CN114995918A - Starting method and configuration method and device of baseboard management controller and electronic equipment - Google Patents
Starting method and configuration method and device of baseboard management controller and electronic equipment Download PDFInfo
- Publication number
- CN114995918A CN114995918A CN202210919497.1A CN202210919497A CN114995918A CN 114995918 A CN114995918 A CN 114995918A CN 202210919497 A CN202210919497 A CN 202210919497A CN 114995918 A CN114995918 A CN 114995918A
- Authority
- CN
- China
- Prior art keywords
- public key
- nonvolatile memory
- encryption information
- management controller
- stored
- Prior art date
- Legal status (The legal status is an assumption and is not a legal conclusion. Google has not performed a legal analysis and makes no representation as to the accuracy of the status listed.)
- Pending
Links
- 238000000034 method Methods 0.000 title claims abstract description 96
- 230000015654 memory Effects 0.000 claims abstract description 206
- 239000000758 substrate Substances 0.000 claims abstract description 13
- 238000004422 calculation algorithm Methods 0.000 claims description 71
- 238000005259 measurement Methods 0.000 claims description 25
- 230000008569 process Effects 0.000 claims description 12
- 238000004590 computer program Methods 0.000 claims description 11
- 238000001514 detection method Methods 0.000 claims description 6
- 230000003213 activating effect Effects 0.000 claims 1
- 238000010586 diagram Methods 0.000 description 6
- 238000004519 manufacturing process Methods 0.000 description 5
- 238000012795 verification Methods 0.000 description 5
- 238000004364 calculation method Methods 0.000 description 2
- 238000005516 engineering process Methods 0.000 description 2
- 230000006870 function Effects 0.000 description 2
- 238000012986 modification Methods 0.000 description 2
- 230000004048 modification Effects 0.000 description 2
- 230000009286 beneficial effect Effects 0.000 description 1
- 238000011161 development Methods 0.000 description 1
- 230000003287 optical effect Effects 0.000 description 1
- 238000005192 partition Methods 0.000 description 1
- 230000000750 progressive effect Effects 0.000 description 1
- 238000007650 screen-printing Methods 0.000 description 1
Images
Classifications
-
- G—PHYSICS
- G06—COMPUTING; CALCULATING OR COUNTING
- G06F—ELECTRIC DIGITAL DATA PROCESSING
- G06F9/00—Arrangements for program control, e.g. control units
- G06F9/06—Arrangements for program control, e.g. control units using stored programs, i.e. using an internal store of processing equipment to receive or retain programs
- G06F9/44—Arrangements for executing specific programs
- G06F9/445—Program loading or initiating
- G06F9/44505—Configuring for program initiating, e.g. using registry, configuration files
-
- G—PHYSICS
- G06—COMPUTING; CALCULATING OR COUNTING
- G06F—ELECTRIC DIGITAL DATA PROCESSING
- G06F21/00—Security arrangements for protecting computers, components thereof, programs or data against unauthorised activity
- G06F21/60—Protecting data
- G06F21/602—Providing cryptographic facilities or services
-
- G—PHYSICS
- G06—COMPUTING; CALCULATING OR COUNTING
- G06F—ELECTRIC DIGITAL DATA PROCESSING
- G06F21/00—Security arrangements for protecting computers, components thereof, programs or data against unauthorised activity
- G06F21/60—Protecting data
- G06F21/64—Protecting data integrity, e.g. using checksums, certificates or signatures
-
- G—PHYSICS
- G06—COMPUTING; CALCULATING OR COUNTING
- G06F—ELECTRIC DIGITAL DATA PROCESSING
- G06F2221/00—Indexing scheme relating to security arrangements for protecting computers, components thereof, programs or data against unauthorised activity
- G06F2221/21—Indexing scheme relating to G06F21/00 and subgroups addressing additional information or applications relating to security arrangements for protecting computers, components thereof, programs or data against unauthorised activity
- G06F2221/2107—File encryption
Abstract
The invention discloses a starting method, a starting configuration method and a starting configuration device of a baseboard management controller, electronic equipment and a computer readable storage medium, and relates to the technical field of computers, wherein the starting method comprises the following steps: after the substrate management controller is electrified and started, a public key stored in the nonvolatile memory is obtained; decrypting the digital signature stored in the nonvolatile memory according to the public key to obtain file encryption information; detecting whether the mirror image file stored in the nonvolatile memory is correct or not according to the file encryption information; if yes, loading the mirror image file into a memory of the substrate management controller to operate; according to the invention, whether the image file stored in the nonvolatile memory is correct or not is detected according to the file encryption information, and whether the image file is tampered or not can be detected, so that the safe starting of the BMC chip can be realized on the basis of not using the RoT and based on the existing characteristics of the nonvolatile memory, and the hardware cost increased by updating the chip is avoided.
Description
Technical Field
The present invention relates to the field of computer technologies, and in particular, to a method and an apparatus for starting a baseboard management controller, a method and an apparatus for starting configuration, an electronic device, and a computer-readable storage medium.
Background
With the development of computer technology, software security becomes more and more important. In the storage device, a BMC (Baseboard Management Controller) is used as an out-of-band Management center, and if a BMC software program is attacked before starting, normal Management of the entire storage device is affected.
Currently, the common practice in the industry is: the method comprises the steps that RoT (Root of Trust) and CRTM (Core Root of Trust for Measurement) are built in a BMC chip, and then whether a BMC-IMAGE (mirror IMAGE file) is tampered or not is verified through the RoT and the CRTM, so that safe starting of the BMC is achieved; however, the BMC chip that has been widely used at present does not basically support the secure boot function. Therefore, how to realize the safe start of the BMC chip without using the RoT is a problem that needs to be solved nowadays, so as to ensure the use safety of the BMC chip and avoid hardware cost caused by updating the chip.
Disclosure of Invention
The invention aims to provide a starting method, a starting device, a starting configuration method, a starting configuration device, electronic equipment and a computer readable storage medium of a baseboard management controller, so as to realize the safe starting of a BMC chip and avoid the hardware cost increased by updating the chip on the basis of not using RoT.
To solve the above technical problem, the present invention provides a method for starting a baseboard management controller, including:
after the baseboard management controller is powered on and started, a public key stored in a nonvolatile memory is obtained;
decrypting the digital signature stored in the nonvolatile memory according to the public key to obtain file encryption information;
detecting whether the mirror image file stored in the nonvolatile memory is correct or not according to the file encryption information;
and if so, loading the image file into a memory of the baseboard management controller for operation.
Optionally, the detecting, according to the file encryption information, whether the image file stored in the nonvolatile memory is correct includes:
calculating a digest value corresponding to the image file by using a first preset digest algorithm;
judging whether the digest value is the same as the file encryption information;
and if the image files are the same, executing the step of loading the image files to the memory of the baseboard management controller for operation.
Optionally, before obtaining the public key stored in the nonvolatile memory, the method further includes:
loading the credibility measurement code stored in the nonvolatile memory into the memory of the baseboard management controller for running;
and executing the step of obtaining the public key stored in the nonvolatile memory in the running process of the credibility measurement code.
Optionally, the loading the trusted metric code stored in the nonvolatile memory into the memory of the baseboard management controller for running includes:
loading the credibility measurement code from a protection area of the nonvolatile memory into a memory of the baseboard management controller to run; wherein the protection region is a programmable region of a read-only mode.
Optionally, before decrypting the digital signature stored in the nonvolatile memory according to the public key to obtain the file encryption information, the method further includes:
judging whether the public key is correct or not according to preset encryption information stored in the nonvolatile memory; wherein the preset encryption information is stored in a one-time programming area in the non-volatile memory;
and if the public key is correct, executing the step of decrypting the digital signature stored in the nonvolatile memory according to the public key to obtain file encryption information.
Optionally, the determining whether the public key is correct according to preset encryption information stored in the nonvolatile memory includes:
calculating a public key abstract value corresponding to the public key by using a second preset abstract algorithm;
judging whether the public key abstract value is the same as the preset encryption information or not;
and if the public key is the same as the encrypted file, determining that the public key is correct, and executing the step of decrypting the digital signature stored in the nonvolatile memory according to the public key to obtain file encrypted information.
The invention also provides a starting configuration method of the baseboard management controller, which comprises the following steps:
encrypting a mirror image file of a substrate management controller to obtain file encryption information;
encrypting the file encryption information by using a private key of a preset asymmetric encryption algorithm to generate a digital signature;
and storing the image file, the digital signature and a public key corresponding to the private key into a nonvolatile memory.
Optionally, the start configuration method further includes:
storing trusted metrics code to a protected area of the non-volatile memory; the protection area is a programmable area in a read-only mode, and the credible measurement code is used for verifying the image file.
Optionally, the start configuration method further includes:
encrypting the public key to obtain preset encryption information;
writing the preset encryption information to a one-time programming area in the non-volatile memory.
Optionally, before writing the preset encryption information into the one-time programming region in the nonvolatile memory, the method further includes:
generating and outputting memory recommendation information according to the size of the preset encryption information; the memory recommendation information comprises nonvolatile memory information, wherein the capacity of a one-time programming area is larger than or equal to the size of the preset encryption information.
Optionally, the encrypting the public key to obtain preset encryption information includes:
and encrypting the public key by using a second preset abstract algorithm to obtain the preset encryption information.
The invention also provides a starting device of the substrate management controller, which comprises:
the public key acquisition module is used for acquiring a public key stored in the nonvolatile memory after the baseboard management controller is electrified and started;
the public key decryption module is used for decrypting the digital signature stored in the nonvolatile memory according to the public key to obtain file encryption information;
the mirror image detection module is used for detecting whether the mirror image file stored in the nonvolatile memory is correct or not according to the file encryption information;
and the starting operation module is used for loading the image file into the memory of the substrate management controller to operate if the image file is correct.
The invention also provides a starting configuration device of the baseboard management controller, which comprises:
the file encryption module is used for encrypting the mirror image file of the substrate management controller to acquire file encryption information;
the private key encryption module is used for encrypting the file encryption information by using a private key of a preset asymmetric encryption algorithm to generate a digital signature;
and the storage module is used for storing the image file, the digital signature and the public key corresponding to the private key into a nonvolatile memory.
The present invention also provides an electronic device, comprising:
a memory for storing a computer program;
a processor, configured to implement the method for starting a baseboard management controller or the method for starting configuration of a baseboard management controller when executing the computer program.
Furthermore, the present invention also provides a computer-readable storage medium, on which a computer program is stored, where the computer program, when executed by a processor, implements the steps of the method for starting up a baseboard management controller or the method for starting up configuration of a baseboard management controller.
The invention provides a starting method of a baseboard management controller, which comprises the following steps: after the baseboard management controller is powered on and started, a public key stored in a nonvolatile memory is obtained; decrypting the digital signature stored in the nonvolatile memory according to the public key to obtain file encryption information; detecting whether the mirror image file stored in the nonvolatile memory is correct or not according to the file encryption information; if yes, loading the mirror image file into a memory of the baseboard management controller for operation;
therefore, the invention can detect whether the image file stored in the nonvolatile memory is correct or not according to the file encryption information, and can detect whether the image file is tampered or not, thereby realizing the safe start of the BMC chip based on the existing characteristics of the nonvolatile memory on the basis of not using the RoT, and avoiding the hardware cost increased by updating the chip. In addition, the invention also provides a starting device, a starting configuration method and a starting configuration device of the baseboard management controller and electronic equipment, and the starting device, the starting configuration method and the starting configuration device of the baseboard management controller also have the beneficial effects.
Drawings
In order to more clearly illustrate the embodiments of the present invention or the technical solutions in the prior art, the drawings used in the description of the embodiments or the prior art will be briefly described below, it is obvious that the drawings in the following description are only embodiments of the present invention, and for those skilled in the art, other drawings can be obtained according to the provided drawings without creative efforts.
Fig. 1 is a flowchart illustrating a method for starting a baseboard management controller according to an embodiment of the present invention;
fig. 2 is a schematic diagram illustrating a partition of a storage area of another method for starting a bmc according to an embodiment of the present invention;
fig. 3 is a flowchart of another method for starting a bmc according to an embodiment of the present invention;
fig. 4 is a schematic diagram of a digital signature production flow of another method for starting a baseboard management controller according to an embodiment of the present invention;
fig. 5 is a flowchart illustrating another method for starting a bmc according to an embodiment of the present invention;
fig. 6 is a flowchart of a method for configuring a baseboard management controller according to an embodiment of the present invention;
fig. 7 is a block diagram illustrating a starting apparatus of a bmc according to an embodiment of the present invention;
fig. 8 is a block diagram of a configuration starting apparatus of a bmc according to an embodiment of the present invention.
Detailed Description
In order to make the objects, technical solutions and advantages of the embodiments of the present invention clearer, the technical solutions in the embodiments of the present invention will be clearly and completely described below with reference to the drawings in the embodiments of the present invention, and it is obvious that the described embodiments are some, but not all, embodiments of the present invention. All other embodiments, which can be derived by a person skilled in the art from the embodiments given herein without making any creative effort, shall fall within the protection scope of the present invention.
Referring to fig. 1, fig. 1 is a flowchart illustrating a method for starting a bmc according to an embodiment of the present invention. The starting method can comprise the following steps:
step 101: and after the baseboard management controller is electrified and started, the public key stored in the nonvolatile memory is obtained.
The public key in this embodiment may be a secret key used to decrypt a digital signature encrypted by file encryption information of an IMAGE file (BMC-IMAGE) corresponding to BMC software that the BMC starts to operate, that is, a public key (KeyPub) corresponding to a private key (KeyPri) used to asymmetrically encrypt file encryption information.
Specifically, the specific content and number of the public keys stored in the nonvolatile memory in this embodiment may be set by a designer according to a practical scenario and a user requirement, for example, the public key may be a pair of private keys used for performing asymmetric encryption on the file encryption information, such as a pair of RSA private key pairs of an RSA encryption algorithm (an asymmetric encryption/decryption algorithm), that is, the public key stored in the nonvolatile memory may be a public key corresponding to the private key used for encrypting the file encryption information by using a preset asymmetric encryption algorithm; the number of the public keys may also be multiple, that is, the public key stored in the nonvolatile memory may be a public key corresponding to each of multiple private keys used for encrypting the file encryption information multiple times, for example, two public keys corresponding to two private keys used for encrypting the file encryption information two times. As long as the processor can decrypt the digital signature obtained by encrypting the file encryption information by using the public key stored in the nonvolatile memory, so as to obtain the file encryption information, this embodiment does not limit this.
It can be understood that the boot method of the BMC provided in this embodiment may be applied to the BMC, for example, a BMC chip of the storage device, that is, a processor (for example, the BMC-CPU in fig. 2) of the BMC may detect whether the image file is tampered with by using the boot method provided in this embodiment after the processor is powered on and started, so that the image file is Loaded (LOAD) into a memory (for example, the BMC-RAM in fig. 2) of the BMC to run when the image file is not tampered with, thereby implementing secure boot of the BMC.
Correspondingly, in the embodiment, the trusted measurement code (CRTM code) is used to detect whether the image file is tampered, that is, the processor of the BMC can detect whether the image file is correct in the process of running the trusted measurement code, thereby implementing secure boot of the BMC; the credibility measurement code can be a first section of code operated by the BMC and is used for completing basic functions of memory initialization, signature verification and the like of the BMC. That is to say, the method provided in this embodiment may further include loading the trusted metric code stored in the nonvolatile memory to the memory of the baseboard management controller for operation after the BMC is powered on and started; so that step 101 and subsequent steps can be performed during the execution of the trusted metrics code.
Specifically, in order to ensure the security of the trusted metric code stored in the nonvolatile memory, in this embodiment, the trusted metric code may be stored in an OTP (One Time program) area or a read-only mode protection area in a programmable area in the nonvolatile memory; as shown in fig. 2, when the nonvolatile memory is a FLASH memory (FLASH), the CRTM code may be stored in a protection area that is only a read-only state among the programmable area (BLOCK area).
Step 102: and decrypting the digital signature stored in the nonvolatile memory according to the public key to obtain the file encryption information.
The digital signature in this step may be a result obtained by encrypting file encryption information corresponding to the image file with a private key, and the digital signature is decrypted with a public key corresponding to the private key stored in the nonvolatile memory in this step to obtain the file encryption information, so that whether the image file stored in the nonvolatile memory is tampered with is detected with the file encryption information obtained by decryption.
Specifically, the specific manner in which the processor decrypts the digital signature stored in the nonvolatile memory according to the public key to obtain the file encryption information may be set by a designer, for example, the processor may decrypt the digital signature stored in the nonvolatile memory by using a preset asymmetric encryption algorithm according to the public key to obtain the file encryption information. The embodiment is not limited to this as long as it is ensured that the processor can decrypt the digital signature stored in the nonvolatile memory by using the public key stored in the nonvolatile memory.
Further, before this step, the processor may further detect whether the public key stored in the nonvolatile memory is correct according to preset encryption information stored in the nonvolatile memory; when the public key is correct, namely the public key is not tampered, entering step 102; when the public key is incorrect, namely the public key is tampered, the process can be directly ended to stop starting the BMC. The preset encryption information may be a result obtained by encrypting a preset public key, for example, a digest value (i.e., a HASH value) obtained by performing digest encryption on the public key.
Correspondingly, the specific way for detecting whether the public key stored in the nonvolatile memory is correct or not according to the preset encryption information stored in the nonvolatile memory can be set by a designer, for example, the processor can calculate the public key digest value corresponding to the public key by using a second preset digest algorithm; judging whether the public key abstract value is the same as the preset encryption information or not; if the public key is the same as the public key, the public key is determined to be correct, and the step 102 is carried out; if not, the public key is determined to be incorrect, the process can be ended, and the BMC is stopped to be started.
Further, for the security of the preset encryption information stored in the nonvolatile memory, the preset encryption information in this embodiment may be stored in an OTP (One Time program) area in the nonvolatile memory; as shown in fig. 2, when the nonvolatile memory is FLASH, the preset encryption information (root public key HASH value) may be stored in the OTP area of FLASH.
Step 103: detecting whether the mirror image file stored in the nonvolatile memory is correct or not according to the file encryption information; if yes, go to step 104.
It can be understood that, in this embodiment, the processor may obtain the file encryption information by decryption, and detect whether the image file stored in the nonvolatile memory is tampered, so that when it is determined that the image file is not tampered, step 104 is performed to load the image file into the memory of the BMC to run, and the BMC software starts to run, so as to implement secure startup of the BMC.
Correspondingly, the condition that the image file is incorrect in the step, namely the condition that the image file is tampered, can be set by a designer, for example, when the processor determines that the image file is incorrect, the process is directly ended, the image file is not loaded, and the BMC is stopped being started.
Correspondingly, the specific mode that the processor detects whether the mirror image file stored in the nonvolatile memory is correct or not according to the file encryption information in the step can be set by a designer according to a practical scene and user requirements, if the processor can encrypt the mirror image file by using the encryption mode corresponding to the file encryption information, an encryption result is obtained; detecting whether the encryption result is the same as the file encryption information; if the image files are the same, determining that the image files are correct; and if not, determining that the mirror image file is incorrect. For example, when the file encryption information is an encryption result (i.e., digest value) obtained by encrypting the image file using the first preset digest algorithm, in this step, the processor may calculate the digest value corresponding to the image file using the first preset digest algorithm; judging whether the digest value is the same as the file encryption information; if so, step 104 may be entered.
Step 104: and loading the image file to a memory of the baseboard management controller for operation.
Specifically, in this step, the processor may load the image file into the memory of the BMC to run when it is determined that the image file is not tampered, start running the BMC software, and complete the secure boot of the BMC.
In this embodiment, whether the image file stored in the nonvolatile memory is correct or not is detected according to the file encryption information, and whether the image file is tampered or not can be detected, so that the safe start of the BMC chip can be realized based on the existing characteristics of the nonvolatile memory on the basis of not using RoT, and the hardware cost for updating the chip is avoided.
Referring to fig. 3, fig. 3 is a flowchart of another method for starting a bmc according to an embodiment of the present invention, where the method includes:
step 201: and after the baseboard management controller is electrified and started, loading the credibility measurement code stored in the nonvolatile memory into the memory of the baseboard management controller for running.
It can be understood that, in this step, the processor of the BMC may load the trusted measurement code (CRTM code) to the memory of the BMC (e.g., BMC-RAM in fig. 5) to run after power-on startup, so as to complete detection of whether the image file is tampered with by using the running CRTM code, and complete secure startup of the BMC.
Specifically, in this embodiment, the trusted measurement code may be stored in a protection area in the nonvolatile memory, that is, only a programmable area in a read-only mode, so as to avoid malicious tampering of the stored trusted measurement code; as shown in fig. 2, when the nonvolatile memory is a FLASH memory (FLASH), a CRTM code (trust metric code) may be stored in a protected area of a programmable area (BLOCK area) which is only a read-only state. Correspondingly, in this step, after the processor of the BMC is powered on and started, the processor of the BMC may load the trusted measurement code from the protection area of the nonvolatile memory into the memory of the baseboard management controller to operate; wherein the protection region is a programmable region in read-only mode.
Step 202: during the running process of the credibility measurement code, a public key stored in a nonvolatile memory is obtained.
The public key in this step may be stored in a non-protection area of the nonvolatile memory, that is, a programmable area outside the protection area, that is, a normal storage area. As shown in fig. 2, the public key may be stored in a non-protected area of a non-volatile memory (FLASH) together with a digital signature and IMAGE file (BMC IMAGE).
Step 203: judging whether the public key is correct or not according to preset encryption information stored in the nonvolatile memory; if yes, go to step 204.
In which the preset encryption information may be stored in a one-time programming region (e.g., OTP region in fig. 2) in the non-volatile memory, e.g., the preset encryption information may be written to the one-time programming region of the non-volatile memory at the production stage.
It is understood that the preset encryption information in this step may be an encryption result obtained by encrypting a preset public key, for example, the public key (e.g., the root public key in fig. 5) is encrypted by a digest algorithm to obtain a digest value (e.g., the HASH value of the RSA public key in fig. 5).
Specifically, the specific manner in which the processor determines whether the public key is correct according to the preset encryption information stored in the nonvolatile memory in this step may be set by a designer according to a practical scene and a user requirement, and if the preset encryption information is that the public key is encrypted by the second preset digest algorithm to obtain a digest value, the processor may calculate the digest value of the public key corresponding to the public key by using the second preset digest algorithm in this step; judging whether the public key abstract value is the same as the preset encryption information or not; if the public key is the same as the public key, the public key is determined to be correct, step 204 can be entered, and the next image file verification process is continued; if the public key is not the same as the public key, the public key is determined to be incorrect, the process can be directly ended, and the BMC is not started to operate. The present embodiment does not set any limit to this.
Step 204: and decrypting the digital signature stored in the nonvolatile memory according to the public key to obtain the file encryption information.
The file encryption information in this step may be an encrypted result obtained by encrypting the IMAGE file, for example, in fig. 4, the IMAGE file (BMC-IMAGE) is encrypted by using a digest algorithm to obtain a digest, so that after the digest is encrypted by using a private key (RSA private key) corresponding to the public key, a digital signature to be stored in the nonvolatile memory may be obtained, so that the processor of the BMC may decrypt the digital signature by using the public key to obtain the digest.
Specifically, the specific manner in which the processor decrypts the digital signature stored in the nonvolatile memory according to the public key in this step to obtain the file encryption information may be set by the designer, and the specific manner is not limited in this embodiment, if the public key decryption method of the asymmetric encryption/decryption algorithm in the prior art is the same as or similar to the public key decryption method.
Step 205: detecting whether the mirror image file stored in the nonvolatile memory is correct or not according to the file encryption information; if yes, go to step 206.
Specifically, the specific way in which the processor detects whether the IMAGE file stored in the nonvolatile memory is correct according to the file encryption information in this step may be set by a designer according to a practical scene and a user requirement, and if the file encryption information is that the IMAGE file is encrypted by a first preset digest algorithm to obtain a digest value (such as a BMC-IMAGE digest value a in fig. 5), the processor may calculate a digest value (such as a digest value a' in fig. 5) corresponding to the IMAGE file by using the first preset digest algorithm in this step; judging whether the digest value is the same as the file encryption information; if the image files are the same, determining that the image files are correct, and entering a step 206 to continue the starting of the BMC; if the image files are different, it is determined that the image files are incorrect, the process can be ended, and the operation of the BMC is not started any more, which is not limited in this embodiment.
It can be understood that, the selection of the specific digest algorithm (SHA algorithm, also called HASH algorithm) of the first preset digest algorithm and the second preset digest algorithm may be set by the designer according to the practical situation and the user requirement, for example, the first preset digest algorithm and the second preset digest algorithm may be the same digest algorithm, such as MD5 (fifth version of message digest algorithm), SM3 (national cryptographic algorithm), SHA-1 (a secure HASH algorithm), SHA-224 (a secure HASH algorithm), SHA-256 (a secure HASH algorithm), SHA-384 (a secure HASH algorithm), and SHA-512 (a secure HASH algorithm); the first preset summarization algorithm and the second preset summarization algorithm may also adopt different summarization algorithms, for example, the first preset summarization algorithm may be the MD5 algorithm, and the second preset summarization algorithm may be the SM3 algorithm. The present embodiment does not set any limit to this.
Step 206: and loading the mirror image file to a memory of the baseboard management controller for operation.
Specifically, in this step, the processor may load the image file into the memory of the BMC to run when it is determined that the image file is not tampered, start running the BMC software, and complete the secure boot of the BMC.
In this embodiment, the embodiment of the present invention determines whether the public key is correct according to the preset encryption information stored in the nonvolatile memory, and can verify the public key stored in the nonvolatile memory, detect whether the public key is tampered, and further ensure the security of starting the BMC chip.
Based on the method for starting the baseboard management controller provided in the above embodiments, this embodiment provides a method for starting and configuring the baseboard management controller, so as to configure the nonvolatile memory used when the BMC is started, thereby ensuring the safe start of the BMC.
Referring to fig. 6, fig. 6 is a flowchart illustrating a method for configuring a baseboard management controller according to an embodiment of the present invention. The startup configuration method can comprise the following steps:
step 301: and encrypting the mirror image file of the substrate management controller to acquire file encryption information.
It can be understood that the start configuration method for the BMC provided in this embodiment may be applied to a computer device, such as a production device of a nonvolatile memory, that is, a processor of the computer device may configure a nonvolatile memory (e.g., FLASH) used when the BMC is started, so as to implement configuration for safe start of the BMC, and ensure that the BMC can be started safely.
Specifically, the embodiment does not limit the specific manner in which the processor encrypts the IMAGE file of the BMC to obtain the file encryption information, and as shown in fig. 4, the processor may encrypt the IMAGE file (BMC-IMAGE) of the BMC by using a digest algorithm (such as the first preset digest algorithm) to obtain the file encryption information (i.e., a digest value).
Step 302: and encrypting the file encryption information by using a private key of a preset asymmetric encryption algorithm to generate a digital signature.
Specifically, in this step, the processor may perform asymmetric encryption on the file encryption information by using a private key of a preset asymmetric encryption algorithm to obtain a signature file (i.e., a digital signature) of the image file. Specific contents and quantity of the private key of the preset asymmetric encryption algorithm in the embodiment can be set by designers according to practical scenes and user requirements, for example, the private key can be a private key used for asymmetric encryption of file encryption information; the number of the private keys may be 1, for example, the private key in a pair of RSA private key pairs of an RSA encryption algorithm, that is, the public key in the RSA private key pair may be stored in the nonvolatile memory, and is used to decrypt the digital signature stored in the nonvolatile memory to obtain file encryption information; the number of the private keys may also be multiple, such as the private keys in multiple pairs of RSA private key pairs of the RSA encryption algorithm, that is, the processor may encrypt the file encryption information multiple times by using multiple private keys to obtain the digital signature. As long as the processor can preset a private key of the asymmetric encryption algorithm, encrypt the file encryption information, and generate a digital signature that can be decrypted by the corresponding public key, this embodiment does not limit this.
For example, the processor may generate one or more pairs of RSA key pairs (i.e., a public key and a private key) using an RSA algorithm, and asymmetrically encrypt the file encryption information using the private key of the RSA key pair to generate a digital signature of the image file.
Specifically, the specific content and number of the private key of the preset asymmetric encryption algorithm in this embodiment may be set by a designer according to a practical scenario and a user requirement, for example, the public key may be a pair of private keys used for asymmetric encryption with the file encryption information, such as a pair of RSA private key pairs of an RSA encryption algorithm (an asymmetric encryption/decryption algorithm), that is, the public key stored in the nonvolatile memory may be a public key corresponding to the private key used for encrypting the file encryption information by using the preset asymmetric encryption algorithm; the number of the public keys may also be multiple, that is, the public key stored in the nonvolatile memory may be a public key corresponding to each of multiple private keys used for performing multiple encryption on the file encryption information, for example, two public keys corresponding to two private keys used for performing secondary encryption on the file encryption information. As long as the processor can decrypt the digital signature obtained by encrypting the file encryption information by using the public key stored in the nonvolatile memory to obtain the file encryption information, the embodiment does not limit this to any way
It should be noted that, in this embodiment, the specific manner in which the processor encrypts the file encryption information by using the private key of the preset asymmetric encryption algorithm to generate the digital signature is not limited, and as shown in fig. 4, the processor may encrypt the image file encryption information of the BMC by using the RSA private key to generate the digital signature.
Step 303: and storing the image file, the digital signature and the public key corresponding to the private key into a nonvolatile memory.
It is understood that the image file, the digital signature, and the public key (such as the public key in the RSA key pair) may be distributed together in this step and written to a normal storage area (such as the non-protected area in fig. 2) of the non-volatile memory.
Further, in this embodiment, the processor may further encrypt the public key to obtain preset encryption information; writing preset encryption information into a one-time programming area in a nonvolatile memory to realize a public key verification process when the BMC is started; for example, the processor may encrypt the public key using a digest algorithm to obtain the preset encryption information (i.e., digest value) and write the preset encryption information into the one-time programming region in the non-volatile memory. For example, the processor may encrypt the public key by using a second preset digest algorithm, obtain preset encryption information (i.e., digest value), and write the preset encryption information into a one-time programming region in the nonvolatile memory; correspondingly, the processor may further select the nonvolatile memory determined to be written with the preset encryption information from a plurality of selectable nonvolatile memories according to the length of the sequence generated by the second preset digest algorithm (i.e., the length of the generated sequence), for example, the nonvolatile memory may be a selectable nonvolatile memory in which the OTP area is greater than or equal to the length of the generated sequence and the OTP area is the smallest.
Correspondingly, in this embodiment, the processor may further write the trusted metric code into a one-time programming area or a read-only mode protection area in the programmable area in the nonvolatile memory, so as to verify the image file by using the trusted metric code, thereby ensuring secure boot of the BMC. As shown in fig. 2, the processor may write the trusted metrics code to the BLOCK region (i.e., programmable region) of FLASH and set the region storing the trusted metrics code (i.e., protected region) to read-only mode; correspondingly, the FLASH does not contain the silk-screen, and if the processor can output prompt information to prompt a worker to remove the silk-screen of the FLASH, the situation that the credible measurement codes in the protection area are modified by utilizing the information on the silk-screen is avoided, and the safe starting of the BMC is ensured; that is, the nonvolatile memory in this embodiment may not include the screen printing.
Further, the start configuration method of the bmc provided in this embodiment may further include a selection process of the nonvolatile memory, for example, when the one-time programming area in the nonvolatile memory is used to store the preset encryption information, the processor of the start configuration device (such as a production device of the nonvolatile memory) of the bmc in this embodiment may generate and output memory recommendation information according to the size of the preset encryption information; the memory recommendation information comprises nonvolatile memory information, wherein the capacity of a one-time programming area is larger than or equal to the size of preset encryption information; that is to say, the starting configuration device can display the nonvolatile memory with the appropriate size of the OTP region to the worker by outputting the memory recommendation information, so that the worker can select the corresponding nonvolatile memory conveniently, and the processor can store the preset encryption information, the trusted measurement code, the image file, the digital signature and the public key by using the nonvolatile memory selected by the worker; correspondingly, the processor may store the preset encryption information, the trusted measurement code, the image file, the digital signature, and the public key in the nonvolatile memory corresponding to the memory selection instruction according to the received memory selection instruction.
Correspondingly, the processor for starting the configuration equipment can also determine the nonvolatile memory according to the size of the preset encryption information; the capacity of the one-time programming area of the nonvolatile memory is larger than or equal to the size of the preset encryption information. For example, the processor may determine the nonvolatile memory from the preset nonvolatile memory according to the size of the preset encryption information, the nonvolatile memory may be a preset nonvolatile memory in which the capacity of the one-time programming region in the target preset nonvolatile memory is the minimum, and the target preset nonvolatile memory may be a preset nonvolatile memory in which the capacity of the one-time programming region is greater than or equal to the size of the preset encryption information.
Specifically, the size of the preset encryption information may be an actual size of the preset encryption information obtained after the public key is encrypted; the size of the preset encryption information may also be a length of a sequence generated by an encryption algorithm (such as a second preset digest algorithm) used for public key encryption (i.e., a generated sequence length), for example, when the processor encrypts the public key by using the second preset digest algorithm to obtain the preset encryption information, the processor may generate and output the memory recommendation information according to the generated sequence length of the second preset digest algorithm; wherein the memory recommendation information includes non-volatile memory information in which a capacity of the one-time programming region is greater than or equal to a generation sequence length.
In this embodiment, the embodiment of the present invention can configure the nonvolatile memory used when the BMC is started by storing the image file, the digital signature, and the public key corresponding to the private key in the nonvolatile memory, thereby ensuring the safe start of the BMC.
Corresponding to the above embodiment of the starting method, an embodiment of the present invention further provides a starting apparatus of a bmc, and the following starting apparatus of the bmc and the above described starting method of the bmc may be referred to correspondingly.
Referring to fig. 7, fig. 7 is a block diagram of a starting apparatus of a bmc according to an embodiment of the present invention. The starting means may comprise:
the public key obtaining module 10 is configured to obtain a public key stored in the nonvolatile memory after the baseboard management controller is powered on and started;
the public key decryption module 20 is configured to decrypt the digital signature stored in the nonvolatile memory according to the public key to obtain file encryption information;
the mirror image detection module 30 is used for detecting whether the mirror image file stored in the nonvolatile memory is correct or not according to the file encryption information;
and the running module 40 is started, and is used for loading the image file into the memory of the baseboard management controller to run if the image file is correct.
Optionally, the image detection module 30 may include:
the first calculation submodule is used for calculating a digest value corresponding to the image file by using a first preset digest algorithm;
the first judgment submodule is used for judging whether the digest value is the same as the file encryption information or not; if the two signals are the same, a start signal is sent to the start running module 40.
Optionally, the starting apparatus may further include:
the loading module is used for loading the credibility measurement code stored in the nonvolatile memory into the memory of the substrate management controller for operation; during the running of the trusted measurement code, a start signal is sent to the public key acquisition module 10.
Optionally, the loading module may be specifically configured to load the trust measurement code from the protection area of the nonvolatile memory into the memory of the baseboard management controller for operation; wherein the protection area is a programmable area of a read-only mode.
Optionally, the starting apparatus may further include:
the public key verification module is used for judging whether the public key is correct or not according to preset encryption information stored in the nonvolatile memory; the encryption method comprises the steps that preset encryption information is stored in a one-time programming area in a nonvolatile memory; if the public key is correct, a start signal is sent to the public key decryption module 20.
Optionally, the public key verification module may include:
the second calculation submodule is used for calculating a public key abstract value corresponding to the public key by using a second preset abstract algorithm;
the second judgment submodule is used for judging whether the digest value of the public key is the same as the preset encrypted information or not; if the public key is the same as the public key, the public key is determined to be correct, and a starting signal is sent to the public key decryption module 20.
In this embodiment, the image detection module 30 detects whether the image file stored in the nonvolatile memory is correct or not according to the file encryption information, and can detect whether the image file is tampered or not, so that the BMC chip can be safely started based on the existing characteristics of the nonvolatile memory without using RoT, and hardware cost for updating the chip is avoided.
Corresponding to the above embodiment of the start-up configuration method, an embodiment of the present invention further provides a start-up configuration device of a bmc, and the following description of the start-up configuration device of the bmc and the above description of the start-up configuration method of the bmc may be referred to correspondingly.
Referring to fig. 8, fig. 8 is a block diagram illustrating a configuration starting apparatus of a bmc according to an embodiment of the present invention. The start-up configuration means may comprise:
the file encryption module 50 is used for encrypting the mirror image file of the substrate management controller to obtain file encryption information;
the private key encryption module 60 is configured to encrypt file encryption information by using a private key of a preset asymmetric encryption algorithm to generate a digital signature;
and the storage module 70 is used for storing the image file, the digital signature and the public key corresponding to the private key into the nonvolatile memory.
Optionally, the starting configuration device may further include:
a code storage module for storing the trusted metrics code to a protected area of the non-volatile memory; the protection area is a programmable area in a read-only mode, and the credibility measurement code is used for verifying the image file.
Optionally, the start configuration device may further include:
the public key encryption module is used for encrypting the public key to obtain preset encryption information;
and the encryption storage module is used for writing preset encryption information into a one-time programming area in the nonvolatile memory.
Optionally, the starting configuration device may further include:
the recommendation generation module is used for generating and outputting memory recommendation information according to the size of the preset encryption information; the memory recommendation information comprises nonvolatile memory information, wherein the capacity of the one-time programming area is larger than or equal to the size of the preset encryption information.
Optionally, the public key encryption module may be specifically configured to encrypt the public key by using a second preset digest algorithm to obtain the preset encryption information.
In this embodiment, in the embodiment of the present invention, the storage module 60 stores the image file, the digital signature, and the public key corresponding to the private key in the nonvolatile memory, so that the nonvolatile memory used when the BMC is started can be configured, and the secure start of the BMC is ensured.
Corresponding to the above method embodiment, an embodiment of the present invention further provides an electronic device, and the electronic device described below may be referred to in correspondence with the above starting method of the bmc and the starting configuration method of the bmc.
An electronic device, comprising:
a memory for storing a computer program;
and a processor, configured to implement the steps of the method for starting a baseboard management controller or the method for starting configuration of a baseboard management controller provided in the foregoing embodiments when executing the computer program.
Specifically, the electronic device provided in this embodiment may be specifically a BMC chip, such as a BMC chip of a storage device; the electronic device provided by the embodiment may also be a computer device, such as a production device of a non-volatile memory.
Corresponding to the above method embodiment, an embodiment of the present invention further provides a computer-readable storage medium, and a computer-readable storage medium described below may be referred to in correspondence with the above starting method of the baseboard management controller and the starting configuration method of the baseboard management controller.
A computer-readable storage medium, on which a computer program is stored, and when executed by a processor, the computer program implements the steps of the startup method of the baseboard management controller or the startup configuration method of the baseboard management controller provided in the above embodiments.
The computer readable storage medium may be a usb disk, a removable hard disk, a Read-Only Memory (ROM), a Random Access Memory (RAM), a magnetic disk or an optical disk, and various computer readable storage media capable of storing program codes.
The embodiments are described in a progressive manner in the specification, each embodiment focuses on differences from other embodiments, and the same and similar parts among the embodiments are referred to each other. The device, the electronic device and the computer-readable storage medium disclosed by the embodiments correspond to the method disclosed by the embodiments, so that the description is simple, and the relevant points can be referred to the description of the method part.
The foregoing describes a method, an apparatus, an electronic device, and a computer-readable storage medium for starting a baseboard management controller according to the present invention. The principles and embodiments of the present invention are explained herein using specific examples, which are presented only to assist in understanding the method and its core concepts. It should be noted that, for those skilled in the art, it is possible to make various improvements and modifications to the present invention without departing from the principle of the present invention, and those improvements and modifications also fall within the scope of the claims of the present invention.
Claims (15)
1. A starting method of a baseboard management controller is characterized by comprising the following steps:
after the substrate management controller is electrified and started, a public key stored in the nonvolatile memory is obtained;
decrypting the digital signature stored in the nonvolatile memory according to the public key to obtain file encryption information;
detecting whether the mirror image file stored in the nonvolatile memory is correct or not according to the file encryption information;
and if so, loading the image file into a memory of the baseboard management controller for operation.
2. The method of claim 1, wherein the detecting whether the image file stored in the non-volatile memory is correct according to the file encryption information comprises:
calculating a digest value corresponding to the image file by using a first preset digest algorithm;
judging whether the digest value is the same as the file encryption information;
and if the image files are the same, executing the step of loading the image files to the memory of the baseboard management controller for operation.
3. The method of claim 1, wherein before obtaining the public key stored in the non-volatile memory, the method further comprises:
loading the credibility measurement code stored in the nonvolatile memory into the memory of the baseboard management controller for running;
and executing the step of obtaining the public key stored in the nonvolatile memory in the running process of the credibility measurement code.
4. The baseboard management controller starting method according to claim 3, wherein the loading the trusted metric code stored in the nonvolatile memory into the memory of the baseboard management controller to be executed includes:
loading the credibility measurement code from a protection area of the nonvolatile memory to a memory of the baseboard management controller for running; wherein the protection region is a programmable region of a read-only mode.
5. The method according to any one of claims 1 to 4, wherein before decrypting the digital signature stored in the nonvolatile memory according to the public key to obtain file encryption information, the method further comprises:
judging whether the public key is correct or not according to preset encryption information stored in the nonvolatile memory; wherein the preset encryption information is stored in a one-time programming area in the non-volatile memory;
and if the public key is correct, executing the step of decrypting the digital signature stored in the nonvolatile memory according to the public key to obtain file encryption information.
6. The method of claim 5, wherein the determining whether the public key is correct according to preset encryption information stored in the non-volatile memory comprises:
calculating a public key abstract value corresponding to the public key by using a second preset abstract algorithm;
judging whether the public key abstract value is the same as the preset encryption information or not;
and if the public key is the same as the encrypted file, determining that the public key is correct, and executing the step of decrypting the digital signature stored in the nonvolatile memory according to the public key to obtain file encrypted information.
7. A startup configuration method of a baseboard management controller is characterized by comprising the following steps:
encrypting a mirror image file of a substrate management controller to obtain file encryption information;
encrypting the file encryption information by using a private key of a preset asymmetric encryption algorithm to generate a digital signature;
and storing the image file, the digital signature and a public key corresponding to the private key into a nonvolatile memory.
8. The method of claim 7, further comprising:
storing trusted metrics code to a protected area of the non-volatile memory; the protection area is a programmable area in a read-only mode, and the credible measurement code is used for verifying the image file.
9. The method for starting configuration of a baseboard management controller according to claim 7 or 8, further comprising:
encrypting the public key to obtain preset encryption information;
writing the preset encryption information to a one-time programming area in the non-volatile memory.
10. The method of claim 9, wherein before writing the predetermined encrypted information to the one-time programming region in the non-volatile memory, the method further comprises:
generating and outputting memory recommendation information according to the size of the preset encryption information; the memory recommendation information comprises nonvolatile memory information, wherein the capacity of a one-time programming area is larger than or equal to the size of the preset encryption information.
11. The method of claim 9, wherein the encrypting the public key to obtain the predetermined encryption information comprises:
and encrypting the public key by using a second preset abstract algorithm to obtain the preset encryption information.
12. An apparatus for activating a baseboard management controller, comprising:
the public key acquisition module is used for acquiring a public key stored in the nonvolatile memory after the baseboard management controller is electrified and started;
the public key decryption module is used for decrypting the digital signature stored in the nonvolatile memory according to the public key to obtain file encryption information;
the mirror image detection module is used for detecting whether the mirror image file stored in the nonvolatile memory is correct or not according to the file encryption information;
and the starting operation module is used for loading the image file into the memory of the substrate management controller to operate if the image file is correct.
13. A startup configuration device of a baseboard management controller is characterized by comprising:
the file encryption module is used for encrypting the mirror image file of the substrate management controller to acquire file encryption information;
the private key encryption module is used for encrypting the file encryption information by using a private key of a preset asymmetric encryption algorithm to generate a digital signature;
and the storage module is used for storing the image file, the digital signature and the public key corresponding to the private key into a nonvolatile memory.
14. An electronic device, comprising:
a memory for storing a computer program;
a processor for implementing the steps of the method for starting up a baseboard management controller according to any one of claims 1 to 6 or the method for starting up a configuration of a baseboard management controller according to any one of claims 7 to 11 when executing the computer program.
15. A computer-readable storage medium, having stored thereon a computer program which, when executed by a processor, implements the steps of the method for starting up a baseboard management controller according to any one of claims 1 to 6 or the method for starting up configuration of a baseboard management controller according to any one of claims 7 to 11.
Priority Applications (1)
| Application Number | Priority Date | Filing Date | Title |
|---|---|---|---|
| CN202210919497.1A CN114995918A (en) | 2022-08-02 | 2022-08-02 | Starting method and configuration method and device of baseboard management controller and electronic equipment |
Applications Claiming Priority (1)
| Application Number | Priority Date | Filing Date | Title |
|---|---|---|---|
| CN202210919497.1A CN114995918A (en) | 2022-08-02 | 2022-08-02 | Starting method and configuration method and device of baseboard management controller and electronic equipment |
Publications (1)
| Publication Number | Publication Date |
|---|---|
| CN114995918A true CN114995918A (en) | 2022-09-02 |
Family
ID=83021633
Family Applications (1)
| Application Number | Title | Priority Date | Filing Date |
|---|---|---|---|
| CN202210919497.1A Pending CN114995918A (en) | 2022-08-02 | 2022-08-02 | Starting method and configuration method and device of baseboard management controller and electronic equipment |
Country Status (1)
| Country | Link |
|---|---|
| CN (1) | CN114995918A (en) |
Cited By (1)
| Publication number | Priority date | Publication date | Assignee | Title |
|---|---|---|---|---|
| CN117170694A (en) * | 2023-09-15 | 2023-12-05 | 合芯科技(苏州)有限公司 | BMC data burning configuration method, device, equipment and medium |
Citations (4)
| Publication number | Priority date | Publication date | Assignee | Title |
|---|---|---|---|---|
| CN112651030A (en) * | 2021-01-14 | 2021-04-13 | 北京工业大学 | Trusted starting method for BMC firmware system security |
| CN113505380A (en) * | 2021-06-11 | 2021-10-15 | 山东云海国创云计算装备产业创新中心有限公司 | BMC (baseboard management controller) safe starting method, device, equipment and medium based on state cryptographic algorithm |
| CN113626803A (en) * | 2021-06-28 | 2021-11-09 | 苏州浪潮智能科技有限公司 | BMC firmware protection method, system and device and readable storage medium |
| CN114329554A (en) * | 2021-12-28 | 2022-04-12 | 苏州浪潮智能科技有限公司 | Method, device, equipment and medium for managing key file of baseboard management controller |
-
2022
- 2022-08-02 CN CN202210919497.1A patent/CN114995918A/en active Pending
Patent Citations (4)
| Publication number | Priority date | Publication date | Assignee | Title |
|---|---|---|---|---|
| CN112651030A (en) * | 2021-01-14 | 2021-04-13 | 北京工业大学 | Trusted starting method for BMC firmware system security |
| CN113505380A (en) * | 2021-06-11 | 2021-10-15 | 山东云海国创云计算装备产业创新中心有限公司 | BMC (baseboard management controller) safe starting method, device, equipment and medium based on state cryptographic algorithm |
| CN113626803A (en) * | 2021-06-28 | 2021-11-09 | 苏州浪潮智能科技有限公司 | BMC firmware protection method, system and device and readable storage medium |
| CN114329554A (en) * | 2021-12-28 | 2022-04-12 | 苏州浪潮智能科技有限公司 | Method, device, equipment and medium for managing key file of baseboard management controller |
Cited By (1)
| Publication number | Priority date | Publication date | Assignee | Title |
|---|---|---|---|---|
| CN117170694A (en) * | 2023-09-15 | 2023-12-05 | 合芯科技(苏州)有限公司 | BMC data burning configuration method, device, equipment and medium |
Similar Documents
| Publication | Publication Date | Title |
|---|---|---|
| US11562075B2 (en) | Secure booting method, apparatus, device for embedded program, and storage medium | |
| KR100792287B1 (en) | Method for security and the security apparatus thereof | |
| KR101393307B1 (en) | Secure boot method and semiconductor memory system for using the method | |
| US20050021968A1 (en) | Method for performing a trusted firmware/bios update | |
| JP5736994B2 (en) | Information processing apparatus, validity verification method, and program | |
| KR102062073B1 (en) | Information processing apparatus and method of controlling the apparatus | |
| US10346179B2 (en) | Information processing apparatus, server apparatus, information processing system, control method, and computer program | |
| CN113434853B (en) | Method for burning firmware to storage device and controller | |
| WO2017133559A1 (en) | Secure boot method and device | |
| CN109445705B (en) | Firmware authentication method and solid state disk | |
| KR102395258B1 (en) | Method of secure booting using route switchover of boot memory bus and apparatus using the same | |
| US20210367781A1 (en) | Method and system for accelerating verification procedure for image file | |
| CN112148314A (en) | Mirror image verification method, device, equipment and storage medium of embedded system | |
| KR101954439B1 (en) | Soc having double security features, and double security method for soc | |
| JP2016146618A (en) | Information processing device | |
| CN109814934B (en) | Data processing method, device, readable medium and system | |
| CN114995918A (en) | Starting method and configuration method and device of baseboard management controller and electronic equipment | |
| JP6930884B2 (en) | BIOS management device, BIOS management system, BIOS management method, and BIOS management program | |
| TWI518539B (en) | Data processing device | |
| KR20210089486A (en) | Apparatus and method for securely managing keys | |
| KR101988404B1 (en) | Soc having double security features, and double security method for soc | |
| CN113761538A (en) | Security boot file configuration method, boot method, device, equipment and medium | |
| CN114065218B (en) | SoC system chip safe starting method | |
| CN114816549B (en) | Method and system for protecting bootloader and environment variable thereof | |
| KR101765209B1 (en) | Apparatus and method for safe booting |
Legal Events
| Date | Code | Title | Description |
|---|---|---|---|
| PB01 | Publication | ||
| PB01 | Publication | ||
| SE01 | Entry into force of request for substantive examination | ||
| SE01 | Entry into force of request for substantive examination | ||
| RJ01 | Rejection of invention patent application after publication | ||
| RJ01 | Rejection of invention patent application after publication |
Application publication date: 20220902 |