TWI822531B - Firmware protection system and method - Google Patents

Abstract

A firmware protection method includes: receiving a firmware update file by a baseboard management controller (BMC), generating a first hash according to the firmware update file and retrieving a digital signature from the firmware update file by the BMC, transmitting the first has and the digital signature to a security processor by the BMC, decoding the digital signature to obtain a second hash based on a pre-stored key by the security processor, determining whether the first hash is the same as the second hash by the security processor, outputting an update notification to the BMC by the security processor when the first hash is the same as the second hash, and outputting the firmware update file to a flash memory according to the update notification by the BMC.

Description

Firmware protection system and method

The invention relates to a firmware protection system and method.

The server includes a baseboard management controller (BMC), which reads firmware files from the storage device for execution. Generally speaking, the number of storage devices of the baseboard management controller is two, one is used to store the firmware files that are usually executed, and the other is used to store the factory firmware files.

When the firmware file is updated and there is a problem with the updated firmware file, although the system can use the factory firmware file to restore the problematic firmware file, this often takes tens of minutes. , causing the system to suspend operation during this period.

In view of the above, the present invention provides a device that meets the above needs.

A firmware protection method according to an embodiment of the present invention includes: using a baseboard management controller to receive a firmware update file; using the baseboard management controller to generate a first hash value based on the firmware update file and retrieving a digital signature from the firmware update file. The baseboard management controller transmits the first hash value and the digital signature to the security processor; the security processor decrypts the digital signature based on the pre-stored key to obtain the second hash value; the security processor determines the difference between the first hash value and the digital signature. Whether the second hash value is the same; when the first hash value and the second hash value are the same, the security processor outputs an update notification to the baseboard management controller; and the baseboard management controller outputs the firmware update file to the baseboard management controller according to the update notification. Flash memory.

A firmware protection system according to an embodiment of the present invention includes: a flash memory, a baseboard management controller and a security processor. The baseboard management controller is connected to the flash memory. The baseboard management controller is used to receive a firmware update file, generate a first hash value based on the firmware update file and retrieve a digital signature from the firmware update file, and transfer the firmware to the firmware update file according to the update notification. Output the body update file to flash memory. The security processor is connected to the baseboard management controller, and is configured to receive the first hash value and the digital signature from the baseboard management controller, decrypt the digital signature based on the pre-stored key to obtain the second hash value, and combine the first hash value with the third digital signature. When the two hash values are the same, an update notification is output to the baseboard management controller.

Through the above structure of verifying the firmware update file by the security processor before storing it in the flash memory, it is possible to prevent incorrect firmware update files from being stored in the flash memory, thereby preventing The system and users have to wait for a long time to restore the firmware file.

The above description of the present disclosure and the following description of the embodiments are used to demonstrate and explain the spirit and principles of the present invention, and to provide further explanation of the patent application scope of the present invention.

The detailed features and advantages of the present invention are described in detail below in the implementation mode. The content is sufficient to enable anyone skilled in the relevant art to understand the technical content of the present invention and implement it according to the content disclosed in this specification, the patent scope and the drawings. , anyone familiar with the relevant art can easily understand the relevant objectives and advantages of the present invention. The following examples further illustrate the aspects of the present invention in detail, but do not limit the scope of the present invention in any way.

Please refer to FIG. 1 , which is a block diagram of a firmware protection system according to an embodiment of the present invention. The firmware protection system 1 includes a flash memory 11 , a baseboard management controller 12 and a security processor 13 . The baseboard management controller 12 is connected to the flash memory 11 and the security processor 13 in a wired or wireless manner, where the baseboard management controller 12 is connected through an inter-integrated circuit (I ₂ C) interface, for example. in flash memory 11. In addition, the security processor 13 can be further connected to the flash memory 11 in a wired or wireless manner, and the security processor 13 can verify the firmware file stored in the flash memory 11 .

The flash memory 11 is used to store firmware files. For example, the flash memory 11 may be an active flash memory (active flash). The baseboard management controller 12 is configured to receive the firmware update file and store the firmware update file in the flash memory 11 after the firmware update file passes the verification. The security processor 13 is, for example, a security chip (security IC), which is used to verify the firmware update file and send a notification to the baseboard management controller 12 according to the verification result.

In order to explain the above content in more detail, please refer to FIG. 1 and FIG. 2 together. FIG. 2 is a flow chart of a firmware protection method according to an embodiment of the present invention. The process shown in Figure 2 is applicable to the firmware protection system 1 of Figure 1 . As shown in Figure 2, the firmware protection method includes: step S101: using the baseboard management controller to receive the first firmware update file; step S103: using the baseboard management controller to generate a first hash value according to the first firmware update file and from The first firmware update file acquires the first digital signature; Step S105: Use the baseboard management controller to transmit the first hash value and the first digital signature to the security processor; Step S107: Use the security processor based on the first deposit Use the key to decrypt the first digital signature to obtain the second hash value; Step S109: Use the security processor to determine whether the first hash value and the second hash value are the same; if the determination result in step S109 is "Yes", execute step S111: The security processor outputs the first update notification to the baseboard management controller; Step S113: The baseboard management controller outputs the first firmware update file to the flash memory according to the first update notification; and if the determination result in step S109 is " No", execute step S115: use the security processor to notify the baseboard management controller to suspend the update.

In step S101, the baseboard management controller 12 may receive the first firmware update file uploaded by the user through the wireless network, but the present invention does not limit the manner in which the baseboard management controller 12 receives the first firmware update file. In addition, when receiving the first firmware update file, the baseboard management controller 12 may first store the first firmware update file in a random access memory (read-only memory, ROM) of the baseboard management controller 12 .

In step S103, the baseboard management controller 12 generates a first hash value corresponding to the first firmware update file, and retrieves a first digital signature from the first firmware update file. Furthermore, the baseboard management controller 12 may perform a hash operation on the first firmware update file to generate the first hash value. The first digital signature may be generated by using an encryption key to encrypt an initial hash value corresponding to a protection block of the first firmware update file, wherein the initial hash value may be an encryption key to the first firmware update file. It is generated by performing a hash operation on the protection block of the body update file. For example, the first digital signature is generated by encrypting an initial hash value by the user's terminal device before the baseboard management controller 12 receives the first firmware update file.

In step S105, the baseboard management controller 12 transmits the first hash value and the first digital signature to the security processor 13, wherein the baseboard management controller 12 may transmit the first hash value and the first digital signature through an interface between integrated circuits. Sign to secure processor 13.

In step S107, the security processor 13 decrypts the first digital signature from the baseboard management controller 12 based on the first pre-stored key to obtain a second hash value. The aforementioned encryption key used to generate the first digital signature may correspond to the first pre-stored key. Furthermore, the encryption key used to generate the first digital signature may be a public key, and the first pre-stored key may be a private key.

In step S109, the security processor 13 determines whether the first hash value and the second hash value are the same to determine whether the first hash value generated by the baseboard management controller 12 and the second hash value in the first digital signature indicate the same firmware. body update file.

If the security processor 13 determines that the first hash value and the second hash value are the same, in step S111, the security processor 13 outputs a first update notification to the baseboard management controller 12, and the security processor 13 may communicate through the integrated circuit. The interface outputs a first update notification to the baseboard management controller 12, wherein the first update notification indicates that the first firmware update file is legal. In step S113, after receiving the first update notification, the baseboard management controller 12 outputs the first firmware update file from the random access memory to the flash memory 11 according to the first update notification. Accordingly, when the first firmware update file is dedicated to the BMC 12 , the BMC 12 can read and execute the first firmware update file from the flash memory 11 .

On the contrary, if the security processor 13 determines that the first hash value and the second hash value are different, it indicates that the first firmware update file is illegal. Therefore, in step S115, the security processor 13 may notify the baseboard management controller 12 to suspend the update to prevent the baseboard management controller 12 from executing an incorrect firmware file.

Through the above method of verifying the firmware update file by the security processor before storing it in the flash memory, it is possible to prevent incorrect firmware update files from being stored in the flash memory, thereby preventing The system and users have to wait for a long time to restore the firmware file.

Please refer to FIG. 1 and FIG. 3 together. FIG. 3 is a flow chart of generating a first hash value in a firmware protection method according to an embodiment of the present invention. FIG. 3 can be viewed as a detailed flow chart of an embodiment of generating the first hash value according to the first firmware update file in step S103 of FIG. 2 . As shown in Figure 3, the method of generating the first hash value includes: step 201: determining the protection block of the first firmware update file; and step S203: calculating the first hash value based on the protection block.

In step S201, the baseboard management controller 12 determines the protection block in the first firmware update file, where the protection block stores at least part of the update content in the first firmware update file. In step S203, the baseboard management controller 12 performs a hash operation on the updated content in the protection block to generate a first hash value.

Please refer to FIG. 4 , which is a block diagram of a firmware protection system according to another embodiment of the present invention. The firmware protection system 2 includes a first flash memory 21 , a baseboard management controller 22 , a security processor 23 and a second flash memory 24 . The implementation and connection methods of the first flash memory 21, the baseboard management controller 22 and the security processor 23 can be the same as the flash memory 11, the baseboard management controller 12 and the security processor 13 shown in Figure 1, respectively. Therefore, no further details will be given here. In the embodiment of FIG. 4 , the firmware protection system 2 further includes a second flash memory 24 . The second flash memory 24 is connected to the baseboard management controller 22 , the security processor 23 and the central processing unit in a wired or wireless manner. Processor CPU, where the central processing unit CPU can be used to execute a basic input/output system (BIOS).

In this embodiment, the first flash memory 21 may be used to store firmware files belonging to the baseboard management controller 22 , and the second flash memory 24 may be used to store firmware files belonging to the basic input and output system. . The security processor 23 can also verify the firmware file stored in the second flash memory 24 . In addition, the security processor 23 can be connected to the central processing unit CPU in a wired or wireless manner, so that the central processing unit CPU can proactively notify the security processor 23 that the firmware update file of the basic input and output system needs to be verified.

Please refer to FIG. 4 and FIG. 5 together. FIG. 5 is a flow chart of a firmware protection method according to another embodiment of the present invention. As shown in Figure 5, the firmware protection method further includes: step S301: using the baseboard management controller to receive the second firmware update file; step S303: using the baseboard management controller to generate a third hash value according to the second firmware update file and Acquire the second digital signature from the second firmware update file; Step S305: Use the baseboard management controller to transmit the third hash value and the second digital signature to the security processor; Step S307: Use the security processor based on the second pre-stored The key decrypts the second digital signature to obtain the fourth hash value; Step S309: Use the security processor to determine whether the third hash value and the fourth hash value are the same; if the determination result in step S309 is "yes", perform step S311: Use the security processor to output a second update notification to the baseboard management controller; Step S313: Use the baseboard management controller to output the second firmware update file to the flash memory according to the second update notification; and if the determination result in step S309 is "No", perform step S315: use the security processor to notify the baseboard management controller to suspend the update.

Steps S301 to S315 shown in FIG. 5 are respectively similar to steps S101 to S105 shown in FIG. 2 . In addition, the baseboard management controller 22 may perform the steps of FIG. 3 on the second firmware update file to generate a third hash value. The method of generating the second digital signature can also be generated by using an encryption key to encrypt the initial hash value. The initial hash value corresponds to the protection block of the second firmware update file, and the encryption key corresponds to the second deposit. key, where the second pre-stored key may be the same as or different from the first pre-stored key.

In the embodiment of FIG. 5 , the second firmware update file refers to a firmware file belonging to the basic input and output system executed by the central processing unit CPU. If the determination result in step S309 is yes, the second update notification output by the security processor 23 in step S311 indicates that the second firmware update file is legal. In step S313, after receiving the second update notification, the baseboard management controller 22 outputs the second firmware update file from the random access memory to the second flash memory connected to the central processing unit CPU according to the second update notification. Body 24. Accordingly, the central processing unit CPU executing the basic input and output system can read and execute the second firmware update file from the second flash memory 24 .

The above-mentioned first firmware update file and the second firmware update file may be, but are not limited to, the firmware file of the baseboard management controller and the firmware file of the basic input and output system respectively.

Through the above structure of verifying the firmware update file by the security processor before storing it in the flash memory, it is possible to prevent incorrect firmware update files from being stored in the flash memory, thereby preventing The system and users have to wait for a long time to restore the firmware file. Therefore, it is possible to prevent the firmware execution unit (such as the baseboard management controller, central processing unit, etc.) from executing wrong firmware files and ensure the correctness of the firmware files subsequently executed by the firmware execution units.

Although the present invention is disclosed in the foregoing embodiments, they are not intended to limit the present invention. All changes and modifications made without departing from the spirit and scope of the present invention shall fall within the scope of patent protection of the present invention. Regarding the protection scope defined by the present invention, please refer to the attached patent application scope.

1,2: Firmware protection system 11,21,24: Flash memory 12,22:Baseboard management controller 13,23: Security processor CPU: central processing unit S101, S103, S105, S107, S109, S111, S113, S115, S201, S203, S301, S303, S305, S307, S309, S311, S313, S315: Steps

FIG. 1 is a block diagram of a firmware protection system according to an embodiment of the present invention. FIG. 2 is a flow chart of a firmware protection method according to an embodiment of the present invention. FIG. 3 is a flow chart of generating a first hash value in a firmware protection method according to an embodiment of the present invention. FIG. 4 is a block diagram of a firmware protection system according to another embodiment of the present invention. FIG. 5 is a flow chart of a firmware protection method according to another embodiment of the present invention.

S101, S103, S105, S107, S109, S111, S113, S115: Steps

Claims (10)

A firmware protection method including: Using a baseboard management controller to receive a firmware update file; using the baseboard management controller to generate a first hash value based on the firmware update file and retrieving a digital signature from the firmware update file; using the baseboard management controller to control The device transmits the first hash value and the digital signature to a security processor; the security processor decrypts the digital signature based on a pre-stored key to obtain a second hash value; and the security processor determines the first hash value. Whether the hash value is the same as the second hash value; when the first hash value is the same as the second hash value, the security processor outputs an update notification to the baseboard management controller; and the baseboard management controller is configured according to The update notification outputs the firmware update file to a flash memory. The firmware protection method as described in claim 1, wherein generating the first hash value based on the firmware update file includes: Determine a protection block of the firmware update file; and calculate the first hash value based on the protection block. The firmware protection method described in claim 1 further includes: When the first hash value is different from the second hash value, the security processor notifies the baseboard management controller to suspend updating. The firmware protection method of claim 1, wherein the digital signature is generated by encrypting an initial hash value using an encryption key, and the initial hash value corresponds to a protection block of the firmware update file, And the encryption key corresponds to the pre-stored key. The firmware protection method as described in claim 1, wherein the firmware update file is a first firmware update file, the flash memory system is a first flash memory, and the digital signature is a first digital signature. Chapter 1, the pre-stored key is based on a first pre-stored key, and the method further includes: The baseboard management controller receives a second firmware update file; the baseboard management controller generates a third hash value according to the second firmware update file and retrieves a second number from the second firmware update file. Sign; use the baseboard management controller to send the third hash value and the second digital signature to the security processor; use the security processor to decrypt the second digital signature based on a second pre-stored key to obtain a The fourth hash value; use the security processor to determine whether the third hash value and the fourth hash value are the same; when the third hash value is the same as the fourth hash value, use the security processor to output another update notification to the baseboard management controller; and using the baseboard management controller to output the second firmware update file to a second flash memory according to the another update notification. A firmware protection system that includes: A flash memory; a baseboard management controller connected to the flash memory, the baseboard management controller is used to receive a firmware update file, generate a first hash value according to the firmware update file and obtain it from the firmware The update file obtains a digital signature and outputs the firmware update file to the flash memory according to an update notification; and a security processor is connected to the baseboard management controller for obtaining the data from the baseboard management controller. Receive the first hash value and the digital signature, decrypt the digital signature based on a pre-stored key to obtain a second hash value, and when the first hash value is the same as the second hash value, output the update notification to the baseboard management controller. The firmware protection system of claim 6, wherein the baseboard management controller generates the first hash value based on the firmware update file including: Determine a protection block of the firmware update file; and calculate the first hash value based on the protection block. The firmware protection system of claim 6, wherein the security processor is further configured to notify the baseboard management controller to suspend updating when the first hash value is different from the second hash value. The firmware protection system of claim 6, wherein the digital signature is generated by encrypting an initial hash value using an encryption key, and the initial hash value corresponds to a protection block of the firmware update file, And the encryption key corresponds to the pre-stored key. The firmware protection system of claim 6, wherein the digital signature is a first digital signature, the pre-stored key is based on a first pre-stored key, and the flash memory system is a first flash memory , the firmware protection system further includes a second flash memory connected to the baseboard management controller, The baseboard management controller is further configured to receive a second firmware update file, generate a third hash value based on the second firmware update file, and retrieve a second digital signature from the second firmware update file, and The second firmware update file is output to the second flash memory according to another update notification, and the security processor is further configured to receive the third hash value and the second digital signature from the baseboard management controller, Decrypt the second digital signature based on a second pre-stored key to obtain a fourth hash value, and when the third hash value is the same as the fourth hash value, output the another update notification to the baseboard management controller .

Images