CN114780327A - Server monitoring method, asset management method and PCIE card - Google Patents

Abstract

An embodiment of the present specification provides a server monitoring method, an asset management method, and a PCIE card, where the server is provided with a first PCIE card, the first PCIE card is provided with a blockchain chip, and the method is executed by the blockchain chip, and the method includes: acquiring the running information of the server through a target interface; determining safety audit information of the server according to the operation information; and saving the safety audit information to the block chain network.

Description

A server monitoring method, asset management method and PCIE card

technical field

One or more embodiments of this specification relate to the field of computer monitoring and computer asset management, and in particular, to a server monitoring method, an asset management method, and a PCIE card.

Background technique

The traditional solution for monitoring and asset management of servers, especially servers in data centers, is to capture the operating information of the servers through the baseboard management controller BMC and the built-in agent in the server OS, and then send them to the management platform of the data center. security monitoring and asset management. However, this solution has the problem of relying on the data center management platform for monitoring, which may have loopholes in monitoring. Because, usually due to the pressure of network transmission, it is difficult to send a large amount of operation information to the management platform in time, and the monitoring information obtained on a regular basis may be the information tampered with by the attacker, and the attack behavior on the server cannot be found based on this information. In addition, this solution also has the problem that server asset information is usually used on a single platform, and it is difficult to use it on multiple platforms.

Therefore, a new approach to server monitoring and asset management is needed.

SUMMARY OF THE INVENTION

The embodiments in this specification aim to provide a new server monitoring and asset management method. A PCIE card configured with an independent third-party blockchain chip is installed in the server, the server operation information is obtained through the blockchain chip, and the server is run Information security audit, send the audit results to the blockchain network, improve the ability to detect security problems on the server; and send the information corresponding to the server asset status in the operating information to the blockchain network for generating The certificate of server assets facilitates the transaction and circulation of server assets among multiple parties and platforms, and solves the deficiencies in the prior art.

According to a first aspect, a server monitoring method is provided, the server is provided with a first PCIE card, the first PCIE card is provided with a blockchain chip, the method is executed by the blockchain chip, the Methods include:

Obtain the operation information of the server through the target interface;

According to the operation information, determine the security audit information of the server;

Save the security audit information to the blockchain network.

In a possible implementation manner, the operating system OS of the server has a built-in first agent program;

The obtaining operation information of the server through the target interface includes:

Obtain the in-band information of the server from the first agent through the first interface;

According to the operation information, determine the security audit information of the server, including:

According to the in-band information, first audit information of the in-band information is determined.

In a possible implementation manner, the in-band information includes: one or more of server hardware information, firmware/kernel version, server process information, port information, user account information, crontab file, and system log;

The first audit information includes: audit information of server configuration, audit information of port control, audit information of network firewall operation, audit information of operating system startup process, audit information of server multi-operating system startup manager, operating system login information. One or more of audit information, audit information of application credibility metrics, audit information of hard disk storage data input and output, and audit information of kernel vulnerabilities.

In a possible implementation manner, the server is further provided with a baseboard management controller BMC,

The obtaining operation information of the server through the target interface includes:

Obtain out-of-band information of the server from the BMC through the second interface;

According to the operation information, determine the security audit information of the server, including:

According to the out-of-band information, second audit information of the out-of-band information is determined.

In a possible implementation manner, the second interface is an interface supporting the NCSI protocol.

In a possible implementation manner, the out-of-band information includes: one or more of out-of-band logs, out-of-band alarms, and out-of-band sensor information;

The second audit information includes: audit information of the server health state.

In a possible implementation manner, the operation information of the server is obtained through the target interface, including:

Obtain the intermediate information after the server is started and before the server OS is started through the third interface; the third interface includes serial port/serial port redirection SOL;

According to the operation information, determine the security audit information of the server, including:

According to the intermediate information, third audit information is determined.

In a possible implementation manner, the operation information of the server is obtained through the target interface, including:

Obtain network communication information of the server through a fourth interface; the fourth interface includes a standard interface of a network card set on the server;

According to the operation information, determine the security audit information of the server, including:

According to the network communication information, fourth audit information related to the network communication is determined.

In a possible implementation manner, the first PCIE card includes one of a PCIE network card/PCIE GPU card/PCIEHBA card.

In a possible implementation manner, the blockchain chip stores a chip ID corresponding to the blockchain chip, and a public-private key pair corresponding to the chip ID; the security audit information is stored in the Blockchain, including:

Using the private key in the public-private key pair, the security audit information is signed to obtain a chip signature;

Upload the security audit information and the chip signature to the blockchain network together.

In a possible implementation manner, the method further includes, before uploading the security audit information and the chip signature to the blockchain network together,

Using the chip ID, the blockchain chip is registered on the blockchain network.

In a possible implementation manner, the public-private key pair corresponding to the chip ID is determined through negotiation with the blockchain network.

According to a second aspect, a server asset management method is provided, the server is provided with a first PCIE card, the first PCIE card is provided with a blockchain chip, the method is executed by the blockchain chip, and the The methods described include:

Obtain the operation information of the server through the target interface;

The operation information of the server is saved to the blockchain network and used to generate the certificate of the server asset status.

In a possible implementation manner, the operating system OS of the server has a built-in first agent program;

The obtaining operation information of the server through the target interface includes:

Through the first interface, the in-band information of the server is acquired from the first agent program.

In a possible implementation manner, the in-band information includes one or more of: server usage time, installation records and usage records of applications on the server.

In a possible implementation manner, the server is further provided with a baseboard management controller BMC,

The obtaining operation information of the server through the target interface includes:

Through the second interface, the out-of-band information of the server is obtained from the BMC.

In a possible implementation manner, the second interface is an interface supporting the NCSI protocol.

In a possible implementation manner, the out-of-band information includes: bios/bmc fw version, OS version, hard disk capacity/number of hard disks, memory capacity/number of memory sticks, motherboard SN serial number/manufacturer/model, One or more of the power supply model/SN number.

In a possible implementation manner, the first PCIE card is a PCIE network card,

The obtaining operation information of the server through the target interface includes:

Obtain the Mac address and/or serial number of the PCIE network card through the medium independent interface MII or the simplified gigabit medium independent interface RGMII.

In a possible implementation manner, the first PCIE card includes one of a PCIE network card/PCIE GPU card/PCIEHBA card.

In a possible implementation manner, the public-private key pair corresponding to the chip ID is determined through negotiation with the blockchain network.

In a possible implementation, the credential of the server asset status is used for one or more of registration, confirmation, evaluation, authentication, valuation, and custody of the server asset.

According to a third aspect, a PCIE card is provided, including a blockchain chip, and the blockchain chip includes a storage module, an information acquisition module, and an uplink module, wherein,

The storage module is used to store the identity of the blockchain chip;

The information acquisition module is used to acquire the operation information of the server through the target interface when the PCIE card is installed in the server;

The on-chain module is configured to save server information to the blockchain network based on the identity identifier stored by the storage module, wherein the server information is obtained based on the operation information.

In a possible implementation manner, the PCIE card further includes an audit module configured to determine security audit information of the server according to the operation information, and use the security audit information as the server information.

In a possible implementation manner, the identity identifier is a chip ID that is factory-set by the blockchain chip, and the storage module further stores a public-private key pair corresponding to the chip ID of the blockchain network.

In a possible implementation manner, the operating system OS of the server has a built-in first agent program, and the information acquisition module is further configured to:

Obtain the in-band information of the server sent by the first agent program through the PCIE bus.

In a possible implementation manner, the PCIE card is a PCIE network card, and the PCIE network card further includes a main control chip, and the main control chip is connected to the blockchain chip through a switch chip.

In a possible implementation manner, the server is further provided with a baseboard management controller BMC, the PCIE network card is provided with a dedicated network port supporting the NCSI protocol, and the information acquisition module is further configured to:

Obtain out-of-band information of the server sent by the BMC through the dedicated network port.

In a possible implementation, the information acquisition module is further configured to:

The SOL is redirected through the serial port to obtain the intermediate information after the server is started but before the server OS is started.

In a possible implementation, the information acquisition module is further configured to:

Obtain the network communication information of the server through the standard network port on the PCIE network card.

Using one or more of the methods in the above aspects and the PCIE card can effectively improve the monitoring capability for server security issues, and enhance the transaction and circulation capabilities of server assets on multiple parties and platforms.

Description of drawings

In order to illustrate the technical solutions of the embodiments of the present invention more clearly, the following briefly introduces the drawings used in the description of the embodiments. Obviously, the drawings in the following description are only some embodiments of the present invention. For those of ordinary skill in the art, other drawings can also be obtained from these drawings without any creative effort.

FIG. 1 shows a schematic diagram of a server monitoring and asset management method and a PCIE card used therefor according to an embodiment of the present specification;

FIG. 2 shows a flowchart of a server monitoring method according to an embodiment of the present specification;

3 shows a schematic diagram of obtaining intermediate operation information through a conventional network port of a PCIE network card according to an embodiment of the present specification;

4 shows a schematic diagram of acquiring network communication information through a conventional network port of a PCIE network card according to an embodiment of the present specification;

5 shows a schematic diagram of acquiring network communication information through network ports on other network cards on the server according to an embodiment of the present specification;

6 shows a schematic diagram of sending uplink data through a conventional network port of a PCIE network card according to an embodiment of the present specification;

FIG. 7 shows a schematic diagram of sending uplink data through network ports on other network cards on the server according to an embodiment of the present specification;

FIG. 8 shows a flowchart of a server asset management method according to an embodiment of the present specification;

FIG. 9 shows a structural diagram of a PCIE card according to an embodiment of the present specification.

Detailed ways

The solution provided by the present invention will be described below with reference to the accompanying drawings.

As mentioned above, the traditional method of data center server monitoring and asset management is to capture service operation information through the BMC and OS built-in agent, and manage the server through the data center management platform. This traditional management method has the following problems: 1) During the operation of the server, depending on the monitoring of the management platform of the data center, there is no independent and effective third party (ie independent of the server processor) locally on the server to monitor the server. Software and hardware operation, audit supervision. Using this method to monitor the server, there is a security loophole. For example, after a malicious login operation occurs on the server, attackers often delete records in the operation log to remove traces of malicious operations. However, since there are usually many types of server operation information and a large amount of data, it is difficult to send all the information to the management platform in real time. Therefore, the operation log sent to the management platform may be the log modified by the attacker, so that the management platform cannot detect malicious logins on the server. 2) The server asset status information in the server operation information obtained by the data center is usually only kept on a single data center platform on the one hand, and on the other hand, the information acquisition process also lacks the endorsement of an independent third party. Therefore, it cannot be easily and credibly shared among external parties and platforms, and then used for the transaction or circulation of server assets among multiple parties and platforms.

In order to solve the above technical problems, the embodiments of this specification provide a server monitoring method, an asset management method and a corresponding PCIE card. The core idea of this method is that the PCIE card carrying the blockchain processing chip in the server installation, and the blockchain processing chip on the PCIE card can obtain the in-band and Out-of-band operation information, and then conduct a security audit on the operation information, and save the obtained audit information in the blockchain network. At the same time, the information related to the status of the server assets in the server operation information can also be sent to the blockchain network to generate the certificates of the server assets. These certificates can be used for the registration, confirmation, evaluation, etc. of the server assets. . Specifically, the blockchain processing chip may be an SE (Secure Element, secure element) chip. The SE chip itself is similar to an independent third-party microcomputer, with an independent chip operating system (COS) and data storage area, which can perform data processing such as Secure storage, encryption and decryption operations, and business computing. The processor on the server cannot freely access the data in the blockchain processing chip, nor can it know its calculation process. Therefore, on the one hand, the PCIE card including the blockchain processing chip is installed on the server, which facilitates the blockchain processing chip to obtain a large amount of operation information of the local server in time (without transmitting it to the remote data center through the network), and to analyze the operation information. Conduct, for example, real-time or quasi-real-time security audits, so that security issues on the server can be discovered in a timely manner. For example, during the period when the attacker maliciously logs into the server, the operation log of the server is obtained in time, and the malicious login operation that occurs on the server can be found through the operation log. In addition, the blockchain processing chip itself is safe, and it is usually impossible for server attackers to access the computing process or stored data of the blockchain processing chip itself, and thus cannot affect the processing process of the blockchain processing chip or tamper with its conclusion. result. As such, the method improves monitoring capabilities for security issues on the server. On the other hand, the blockchain processing chip itself is independent of the server processor, and it sends the acquired server asset status information such as signatures to the blockchain network. The blockchain network itself is distributed, which, for example, can include nodes of multiple participating parties. Therefore, the server asset status information sent by the blockchain processing chip can be used to generate the server asset status certificate in the blockchain network, which can be used for the registration, confirmation, appraisal, valuation, etc. This facilitates, for example, the transaction and circulation of server assets between multiple participants in the blockchain. Or further used, the transaction and circulation of server assets between different blockchain networks.

FIG. 1 shows a schematic diagram of the principles of a server monitoring method, an asset management method, and a PCIE card according to an embodiment of the present specification. The main idea of the method is described below with reference to FIG. 1 . In the embodiment shown in FIG. 1 , the PCIE network card is specifically a PCIE network card, and the PCIE network card is provided with a blockchain chip. The PCIE network card is usually installed on the target server by inserting it into the PCIE slot of the server. After the PCIE network card is installed on the target server, the blockchain chip can obtain the server operation information sent by the agent program running on the server OS through the PCIE bus. Generally speaking, in server management, obtaining server operation information can usually be divided into two levels, namely in-band information and out-of-band information. In-band information is mainly server operation information obtained through the server OS after the server is started. Out-of-band information refers to the running information of the server obtained through the BMC regardless of whether the server is started or not. The blockchain chip can be connected to the main control chip (MAC chip) of the PCIE network card through a switch chip. Since the network card on the server usually has business communication tasks, such as connecting to an internal network or an external network, these services need to occupy a conventional network interface on the server. Therefore, in addition to the conventional network interface, the PCIE network card is provided with a dedicated network interface, which is connected to the switching chip, and the BMC can send out-of-band information to the blockchain chip through the dedicated network interface and the NSCI protocol.

After obtaining server operation information including in-band and out-of-band information, the blockchain chip can conduct security audits on the server based on the in-band and out-of-band information. Specifically, blockchain chips can perform different types of security audits based on different types of operating information. For example, in an example, the obtained server operation information includes the log-in record of the server, and it can be determined whether malicious login currently occurs on the server according to the log-in record. In one embodiment, the blockchain chip can also redirect SOL (Serial Over Lan, serial over LAN) through a serial port, for example, and use the conventional network port on the PCIE network card to obtain the middle of the server after the server is started and before the server OS is started. information. And using the intermediate information, security audit is performed on the intermediate process after the server is started but before the server OS is started, for example, virus detection is performed. In yet another embodiment, the blockchain chip may also use a conventional network port on a PCIE network card to obtain network communication information of the server, and perform traffic security audit according to the network communication information.

After various types of security audits, the blockchain chip can send various audit results to the blockchain network through the PCIE network card. In order to retain the original information and facilitate post-event verification, in one embodiment, the part of the operation information that directly corresponds to the audit result may also be sent to the blockchain network. As mentioned above, the independent audit of the blockchain chip originating from the server not only ensures the timeliness of the security audit, but also improves the security of the audit process itself, and improves the security monitoring capability of the server as a whole. In addition, after the audit information is sent to the blockchain network, due to the mechanism of the blockchain itself, the audit information stored on it is difficult to tamper with after the fact, and the credibility of the audit information, such as post-mortem inspection, is also strengthened.

The operating information of the server can include information that can be used to determine the status of the server assets, such as CPU model, memory model, hard disk model/number of reads and writes, etc., which can be used to prove whether each hardware accessory of the server is a newer model accessory, or these Use status of accessories, etc. Therefore, this part of the server operation information can also be sent to the blockchain network to generate a certificate for the status of the server asset, which can be used for the registration, confirmation, evaluation, etc. of the server asset to facilitate the transaction and circulation.

FIG. 2 shows a flowchart of a server monitoring method according to an embodiment of the present specification. The server is provided with a first PCIE card, the first PCIE card is provided with a blockchain chip, and the method is executed by the blockchain chip, as shown in FIG. 2 , the method includes:

Step 21, obtain the running information of the server through the target interface;

Step 22, according to the operation information, determine the security audit information of the server;

Step 23: Save the security audit information to the blockchain network.

First, in step 21, the operation information of the server is acquired through the target interface.

In this step, the blockchain chip can obtain different types of operation information through different types of target interfaces.

As previously described, the acquired operational information may include in-band information. In-band information can be obtained through an agent built into the OS. The agent program built into the OS here does not mean that the agent program must be a component of the OS itself, but refers to an agent program that runs in the OS and depends on the OS to run. Therefore, in one embodiment, the operating system OS of the server has a built-in first agent program; the in-band information of the server can be obtained from the first agent program through the first interface. Since the PCIE card is usually inserted into the PCIE slot of the server, it is installed to the target server. PCIE (or PCI-Express, Peripheral Component Interconnect Express, peripheral device interconnect bus interface) is a high-speed serial computer expansion bus standard. Therefore, in one example, the first interface is a PCIE interface. In different embodiments, the first PCIE card may be a different type of PCIE card. In one embodiment, the first PCIE card may include one of a PCIE network card/PCIE GPU card/PCIE HBA card.

In different embodiments, in-band information of different refinement types may be acquired, which is not limited in this specification. In one embodiment, the in-band information may include: hardware information of the server, firmware/kernel version, server process information, port information, operating system startup information, user account information, crontab file (for setting the periodic execution command), network firewall logs, and system logs. In subsequent steps, different types of security audits can be performed based on different types of in-band information.

As mentioned above, the operating information may also include out-of-band information, and the out-of-band information can usually be obtained through the BMC. BMC (Baseboard Management Controller, baseboard management controller) is a server management system that does not depend on the processor, BIOS or operating system of the server to work. What the BMC can monitor and operate on is server hardware. In different examples, the BMC can monitor the server's voltage, fans, power supplies, etc., and make corresponding adjustments based on the information. For example, adjust the fan speed in real time to ensure that the server is in a healthy state. For example, reset the server and restart the system. In one example, hardware information may also be recorded to generate a hardware information log. Since the BMC does not depend on the server's processor, BIOS or operating system, it can monitor the server independently whether the server is started or not. Therefore, in one embodiment, the server is further provided with a baseboard management controller BMC; the out-of-band information of the server can be obtained from the BMC through the second interface. Because the BMC can usually transmit information through the NSCI (Network Controller Sideband Interface, network controller sideband interface) protocol, in one embodiment, the second interface is an interface supporting the NCSI protocol, such as a network port supporting the NCSI protocol.

In different embodiments, out-of-band information of different refinement types may be acquired, which is not limited in this specification. In one embodiment, the out-of-band information may include one or more of: out-of-band logs, out-of-band alarms, and out-of-band sensor (eg, temperature, humidity sensor) information.

In actual production scenarios, some computer viruses will be used. After the server is started (power-on), but before the server OS is started, for example, virus code introduction and other operations are performed. In order to detect these virus operations, it is necessary to obtain the server at startup Operation information after (power-on) but before the server OS is started. Therefore, in one embodiment, the intermediate information after the server is started but before the server OS is started can also be obtained through the third interface. In one embodiment, the third interface may include a serial port or a serial port redirection SOL (Serial Over Lan, serial over local area network). Generally speaking, the intermediate information can be obtained through the serial port of the server. In essence, SOL can obtain serial communication information through the network port on the server. Therefore, in a specific embodiment, if the PCIE card where the blockchain chip is located is a PCIE network card, the intermediate information can be obtained through the conventional network port by redirecting the serial port to a conventional network port on the PCIE network card, As shown in Figure 3.

The acquired operation information may also include network communication information of the server. Therefore, in one embodiment, the network communication information of the server can be acquired through the fourth interface. In one embodiment, the fourth interface includes a standard interface (or a conventional interface, a conventional network port) of a network card set on the server. In an example, if the PCIE card where the blockchain chip is located is a PCIE network card, the network communication information can be obtained through a conventional network port on the PCIE network card, as shown in FIG. 4 . In another example, if the PCIE card where the blockchain chip is located is not a PCIE network card, the network communication information can be obtained through the network ports of other network cards on the server. In essence, it obtains network communication information from other network cards through the server CPU, and then forwards it to the blockchain chip through the PCIE bus. In other words, the network communication information can be obtained from other network cards through the built-in agent program of the server OS, and then forwarded to the blockchain chip through the PCIE bus, as shown in Figure 5.

Then, in step 22, the security audit information of the server is determined according to the operation information.

In this step, according to the different types of operation information obtained in step 21, different types of security audits may be performed to obtain corresponding security audit information.

In the above embodiment of acquiring in-band information through an agent program in the OS, the first audit information of the in-band information may be determined according to the in-band information. In different embodiments, different types of corresponding security audit information may be determined according to the acquired in-band information of different refined types. This manual does not limit the specific types of security audits. In one example, for example, according to the obtained version information of the system/application on the server, it can be determined whether the system/application is of the correct version, and then it can be determined whether the server has a security risk, for example, an attacker attacks the system or application. risk. In another example, the obtained server operation information includes information about the system patches installed on the server, then it can be determined whether the server omits the necessary patches that should be installed according to the information on the installed system patches, and then it is determined whether the server has the necessary system patches. Corresponding system vulnerabilities. In one embodiment, the first audit information may include: audit information of server configuration, audit information of port control, audit information of network firewall operation, audit information of operating system startup process, server multi-operating system startup manager (for example, GRUB , GRand UnifiedBootloader) audit information, operating system login audit information, application trust metrics audit information, hard disk storage data input and output audit information, kernel vulnerability audit information one or more.

In the above embodiment of acquiring out-of-band information through the BMC, the second audit information may be determined according to the out-of-band information. In one embodiment, the second audit information may include: audit information of the server health state. For example, according to the obtained voltage, fan, and power supply information of the server, it is determined whether the server is in a healthy running state.

In the above embodiment of obtaining the intermediate information, the third audit information may be determined according to the intermediate information. In a specific embodiment, the third audit information may be virus audit information, for example.

In the above embodiment of acquiring network communication information, the fourth audit information related to network communication may be determined according to the network communication information. In a specific embodiment, the fourth audit information is, for example, network abnormal traffic audit information. In a different example, the fourth audit information may also be audit information for different types of abnormal traffic that is further refined, which is not limited in this specification.

In addition, according to different types of security audits, the corresponding security audit information obtained may, in one embodiment, include audit results of this type of security audit. For example, the above-mentioned security audit for server user login, the corresponding security audit information may include, for example, the audit result of the presence or absence of malicious login on the target server within a specific time period. In another embodiment, the security audit information may further include operation information directly associated with the audit result. For example, in an example, if the determined audit result is that there is malicious login on the target server within a certain period of time, the security audit information may also include the original malicious login record, so as to facilitate the comparison and verification with the audit result afterwards.

Finally, in step 13, the security audit information is saved to the blockchain network.

In this step, the audit information is saved to the blockchain network, and the mechanism of the blockchain can be used to make the saved audit information difficult to tamper with after the fact, and to enhance the security of the audit information preservation. According to different implementations, different specific types of blockchains may be utilized, which are not limited in this specification. In one embodiment, the blockchain chip may store a chip ID corresponding to the blockchain chip, and a public-private key pair corresponding to the chip ID. The security audit information can be signed by using the private key in the public-private key pair to obtain a chip signature; the security audit information and the chip signature can be uploaded to the blockchain network together. In one example, the chip ID may be the unique ID of the chip set before the chip leaves the factory.

Typically, blockchain chips can be registered on the blockchain network before saving the information to the blockchain network. Therefore, in one embodiment, before uploading the security audit information to the blockchain network, the chip ID may also be used to register the blockchain chip on the blockchain network.

The key of the blockchain chip for a specific blockchain network, or the key used to save the security audit information to a specific blockchain network, can be determined through negotiation with the blockchain network. Therefore, in one embodiment, the public-private key pair corresponding to the chip ID may be determined through negotiation with the blockchain network.

Specifically, in one embodiment, if the PCIE card where the blockchain chip is located is a PCIE network card, the security audit information can be sent to the blockchain network through a conventional network port on the PCIE network card, as shown in Figure 6 . In another embodiment, if the PCIE card where the blockchain chip is located is not a PCIE network card, the security audit information can be sent to the blockchain network through the network ports of other network cards on the server. In essence, the on-chain information is sent to the server CPU through the PCIE bus, and then the server CPU uploads the blockchain chip through other network cards. In other words, the on-chain information can be sent to an agent program built into the server OS, and the agent program sends the on-chain information to the blockchain network through other network cards, as shown in FIG. 7 .

FIG. 8 shows a flowchart of a server asset management method according to an embodiment of the present specification. The server is provided with a first PCIE card, the first PCIE card is provided with a blockchain chip, and the method is executed by the blockchain chip. As shown in Figure 8, the method includes:

Step 81, obtain the operation information of the server through the target interface;

Step 82: Save the operation information of the server to the blockchain network, and use it to generate the certificate of the server asset status.

First, in step 81, the operation information of the server is acquired through the target interface.

In this step, the blockchain chip can obtain different types of operation information through different types of target interfaces. The operation information may be operation information corresponding to the server asset status, such as configuration information and status information of server software and hardware accessories, such as memory model, processor model, hard disk read/write time, system version, and the like. In one example, based on the information, it is possible to determine, for example, the old or new model/version of the server software and hardware accessories, and the status, and then determine the status of the server assets, for example, within a specific period of time.

The acquired operational information may include in-band information. The process and manner of acquiring in-band information are similar to the process and manner of acquiring in-band information in step 21 , and reference may be made to the description of step 21 , which will not be repeated here. In different embodiments, in-band information may be obtained for different types of refinements. In one embodiment, the in-band information may include one or more of server usage time, installation records and usage records of applications on the server.

The acquired operational information may also include out-of-band information. The process and manner of acquiring the out-of-band information are similar to the process and manner of acquiring the out-of-band information in step 21, and reference may be made to the description of step 21, which will not be repeated here. In different embodiments, different types of out-of-band information may be obtained. In one embodiment, the out-of-band information may include: bios/bmc fw version, OS version, hard disk capacity/number of hard disks, memory capacity/number of memory sticks, motherboard SN serial number/manufacturer/model, power supply model/ One or more of the SN numbers.

The obtained operating information may also include the server's Mac address. In one embodiment, the first PCIE card is a PCIE network card, and the blockchain chip can be connected to the main control chip. Furthermore, the Mac address (server) of the PCIE network card can be obtained through the media independent interface MII (Media Independent Interfac) or RGMII (Reduced Gigabit Media Independent Interface, which simplifies the gigabit media independent interface) between the blockchain chip and the main control chip. Mac address) and/or serial number.

Then, in step 82, the operation information of the server is saved to the blockchain network.

In this step, the operation information is saved to the blockchain network, which is mainly used to generate the credentials of the server asset status. In one embodiment, the credentials of the server asset status may be used for one or more of registration, validation, evaluation, authentication, valuation, and escrow of the server asset. The distributed nature of the blockchain network and the high reliability of data facilitate the transaction and circulation of server assets between multiple participants in the blockchain network, for example.

According to different implementations, different types of blockchains may be utilized, which are not limited in this specification. In one embodiment, the blockchain chip may store a chip ID corresponding to the blockchain chip, and a public-private key pair corresponding to the chip ID. Using the private key in the public-private key pair, the security audit information is signed to obtain a chip signature; the security audit information and the chip signature are uploaded to the blockchain network together. In one example, the chip ID may be the unique ID of the chip set before the chip leaves the factory.

The process and method of uploading the operation information to the blockchain network are similar to the process and method of uploading the audit information to the blockchain network in step 23, and you can refer to the description of step 23, which will not be repeated here.

Another embodiment of the present specification further provides a PCIE card. FIG. 9 shows a structural diagram of a PCIE card according to an embodiment of the present specification. As shown in FIG. 9 , the PCIE card 9000 includes a blockchain chip 910, and the blockchain chip includes a storage module 91, an information acquisition module 92, and an uplink module 93, wherein,

The storage module 91 is used to store the identity identifier of the blockchain chip;

The information acquisition module 92 is configured to, when the PCIE card is installed in the server, acquire the operation information of the server through the target interface;

The on-chain module 93 is configured to, based on the identity identifier stored in the storage module, save server information to the blockchain network, where the server information is obtained based on the operation information.

In one embodiment, the PCIE card 900 further includes an auditing module 94, configured to determine security audit information of the server according to the operation information, and use the security audit information as the server information.

In one embodiment, the identity identifier may be a chip ID that is factory-set by the blockchain chip, and the storage module may also store a public-private key pair whose chip ID corresponds to the blockchain network.

In one embodiment, the operating system OS of the server may have a built-in first agent program, and the information acquisition module may be further used for:

Obtain the in-band information of the server sent by the first agent program through the PCIE bus.

In one embodiment, the PCIE card may be a PCIE network card, the PCIE network card further includes a main control chip, and the main control chip is connected to the blockchain chip through a switch chip.

In one embodiment, the server is further provided with a baseboard management controller BMC, the PCIE network card is provided with a dedicated network port supporting the NCSI protocol, and the information acquisition module is further configured to:

Obtain out-of-band information of the server sent by the BMC through the dedicated network port.

In one embodiment, the information acquisition module can be further used for:

The SOL is redirected through the serial port to obtain the intermediate information after the server is started but before the server OS is started.

In one embodiment, the information acquisition module can be further used for:

Obtain the network communication information of the server through the standard network port on the PCIE network card.

It should be understood that the descriptions of "first", "second" and so on herein are only for the simplicity of description to distinguish similar concepts, and have no other limiting effect.

Those skilled in the art should appreciate that, in one or more of the above examples, the functions described in the present invention may be implemented in hardware, software, firmware, or any combination thereof. When implemented in software, the functions may be stored on or transmitted over as one or more instructions or code on a computer-readable medium.

The specific embodiments described above further describe the objectives, technical solutions and beneficial effects of the present invention in detail. It should be understood that the above descriptions are only specific embodiments of the present invention and are not intended to limit the scope of the present invention. Any modification, equivalent replacement, improvement, etc. made on the basis of the technical solution of the present invention shall be included within the protection scope of the present invention.

Claims (30)

1. A server monitoring method, wherein the server is provided with a first PCIE card, the first PCIE card is provided with a blockchain chip, the method is executed by the blockchain chip, and the method comprises: Obtain the operation information of the server through the target interface; According to the operation information, determine the security audit information of the server; Save the security audit information to the blockchain network. 2. The method according to claim 1, wherein the operating system OS of the server has a built-in first agent program; The obtaining operation information of the server through the target interface includes: Obtain the in-band information of the server from the first agent through the first interface; According to the operation information, determine the security audit information of the server, including: According to the in-band information, first audit information of the in-band information is determined. 3. The method according to claim 2, wherein the in-band information comprises: hardware information of the server, firmware/kernel version, server process information, port information, operating system startup information, user account information, crontab file, network One or more of firewall logs and system logs; The first audit information includes: audit information of server configuration, audit information of port control, audit information of network firewall operation, audit information of operating system startup process, audit information of server multi-operating system startup manager, operating system login information. One or more of audit information, audit information of application credibility metrics, audit information of hard disk storage data input and output, and audit information of kernel vulnerabilities. 4. The method according to claim 1, wherein the server is further provided with a baseboard management controller BMC, The obtaining operation information of the server through the target interface includes: Obtain out-of-band information of the server from the BMC through the second interface; According to the operation information, determine the security audit information of the server, including: According to the out-of-band information, second audit information of the out-of-band information is determined. 5. The method of claim 4, wherein the second interface is an interface supporting the NCSI protocol. 6. The method according to claim 4, wherein the out-of-band information comprises: one or more of out-of-band logs, out-of-band alarms, and out-of-band sensor information; The second audit information includes: audit information of the server health state. 7. The method of claim 1, wherein, Obtain the running information of the server through the target interface, including: Obtain the intermediate information after the server is started and before the server OS is started through the third interface; the third interface includes serial port/serial port redirection SOL; According to the operation information, determine the security audit information of the server, including: According to the intermediate information, third audit information is determined. 8. The method of claim 1, wherein, Obtain the running information of the server through the target interface, including: Obtain network communication information of the server through a fourth interface; the fourth interface includes a standard interface of a network card set on the server; According to the operation information, determine the security audit information of the server, including: According to the network communication information, fourth audit information related to the network communication is determined. 9. The method according to claim 1, wherein the first PCIE card comprises one of a PCIE network card/PCIE GPU card/PCIE HBA card. 10. The method according to claim 1, wherein a chip ID corresponding to the blockchain chip and a public-private key pair corresponding to the chip ID are stored in the blockchain chip; Audit information is saved to the blockchain, including: Using the private key in the public-private key pair, the security audit information is signed to obtain a chip signature; Upload the security audit information and the chip signature to the blockchain network together. 11. The method according to claim 10, further comprising, before uploading the security audit information and the chip signature to the blockchain network together, Using the chip ID, the blockchain chip is registered on the blockchain network. 12. The method according to claim 10, wherein the public-private key pair corresponding to the chip ID is determined through negotiation with the blockchain network. 13. A server asset management method, wherein the server is provided with a first PCIE card, the first PCIE card is provided with a blockchain chip, the method is executed by the blockchain chip, and the method comprises: Obtain the operation information of the server through the target interface; The operation information of the server is saved to the blockchain network and used to generate the certificate of the server asset status. 14. The method according to claim 13, wherein the operating system (OS) of the server has a built-in first agent program; The obtaining operation information of the server through the target interface includes: Through the first interface, the in-band information of the server is acquired from the first agent program. 15. The method of claim 14, wherein the in-band information comprises one or more of: server usage time, installation records and usage records of applications on the server. 16. The method according to claim 13, wherein the server is further provided with a baseboard management controller BMC, The obtaining operation information of the server through the target interface includes: Through the second interface, the out-of-band information of the server is obtained from the BMC. 17. The method of claim 16, wherein the second interface is an interface supporting the NCSI protocol. 18. The method according to claim 16, wherein the out-of-band information comprises: bios/bmc fw version, OS version, hard disk capacity/number of hard disks, memory capacity/number of memory sticks, mainboard SN serial number/manufacturer One or more of /model, power supply model/SN number. 19. The method according to claim 13, wherein the first PCIE card is a PCIE network card, The obtaining operation information of the server through the target interface includes: Obtain the Mac address and/or serial number of the PCIE network card through the medium independent interface MII or the simplified gigabit medium independent interface RGMII. 20. The method of claim 13, wherein the first PCIE card comprises one of a PCIE network card/PCIE GPU card/PCIE HBA card. 21. The method according to claim 21, wherein the public-private key pair corresponding to the chip ID is determined through negotiation with the blockchain network. 22. The method of claim 13, wherein the credential of the server asset state is used for one or more of registration, entitlement, appraisal, authentication, valuation, escrow of the server asset. 23. A PCIE card, comprising a blockchain chip, the blockchain chip comprising a storage module, an information acquisition module, and an uplink module, wherein, The storage module is used to store the identity of the blockchain chip; The information acquisition module is used to acquire the operation information of the server through the target interface when the PCIE card is installed in the server; The on-chain module is configured to save server information to the blockchain network based on the identity identifier stored by the storage module, wherein the server information is obtained based on the operation information. 24. The PCIE card according to claim 23, further comprising an auditing module configured to determine security audit information of the server according to the operation information, and use the security audit information as the server information. 25. The PCIE card according to claim 23, wherein the identity identifier is a chip ID of the blockchain chip factory-set, and the storage module further stores the chip ID corresponding to the blockchain network. public-private key pair. 26. The PCIE card according to claim 23, wherein the operating system OS of the server has a built-in first agent program, and the information acquisition module is further used for: Obtain the in-band information of the server sent by the first agent program through the PCIE bus. 27. The PCIE card according to claim 23, wherein the PCIE card is a PCIE network card, the PCIE network card further comprises a main control chip, and the main control chip is connected to the blockchain chip through a switch chip. 28. The PCIE card according to claim 27, wherein the server is further provided with a baseboard management controller (BMC), the PCIE network card is provided with a dedicated network port supporting the NCSI protocol, and the information acquisition module is further used for: Obtain out-of-band information of the server sent by the BMC through the dedicated network port. 29. The PCIE card according to claim 27, wherein the information acquisition module is further used for: The SOL is redirected through the serial port to obtain the intermediate information after the server is started but before the server OS is started. 30. The PCIE card according to claim 27, wherein the information acquisition module is further used for: Obtain the network communication information of the server through the standard network port on the PCIE network card.

Images