TWI726406B - Authentication method - Google Patents

Abstract

An authentication method is implemented by a host unit of a computer system. The computer system further includes a baseboard management controller (BMC). The authentication method includes steps of: the host unit sending to BMC a request for BMC signature; the host unit receiving BMC signature data from the BMC; the host unit determining whether the received BMC signature data is authentic based on a BMC public key stored in the host unit and the received BMC signature data; and the host unit allowing the BMC to access the host unit when it is determined that the BMC signature data is authentic.

Description

Authentication method

The present invention relates to an authentication method, in particular to an authentication method used in a substrate management control system.

Existing computer systems usually include a baseboard management controller system (BMC) to monitor the operating status of the computer system. Among them, the BMC can monitor the sensors set on the computer system. Whether the value is abnormal, and record the abnormal state, through the BMC can also control the computer system reset and issue power restart. In some computer systems, the system firmware, such as BIOS or U-Boot, can also be updated through the BMC. The security issue of BMC is getting more and more attention. If hackers use BMC to attack the computer system to tamper with the firmware running on the computer system, the computer system will be exposed to great risks and threats. On the other hand, although the motherboard in the computer system is booted, there is a Secure Boot (Secure Boot) security mechanism in the Unified Extensible Firmware Interface (UEFI). The board hardware manufacturer pre-loads a set of certificates in the motherboard to identify whether the booted operating system is trustworthy. If it is not, it cannot be booted. However, this security mechanism can only identify whether the operating system is trustworthy. Security protection is quite limited. If the computer system is attacked by hackers, not only the security of the computer system is worrying, but the BMC may also suffer. Therefore, how to improve the security of the computer system is an urgent issue to be solved.

Therefore, an object of the present invention is to provide an authentication method that improves the security of a computer system.

Therefore, the authentication method of the present invention is suitable for authenticating a baseboard management controller included in a computer system, and is implemented by a host unit included in the computer system that is electrically connected to the baseboard management controller, and the host unit stores a Related to the reference board-side public key of a specific board management controller, the authentication method includes the following steps:

(A) The host unit transmits a substrate end signature request related to the baseboard management controller to the baseboard management controller;

(B) After the host unit obtains the substrate-side signature data from the substrate management controller in response to the substrate-side signature request, the host unit authenticates the substrate based on the reference substrate-side public key and the substrate-side signature data Whether the baseboard management controller is the specific baseboard management controller; and

(C) When the host unit authenticates that the baseboard management controller is the specific baseboard management controller, the host unit allows the baseboard management controller to access the host unit.

Another object of the present invention is to provide an authentication method that improves the security of the computer system.

Therefore, the authentication method of the present invention is suitable for authenticating a host unit included in a computer system, and is implemented by a baseboard management controller included in the computer system that is electrically connected to the host unit, and the baseboard management controller stores a Related to the reference host public key of a specific host, the authentication method includes the following steps:

(A) The baseboard management controller transmits a host-side signature request related to the host unit to the host unit;

(B) After the baseboard management controller obtains the host-side signature data from the host unit in response to the host-side signature request, the baseboard management controller uses the reference host-side public key and the host-side signature data, Authenticate whether the host unit is the specific host; and

(C) When the baseboard management controller authenticates whether the host unit is the specific host end, the baseboard management controller allows the host unit to access the baseboard management controller.

The effect of the present invention is that the host unit authenticates whether the baseboard management controller is the specific baseboard management controller according to the reference substrate end public key and the substrate end signature data, and the host unit successfully authenticates the substrate After the controller is managed, the host unit allows the baseboard management controller to access the host unit, thereby improving the security of the communication between the baseboard management controller and the host unit, thereby enhancing the security of the computer system.

Referring to FIG. 1, an embodiment of the authentication method of the present invention is implemented by a computer system 1 which includes a host unit 2 and a baseboard management controller 3 electrically connected to the host unit 2.

The host unit 2 includes a processing module 21, a storage module 22 electrically connected to the processing module 21, and a storage module 22 controlled by the processing module 21 for controlling the storage module 22 and the baseboard management controller A switch 23 with 3 write permissions. The storage module 22 stores a reference board-side public key 222 related to a specific board management controller, a basic input output system program 223 run by the processing module 21, and A host-side digital signature 224 related to a part of the basic input/output system program 223 (Basic Input/Output System, referred to as BIOS) run by the host unit 2 Part of the program fragments perform the same hash operation of the MD5 message digest algorithm to obtain a check code, and the check code is obtained through a host-side private key encryption. The processing module 21 may be, for example, a central processing unit (Center Processing Unit, CPU for short), and the storage module 22 may be, for example, a BIOS chip. In this embodiment, the host-side digital signature 224 is obtained by encrypting the part of the program fragment that has been hashed; however, in other embodiments, the part of the program fragment may be combined with the BIOS label. At least one of the header, the signature of the BIOS vendor, the BIOS version, the size of the BIOS, and the memory address related to the part of the program fragment performs the hash operation to obtain the corresponding check code, and then the obtained The check code is encrypted with the host-side private key (not shown) to obtain the host-side digital signature 224, and it is not limited to this.

The baseboard management controller 3 includes a processing unit 31, a storage unit 32 electrically connected to the processing unit 31, and a storage unit 32 controlled by the processing unit 31 for controlling the writing between the storage unit 32 and the host unit 2 Permission switch 33. The storage unit 32 stores a reference host-side public key 321 related to a specific host-side, a firmware 322 run by the processing unit 31, and a partial firmware fragment of the firmware 322 run by the baseboard management controller 3 A related board-side digital signature 323, the board-side digital signature 323 is obtained by performing the hash operation of the part of the firmware segment, such as the MD5 message digest algorithm, to obtain another check code. The check code is obtained through encryption with a board-side private key (not shown). In this embodiment, the substrate-side digital signature 323 is obtained by encrypting the part of the firmware segment that has been hashed; however, in other embodiments, the part of the firmware segment can also be combined with At least one of the firmware header, the signature of the firmware vendor, the firmware version, the firmware size, and the memory address related to the part of the firmware segment performs the hash operation to obtain the corresponding check code, and then, Encrypting the obtained check code through the substrate-side private key to obtain the substrate-side digital signature 323 is not limited to this.

1, 2 and 4, the embodiment of the authentication method of the present invention is implemented by the host unit 2 and the baseboard management controller 3 executing the corresponding basic input output system program 223 and firmware 322, and includes The following steps.

In step 201, the processing module 21 of the host unit 2 transmits a substrate end signature request related to the substrate management controller 3 to the substrate management controller 3.

In step 202, after the processing unit 31 of the substrate management controller 3 receives the substrate-side signature request, the processing unit 31 of the substrate management controller 3 responds to the substrate-side signature request according to the storage The substrate-side digital signature 323 and firmware 322 of the unit 32 generate the substrate-side signature data including the substrate-side digital signature 323 and a substrate-side plaintext data related to the part of the firmware segment, and transmit the substrate End signature data to the host unit 2. It is worth mentioning that, in this embodiment, since the check code corresponding to the digital signature 323 on the substrate side is obtained based on the part of the firmware segment, the plaintext data on the substrate side only includes the part of the firmware segment; however, , The check code corresponding to the digital signature 323 on the board end is based on the part of the firmware segment, and the signature of the firmware supplier, the firmware version, the firmware size, and the memory location related to the part of the firmware segment In the case of obtaining at least one of the address, the plaintext data of the board end must include the signature of the firmware supplier, the firmware version, the firmware size, and the related part in addition to the part of the firmware fragment. At least one of the memory addresses of the firmware segment. In addition, in this embodiment, the processing unit 31 of the baseboard management controller 3 transmits the baseboard end signature data to the host unit 2 through an Intelligent Platform Management Interface (IPMI).

In step 203, the processing module 21 of the host unit 2 determines whether the substrate-side signature data in response to the substrate-side signature request is received within a first predetermined time interval. When the processing module 21 of the host unit 2 determines that the substrate end signature data is not received within the first predetermined time interval, the processing module 21 of the host unit 2 returns to step 201; When the processing module 21 determines that the substrate end signature data is received within the first predetermined time interval, the processing module 21 of the host unit 2 proceeds to step 204.

In step 204, after the processing module 21 of the host unit 2 obtains the substrate-side signature data in response to the substrate-side signature request, the processing module 21 of the host unit 2 uses the reference substrate-side public key 222 and The substrate end signature data verifies whether the substrate management controller 3 is the specific substrate management controller. When the processing module 21 of the host unit 2 authenticates that the baseboard management controller 3 is not the specific baseboard management controller, the process proceeds to step 205; when the processing module 21 of the host unit 2 authenticates the baseboard management controller When 3 is the specific baseboard management controller 3, the flow proceeds to step 206.

In step 205, the processing module 21 of the host unit 2 controls the switch 23 of the host unit 2 to be turned off, so as to prevent the baseboard management controller 3 from writing to the storage module 22 of the host unit 2.

In step 206, the processing module 21 of the host unit 2 controls the switch 23 of the host unit 2 to be turned on to allow the baseboard management controller 3 to write to the storage module 22 of the host unit 2 and send an authentication Successfully notify the baseboard management controller 3. In other embodiments, the host unit 2 not only allows the baseboard management controller 3 to write to the storage module 22 of the host unit 2, but also allows the baseboard management controller 3 to control the host unit 2, and the host unit 2 can also respond to an operation request of the baseboard management controller 3 to perform an operation related to the operation request, that is, respond to the operation request of the baseboard management controller 3 to include, for example, provide information about the computer system 1 Give the baseboard management controller 3, or restart the operation of the host unit 2, etc.

1 and 3, it is worth mentioning that step 204 includes the following sub-steps.

In sub-step 241, the processing module 21 of the host unit 2 performs the hash operation according to the plaintext data on the substrate side to obtain a check code data, and decrypts the substrate side digital signature 323 with the reference substrate side public key 222 Obtain a check code to be compared.

In sub-step 242, the processing module 21 of the host unit 2 determines whether the check code data matches the check code to be compared to verify whether the baseboard management controller 3 is the specific baseboard management controller 3. When the processing module 21 of the host unit 2 determines that the check code data does not match the check code to be compared, the baseboard management controller 3 is authenticated as not the specific baseboard management controller 3; when the host unit 2 When the processing module 21 determines that the check code data matches the check code to be compared, the baseboard management controller 3 is authenticated as the specific baseboard management controller 3.

Continuing to refer to FIGS. 1, 2 and 4, in step 207, the processing unit 31 of the baseboard management controller 3 determines whether an authentication success notification from the host unit 2 is received within a second predetermined time interval. When the processing unit 31 of the substrate management controller 3 determines that the authentication success notification is not received within the second predetermined time interval, the processing unit 31 of the substrate management controller 3 proceeds to step 208; when the substrate management controller 3 When the processing unit 31 determines that the authentication success notification is received within the second predetermined time interval, the processing unit 31 of the baseboard management controller 3 proceeds to step 209.

In step 208, the processing unit 31 of the substrate management controller 3 waits to receive the substrate-side signature request again, and returns to step 202 after receiving the substrate-side signature request.

In step 209, the processing unit 31 of the baseboard management controller 3 transmits a host-side signature request related to the host unit 2 to the host unit 2.

In step 210, the processing module 21 of the host unit 2 determines whether the host side signature request from the baseboard management controller 3 is received within a third predetermined time interval. When the processing module 21 of the host unit 2 determines that the host end signature request is not received within the third predetermined time interval, the processing module 21 of the host unit 2 returns to step 201; When the processing module 21 determines that the host side signature request is received within the third predetermined time interval, the processing module 21 of the host unit 2 proceeds to step 211.

In step 211, after the processing module 21 of the host unit 2 receives the host-side signing request, the processing module 21 of the host unit 2 responds to the host-side signing request according to the data stored in the storage module 22 host-side digital signature 224 and basic input output system program 223, generate the host-side signature data including the host-side digital signature 224 and a host-side plaintext data related to the part of the program fragment, and send the The host side signs the data to the baseboard management controller 3. It is worth mentioning that in this embodiment, since the check code corresponding to the host-side digital signature 224 is obtained based on the part of the program fragment, the host-side plaintext data only includes the part of the program fragment; however, The check code corresponding to the host-side digital signature 224 is obtained based on the part of the program fragment, and at least one of the BIOS vendor's signature, BIOS version, BIOS size, and the memory address related to the part of the program fragment In the case of, in addition to the part of the program fragment, the host-side plaintext data must also include at least one of the signature with the BIOS vendor, the BIOS version, the BIOS size, and the memory address related to the part of the program fragment. In addition, in this embodiment, the processing module 21 of the host unit 2 transmits the host-side signature data to the baseboard management controller 3 through an Intelligent Platform Management Interface (IPMI).

In step 212, the processing unit 31 of the baseboard management controller 3 determines whether the host side signature data from the host unit 2 is received within a fourth predetermined time interval. When the processing unit 31 of the substrate management controller 3 determines that the host side signature data is not received within the fourth predetermined time interval, the processing unit 31 of the substrate management controller 3 returns to step 209; when the substrate management When the processing unit 31 of the controller 3 determines that the host-side signature data is received within the fourth predetermined time interval, the processing unit 31 of the baseboard management controller 3 proceeds to step 213.

In step 213, after the processing unit 31 of the baseboard management controller 3 obtains the host-side signature data in response to the host-side signature request, the processing unit 31 of the baseboard management controller 3 according to the reference host-side public key 321 and the host side signature data to verify whether the host unit 2 is the specific host side. When the processing unit 31 of the baseboard management controller 3 authenticates that the host unit 2 is not the specific host, the process proceeds to step 214; when the processing unit 31 of the baseboard management controller 3 authenticates that the host unit 2 is the specific host On the host side, the process proceeds to step 215.

In step 214, the processing unit 31 of the baseboard management controller 3 controls the switch 23 of the baseboard management controller 3 to be turned off, so as to prevent the host unit 2 from writing to the storage unit 32 of the baseboard management controller 3.

In step 215, the processing unit 31 of the baseboard management controller 3 controls the switch 23 of the baseboard management controller 3 to be turned on to allow the host unit 2 to write to the storage unit 32 of the baseboard management controller 3 and transmit The host unit 2 is notified of another successful authentication. In other embodiments, the baseboard management controller 3 not only allows the host unit 2 to write to the storage unit 32 of the baseboard management controller 3, but also allows the host unit 2 to receive data requests to report back to the host unit 2 Related data, and allow the host unit 2 to update the firmware 322 stored in the storage unit 32 of the baseboard management controller 3, and the baseboard management controller 3 can also respond to an operation request of the host unit 2 to perform related The operation of the operation request, that is, in response to the operation request of the host unit 2 to perform operations including, for example, obtaining a file from an external storage module, or restarting the baseboard management controller 3, etc.

1 and 5, it is worth mentioning that step 213 includes the following sub-steps.

In sub-step 231, the processing unit 31 of the baseboard management controller 3 performs the hash operation according to the host-side plaintext data to obtain another check code data, and decrypts the host-side digital signature through the reference host-side public key 321 224 to obtain another check code to be compared.

In sub-step 232, the processing unit 31 of the baseboard management controller 3 determines whether the other check code data matches the other check code to be compared to verify whether the baseboard management controller 3 is the specific baseboard management control器3. When the processing unit 31 of the baseboard management controller 3 determines that the other check code data does not match the other check code to be compared, the host unit 2 is authenticated as not the specific host; when the baseboard management controls When the processing unit 31 of the device 3 determines that the other check code data matches the other check code to be compared, the host unit 2 is authenticated as the specific host.

Continuing to refer to FIGS. 1, 2 and 4, in step 216, the processing module 21 of the host unit 2 determines whether another successful authentication from the baseboard management controller 3 is received within a fifth predetermined time interval Notice. When the processing module 21 of the host unit 2 determines that the another authentication success notification is not received within the fifth predetermined time interval, the processing module 21 of the host unit 2 proceeds to step 217; when the host unit 2 processes When the module 21 determines that the another authentication success notification is received within the fifth predetermined time interval, the bidirectional authentication of the baseboard management controller 3 and the host unit 2 is successful.

It is worth mentioning that in this embodiment, when the baseboard management controller 3 and the host unit 2 successfully authenticate each other, it means that the reference baseboard-side public key 222 and the baseboard-side private key are a set of mutual keys. Pair (Key Pair), and the reference host-side public key 321 and the host-side private key are also a set of key pairs (Key Pair), where the reference board-side public key 222, the board-side private key, the Refer to the host-side public key 321, the host-side private key, the board-side digital signature 323, and the host-side digital signature 224. All of them are used by a trusted third-party certification authority using a hardware security module (Hardware security module, (Referred to as HSM), the board-side private key and the host-side private key are kept by the third-party certification authority and not disclosed to the public.

In step 217, the processing module 21 of the host unit 2 waits to receive the host-side signature request again, and returns to step 211 after receiving the host-side signature request.

It is worth mentioning that, whenever the computer system 1 is turned on for the first time and the host unit 2 is restarted, the embodiment of the authentication method of the present invention will be executed again.

In summary, the authentication method of the present invention uses the host unit 2 and the baseboard management controller 3 to mutually authenticate each other, and only allows the baseboard management controller 3 to be authenticated by the host unit 2 successfully. 3 Access the host unit 2. Similarly, the host unit 2 is allowed to access the baseboard management controller 3 only after the host unit 2 is successfully authenticated by the baseboard management controller 3, thereby improving the baseboard management control The security of the communication between the device 3 and the host unit 2 further enhances the security of the computer system 1, so it can indeed achieve the purpose of the invention.

However, the above are only examples of the present invention. When the scope of implementation of the present invention cannot be limited by this, all simple equivalent changes and modifications made in accordance with the scope of the patent application of the present invention and the content of the patent specification still belong to Within the scope covered by the patent of the present invention.

1········Computer System 2········ Main unit 21·······Processing Module 22······· Storage Module 222····· Reference board public key 223·····Basic Input Output System Program 224····· Host-side digital signature 23······· Switch 3········ Baseboard Management Controller 31·······Processing Unit 32······· Storage Unit 321····· Refer to the host-side public key 322····· Firmware 323····· Digital Signature on Board Side 33······· Switch 201~217 steps 231~232 sub-step 241~242 sub-steps To

Other features and effects of the present invention will be clearly presented in the embodiments with reference to the drawings, in which: Figure 1 is a block diagram illustrating a computer system implementing an embodiment of the authentication method of the present invention; Figure 2 is a flowchart illustrating a baseboard management controller authentication procedure of an embodiment of the authentication method of the present invention Figure 3 is a flowchart illustrating the detailed process of how a host unit authenticates a baseboard management controller; FIG. 4 is a flowchart illustrating a host unit authentication procedure of an embodiment of the authentication method of the present invention; and Fig. 5 is a flowchart illustrating the detailed process of how the baseboard management controller authenticates the host unit.

201~209····Steps

Claims (12)

An authentication method is suitable for authenticating a baseboard management controller included in a computer system, and is implemented by a host unit included in the computer system that is electrically connected to the baseboard management controller, and the baseboard management controller stores a related A reference host-side public key at a specific host side, the host unit stores a reference board-side public key related to a specific baseboard management controller, the authentication method includes the following steps: (A) the host unit transmits a reference board-side public key related to the board The board end signing request of the management controller is sent to the board management controller; (B) After the host unit obtains the board end signing data in response to the board end signing request, the host unit according to the reference board end public key And the baseboard end signature data to verify whether the baseboard management controller is the specific baseboard management controller; (C) when the host unit authenticates that the baseboard management controller is the specific baseboard management controller, the host unit Send an authentication success notification to the baseboard management controller and allow the baseboard management controller to access the host unit; (D) receive a host end signature from the baseboard management controller and related to the host unit in the host unit After the chapter request, the host unit sends the host-side signature data to the baseboard management controller in response to the host-side signature request, so that the baseboard management controller authenticates according to the reference host-side public key and the host-side signature data Whether the host unit is the specific host; and (E) receiving a message from the baseboard management controller in the host unit After the authentication success notification, the host unit can access the baseboard management controller. The authentication method according to claim 1, wherein step (B) includes the following sub-steps: (B-1) the board end signature data includes a part of the firmware segment related to the firmware run by the board management controller A digital signature of the substrate end of the, and a plaintext data of the substrate end related to the part of the firmware segment. The digital signature of the substrate end is obtained by performing a hash operation on the part of the firmware segment to obtain a check code. The check code is obtained by encrypting with a board-side private key. The host unit performs the hash operation based on the board-side plaintext data to obtain a check code data, and decrypts the board-side digital signature with the reference board-side public key. Obtain a check code to be compared; (B-2) The host unit verifies whether the baseboard management controller is the specific baseboard management controller by determining whether the check code data matches the check code to be compared. According to the authentication method of claim 1, the host unit includes a processing module, a storage module electrically connected to the processing module, and a storage module controlled by the processing module for controlling the storage module and the The switch of the write permission between the baseboard management controllers, the storage module also stores a basic input output system program, wherein, in this step (C), when the host unit authenticates the baseboard management controller as the specific When the baseboard management controller is used, the processing module of the host unit controls the switch to be turned on to allow the baseboard management controller to write to the storage module. In the authentication method described in claim 1, in step (D), the host signs The chapter data includes a host-side digital signature related to a part of the program segment of the basic input output system program run by the host unit, and a host-side plaintext data related to the part of the program segment, and the host-side digital signature is borrowed A check code is obtained by performing a hash operation on the partial program fragments, and the check code is obtained by encrypting the check code with a host-side private key. According to the authentication method of claim 1, the baseboard management controller includes a storage unit storing a firmware run by the baseboard management controller, and a storage unit controlled by the baseboard management controller for controlling the storage unit Switching the write authority between the host unit and the host unit, wherein, in the step (E), after the host unit receives the authentication success notification from the baseboard management controller, the host unit can pass through the turned-on The other switch writes to the storage unit. The authentication method as described in claim 1, after step (C), further includes the following steps: (F) the host unit determines whether the host-side signature request is received within a predetermined time; and (G) when the When the host unit determines that it has not received the host-side signature request within the predetermined time, the host unit returns to step (A); wherein, when the host unit determines that the host-side signature request has been received within the predetermined time When signing the request, proceed to step (D). An authentication method is suitable for authenticating a host unit included in a computer system, and is implemented by a substrate management controller included in the computer system that is electrically connected to the host unit, and the host unit stores a specific substrate related to The reference baseboard end public key of the management controller, the baseboard management controller stores There is a reference host-side public key related to a specific host-side, and the authentication method includes the following steps: (A) the baseboard management controller receives a baseboard-side signature from the host unit and related to the baseboard management controller After the request, the baseboard management controller transmits the baseboard end signature data to the host unit in response to the baseboard end signature request, so that the host unit authenticates the baseboard management based on the reference baseboard end public key and the baseboard end seal data Whether the controller is the specific baseboard management controller; (B) After the baseboard management controller receives an authentication success notification from the host unit, the baseboard management controller is allowed to access the host unit and send a related The host-side signing request of the host unit is sent to the host unit; (C) after the baseboard management controller obtains the host-side signing data in response to the host-side signing request, the baseboard management controller according to the reference host End public key and the host end signature data to verify whether the host unit is the specific host end; and (D) when the baseboard management controller authenticates that the host unit is the specific host end, the baseboard management control The device allows the host unit to access the baseboard management controller. The authentication method according to claim 7, wherein (C-1) the host-side signature data includes a host-side digital signature related to a part of the basic input output system program run by the host unit, and A host-side plaintext data related to the part of the program fragment. The host-side digital signature is used to perform a miscellaneous operation of the part of the program fragment. A check code is obtained through a summing operation, and the check code is obtained by encrypting a host-side private key. The baseboard management controller performs the hash operation according to the host-side plaintext data to obtain a check code data, and passes the reference The host-side public key decrypts the host-side digital signature to obtain a check code to be compared; (C-2) The baseboard management controller verifies the check code by determining whether the check code data matches the check code to be compared Whether the host unit is the specific host. The authentication method according to claim 7, wherein the baseboard management controller includes a storage unit storing a firmware run by the baseboard management controller, and a storage unit controlled by the baseboard management controller for controlling the The switch of the write authority between the storage unit and the host unit, wherein, in the step (D), when the baseboard management controller authenticates that the host unit is the specific host, the baseboard management controller controls the The switch is turned on to allow the host unit to write to the storage unit. According to the authentication method of claim 7, the host unit includes a processing module, a storage module electrically connected to the processing module, and a storage module controlled by the processing module for controlling the storage module and the Switching of the write authority between the baseboard management controllers, wherein, in the step (B), after the baseboard management controller receives the authentication success notification from the host unit, the baseboard management controller can be turned on The switch for writing to the storage module. According to the authentication method of claim 7, in step (A), the board-side signature data includes a board-side digital signature related to a part of the firmware segment of the firmware run by the board management controller, and Corresponding to this part of the firmware segment A board-side plaintext data related to the board-side digital signature is obtained by performing a hash operation on the part of the firmware segment to obtain a check code, and the check code is obtained by encrypting the board-side private key. The authentication method according to claim 7, after step (B), further includes the following steps: (E) the baseboard management controller determines whether the host side signature data is received within another predetermined time; and (F ) When the baseboard management controller determines that the host side signature data has not been received within another predetermined time, the baseboard management controller returns to step (B); wherein, when the baseboard management controller determines When the host side signature data is received within the other predetermined time, step (C) is performed.

Images