 , the method can proceed to step  704 . 
         [0050]    At step  704 , smartcard  124  can receive and decrypt the encrypted smartcard passcode. For example, smartcard  124  can decrypt the encrypted smartcard passcode using the same encryption key (e.g., secret key, private key, etc.) used to encrypt the random number (i.e., in method  500 ). When the encrypted smartcard passcode has been decrypted, smartcard  124  can compare the decrypted smartcard passcode with the previously stored random number (i.e., in method  500 ). When the encrypted smartcard passcode has been decrypted and compared to the previously stored random number, the method can proceed to step  706 . 
         [0051]    At step  706 , smartcard  124  can transmit to the BMC  104  the results of the comparison between the previously stored random number and the decrypted smartcard passcode. When the decrypted smartcard passcode is equal to the previously stored random number, the smartcard  124  can return an authentication success to BMC  104 . When the decrypted smartcard passcode is not equal to the previously stored random number, the smartcard  124  can return an authentication failure to BMC  104 . When smartcard  124  has returned a success or failure to BMC  104 , the method  700  can end. 
         [0052]      FIG. 8  is flow diagram of an example method  800  of exporting and importing a passcode of an improved BMC login authentication in a multi-node environment. In some embodiments an administrator can have multiple BMCs (and servers) to manage. Multiple smartcards can be difficult to manage. In some embodiments, a single smartcard (per administrator) can manage multiple BMCs. Smartcard authentication is based on an encrypted smartcard passcode. A single smartcard can manage multiple BMC, when the each BMC has stored the encrypted smartcard passcode associated with the single smartcard. 
         [0053]    Method  800  can begin at step  802 . At step  802 , LAN user  112  can login to BMC  104 A (e.g., through web browser  114  over LAN port  110 ). When LAN user  112  has logged in to BMC  104 A, method  800  can proceed to step  804 . At step  804 , LAN user  112  can download the encrypted smartcard passcode. For example, the encrypted smartcard passcode can be the passcode saved in method  500  of  FIG. 5 . When LAN user  112  has downloaded the encrypted smartcard passcode, the method  800  can proceed to step  806 . At step  806 , LAN user  112  can login to BMC  104 N. For example, LAN user  112  can login to BMC  104 N (e.g., through web browser  114  over LAN port  110 ). In some embodiments, BMC  104 N can be a plurality of different BMCs. In some embodiments, BMC  104 N can be one BMC of a plurality of different BMCs. When LAN user  112  has logged in to BMC  104 N, method  800  can proceed to step  808 . At step  808 , LAN user  112  can upload the encrypted smartcard passcode to BMC  104 N. For example, the BMC  104 N can receive and store, in memory (e.g., flash ROM, etc.), the encrypted smartcard passcode. When the BMC  104 N has received and stored the encrypted passcode in memory, method  800  can end. 
         [0054]      FIG. 9  is flow diagram of an example method  900  of exporting and importing a passcode of an improved BMC login authentication in a mobile device. A system administrator can enable authorization between mobile device  126  and BMC  104  (through USB adapter  116 ). To enable authorization between mobile device  126  and BMC  104 , the encrypted smart passcode can be transmitted from BMC  104  and stored, in the memory, of mobile device  126 . When mobile device  126  has the encrypted smartcard passcode, mobile device  126  can be enabled for authorization at BMC  104 . 
         [0055]    Method  900  can begin at step  902 . At step  902 , a USB adapter  116  can be coupled to server  102  at USB port  108 . When the USB adapter  116  has been coupled to server  102 , method  900  can proceed to step  904 . 
         [0056]    At step  904 , mobile device  126  can communicatively couple (i.e., by short-range wireless) with USB adapter  116 . In some embodiments, mobile device  126  can pair with USB adapter  116 , by short-range wireless adapter  118 , using secure simple pairing (SSP). When mobile device  126  has successfully coupled to USB adapter  116 , method  900  can proceed to step  906 . 
         [0057]    At step  906 , mobile device  126  can establish a connection with BMC  104 . For example, mobile device  126  can access server  102  and BMC  104  through USB adapter  116 , after a successfully pairing in step  204 . When mobile device  126  has successfully established a connection with BMC  104 , method  900  can proceed to step  908 . 
         [0058]    At step  908 , mobile device  126  can transmit login credentials to BMC  104 . For example, an administrator of mobile device  126  can enter a user name and password for BMC  104 . When login credentials have been transmitted to BMC  104 , the method  900  can proceed to step  910 . At step  910 , BMC  104  can receive the login credentials, authenticate the credentials, and return the results to mobile device  126 . For example, BMC  104  can receive a user name and password, authenticate the user name and password as valid, and return to the mobile device  126  an unsuccessful authentication (i.e., when the user name and password are incorrect) or a successful authentication (i.e., when the user name and password are correct). In some embodiments, the authentication is performed by a comparison of encrypted login credentials stored in a database. When the results of the login authentication have been returned to the mobile device  126 , method  900  can proceed to step  912 . 
         [0059]    At step  912 , mobile device  126  can download encrypted passcode file stored in memory from BMC  104 . For example, the encrypted passcode file stored in memory of BMC  104  in method  500  of  FIG. 5 . When the encrypted passcode file has been downloaded to mobile device  126 , method  900  can proceed to step  914 . 
         [0060]    At step  914 , mobile device  126  can enable on BMC  104  smartcard authorization using a smart card. For example, the system administrator (i.e., of mobile device  126 ) can enable or disable smartcard authorization for BMC  104  (i.e., allow smartcard authorization or not allow smartcard authorization). In some embodiments, smartcard authorization is already enable and the system administrator does not have to enable smartcard authorization. When smartcard authorization has been enabled, the method  900  can end. 
         [0061]    It is believed the exemplary embodiment and its advantages will be understood from the foregoing description, and it will be apparent that various changes may be made thereto without departing from the spirit and scope of the disclosure or sacrificing all of its advantages, the examples hereinbefore described merely being preferred or exemplary embodiments of the disclosure.