Patent Description:
The threat profile changes if the data plane servers and the control plane servers are not located in a same secure physical location. For example, communication between data plane servers and the control plane servers over the public internet is less secure than intra-location (e.g., direct-wired) communication. Moreover, measures deployed by control plane servers to respond to threats to data plane servers may be less robust than desired if the physical security of the data plane servers is suspect.

Systems are desired to provide increased security to computer servers, particularly with respect to remotely-managed computer servers.

<CIT> relates to a radio communication system control method, a radio communication system, and an information processing apparatus used therein, where system a server and terminals are linked via a plurality of base stations. The radio communication system is configured to prevent communication errors. When the link between a server and a base station is disconnected, the server detects the disconnection, and transmits, to a base station adjacent to the base station, a power supply off command for disconnecting the power supply in the base station. By transmitting the command to the base station via the base station, the server disconnects the power supply in the base station and stops the communication between the base station and a radio terminal apparatus.

It is the object of the present invention to provide additional security to a computer server that is controlled by an external system.

The following description is provided to enable any person in the art to make and use the described embodiments. Various modifications, however, will remain readily-apparent to those in the art.

Some embodiments facilitate protection of a computer server. For example, a server according to some embodiments may operate to detect a loss of network connectivity and power itself down in response to the detection. Powering down is intended to transition the server into a state which resists theft or other unauthorized access to data stored in the server. For example, powering down the server may disable power to volatile memory of the server, thereby erasing its contents. Accordingly, an attacker is thereafter unable to access data which was stored in the volatile memory, or any data stored in non-volatile memory and which is accessible using the data which was stored in the volatile memory.

Some embodiments may provide particular benefits in cases where a computer server is managed by an external system such as a remote computer server. In typical operation, such a remote computer server may, as described above, detect suspicious activity based on data received from a managed computer server and, in response, transmit a signal to initiate a power-down sequence of the managed computer server. The present inventors have recognized that the ability to deploy these measures is limited or lost if the network connectivity between the managed computer server and the remote computer server is disabled. Moreover, the threat of disabled network connectivity increases if the managed computer server is not in the same physically-protected location as the remote computer server. According to some embodiments, the managed computer server addresses this threat by monitoring its own network connectivity and powering itself down in response to detecting a loss of network connectivity.

<FIG> depict autonomous power-down of a computer server according to some embodiments. For purposes of the present description, a computer server may comprise a hardware device including at least one processor capable of executing software program code to cause the hardware device to operate as described herein. A computer server may exhibit any architecture and/or form factor that is or becomes known. In one non-exhaustive example, a computer server is a blade server comprising a plurality of multi-core processors and installed in a server rack along with a plurality of other blade servers.

<FIG> shows computer server <NUM> including agent <NUM>. Agent <NUM> represents one or more components of computer server <NUM> which perform the inventive functions described herein. Agent <NUM> may comprise a software service executing on computer server <NUM>, an operating system component, and/or any other combination of hardware and/or software.

<FIG> depict a process for autonomous power-down over time, such that the operation depicted in <FIG> occurs prior to the operation depicted in <FIG>, which occurs prior to the operation depicted in <FIG>, etc. Initially, as shown in <FIG>, computer server <NUM> executes agent <NUM> to cause transmission of data <NUM> to system <NUM>. External system <NUM> may comprise any computing system accessible to computer server <NUM> over any one or more public and/or private networks and capable of receiving data <NUM> over the one or more public and/or private networks.

Data <NUM> may comprise any data suitable to elicit responsive data from external system <NUM>. According to some embodiments, data <NUM> comprises an Internet Control Message Protocol (ICMP) message such as a traceroute message or an echo request message. Computer server <NUM> may transmit data <NUM> to system <NUM> specifically to determine whether network connectivity to system <NUM> has been lost, or may transmit data <NUM> for other purposes related to the operation of computer server <NUM>, such as to acquire data requested by an application executing on computer server <NUM>.

<FIG> illustrates transmission of responsive data <NUM> from system <NUM> to computer server <NUM>. Responsive data <NUM> may comprise a responsive ICMP message such as an echo reply message or a response to a request from an application executing on computer server <NUM>, but embodiments are not limited thereto. In response to reception of data <NUM>, agent <NUM> determines that network connectivity between computer server <NUM> and system <NUM> exists.

After a predetermined or programmatically-determined time, agent <NUM> determines to again check the network connectivity between computer server <NUM> and system <NUM>. <FIG> depicts transmission of data <NUM> intended to perform this check. Data <NUM> may be identical to data <NUM> or may comprise any other suitable data for eliciting a response from system <NUM>.

<FIG> indicates that no response from system <NUM> has been received by computer server <NUM>. Accordingly, agent <NUM> determines that network connectivity to computer server <NUM> has been lost. This determination indicates that system <NUM> is down or otherwise unavailable (which may be extremely unlikely in some scenarios which provide significant redundancies) and/or that a network connection between computer server <NUM> and system <NUM> is compromised.

In response to the determination that network connectivity to computer system <NUM> has been lost, and as illustrated in <FIG>, agent <NUM> initiates a power-down sequence of computer server <NUM>. This initiation may comprise sending a request to an operating system of computer server <NUM> to initiate a power-down sequence. Alternatively, and according to some embodiments, agent <NUM> may control a power supply unit of computer server <NUM> to cut off power to the other components of computer server <NUM> (i.e., akin to switching computer server <NUM> off). In some embodiments, "powering down" may describe any system to reduce power to the volatile memory of computer server <NUM> such that the volatile memory no longer retains its data.

By enabling computer server <NUM> to power itself down in response to a loss of network connectivity, some embodiments may efficiently resist unauthorized attempts to access data stored within computer server <NUM>. Some embodiments may be particularly beneficial in scenarios where security measures for protecting a computer server from attack are at least partially provided by a remote computer server.

<FIG> comprises a flow diagram of process <NUM> to autonomously power-down a computer server according to some embodiments. In some embodiments, processing units (e.g., one or more processors, processing cores, processor threads) of a computer server execute software program code to perform process <NUM>. Computer server <NUM> may execute program code of agent <NUM> to perform process <NUM>, but embodiments are not limited thereto. Process <NUM> and all other processes mentioned herein may be embodied in processor-executable program code read from one or more of non-transitory computer-readable media, such as a volatile or non-volatile random access memory, a fixed disk drive, a DVD-ROM, a Flash drive, and a magnetic tape, and then stored in a compressed, uncompiled and/or encrypted format. Embodiments are therefore not limited to any specific combination of hardware and software.

At S210, a computer server executing process <NUM> monitors its network connectivity to determine whether network connectivity has been lost. Flow cycles at S210 as long as the network connectivity is determined to exist. Evaluation of network connectivity loss at S210 may occur periodically or continuously.

S210 may comprise determining whether the computer server is able to communicate at all over a computer network to which it is coupled (e.g., determining whether a computer network interface of the computer server is disabled), or determining whether the computer server is able to communicate with a particular one or more external servers. In the latter case, the one or more external servers may comprise one or more control plane servers which perform monitoring and management of the computer server.

The external server may be co-located with or remote from the computer server. The network connection between the external server and the computer server may include any one or more public and/or private networks. In some embodiments, the external server is located in a secure remote data center which is connected to the public internet, the computer server is located on client premises and is also connected to the public internet, and the external server and the computer server communicate via an encrypted tunnel.

Network connectivity may be monitored at S210 in any suitable manner that is or becomes known. In one example, S210 includes determining whether a network interface card of the computer server is receiving data. In another example of S210, the computer server periodically pings a known network device and determines a state of network connectivity based on a response of the network device.

S210 may comprise attempting to communicate directly with an external server using a communication protocol and network path over which the external server collects telemetry of and manages the computer server. For example, the computer server may periodically transmit an ICMP message to the external server to determine a state of network connectivity therewith.

Flow proceeds from S210 to S220 once the computer server determines that network connectivity has been lost. At S220, the computer server initiates a power-down sequence. S220 may comprise transmitting a request to an operating system of the computer server to initiate a power-down sequence controlled by the operating system. In some embodiments, the computer server may control its power supply unit (via the operating system or otherwise) to immediately power off rather than proceeding with the power-down sequence. Some embodiments of S220 may include controlling an external power supply which supplies power to the computer server to shut off power to the computer server. S220 may be performed in any suitable manner which results in erasure of the volatile memory of the computer server, according to some embodiments.

<FIG> illustrates computer server <NUM> and external network <NUM> according to some embodiments. Computer server <NUM> includes motherboard <NUM> supporting one or more volatile Random Access Memory (RAM) modules <NUM> and one or more Central Processing Units (CPUs) <NUM>, one or more data storage devices <NUM> (e.g., hard and/or solid-state disk drives), network interface card <NUM> and power supply unit <NUM>. Computer server <NUM> may comprise any types or combinations of server hardware that is or becomes known.

The components of computer server <NUM> may be located within a same physical chassis or multiple independent physical chassis. Computer server <NUM> may include other hardware and software required to execute the functions attributed to computer server <NUM> herein, as well as any other functions to be performed by computer server <NUM>.

Computer server <NUM> also includes program code of agent <NUM>, operating system <NUM> and applications <NUM>. The program code may be stored in data storage devices <NUM> and loaded into RAM modules <NUM> for execution by CPUs <NUM>. Applications <NUM> and agent <NUM> execute on operating system <NUM> to provide desired functionality using the hardware resources of computer server <NUM>. Agent <NUM> may execute as a service and computer server <NUM> may also execute other services. Operating system <NUM> may communicate natively or with device drivers (not shown) associated with the various hardware resources.

External network <NUM> may comprise any number of public or private networks with which computer server <NUM> is intended to communicate. Under control of operating system <NUM>, and responsive to instructions issued to operating system <NUM> by applications <NUM> and/or agent <NUM>, network interface card <NUM> transmits data to and receives data from external network <NUM>.

Computer server <NUM> may execute agent <NUM> to identify a loss of connectivity with network <NUM> and to initiate a power-down sequence of computer server <NUM> in response. According to some embodiments, computer server <NUM> may execute agent <NUM> to perform process <NUM>. In some embodiments, the power-down sequence may include an instruction from operating system <NUM> to power supply unit <NUM> to disable power to motherboard <NUM>.

<FIG> is a flow diagram of process <NUM> to autonomously power-down a computer server in response to network connectivity loss according to some embodiments. Process <NUM> may comprise a specific implementation of process <NUM>. Process <NUM> may be executed by a software agent executing as a service within a computer server but embodiments are not limited thereto.

Initially, at S410, a computer server initiates communication with an external computing system via a computer network. The other computing system may comprise a remotely-located monitoring and management computer server. The communication may be initiated at S410 exclusively to determine a state of network connectivity with the other computing system (e.g., a ping) or may be related to another function of the computer server (e.g., to communication telemetry data to the other computing system). The communication may be initiated by an agent executing on the computer server and which also performs the remaining steps of process <NUM> or by an application unrelated to the remaining steps of process <NUM>.

S420 comprises a determination of whether the communication was successful. The determination may comprise determining whether an acknowledgement or other expected response was received within an expected timeframe. If so, flow proceeds to S430 to set a Last Communication timestamp to a current time. An agent executing process <NUM> may store the Last Communication timestamp in volatile or non-volatile memory of the computer server. Flow pauses at S440 for a time (e.g., <NUM> seconds) determined to suitably limit resource consumption of process <NUM> and flow then returns to S410. Accordingly, and assuming that network communication continues to be successful, the Last Communication timestamp is repeatedly updated to the current time as flow cycles through S410, S420, S430 and S440.

Flow proceeds from S420 to S450 once it is determined that an initiated communication was not successful, indicating a loss of network connectivity. At S450, it is determined whether the amount of time since a last successful communication with the external system exceeds a threshold time. For example, it may be determined whether an amount of time between the current Last Communication timestamp and the current time is greater than a specified number of minutes. If not, flow returns to S440 and continues as described above. Accordingly, the determination at S450 allows for brief losses in network connectivity without resulting in powering down of the computer server. The specified number of minutes (i.e., the duration of such brief losses) may be configurable based on security and performance considerations.

Flow proceeds from S450 to S460 if it is determined that an amount of time between the current Last Communication timestamp and the current time is greater than a specified number of minutes. At S460, power-down of the computer server is initiated, using any of the techniques described herein.

<FIG> illustrates a system including computer server <NUM> and computer system <NUM>. Computer system <NUM> may comprise any number of computer servers and other computing devices. Computer system <NUM> may provide management and monitoring of computer server <NUM> as is known in the art. Computer server <NUM> is located in location <NUM>, which may be protected according to physical security protocols of a customer, while computer system <NUM> is located in location <NUM>, which may be protected according to physical security protocols of a provider of computer system <NUM>. For example, location <NUM> may comprise a data center owned and controlled by a cloud service provider, and location <NUM> may comprise a data center owned and controlled by a customer of the cloud service provider.

Locations <NUM> and <NUM> may be connected to one another via the public internet. To increase security of communications between locations <NUM> and <NUM>, computer server <NUM> communicates with computer system <NUM> via encrypted tunnel <NUM>. Encrypted tunnel <NUM> is established between computer server <NUM> and computer system <NUM> as is known in the art.

Computer server <NUM> may execute agent <NUM> to perform process <NUM>, process <NUM>, and any other process described herein. Generally, computer server <NUM> may execute agent <NUM> to detect a loss of connectivity with computer system <NUM> and to power-down in response to the detected loss. As will be described below, location <NUM> may include other instances of computer server <NUM>, each of which is also in communication with computer system <NUM> via an encrypted tunnel and executes an agent to independently detect a loss of connectivity with computer system <NUM> and power itself down in response.

<FIG> illustrates a scenario similar to <FIG> but in which computer system <NUM> creates and manages virtual machines within computer server <NUM>. Computer system <NUM> may comprise any number of computer servers and other computing devices and may provide management and monitoring of computer server <NUM> as is known in the art. Location <NUM> may comprise a data center owned and controlled by a cloud service provider and location <NUM> may comprise a data center owned and controlled by a customer of the cloud service provider.

As is known in the art, computer system <NUM> instructs computer server <NUM> to allocate its physical hardware resources, such as RAM <NUM>, CPUs <NUM> and storage devices <NUM>, to one or more virtual machines, and assigns workloads to the virtual machines. In the illustrated example, computer system <NUM> has instructed computer server <NUM> to instantiate virtual machines <NUM> and <NUM>, each of which is associated with dedicated subunits of RAM <NUM>, CPUs <NUM> and storage devices <NUM>. Each of virtual machines <NUM> and <NUM> executes an operating system and applications using the physical resources allocated thereto, independent of other physical resources which are present on computer server <NUM>.

Computer server <NUM> executes hypervisor <NUM> to manage virtual machines executing therein. For example, hypervisor <NUM> loads the operating systems of virtual machines <NUM> and <NUM> and allocates CPU resources, RAM, and disk storage space to each virtual machine <NUM> and <NUM> as instructed by computer system <NUM>. Each virtual machine <NUM> and <NUM> then interacts with hypervisor <NUM> to utilize its allocated resources.

Hypervisor <NUM> may comprise a native hypervisor or a hosted hypervisor. A native hypervisor runs directly on host system hardware and does not execute on an underlying operating system. A native hypervisor therefore directly accesses the physical resources of the host system. A hosted hypervisor is installed on the underlying operating system of a host system. A hosted hypervisor therefore issues requests to the underlying operating system to access the physical resources of the host system.

Computer server <NUM> may execute agent <NUM> to detect a loss of connectivity with computer system <NUM> and to power-down in response to the detected loss. Location <NUM> may include other instances of computer server <NUM>, each of which is also managed and controlled by computer system <NUM> to instantiate virtual machines and assign workloads thereto. Each of such instances may be in communication with computer system <NUM> via an encrypted tunnel and execute an agent to independently detect a loss of connectivity with computer system <NUM> and power itself down in response. Computer system <NUM> may deploy agent <NUM> to each instance of computer server <NUM> using known service deployment protocols.

<FIG> is a block diagram of data plane <NUM> and control plane <NUM> according to some embodiments. Control plane <NUM> may comprise any number of control plane nodes (e.g., computer servers) <NUM>-<NUM> and other computing devices, and may provide management and monitoring of data plane <NUM> as is known in the art. Control plane <NUM> may be located at data center owned and controlled by a cloud service provider.

Control plane <NUM> includes load balancer <NUM> in communication with each control plane node <NUM>-<NUM>. Load balancer <NUM> distributes network traffic among control plane nodes <NUM>-<NUM> as is known in the art. Load balancer <NUM> communicates with networking rack <NUM> of data plane <NUM> over the public internet <NUM> via encrypted tunnel <NUM>.

Data plane <NUM> may comprise a data center owned and controlled by a customer of the cloud service provider operating control plane <NUM>. Data plane <NUM> includes several types of server racks, each containing one or more computer servers and supporting a type of workload. Each computer server of each server rack may be implemented by a computer server as described herein. Embodiments of data plane <NUM> are not limited to <FIG>.

Each of compute racks <NUM> includes one or more computer servers providing execution of customer application workloads, and each of storage racks <NUM> includes one or more computer servers providing storage of customer data. Software load balancer racks <NUM> also include computer servers, which are intended to distribute network traffic among virtual machines of compute racks <NUM>. Data plane <NUM> may include other computer servers providing other functionality. Each computer server of each of racks <NUM>, <NUM> and <NUM> is in communication with networking rack <NUM>. Each computer server of each of racks <NUM>, <NUM> and <NUM> therefore communicates with control plane <NUM> through networking rack <NUM> and encrypted tunnel <NUM>.

Control plane <NUM> may instruct any computer servers of data plane to allocate their physical resources to one or more virtual machines. Control plane <NUM> may then assign workloads to the one or more virtual machines as is known in the art. Control plane <NUM> may further de-allocate virtual machines and re-assign workloads as appropriate.

According to some embodiments, control plane <NUM> operates to deploy an agent to each computer server of each of racks <NUM>, <NUM> and <NUM>. Each computer server executes its agent to determine whether it is able to communicate with control plane <NUM> and, if not, to initiate a power-down sequence. Each agent may operate independently, such that if one agent of one computer server of racks <NUM>, <NUM> and <NUM> detects a loss of network connectivity, the one computer server is powered down without affecting the power status any other computer server of data plane <NUM>.

<FIG> is a block diagram of computer server <NUM> configured to autonomously power-down in response to network connectivity loss according to some embodiments. Server <NUM> may comprise a general-purpose computing apparatus and may execute program code to perform any of the functions described herein. Server <NUM> may comprise an implementation of any computer server described herein. Server <NUM> may include other unshown elements according to some embodiments.

Server <NUM> includes processing unit <NUM> operatively coupled to network interface <NUM>, data storage device <NUM>, one or more input devices <NUM>, one or more output devices <NUM> and memory <NUM>. Network interface <NUM> may facilitate communication with another computer system over a computer network as described above. Input device(s) <NUM> may comprise, for example, a keyboard, a keypad, a mouse or other pointing device, a microphone, knob or a switch, an infra-red (IR) port, a docking station, and/or a touch screen. Input device(s) <NUM> may be used, for example, to enter information into server <NUM>. Output device(s) <NUM> may comprise, for example, a display and a speaker.

Data storage device <NUM> may comprise any appropriate persistent storage device, including combinations of magnetic storage devices (e.g., magnetic tape, hard disk drives and flash memory), optical storage devices, Read Only Memory (ROM) devices, etc., while memory <NUM> may comprise Random Access Memory (RAM), Storage Class Memory (SCM) or any other fast-access memory. Data storage device <NUM> may be implemented using distributed storage systems.

Agent <NUM> may comprise program code executable by processing unit <NUM> to cause server <NUM> to perform any one or more of the processes described herein. In this regard, data storage device <NUM> stores Last Communication timestamp <NUM> to enable operation such as described with respect to process <NUM> of <FIG>.

Storage device <NUM> further includes program code of applications <NUM> and operating system <NUM> as is known in the art. Data storage device <NUM> may also store data <NUM> other program code for providing additional functionality and/or which are necessary for operation of server <NUM>, such as but not limited to program code of device drivers, program code of other services, and hypervisor program code.

Each functional component described herein may be implemented in computer hardware (integrated and/or discrete circuit components), in program code and/or in one or more computing systems executing such program code as is known in the art. Such a computing system may include one or more processing units which execute processor-executable program code stored in a memory system.

The above-described diagrams represent logical architectures for describing processes according to some embodiments, and actual implementations may include more or different components arranged in other manners. Other topologies may be used in conjunction with other embodiments. Moreover, each component or device described herein may be implemented by any number of devices in communication via any number of other public and/or private networks. Two or more of such computing devices may be located remote from one another and may communicate with one another via any known manner of network(s) and/or a dedicated connection. Each component or device may comprise any number of hardware and/or software elements suitable to provide the functions described herein as well as any other functions.

Claim 1:
A ecomputer server (<NUM>, <NUM>, <NUM>, <NUM>, <NUM>) configured to be remotely managed and monitored by an external system (<NUM>) via a computer network, wherein
the computer server (<NUM>, <NUM>, <NUM>, <NUM>, <NUM>) comprises:
a volatile memory storing processor-executable program code; and
a processing unit (<NUM>) to execute the program code to:
determine that the computer server (<NUM>, <NUM>, <NUM>, <NUM>, <NUM>) has lost
network connectivity to the external system (<NUM>); wherein determining that the computer server (<NUM>, <NUM>, <NUM>, <NUM>, <NUM>) has lost connectivity to the external system (<NUM>) comprises:
transmitting data (<NUM>) to the external system (<NUM>), the data (<NUM>) associated with an expected response (<NUM>);
determining that the expected response (<NUM>) was not received from the external system (<NUM>) within an expected time frame;
in response to determining that the expected response (<NUM>) was not received from the external system (<NUM>), determining an amount of time since a last successful communication with the external system (<NUM>); and
determining that the computer server (<NUM>, <NUM>, <NUM>, <NUM>, <NUM>) has lost network connectivity to the external system (<NUM>) if the amount of time exceeds a threshold time; and
in response to the determination that the computer server (<NUM>, <NUM>, <NUM>, <NUM>, <NUM>) has lost network connectivity to the extemal system (<NUM>), power down the computer server (<NUM>, <NUM>, <NUM>, <NUM>, <NUM>).