Research On Out-of-Band Management Equipment Security Vulnerability

With the rapid development of information technology,especially the widely used concepts such as big data,cloud computing and artificial intelligence,higher demands on computing power are required,and at the same time,computer equipment is required to have stronger stability and maintainability.Server is a kind of high performance computer,which is an important node device in network environment.It has massive information storage capacity and high-speed data processing capability.Server management is divided into in-band management and out-of-band management.Driven by Intel,server vendors such as Dell,Hewlett-Packard and NEC have come up with the Intelligent Platform Management Interface(IPMI)specification,an out-of-band management approach that takes advantage of server system resources,To achieve the server's 7*24-hour monitoring,automatic alarm,remote maintenance and other functions.The traditional management and control information and data information in the In-Band management mode are transmitted on the same physical channel.When the network is interrupted or the channel is congested,the data and management information can not be transmitted normally.Out-of-band management The management control information and data information are in different physical channels,and the two are independent and do not affect each other.Due to its good operability and manageability,the IPMI specification has received widespread popularity among server vendors and users.However,the IPMI protocol itself has some security issues.Major server vendors further develop independent Out-of-band management products have exacerbated the chaos in out-of-band management of security vulnerabilities.This article briefly introduces the research status of out-of-band management both at home and abroad,and compares and analyzes the advantages and disadvantages of in-band management and out-band management.Based on careful analysis of out-of-band management practices and mainstream IPMI products,the paper focuses on the principles and development of IPMI specifications,analyzes out-of-band management security issues within IPMI protocols and mainstream IPMI products,Firmware loopholes and other aspects of in-depth management of unsafe management.For a variety of out-of-band vulnerabilities research,we propose to design out-of-band testing tools to detect out-of-band vulnerabilities and provide repair measures and improvement programs.