TW201426297A - System and method for securing baseboard management controller - Google Patents

Abstract

The present invention provides a system for securing a baseboard management controller (BMC). The system includes an allocation module, an obtaining module, a detection module, and a recovery module. The allocation module allocates a storage area of a storage device of the BMC for storing configuration parameters of the BMC. The obtaining module obtains the configuration parameters of the BMC and stores the configuration parameters into the storage area when the BMC is running a firmware program. The detection module detects whether processes run in the BMC work normally. The recovery module reads the configuration parameters of the BMC from the storage area when any of the processes work abnormally, modifies the firmware program, and runs the modified firmware program. A related method is also disclosed.

Description

Substrate management controller security protection system and method

The invention relates to a computer security protection system and method, in particular to a substrate management controller security protection system and method.

In a computing device (such as a server), the baseboard management controller is responsible for monitoring the operating state of each hardware of the computing device (such as the speed of the fan, the temperature of the CPU, the voltage of the CPU, etc.), and reporting the abnormality to the abnormality when an abnormality occurs. user. However, the substrate management controller itself may also have an abnormality. If the substrate management controller is abnormal, the operating status of each hardware of the computing device cannot be monitored.

In view of the above, it is necessary to provide a substrate management controller security protection system and method, which can ensure the normal operation of the substrate management controller.

A substrate management controller security protection system, running in a substrate management controller, the substrate management controller includes a storage device, wherein the storage device stores a firmware program, and the system includes: a partitioning module for storing in the storage A parameter storage area is defined in the device, where the parameter storage area is used for storing configuration parameters of the baseboard management controller; and an acquisition module is configured to acquire configuration parameters of the baseboard management controller in a process of the baseboard management controller running the firmware program And storing the obtained configuration parameters to the parameter storage area; the detecting module is configured to detect the running status of each process in the baseboard management controller; and the recovery module is configured to be used in the baseboard management control When an abnormality occurs in the process of the device, the configuration parameters of the baseboard management controller are read from the parameter storage area, the firmware program is modified according to the read configuration parameters, and the modified firmware program is started.

A substrate management controller security protection method is applied to a substrate management controller, wherein the substrate management controller includes a storage device, wherein the storage device stores a firmware program, and the method includes the steps of: dividing parameter storage in the storage device a parameter storage area for storing configuration parameters of the baseboard management controller; acquiring configuration parameters of the baseboard management controller during operation of the firmware management program by the baseboard management controller, and storing the acquired configuration parameters to the a parameter storage area; detecting an operation status of each process in the baseboard management controller; and reading, when the process of the baseboard management controller is abnormal, reading configuration parameters of the baseboard management controller from the parameter storage area, Modify the firmware program according to the read configuration parameters and start the modified firmware program.

The invention divides the configuration parameters of the special storage area storage substrate management controller, and restores the firmware program of the substrate management controller according to the stored configuration parameters when the substrate management controller is abnormal, thereby ensuring the normal operation of the substrate management controller.

Referring to FIG. 1 , it is a schematic diagram of an operating environment of a substrate management controller security protection system of the present invention. The baseboard management controller security protection system 100 operates in the baseboard management controller 10 of the computing device 1. The baseboard management controller 10 further includes a firmware program 101, a storage device 102, and a processor 103. The storage device 102 stores the code of the baseboard management controller security protection system 100 and the firmware program 101. The processor 103 executes the code of the substrate management controller security protection system 100 and the firmware program 101 to ensure normal operation of the substrate management controller 10. In this embodiment, the storage device 102 is a flash memory.

Referring to FIG. 2, it is a functional module diagram of the substrate management controller security protection system in FIG. The baseboard management controller security protection system 100 includes a partitioning module 1000, an obtaining module 1001, a detecting module 1002, and a recovery module 1003.

The partitioning module 1000 is configured to divide a parameter storage area in the storage device 102 for storing configuration parameters of the baseboard management controller 10. In this embodiment, the configuration parameters include boot loader environment parameters, operating system kernel environment parameters, root file system mapping environment parameters, and IPMI (Intelligent Platform Management Interface) application parameters. In this embodiment, the partitioning module 1000 also sets the read and write permissions of the parameter storage area. For example, the parameter storage area is set to allow only the acquisition module 1001 to write data, and only the recovery module 1003 is allowed to read data.

The acquiring module 1001 is configured to acquire configuration parameters of the substrate management controller 10 during the execution of the firmware program 101 by the substrate management controller 10, and store the acquired configuration parameters into the parameter storage area. In this embodiment, the acquisition module 1001 acquires the configuration parameters of the substrate management controller 10 at a specified time interval (eg, once per hour), and stores the acquired configuration parameters into the parameter storage area and replaces the original configuration parameters.

The detection module 1002 is configured to detect the running status of each process in the baseboard management controller 10. In this embodiment, the process of the baseboard management controller 10 includes a storage device driver process, a storage device read/write management process, a memory recovery process, a user login process, a firmware update process, a web server process, and an IPMI (Intelligent Platform). Management Interface, intelligent platform management interface) management process, system event alert process, etc.

The recovery module 1003 is configured to read the configuration parameters of the substrate management controller 10 from the parameter storage area when an abnormality occurs in the process of the substrate management controller 10 running. For example, if the IPMI management process is abnormal, the recovery module 1003 reads the configuration parameters of the baseboard management controller 10 from the parameter storage area.

The recovery module 1003 is further configured to modify the firmware program 101 according to the read configuration parameters of the baseboard management controller 10 and start the modified firmware program 101, so that the baseboard management controller 10 resumes normal operation. For example, if the IPMI application of the baseboard management controller 10 changes and the IPMI application parameters change, the firmware program 101 is modified based on the changed IPMI application parameters and the modified firmware program 101 is started.

Referring to FIG. 3, it is a flow chart of a preferred embodiment of the substrate management controller security protection method of the present invention.

In step S301, the partitioning module 1000 divides a parameter storage area in the storage device 102 for storing configuration parameters of the baseboard management controller 10. In this embodiment, the configuration parameters include boot loader environment parameters, operating system kernel environment parameters, root file system mapping environment parameters, and IPMI (Intelligent Platform Management Interface) application parameters. In this embodiment, the partitioning module 1000 also sets the read and write permissions of the parameter storage area. For example, the parameter storage area is set to allow only the acquisition module 1001 to write data, and only the recovery module 1003 is allowed to read data.

In step S302, the acquisition module 1001 acquires the configuration parameters of the substrate management controller 10 during the execution of the firmware program 101 by the substrate management controller 10, and stores the acquired configuration parameters into the parameter storage area. In this embodiment, the acquisition module 1001 acquires the configuration parameters of the substrate management controller 10 at a specified time interval (eg, once per hour), and stores the acquired configuration parameters into the parameter storage area and replaces the original configuration parameters.

In step S303, the detecting module 1002 detects the running status of each process in the baseboard management controller 10. If each process in the substrate management controller 10 is operating normally, the detection module 1002 repeatedly performs the detection action. In this embodiment, the process of the baseboard management controller 10 includes a storage device driver process, a storage device read/write management process, a memory recovery process, a user login process, a firmware update process, a web server process, and an IPMI (Intelligent Platform). Management Interface, intelligent platform management interface) management process, system event alert process, etc.

If the detection module 1002 detects that the process of the substrate management controller 10 is abnormal, the recovery module 1003 reads the configuration parameters of the substrate management controller 10 from the parameter storage area in step S304. For example, if the IPMI management process is abnormal, the recovery module 1003 reads the configuration parameters of the baseboard management controller 10 from the parameter storage area.

In step S305, the recovery module 1003 modifies the firmware program 101 according to the configuration parameters of the read substrate management controller 10. For example, if the IPMI application of the baseboard management controller 10 changes, the IPMI application parameters change, and the firmware program 101 is modified based on the changed IPMI application parameters.

In step S306, the recovery module 1003 starts the modified firmware program 101, so that the substrate management controller 10 resumes normal operation.

In summary, the present invention complies with the requirements of the invention patent and submits a patent application according to law. However, the above description is only a preferred embodiment of the present invention, and the scope of the present invention is not limited to the above-described embodiments, and equivalent modifications or variations made by those skilled in the art in accordance with the spirit of the present invention are It should be covered by the following patent application.

1. . . Computing device

10. . . Baseboard management controller

100. . . Baseboard management controller security protection system

101. . . Firmware program

102. . . Storage device

103. . . processor

1000. . . Partition module

1001. . . Get module

1002. . . Detection module

1003. . . Recovery module

1 is a schematic diagram of an operating environment of a substrate management controller security protection system of the present invention.

2 is a functional block diagram of the substrate management controller security protection system of FIG. 1.

3 is a flow chart of a preferred embodiment of the substrate management controller security protection method of the present invention.

100. . . Baseboard management controller security protection system

1000. . . Partition module

1001. . . Get module

1002. . . Detection module

1003. . . Recovery module

Claims (8)

A substrate management controller security protection system runs in a baseboard management controller, the baseboard management controller includes a storage device, and the storage device stores a firmware program, and the system includes:
a dividing module, configured to divide a parameter storage area in the storage device, where the parameter storage area is used to store configuration parameters of the baseboard management controller;
Obtaining a module, configured to acquire configuration parameters of the baseboard management controller during a process of running the firmware program by the baseboard management controller, and store the acquired configuration parameters into the parameter storage area;
a detection module, configured to detect an operation status of each process in the baseboard management controller; and a recovery module, configured to read from the parameter storage area when an abnormality occurs in a process of the baseboard management controller The baseboard manages the configuration parameters of the controller, modifies the firmware program according to the read configuration parameters, and starts the modified firmware program. The substrate management controller security protection system according to claim 1, wherein the configuration parameters include a boot loader environment parameter, an operating system kernel environment parameter, a root file system mapping environment parameter, and a smart platform management interface application parameter. . The substrate management controller security protection system of claim 1, wherein the division module is further configured to set a read/write permission of the parameter storage area. The substrate management controller security protection system of claim 1, wherein the acquisition module acquires configuration parameters of the baseboard management controller at specified time intervals. A substrate management controller security protection method is applied to a substrate management controller. The substrate management controller includes a storage device, and the storage device stores a firmware program. The method includes the following steps:
Dividing a parameter storage area in the storage device, the parameter storage area is configured to store configuration parameters of the baseboard management controller;
Acquiring configuration parameters of the baseboard management controller in a process of running the firmware program by the baseboard management controller, and storing the acquired configuration parameters into the parameter storage area;
Detecting an operation status of each process in the baseboard management controller; and when an abnormality occurs in a process of the baseboard management controller, reading configuration parameters of the baseboard management controller from the parameter storage area, according to the read The configuration parameters modify the firmware program and launch the modified firmware program. The substrate management controller security protection method according to claim 5, wherein the configuration parameters include a boot loader environment parameter, an operating system kernel environment parameter, a root file system mapping environment parameter, and a smart platform management interface application parameter. . The method for securing a substrate management controller according to claim 5, wherein the method further comprises:
Set the read and write permissions of the parameter storage area. The substrate management controller security protection method according to claim 5, wherein the configuration parameters of the baseboard management controller are acquired at specified time intervals.