US20080273470A1

US20080273470A1 - System for interlocking a server to a server system and a computer system utilizing the same

Info

Publication number: US20080273470A1
Application number: US12/130,815
Authority: US
Inventors: Simon C. Chu; Richard A. Dayan
Original assignee: International Business Machines Corp
Current assignee: International Business Machines Corp
Priority date: 2003-06-19
Filing date: 2008-05-30
Publication date: 2008-11-06
Also published as: US20040257998A1; US8843604B2

Abstract

A system for interlocking a plurality of servers to a server system is disclosed. In a first aspect, a computer system comprises a plurality of servers, a management module coupled to each of the plurality of servers, and an interlock mechanism coupled to the management module, wherein the interlock mechanism assigns to each of the plurality of servers an identifier that associates each of the plurality of servers to the server system, thereby defining a plurality of interlocked servers.

Description

CROSS-REFERENCE TO RELATED APPLICATIONS

Under 35 USC § 120, this application is a continuation application and claims the benefit of priority to U.S. patent application Ser. No. 10/465,043, filed Jun. 19, 2003, entitled “Method and System for Interlocking a Server to a Server System and a Computer System Utilizing the Same”, all of which is incorporated herein by reference.

FIELD OF THE INVENTION

The present invention relates generally to computer server systems and, more particularly, to a system for interlocking a server to a server system.

BACKGROUND OF THE INVENTION

In today's environment, a computing system often includes several components, such as servers, hard drives, and other peripheral devices. These components are generally stored in racks. For a large company, the storage racks can number in the hundreds and occupy huge amounts of floor space. Also, because the components are generally free standing components, i.e., they are not integrated, resources such as floppy drives, keyboards and monitors, cannot be shared.
A system has been developed by International Business Machines Corp. of Armonk, N.Y., that bundles the computing system described above into a compact operational unit. The system is known as an IBM eServer BladeCenter™. The BladeCenter is a 7U modular chassis that is capable of housing up to 14 individual server blades. A server blade or blade is a computer component that provides the processor, memory, hard disk storage and firmware of an industry standard server. Each blade can be “hot-plugged” into a slot in the chassis. The chassis also houses supporting resources such as power, switch, management and blower modules. Thus, the chassis allows the individual blades to share the supporting resources.
In a dense server environment, multiple BladeCenter type products can be utilized. Because the server blades are highly mobile, i.e., they are easily removed from a chassis and easily reinstalled into the same or another chassis, there is a possibility that an unauthorized or hostile server blade can be placed in a chassis. In that case, the hostile server blade could have access to information on the other server blades in the chassis or be privy to information distributed to the authorized server blades in the chassis. Moreover, the hostile server blade could corrupt the other server blades, e.g., by introducing viruses into the system. Clearly, this raises serious security concerns.
Accordingly, a need exists for a system for securely interlocking servers to their respective server systems. The system should be able to detect and isolate a non-interlocked, i.e., unauthorized, server in the server system. The present invention addresses such a need.

SUMMARY OF THE INVENTION

The present invention is directed to a system for interlocking a plurality of servers to a server system and a computer system utilizing the same. In a first aspect, a computer system comprises a plurality of servers, a management module coupled to each of the plurality of servers, and an interlock mechanism coupled to the management module, wherein the interlock mechanism assigns to each of the plurality of servers an identifier that associates each of the plurality of servers to the server system, thereby defining a plurality of interlocked servers.
Through the aspects of the present invention, each server is interlocked to its respective server system via an identifier stored in its non-volatile storage. The identifier is unique to the server system. Thus, if an unauthorized server is placed in the server system, it will be identified immediately as such and isolated from the other servers in the system. In this manner, the server system is protected from intruders.

BRIEF DESCRIPTION OF THE DRAWINGS

FIG. 1 is a perspective view illustrating the front portion of a BladeCenter.

FIG. 2 is a perspective view of the rear portion of the BladeCenter.

FIG. 3 is a schematic block diagram of a server blade system according to a preferred embodiment of the present invention.

FIG. 4 is a flowchart illustrating a process by which a system administrator uses the interlock utility in accordance with a preferred embodiment of the present invention.

FIG. 5 is a flowchart illustrating the process by which the server system performs a power-up sequence according to a preferred embodiment of the present invention.

DETAILED DESCRIPTION

The present invention relates generally to computer server systems and, more particularly, to a method and system for interlocking a server to a server system. The following description is presented to enable one of ordinary skill in the art to make and use the invention and is provided in the context of a patent application and its requirements. Although the preferred embodiment of the present invention will be described in the context of a BladeCenter, various modifications to the preferred embodiment and the generic principles and features described herein will be readily apparent to those skilled in the art. Thus, the present invention is not intended to be limited to the embodiment shown but is to be accorded the widest scope consistent with the principles and features described herein.
According to a preferred embodiment of the present invention, an interlock mechanism allows an administrator to interlock each server in a server system (chassis) to the system by storing an identifier in each server's non-volatile storage. The identifier uniquely identifies the server system. Thus, at appropriate times, the interlock mechanism will autonomously check each server in the system to ensure that each server is interlocked to the server system. If an unauthorized server is detected, the interlock mechanism will take appropriate action to protect the server system from the unauthorized server.
To describe the features of the present invention, please refer to the following discussion and Figures, which describe a computer system, such as the BladeCenter, that can be utilized with the present invention. FIG. 1 is an exploded perspective view of the BladeCenter system 100. Referring to this figure, a main chassis 102 houses all the components of the system. Up to 14 server blades 104 (or other blades, such as storage blades) are optionally hot plugable into 14 corresponding slots 105 a-105 n in the front of chassis 102. Blades 104 may be “hot swapped” without affecting the operation of other blades 104 in the system 100. A server blade 104 a can use any microprocessor technology so long as it is compliant with the mechanical and electrical interfaces, and the power and cooling requirements of the system 100.
A midplane circuit board 106 is positioned approximately in the middle of chassis 102 and includes two rows of connectors 108, 108′. Each one of the 14 slots includes one pair of midplane connectors, e.g., 108 a, 108 a′, located one above the other, and each pair of midplane connectors, e.g., 108 a, 108 a′ mates to a pair of connectors (not shown) at the rear edge of each server blade, e.g., 104 a.
FIG. 2 is a perspective view of the rear portion of the BladeCenter system 100, whereby similar components are identified with similar reference numerals. Referring to FIGS. 1 and 2, a second chassis 202 also houses various components for cooling, power, management and switching. The second chassis 202 slides and latches into the rear of main chassis 102.
As is shown in FIGS. 1 and 2, two optionally hot plugable blowers 204 a, 204 b provide cooling to the blade system components. Four optionally hot plugable power modules 206 provide power for the server blades and other components. Management modules MM1 and MM2 (208 a, 208 b) provide basic management functions such as controlling, monitoring, alerting, restarting and diagnostics. Management modules 208 also provide other functions required to manage shared resources, such as multiplexing the keyboard/video/mouse (KVM) to provide a local console for the individual blade servers 104 and configuring the system 100 and switching modules 210.
The management modules 208 communicate with all of the key components of the system 100 including the switch 210, power 206, and blower 204 modules as well as the blade servers 104 themselves. The management modules 208 detect the presence, absence, and condition of each of these components. When two management modules are installed, a first module, e.g., MM1 (208 a), will assume the active management role, while the second module MM2 (208 b) will serve as a standby module.
The second chassis 202 also houses up to four switching modules SM1 through SM4 (210 a-210 d). Each switch module includes several external data ports (not shown) for connection to the external network infrastructure. The primary purpose of the switch module 210 is to provide interconnectivity between the server blades (104 a-104 n), management modules (208 a, 208 b) and the outside network infrastructure.
FIG. 3 is a schematic block diagram of a server blade system 300 according to a preferred embodiment of the present invention. For the sake of clarity only, one management module 302 and three server blades (304 a-304 c) are illustrated. Referring to this figure, the management module 302 is coupled to the server blades (304 a-304 c) via at least one serial bus (310) for “out-of-band” communication between the management module (302) and the server blades (304 a-304 c). “Out-of-band” communications refer to secure internal communications between components in the server system. These communications are not accessible by external entities.
As is shown in FIG. 3, the management module 302 communicates with each server blade 304 a-304 c through a dedicated service processor 308 a-308 c in each server blade 304 a-304 c. The management module 302 also includes a port 306 that is intended to be attached to a private, secure management server 314. The management module 302 can send alerts to the management server 314 to indicate changes in status, such as removal or addition of a blade 304 a-304 c or module.
In general, the management module 302 can detect the presence, quantity, type, and revision level of each blade 304 a-304 c, power module 206, blower 204, and midplane 106 in the system, and can detect invalid or unsupported configurations. The management module 302 will retrieve and monitor critical information about the chassis 102 and server blades 304 a-304 c, such as temperature, voltages, power supply, memory, fan and hard drive status. If a problem is detected, the management module 302 can transmit a warning to a system administrator 315 via the port 306 coupled to the management server 314.
Referring again to FIG. 1, up to 14 server blades 104 a-104 n can be hot-plugged into corresponding slots 105 a-105 n in the chassis 102 of a BladeCenter type server system 100. Therefore, one advantage of the BladeCenter server system 100 is that server blades 104 a-104 n can be easily removed from and installed into the chassis 102. Nevertheless if multiple server systems, i.e. more than one chassis, are utilized, keeping track of which chassis 102 a server blade, e.g., 104 a, is associated with can become problematic if the server blade 104 a is removed from its chassis 102. Moreover, serious security concerns are presented because an unauthorized server blade, e.g., 104 n, can easily be placed in the chassis 102. The unauthorized server blade 104 n could then have access to the other server blades 104 a-104 m in the chassis 102. The present invention addresses these issues.
Referring again to FIG. 3, an interlock mechanism 316 is coupled to each of the blades 304 a-304 c via the management module 302. In this embodiment, the interlock mechanism 316 utilizes the “out-of-band” serial bus 310 to communicate with each of the blades 304 a-304 c through each blade's dedicated service processor 308 a-308 c. In another embodiment, the interlock mechanism 316 could be a stand alone module coupled to the service processors 308 a-308 c. The interlock mechanism 316 includes a Blade Present Table 318, which includes information about which server blade, e.g., 304 a, occupies which slot 105 a (FIG. 1) in the chassis 102. The interlock mechanism 316 also includes an interlocking utility 319, which provides an interface between the system administrator 315 and the interlock mechanism 316.
In a preferred embodiment of the present invention, the system administrator (or some other authorized entity) (315) invokes the interlock utility 319 via the management server 314 to interlock the server blades 304 a-304 c to the server system 300. As used in this description, “interlocking” a server blade, e.g., 304 a, refers to associating the server blade 304 a to an entity, such as the server system 300 or chassis 102. In an initializing session, the interlock mechanism 316 assigns to each server blade 304 a-304 c an identifier, hereinafter referred to as an interlock record 320 a-320 c, that uniquely identifies the server system 300.
Each server blade 304 a-304 c includes non-volatile storage (NVS) 312 a-312 c, which is accessible by the associated service processor 308 a-308 c. The NVS 312 a-312 c can be any storage medium known in the art, such as storage on a hard file partition or non-volatile memory (CMOS). The interlock record 320 a-320 c is stored in each blade's NVS 312 a-312 c as well as in the Blade Present Table 318. Thus, at appropriate times, the interlock mechanism 316 will autonomously check each server blade 304 a-304 c in the system 300 to ensure that each server blade 304 a-304 c is interlocked to the server system 300. If an unauthorized server blade, e.g., 304 b is detected, the interlock mechanism 316 will take appropriate action to protect the server system 300 from the unauthorized server blade 304 b.
FIG. 4 is a flowchart illustrating a process by which a system administrator 315 uses the interlocking utility 319 in accordance with a preferred embodiment of the present invention. As is shown, the interlocking utility 319 allows the system administrator 315 to perform interlocking actions such as interlocking, removing, adding and disassociating one or more server blades from the server blade system. The process begins when the administrator 315 invokes the interlocking utility 319 in step 402. In a preferred embodiment, the interlocking utility 319 is password protected to restrict access only to authorized personnel. After the administrator has entered a valid password, the administrator 315 selects the type of action he or she would like to perform in step 404.
If none of the server blades 304 a-304 c are interlocked to the server system 300, the administrator can select an initial interlocking session (in step 406). In step 407, the interlock mechanism 316 interlocks each server blade 304 a-304 c to the server system 300. In a preferred embodiment, the interlocking process begins by building the Blade Present Table 318 (step 408) so that the table 318 includes an entry for each server blade 304 a-304 c present in the system 300. The interlock mechanism 316 then generates the interlock record 320 and stores the interlock record 320 in each server blade's non-volatile storage 312 a-312 c in step 409. In a preferred embodiment, the interlock mechanism 316 transfers the interlock record 320 to each server blade's non-volatile storage 312 a-312 c in the form of an enumeration, such as an ACPI enumeration. After each server blade 304 a-304 c has been interlocked, the interlocking utility 319 updates the Blade Present Table 318.
In one preferred embodiment, the interlock record 320 a-320 c is some alphanumeric string that uniquely identifies the server system 300. For example, the record 320 a for a server blade 304 a could include the serial number for the management module 302, the server blade's 304 a serial number, and the date and time of the session. Moreover, if the server system 300 includes a second management module (not shown), e.g., a backup module, the record 320 a-320 c could also include the serial number of the second management module. Accordingly, if the second module is activated, the server blades 304 a-304 c remain automatically interlocked to the server system 300. In this case, the Blade Present Table 318 is copied to the second management module.
If the initial interlocking session has been completed, the administrator 315 can choose to remove an entry in the Blade Present Table 318 (step 412). The administrator 315 might perform this action if he or she were removing one of the interlocked server blades, e.g., 304 b, from the server system 300. Here, in step 414, the administrator 315 provides a slot number representing the slot (e.g., 105 b) from which the server blade 304 b will be removed. The interlock mechanism 316 then disassociates the server blade 304 b from the server system 300 in step 416 by erasing the interlock record 320 b stored in the server's non-volatile storage 312 b. In step 410, the interlock mechanism 316 removes the corresponding entry in the Blade Present Table.
If the administrator wishes to add an entry (step 418), i.e., add a new server blade (304 c) into the server system 300, the administrator 315 provides the slot number representing the slot (e.g., 105 b) into which the server blade 304 c will be placed via step 420. The interlock mechanism 316 then interlocks the server blade 304 c to the server system 300 in step 422 by generating the interlock record 320 c and storing it in the server's non-volatile storage 312 c. In step 410, the interlock mechanism 316 adds the corresponding entry in the Blade Present Table.
If the administrator would like to disassociate each server blade 304 a-304 c from the server system 300 (step 426), the interlock mechanism 316 disassociates each server blade in step 428 by erasing each interlock record 320 a-320 c in each server blade's non-volatile storage 312 a-312 c. In step 430, all entries in the Blade Present Table 318 are cleared.
Once the administrator 315 has interlocked the server blades 304 a-304 c to the server system 300, the interlock mechanism 316 can detect automatically the presence of a server blade that has not been authorized, i.e., interlocked, by the administrator 315. As stated above, the interlock mechanism 316 checks each server blade 304 a-304 c in the system 300 to ensure that each server blade 304 a-304 c is interlocked to the server system 300. Preferably, the interlock mechanism 316 checks each server blade 304 a-304 c during a power-up sequence for the server system 300, and investigates if a server blade has been added to or removed from the server system 300.
FIG. 5 is a flowchart illustrating the process by which the server system 300 performs a power-up sequence according to a preferred embodiment of the present invention. The process starts at the initial power up or reset sequence of the server system 300, i.e., when the management module 302 is powered up (via step 502) or reset. The interlock mechanism 316 instructs the management module 302 to hold all of the blades 304 a-304 c in a powered off state (step 504). In step 506, the interlock mechanism 316 checks a first blade's, e.g., 304 a, non-volatile storage 312 a to determine whether it has an existing interlock record 320 a (step 508). If the interlock mechanism 316 fails to find an interlock record 320 a in the first server blade 304 a, e.g., because the server blade 304 a was placed in the server system 300 during a power-off state, then the interlock mechanism 316 instructs the management module 302 to maintain the power off state for that server blade 304 a in step 510. If more server blades need to be checked (step 518), then the interlock mechanism 316 continues by checking the next server blade's non-volatile storage 312 b for an interlock record 320 b via step 520.
If the interlock mechanism 316 finds an existing interlock record 320 b (step 508) in the server blade's non-volatile storage 312 b, the interlock mechanism 316 must determine whether the interlock record 320 b is valid, i.e., not generated by another interlock mechanism, in step 512. In one preferred embodiment, the interlock mechanism 316 will access the Blade Present Table 318 and compare the existing interlock record 320 b to that stored in the table 318. If the values do not match, i.e., the interlock record 320 b is invalid, the interlock mechanism 316 erases the existing interlock record 320 b in step 514 and instructs the management module 302 to maintain the power off state for that server blade 304 b in step 510. If the values do match, i.e., the interlock record 320 b is valid, the interlock mechanism 316 instructs the management module 302 to power up the server blade 304 b and to release it for booting in step 516. In either case, the next step (step 518) involves determining whether the interlock mechanism 316 must check more blades. If there are more, steps 508-520 are repeated.
After the interlock mechanism 316 has checked each of the server blades 304 a-304 c in the server system 300 (step 518), it determines which, if any, of the server blades 304 a-304 c are not interlocked in step 522. The server blades, e.g., 304 a, that are held in the power-off state are not interlocked to the server system 300. If there are any server blades that are not interlocked, the interlock mechanism 316 generates an alert and transmits it to the system administrator via the management server 314, in step 524. In a preferred embodiment, the alert includes the slot number into which the non-interlocked server blade(s) 304 a is placed.
As stated above, a non-interlocked server blade, e.g., 304 a, is not authorized to operate in the server system 300. By holding the non-interlocked server blade 304 a in a power-off state, the interlock mechanism 316 isolates the non-interlocked server blade 304 a from the interlocked server blades, e.g., 304 b, 304 c. In another embodiment, the interlock mechanism 316 instructs the management module 302 to power off the entire server system 300 after transmitting the alert if any of the server blades 304 a-304 c are not interlocked to the server system 300. In either embodiment, the interlock mechanism 316 protects the integrity of the server system 300 from any unauthorized, i.e., non-interlocked, server blades 304 a coupled to the system 300.
As mentioned above, the management module 302 and therefore the interlock mechanism 316 are sensitive to the addition or removal of a server blade to and from the server system 300. In both instances, the interlock mechanism 316 ensures that the server system 300 is protected and that the administrator 315 is alerted of any potential security breach.
For instance, in a preferred embodiment, if the management module 302 detects that a blade server, e.g., 304 c, is inserted into the server system 300, the interlock mechanism 316 will instruct the management module 302 to hold the newly inserted blade server 304 c in a power off state, while it checks the server blade 304 c to determine whether it is interlocked to the server system 300 (process steps 506-516 in FIG. 5). If the server blade is not interlocked, the interlock mechanism 316 instructs the management module 302 to maintain the power off state, and generates the alert indicating the slot number of the non-interlocked server blade 304 c. The interlock mechanism 316 then transmits the alert to the administrator 315.
If the management module 302 detects that a server blade, e.g., 304 b, has been removed or powered off, the interlock mechanism 316 marks the entry in the Blade Present Table 318 corresponding to the removed server blade 304 b and generates the alert indicating the slot number of the removed server blade 304 b. The interlock mechanism 316 then transmits the alert to the administrator 315. If the removed server blade 304 b is reinserted into the slot, the management module 302 detects that a server blade 304 b is inserted into the server system 300, and the interlock mechanism 316 instructs the management module 302 to hold the reinserted server blade 304 b in a power off state, while it checks the server blade 304 b to determine whether it is interlocked to the server system 300 (process steps 506-514 in FIG. 5). In this case, the interlock mechanism 316 notes the mark in the entry in the Blade Present Table 318 when it compares the identifiers. The interlock mechanism 316 instructs the management module 302 to maintain the power off state, and generates another alert indicating the slot number of the suspect server blade 304 b. The interlock mechanism 316 then transmits this alert to the administrator 315.
The interlock mechanism 316 generates and transmits the alert to the administrator 315 only if a non-interlocked server blade has been detected or if a server blade has been removed, or if a removed server blade has been reinserted. In either case, the administrator 315 utilizes the alert to manage and maintain the server system 300. For example, referring again to FIG. 4, if a server blade has been removed, the administrator receives an alert indicating the slot number of the removed server blade. After the administrator authorizes the removal, the administrator invokes the interlock utility (step 402) and selects the action of removing an entry (step 412). The administrator provides the slot number indicated in the alert (step 414) and the interlock mechanism 316 disassociates the server blade from the server system 300. Similarly, if a non-interlocked server blade has been detected, the administrator receives an alert indicating the slot number of the non-interlocked server blade. After the administrator authorizes the server blade, the administrator invokes the interlock utility (step 402) and selects the “add an entry” action (step 418). The administrator provides the slot number indicated in the alert (step 420) and the interlock mechanism 316 interlocks the server blade to the server system 300.
As stated above, the process of interlocking a server, e.g., 304 c, to the server system 300 involves generating an interlock record 320 c and storing it in the server's non-volatile storage 312 c. The interlock record 320 c is preferably based on any combination of the serial number for the management module 302, the server blade's 304 c serial number, and the date and time of the session. For added security, the interlock mechanism 316 preferably utilizes a hashing algorithm to hash the interlock record 320 c to form a nonce. The nonce is then stored in the Blade Present Table 318. When the interlock mechanism 316 stores the nonce in the server blade's non-volatile storage 312 c, it instructs the server blade 304 c to encrypt the nonce using the server blade's private key. Accordingly, the server blade 304 c stores the encrypted nonce in its non-volatile storage 312 c.
When the interlock mechanism 316 attempts to validate the interlock record 320 c in the server blade 304 c, e.g., during a system power up sequence, the interlock mechanism 316 obtains the server blade's public key via the “out-of-band” serial bus 310. The interlock mechanism 316 uses the public key to decrypt the encrypted nonce and compares the nonce in the server blade 304 c with that stored in the Blade Present Table 318.
By creating a nonce to represent the interlock record 320 and then encrypting the nonce at the server blade, the interlock mechanism 316 adds several layers of security to the interlocking configuration of the server system 300. Thus, unauthorized access to the server system 300 is further deterred.
Through aspects of the present invention, the interlock mechanism 316 allows an administrator 315 to interlock each server in a server system to the system by storing an interlock record in each server's non-volatile storage. The interlock record uniquely identifies the server system. Thus, at appropriate times, the interlock mechanism will autonomously check each server in the server system to ensure that each server is interlocked. If an unauthorized server is detected, the interlock mechanism will take appropriate action to protect the server system from the unauthorized server.
While the preferred embodiment of the present invention has been described in the context of a BladeCenter environment, the functionality of the interlock mechanism 316 could be implemented in any computer environment where the servers are closely coupled. Thus, although the present invention has been described in accordance with the embodiments shown, one of ordinary skill in the art will readily recognize that there could be variations to the embodiments and those variations would be within the spirit and scope of the present invention. The present invention may be in the form of a computer program product, the computer program product comprising a computer-readable storage medium having computer-readable program code portions stored therein, the computer-readable program code portions including a plurality of executable instruction codes for executing in accordance with the present invention. Accordingly, many modifications may be made by one of ordinary skill in the art without departing from the spirit and scope of the appended claims.

Claims

1. A computer readable medium containing a plurality of executable program instructions for interlocking a plurality of servers to a server system, the instructions for:

a) assigning an identifier to each of the plurality of servers, wherein the identifier associates each of the plurality of servers to the server system, thereby defining a plurality of interlocked servers.

2. The computer readable medium of claim 1, wherein each of the plurality of interlocked servers includes non-volatile storage.

3. The computer readable medium of claim 2 further comprising:

b) storing the identifier in each interlocked server's non-volatile storage.

4. The computer readable medium of claim 3, wherein the assigning instruction (a) further comprising:

(a1) generating the identifier; and

(a2) storing the identifier in a table.

5. The computer readable medium of claim 4 further comprising the instruction for:

c) detecting a server that is not interlocked to the server system by examining the server's non-volatile storage, wherein a non-interlocked server is not authorized to run in the server system.

6. The computer readable medium of claim 5, wherein the detecting instruction (c) comprising:

(c1) concluding the server is not interlocked if the non-volatile storage does not include an identifier; else

(c2) determining whether an existing identifier is valid if an identifier is found in the non-volatile storage; and

(c3) concluding that the server is not interlocked if the existing identifier is invalid.

7. The computer readable medium of claim 6, wherein the determining instruction (c2) comprising:

(c2i) comparing the existing identifier to the identifier stored in the table; and

(c2ii) concluding the existing identifier is invalid if the existing identifier does not match the stored identifier.

8. The computer readable medium of claim 7, wherein the storing instruction (b) comprising:

(b1) encrypting the identifier with a private key for each interlocked server; and

(b2) storing the encrypted identifier in each interlocked server's non-volatile storage.

9. The computer readable medium of claim 8, wherein the determining instruction (c2) comprising:

(c2iii) decrypting the existing identifier with a public key for the server.

10. The computer readable medium of claim 5 further comprising:

d) protecting the server system from the non-interlocked server.

11. The computer readable medium of claim 10, wherein the protecting instruction (d) comprising:

(d1) isolating the server from the plurality of interlocked servers; and

(d2) notifying a system administrator that the server is not interlocked to the server system.

12. The computer readable medium of claim 11, wherein the isolating instruction (d1) comprising:

(d1i) holding the server in a power-off state.

13. The computer readable medium of claim 11, wherein the isolating instruction (d1) comprising:

(d1i) powering-down the server system.

14. The computer readable medium of claim 5, wherein the detecting instruction (c) is performed during a power-up sequence for the server system.

15. The computer readable medium of claim 5, wherein the detecting instruction (c) is performed if the server system senses that a new server has been placed into the system.

16. The computer readable medium of claim 4 further comprising instruction for:

(c) adding a server to the plurality of interlocked servers.

17. The computer readable medium of claim 16, wherein the adding instruction (c) comprising:

(c1) providing a slot number into which the server will be placed;

(c2) assigning the identifier to the server and storing the identifier in the server's non-volatile storage; and

(c3) updating the table to include the server in the plurality of interlocked servers.

18. The computer readable medium of claim 4 further comprising instruction for:

(c) removing a server from the plurality of interlocked servers.

19. The computer readable medium of claim 18, wherein the removing instruction (c) comprising:

(c1) providing the slot number from which the server will be removed;

(c2) erasing the identifier from the server's non-volatile storage; and

(c3) updating the table to exclude the server from the plurality of interlocked servers.

20. The computer readable medium of claim 4 further comprising:

(c) sensing a removal of one of the plurality of interlocked servers;

(d) marking the identifier in the table corresponding to the removed server; and

(e) protecting the server system.

21. The computer readable medium of claim 20, wherein the protecting instruction (e) further comprising:

(e1) notifying a system administrator that the server has been removed; and

(e2) isolating the removed server from the plurality of interlocked servers if the removed server is reinserted into the system.

22. The computer readable medium of claim 21, wherein the isolating step (e2) further comprising:

(e2i) comparing the removed server's identifier with the identifier stored in the table when the system senses that the removed server has been reinserted into the system; and

(e2ii) holding the removed server in a power-off state if the identifier stored in the table is marked.

23. A mechanism for interlocking a plurality of servers to a server system comprising:

an interlock mechanism for assigning an identifier to each of the plurality of servers, wherein the identifier associates each of the plurality of servers to the server system, thereby defining a plurality of interlocked servers.

24. The mechanism of claim 23, wherein each of the plurality of interlocked servers includes non-volatile storage.

25. The mechanism of claim 24, wherein each of the plurality of interlocked servers comprising:

means for storing the identifier in each interlocked server's non-volatile storage.

26. The mechanism of claim 25, wherein the interlock mechanism further comprising a utility for generating the identifier and a table for storing information related to each of the interlocked servers and their respective identifiers.

27. The mechanism of claim 26 wherein the interlock mechanism further comprising:

means for detecting a server that is not interlocked to the server system, wherein a non-interlocked server is not authorized to run in the server system.

28. The mechanism of claim 27, wherein the means for detecting comprising means for examining the server's non-volatile storage and means for determining whether an existing identifier is valid if an identifier is found in the non-volatile storage, wherein the server is not interlocked if the existing identifier is invalid.

29. The mechanism of claim 28, wherein the interlock mechanism further comprising:

means for protecting the server system from the non-interlocked server.

30. The mechanism of claim 27, wherein the utility further comprising means for adding a server to the plurality of interlocked servers.

31. The mechanism of claim 27, wherein the utility further comprising means for removing a server from the plurality of interlocked servers.

32. A computer server system comprising:

a plurality of servers;

a management module coupled to the plurality of servers; and

an interlock mechanism coupled to the management module, wherein the interlock mechanism assigns to each of the plurality of servers an identifier that associates each of the plurality of servers to the server system, thereby defining a plurality of interlocked servers.

33. The server system of claim 32, wherein each server comprising:

means for storing the identifier in each server's non-volatile storage.

34. The server system of claim 32, wherein the interlock mechanism comprises a table, wherein the table stores information related to each of the interlocked servers and their associated identifiers.

35. The server system of claim 32, wherein the interlock mechanism further comprises means for detecting a server that is not interlocked to the server system.

36. The server system of claim 35, wherein the means for detecting comprising means for examining the server's non-volatile storage and means for determining whether an existing identifier is valid if an identifier is found in the non-volatile storage, wherein the server is not interlocked if the existing identifier is invalid.

37. The server system of claim 35, wherein the interlock mechanism further comprises means for protecting the server system from the non-interlocked server.

38. The server system of claim 32, wherein the interlock mechanism further comprising a utility for adding a server to the plurality of interlocked servers.

39. The server system of claim 32, wherein the interlock mechanism further comprising a utility for removing a server from the plurality of interlocked servers.

40. The server system of claim 32, wherein the identifier is a nonce based on a serial number for the management module.

41. The server system of claim 40, wherein each server comprising:

means for encrypting the nonce; and

means for storing the encrypted nonce in each server's non-volatile storage.

42. The server system of claim 41, wherein the interlock mechanism further comprising means for examining the server's non-volatile storage and means for decrypting the encrypted nonce so that the interlock mechanism can determine whether the identifier is valid.