Congatec

Zeljko Loncaric | Meinrad Happacher,

IT and OT converge at the edge

The demand for computing power at the edge is increasing enormously. However, critical infrastructures are often subject to harsh environmental conditions. Embedded and server technologies must therefore converge at the edge.

The demand for computing power at the edge is increasing enormously. Congatec offers solutions for this.

© Congatec

Edge server technologies should make bandwidth-intensive real-time applications possible that could never be achieved with central cloud services. They make it possible to supply autonomous vehicles with important infrastructure information in real time - whether on the rail or road. Infrastructure for the oil, gas and water industries as well as electricity distribution grids can also become smarter if the necessary intelligence is available locally. A major field of application for locally networked server technology is also Industry 4.0 projects in which edge analytics are used and where digital twins are even copied by the collaborative systems so that the counterpart's model can still be used for further calculations in the event of a network failure. It is also easy to understand that even more computing power must be kept on site for the edges of increasingly high-performance communication networks if bandwidths are to continue to increase and response times are to decrease. This affects both the base stations and dial-up nodes of the networks as well as the systems that are provided directly behind them for low-latency colocation applications - i.e. for data centers that are outsourced 'into the network' to enable tactile Internet applications and that are ultimately shared by companies and users. At 54%, these two segments make up by far the largest share of the edge data center market, which, according to Global Market Insights, is set to grow at a highly dynamic 23% compound annual growth rate over the next few years.

Advertisement

Defying a harsh environment

According to Global Market Insights, the edge data center market is expected to grow at an average annual rate of 23% until 2026.

© Congatec/GM Insights

In many cases, this growth must be implemented with server technology that differs significantly from what is used in traditional IT server farms, because with increasing decentralization, increasingly smaller edge servers must be positioned in increasingly harsh environments. This requires such systems to be significantly more robust. Processors that are BGA-compatible are required so that they are more resistant to shock and vibration. Ideally, they should offer high EMI protection against electromagnetic interference in order to provide a high level of operational reliability in an industrial environment. The supported temperature range should also be suitable for industrial use and, depending on the application, not only support systems from 0 to +60 °C, but also withstand significantly warmer and colder ambient temperatures: from arctic cold -40 °C to sauna-like +85 °C, which can quickly occur when exposed to sunlight. Depending on the application, the systems should also be able to withstand temperature drops, as it may be necessary to be able to open the system for servicing, even if it is cold outside. The maximum permitted temperature change of 20 °C within one hour and a maximum of 5 °C in 15 minutes proposed by ASHRAE for edge data centers is clearly too low and cannot be adhered to, especially for edge data centers that are smaller than a telephone booth, because such systems must be able to be opened for maintenance at any ambient temperature. It is not possible to quickly 'scurry in' and close the door again to carry out maintenance work with the edge server room closed.

When issues such as supporting longer development cycles and operating times, which in industry can easily last ten years or more, the long-term availability of the processor technology also plays a role. Added to this is the industry's need for software support that is outside the IT mainstream so that industrial components can be optimally addressed for specific requirements. All of this means that IT managers who want to develop edge server technologies should primarily use the embedded variants of server processor technologies. They are offered application-ready and scalable as required, for example on Computer-on-Modules from Congatec in accordance with the COM Express Type 7 and COM-HPC Server standards. The Conga-B7E3 server-on-module with AMD Epyc 3000 embedded processors represents the top class. Congatec will also make module variants with even higher performance available on COM-HPC server modules. This new PICMG standard can manage up to eight memory modules for currently 1 terabyte of RAM.

A high level of security is essential

It is advantageous if embedded server platforms are used that are particularly hardened, as they are used between cloud and office IT and OT (operational technology) and are also exposed to the typical IT threat scenarios posed by cyber attacks. They therefore have to meet the highest requirements from both directions: high robustness to withstand the physical influences at the edge and the highest security requirements to counter the threats posed by hacking from the internet. In addition, edge and fog servers - like their IT counterparts in data centers - are now often designed as convergent or hyper-convergent infrastructures with extensive virtualization. It is therefore not just a matter of securing one system, but the entire platform with its hypervisor and numerous virtual machines, in order to create optimum conditions for colocation applications at the edge or to implement hardware consolidation for an overall application.

With Secure Memory Encryption (SME), the encryption engine in the memory controller encrypts the contents of the main memory using the AES-128 keys provided by the AMD Secure Processor

© Congatec

As part of the digitalization of devices, machines and systems, control systems, IoT gateways and security applications such as firewalls and anomaly detection are migrating to edge servers. The aim is also to host further devices, machines and systems on these real-time-capable servers in order to ultimately be able to combine the OT of entire factories on such servers. If you also consider the requirements of monetizing new business models, such edge servers will also become valuable suppliers of the data needed for billing feature-based licensing and pay-per-use services. A particularly high level of data security is therefore required. The AMD EPYC Embedded 3000 server processors have a whole range of server security features that already take these requirements into account on the hardware side. The central element and the anchor of trust is the integrated security coprocessor, which is specifically responsible for the security functions of the AMD Embedded EPYC 3000 processors and offers numerous 128-bit AES-encrypted security features. These start with the decision to generate the encryption via a dedicated coprocessor, as the physical x86 CPU cores have no access to the encryption keys due to the exclusive handling. This means that no X86 software can monitor, extract or modify the keys.

Hardware-based virtualization

Embedded edge server technologies with AMD EPYC processor-based computer-on-modules can also be built completely modularly. Performance upgrades can therefore be carried out by simply replacing modules.

© Congatec

An important security element provided by the coprocessor for security functions is Secure Memory Encryption (SME). It helps to protect against attacks on the integrity of the main memory, such as cold start attacks. Attackers cannot read the contents of the system memory in plain text, even if they gain physical access to the systems - which is easier to achieve in decentralized infrastructures than in secure data centers. This encryption engine is integrated directly into the storage controller to make storage access particularly fast. The security coprocessor is therefore a sub-function of the memory controller. Another advantage is that the SME can be used without any software customization - neither in the hypervisor, the guest OS nor the application software.

Secure Encrypted Virtualization, or SEV for short, is predestined for the secure separation of heterogeneous tasks on AMD EPYC Embedded 3000-based edge servers. It supports data protection and integrity through the AES encryption of each virtual machine in order to isolate it from the hypervisor. Each virtual machine is assigned its own individual key, which is provided by the security coprocessor. These keys are also only known to this processor. This ensures that the data is secure, even if a malicious virtual machine finds its way into the memory of another VM or the hypervisor is compromised and attempts to penetrate a guest virtual machine or read its data.

Zeljko Loncaric is a Marketing Engineer at Congatec.

© Congatec

Unlike secure memory encryption via AMD SME, however, the AMD SEV VM security function requires activation in the guest operating system and hypervisor. However, code changes or recompilation of the actual applications are not required. If a customer application runs on a system with SEV activated, it can therefore take full advantage of this security function.

  • Xing Icon
  • LinkedIn Icon
Advertisement
Advertisement

You might also be interested in

Advertisement

Congatec

3D vision benefits from COM-HPC

3D vision is a must, especially for guided robotics and automated guided vehicles (AGV). The new COM-HPC modules can offer a decisive performance boost in these fields of application and also drive the trend towards hardware consolidation in both...

read more...
Advertisement
Advertisement
Advertisement
Advertisement
Advertisement
Advertisement

Congatec

Next-generation AI computing for the edge

Congatec introduces COM Express Compact modules based on Intel Core Ultra processors. The new modules combine heterogeneous computing units such as CPU, GPU and NPU and are therefore particularly suitable for executing demanding AI workloads at the...

read more...
Subscribe to our newsletter
Advertisement
Back to home