Baseboard management controller, server, data center and server control method

Abstract

This application discloses a baseboard management controller, a server, a data center, and a server control method. To ensure server security, target components connected to the server are measured. These target components play a role in the server's operation. The technical solution in this application measures these target components, avoiding the risks and negative impacts of attacks on them on the server, thus improving server security. The technical solution uses a first circuit to communicate with target units requiring measurement, while using a second circuit with a certain degree of isolation to communicate with target units that do not require measurement. This ensures a degree of isolation between the target units requiring measurement and the baseboard management controller, preventing the risk from spreading to other components of the server even if the target unit has a certain risk.

Description

Technical Field

[0001] This application relates to the field of electronic equipment technology, and in particular to a baseboard management controller, server, data center, and server control method. Background Technology

[0002] In recent years, with the emergence of new information technologies such as cloud computing, big data, the Internet of Things, mobile computing, and artificial intelligence, the internet is undergoing a new transformation, and data centers deployed globally have become one of the most important infrastructures supporting current internet services. If a data center's servers experience security issues, the consequences will be extremely serious. Therefore, it is essential to ensure server security. Summary of the Invention

[0003] This application provides a baseboard management controller, a server, a data center, and a server control method to partially solve the aforementioned problems existing in the prior art.

[0004] The embodiments of this application adopt the following technical solutions:

[0005] In a first aspect, this application provides a substrate management controller, comprising:

[0006] The first type of bus interface is used to connect to the target component via the first circuit;

[0007] The second type of bus interface is used to connect to the target component via a second circuit.

[0008] The trusted measurement module, configured as a trusted root, is used to trigger the first circuit to connect when the target component is determined to be a component that needs to be measured, so as to measure the target component through the first type of bus interface and the first circuit.

[0009] The management module is used to trigger the second circuit to connect when it is determined that the target component is a component that does not need to be measured, and to communicate with the target component through the second type of bus interface and the second circuit, so that the target component enters the working state.

[0010] In an optional embodiment of this application, the trust measurement module is further configured to, when measuring the target component as untrustworthy, issue an isolation command for the target component through the first circuit to cut off the power supply signal of the target component; and store log information of the target component being isolated due to untrustworthiness.

[0011] In an optional embodiment of this application, the trust measurement module includes a decision unit and a trust measurement unit:

[0012] The determination unit is used to obtain component information of the target component, and determine whether the target component needs to be measured based on the component information; when the target component needs to be measured, the trusted measurement unit is triggered to perform trusted measurement on the target component; when the target component does not need to be measured, the management module is triggered to take over the target component.

[0013] In an optional embodiment of this application, the trusted measurement unit pre-stores measurement information and is used to communicate with the target component through the first type of bus interface and the first circuit when the target component is a component that needs to be measured, so as to measure the target component using the measurement information.

[0014] In an optional embodiment of this application, the trusted measurement unit is further configured to obtain measurement information published by the network side and pre-store the measurement information locally.

[0015] In an optional embodiment of this application, the first type of bus interface is an I3C interface, and correspondingly, the first circuit is a measurement interface management bus circuit conforming to the I3C protocol standard that electrically connects the first type of bus interface and the target component.

[0016] The second type of bus interface is an I2C interface. Correspondingly, the second circuit is an out-of-band management bus circuit that is electrically connected to the second type of bus interface and the target component and conforms to the I2C protocol standard.

[0017] Secondly, this application provides a server, comprising:

[0018] The substrate management controller as described in any one of the first aspects above;

[0019] Target component;

[0020] A circuit board having a first circuit for electrically connecting the first type of bus interface and the target component, and a second circuit for electrically connecting the second type of bus interface and the target component.

[0021] In one optional embodiment of this application, the circuit board is provided with a routing element and at least one level of multiplexing element;

[0022] The first terminal of the multiplexing element is directly or indirectly connected to the first type of bus interface through at least one preceding multiplexing element.

[0023] The second terminal of the multiplexing element is directly or indirectly connected to the second type of bus interface through at least one preceding multiplexing element;

[0024] The third terminal of the multiplexer is directly or indirectly connected to a circuit board port on the circuit board, either through at least one subsequent multiplexer, and the circuit board port is electrically connected to the target component.

[0025] The routing element is electrically connected to the substrate management controller and to the fourth terminal of the multi-channel element. It is used to send a corresponding routing signal to the multi-channel element based on the result of whether the target component needs to be measured as determined by the substrate management controller, and to control the multi-channel element to switch the connection circuit.

[0026] In an optional embodiment of this application, the server further includes:

[0027] A board-to-board connector is used to connect the baseboard management controller and the circuit board.

[0028] Thirdly, this application provides a data center including one or more servers as described in the second aspect.

[0029] Fourthly, this application provides a server control method, applicable to a baseboard management controller, comprising:

[0030] Determine whether the target components of the server require measurement;

[0031] When the target component needs to be measured, the first circuit is activated to measure the target component through the first type of bus interface and the first circuit.

[0032] When the target component does not require measurement, the second circuit is activated, and the target component communicates with the second type of bus interface and the second circuit to enable the target component to enter the working state.

[0033] In an optional embodiment of this application, the baseboard management controller has a first type of bus interface and a second type of bus interface. The first type of bus interface is connected to the target component through a first circuit, and the second type of bus interface is connected to the target component through a second circuit.

[0034] Furthermore, the method further includes:

[0035] When the target component needs to be measured, a first signal is sent to the routing element, which then selects the first circuit to be connected.

[0036] When the target component does not require measurement, a second signal is sent to the routing element, which then selects the second circuit to connect.

[0037] In an optional embodiment of this application, the server control method further includes:

[0038] When the target component is deemed untrustworthy, an isolation command is issued for the target component through the first circuit to cut off the power supply signal to the target component; and log information of the target component being isolated due to untrustworthiness is stored.

[0039] When the reliability of the target component is measured, the first circuit is triggered to disconnect and the second circuit is triggered to connect. The target component is then communicated with through the second type of bus interface and the second circuit, so that the target component enters the working state.

[0040] In an optional embodiment of this application, the server control method further includes:

[0041] Using the first circuit, read the component certificate from the target component;

[0042] Compare the component certificate with the first benchmark certificate stored locally;

[0043] If the component certificate matches the first benchmark certificate, then the component code is read from the target component using the first circuit;

[0044] The component code is processed to obtain the component code hash value;

[0045] If the component code hash value matches a first benchmark value stored locally, the component is considered trustworthy.

[0046] In an optional embodiment of this application, the server control method further includes:

[0047] Read the Basic Input / Output System (PIS) certificate from the server's PIS flash memory;

[0048] The basic input / output system certificate is compared with a second benchmark certificate stored locally;

[0049] If the Basic Input / Output System (PIOS) certificate matches the second benchmark certificate, then PIOS code is read from the PIOS flash memory;

[0050] The Basic Input / Output System (BIOS) code is processed to obtain the BIOS code hash value;

[0051] If the hash value of the Basic Input / Output System code matches a second benchmark value stored locally, then the Basic Input / Output System is considered trustworthy.

[0052] Fifthly, this application provides an electronic device, including a memory, a processor, and a computer program stored in the memory and executable on the processor, wherein the processor executes the program to implement the above-described game application running method.

[0053] The above-described technical solutions adopted in the embodiments of this application can achieve the following beneficial effects:

[0054] The baseboard management controller, server, and server control method in this application embodiment measure target components connected to the server to ensure server security. These target components play a role in the server's operation. Measuring these target components in this application avoids the risks and negative impacts on the server caused by attacks on them, thus improving server security. Furthermore, the technical solution in this application uses a first circuit to communicate with target units requiring measurement, while using a second circuit with a certain degree of isolation to communicate with target units that do not require measurement. This ensures that the communication between the target units requiring measurement and the baseboard management controller is isolated, preventing the risk from spreading to other components of the server even if the target unit has a certain risk, further improving server security. Moreover, the baseboard management controller manages the components during server startup and when a component is started. Since the baseboard management controller is one of the earlier stages in the component startup process, the technical solution in this application allows for component measurement during startup. Even if a component has a risk, it cannot bypass the baseboard management controller, facilitating timely risk detection. Furthermore, when the server starts up, the baseboard management controller starts up earlier than most of the server's components. The trusted measurement module for measuring the components is set in the baseboard management controller. Therefore, when the baseboard management controller starts up, it can trigger the components to perform measurement, thus enabling the baseboard management controller to be proactive in the measurement process. Attached Figure Description

[0055] The accompanying drawings, which are included to provide a further understanding of this application and form part of this application, illustrate exemplary embodiments and are used to explain this application, but do not constitute an undue limitation of this application. In the drawings:

[0056] Figure 1 This is a schematic diagram of the server portion structure provided in an embodiment of this application;

[0057] Figure 2a This is a schematic diagram of the server portion structure provided in an embodiment of this application;

[0058] Figure 2b This is a schematic diagram of the multi-channel component structure of the server provided in the embodiments of this application;

[0059] Figure 3 A flowchart illustrating the selection steps of the server control method provided in this application embodiment;

[0060] Figure 4 A flowchart illustrating the steps of determining the target component to be measured in the server control method provided in this application embodiment;

[0061] Figure 5 A flowchart illustrating the steps of determining whether a target component is trustworthy in the server control method provided in this application embodiment;

[0062] Figure 6 A flowchart illustrating the steps of determining whether the Basic Input Output System (BIOS) is trustworthy in the server control method provided in this application embodiment;

[0063] Figure 7 This is a schematic diagram of the structure of the baseboard management controller provided in the embodiments of this application;

[0064] Figure 8 The embodiments provided in this application correspond to Figure 3 A schematic diagram of an electronic device. Detailed Implementation

[0065] To make the objectives, technical solutions, and advantages of this application clearer, the technical solutions of this application will be clearly and completely described below in conjunction with specific embodiments and corresponding drawings. Obviously, the described embodiments are only a part of the embodiments of this application, and not all of them. Based on the embodiments in this application, all other embodiments obtained by those skilled in the art without creative effort are within the scope of protection of this application.

[0066] The technical solutions provided by the various embodiments of this application are described in detail below with reference to the accompanying drawings.

[0067] Information technology has become an integral part of people's lives, with people accessing information and conducting various activities through computers and the internet every day. However, computers and cyberspace are not always secure. On the one hand, hackers attack legitimate users by spreading malicious viruses across the network; on the other hand, many unscrupulous vendors create backdoors in their software to steal users' privacy or display pop-up ads when users are not paying attention. These factors pose significant challenges to maintaining information security in cyberspace. To enable people to conduct various activities on the internet normally using computers, it is necessary to establish a secure and reliable defense system to ensure that computers can provide services stably as expected.

[0068] Currently, most network security systems consist primarily of firewalls, intrusion detection systems, and virus protection. These conventional security measures only defend at the network and boundary layers, blocking unauthorized users and access from the perimeter to prevent external attacks. However, because these measures lack control over the source of the access—the client machine—and because insecure operating systems lead to numerous vulnerabilities in application systems, their protective effectiveness is becoming increasingly unsatisfactory. Furthermore, blocking methods rely on capturing the characteristic information of hacker attacks and virus intrusions, which is reactive information—a form of "post-incident defense." As malicious users' attack methods become increasingly sophisticated, defenders are forced to build ever-higher firewalls, more complex intrusion detection systems, and larger malware libraries, leading to higher false positive rates and continuously increasing security investment.

[0069] Trusted computing is a technological approach designed to fundamentally improve security by addressing insecurity in computer and network architectures. It involves technological innovations in areas such as logical correctness verification, computing architecture, and computing models to prevent attackers from exploiting logical flaws. This creates a unified system of attack and defense, ensuring that the logical combination used to complete computational tasks is not tampered with or destroyed, thus achieving correct computation.

[0070] Because operating systems and applications are regularly updated to add new features or fix vulnerabilities, they are easy targets for hackers to compromise servers. Therefore, organizations' security resources and strategies generally tend to focus on protecting operating systems and application software. However, there is another, lesser-known attack vector for server intrusion: firmware. It is clear that trusted computing targets not only operating systems and applications, but also firmware.

[0071] A server typically contains multiple components, each of which can use its own non-volatile SPI Flash cache to store its firmware. Firmware refers to the first boot code executed immediately after a component powers on. The component's processor assumes the firmware as a valid and reliable starting point, boots from it, and uses it, depending on the server's configuration, to verify and load higher-level functionalities in stages. In some cases, the processing component uses the firmware to perform the required functions throughout its entire runtime.

[0072] While flash memory offers convenient on-site upgrades and troubleshooting, it also makes the system vulnerable to malicious attacks. Hackers can gain unauthorized access to firmware and implant malicious code into the flash memory of components. This code can potentially evade standard system detection methods and remain unresolved even after updates or hard drive replacements, causing permanent damage to the system.

[0073] Unlawful acts committed through firmware attacks include: viewing or stealing proprietary data (credit card numbers, company intellectual property, etc.) stored on the server; bypassing the server to view or steal data; hijacking the server to launch DDoS attacks against other targets; and causing damage to the server by rendering one or more hardware components inoperable.

[0074] Firmware can be compromised at various stages of the supply chain, including: at the original equipment manufacturer (OEM): during production, operators may maliciously implant infected firmware; at the system integrator: when configuring servers according to customer requirements, unauthorized firmware may be installed; during transport to the customer: hackers may open the server packaging and download unauthorized firmware over the cable, implanting malicious code into the component's SPI memory; during field operation: hackers may exploit automatic firmware updates to replace normal updates with counterfeit firmware that can bypass any existing protection mechanisms.

[0075] A server contains multiple components, some of which have questionable trustworthiness (i.e., components that need to be measured), while others are known to be trustworthy (i.e., components that do not require measurement). If all components with varying trustworthiness are powered on without differentiation, the risks posed by the components with questionable trustworthiness could negatively impact other components of the server. Conversely, if trustworthiness is measured for all components with varying trustworthiness, it can affect the startup efficiency of those components, for example, causing the server to start up slowly.

[0076] It is evident that improving server startup efficiency while avoiding risks posed by components with uncertain reliability has become an urgent problem to be solved.

[0077] In view of this, this application provides a Baseboard Management Controller (BMC), a server including the Baseboard Management Controller, and a server control method.

[0078] For example, the server in this application has the following characteristics: Figure 1 and Figure 2a The structure is shown. It should be noted that the server described in this specification can be used to build a data center. The server and at least some of the components included in the services described in this application will now be described from the following aspects:

[0079] 1. Circuit board.

[0080] The circuit board in this application is used to provide mounting locations for at least some components of a server. Components mounted on the circuit board may include communication circuitry.

[0081] The communication circuit described in this application is used at least to enable communication between the baseboard management controller and the target component. The communication circuit may include a first circuit and a second circuit. A certain degree of signal isolation exists between the first circuit and the second circuit; that is, signals in the first circuit are not transmitted to the second circuit, so that risk signals transmitted in the first circuit will not negatively affect components in the server that are not connected to the first circuit.

[0082] In this application, the first circuit is a circuit that electrically connects the substrate management controller to the target component that needs to be measured. The second circuit is a circuit that electrically connects the substrate management controller to the target component that does not need to be measured.

[0083] In other words, the first circuit in this application is used to measure the target component, and the first circuit can be a measurement interface management bus circuit. The second circuit in this application is used to manage the target component in its operational state, and the second circuit can be an out-of-band management bus circuit.

[0084] In an optional embodiment of this application, the first circuit is a circuit conforming to the I3C protocol standard; the second circuit is a circuit conforming to the I2C protocol standard. Since the circuit conforming to the I3C protocol standard has a higher communication rate than the circuit conforming to the I2C protocol standard, using the circuit conforming to the I3C protocol standard as the first circuit can improve the efficiency of measurement and shorten the startup time of the target component.

[0085] In another optional embodiment of this application, the first circuit is a circuit conforming to the I2C protocol standard; the second circuit is a circuit conforming to the I3C protocol standard. Since the communication rate of the circuit conforming to the I2C protocol standard is lower than that of the circuit conforming to the I3C protocol standard, using the circuit conforming to the I2C protocol standard as the first circuit can prevent the risk from rapidly spreading to other components if there is indeed a risk in the target component.

[0086] The circuit in this application may include, but is not limited to, a bus. In some alternative embodiments, the circuit may include other devices in addition to the bus, which will not be described in detail here.

[0087] Furthermore, in an optional embodiment of this application, the circuit board is also provided with a routing element and at least one level of multiplexing element, such as... Figure 1 As shown. The routing element is used to control the multiplexer based on the control signals from the board management controller, thereby controlling the selection of the first and second circuits through the multiplexer. The routing element is connected to the board management controller via an I2C bus.

[0088] The first terminal of the multiplexer is directly or indirectly connected to a first-type bus interface, either through at least one preceding multiplexer. The second terminal of the multiplexer is directly or indirectly connected to a second-type bus interface, either through at least one preceding multiplexer. The third terminal of the multiplexer is directly or indirectly connected to a board port on the circuit board, either through at least one subsequent multiplexer, and the board port is electrically connected to the target component. Furthermore, a routing element, electrically connected to the substrate management controller and to the fourth terminal of the multiplexer, is used to send a corresponding routing signal to the multiplexer based on whether the target component requires measurement, thereby controlling the multiplexer to switch the connected circuit.

[0089] In such Figure 1 In the example shown, multiplexing unit 2 is the preceding multiplexing unit of multiplexing unit 1, and multiplexing unit 1 is the following multiplexing unit. In the example shown... Figure 2b In the multiplexer shown, 1D is the first terminal, 2D is the second terminal, D is the third terminal, and S is the fourth terminal.

[0090] In an optional embodiment of this application, the routing element is a CPLD (Complex Programmable Logic Device); the multiplexing element is a MUX (Multiplexer).

[0091] In a further optional embodiment of this application, a connector is also provided on the circuit board for connecting the baseboard management controller and the circuit board. Optionally, the connector is a BTB connector (board-to-board connector).

[0092] II. Target Components.

[0093] The target component in this application is a component connected to a circuit board to perform a certain function during server operation, and can be considered as part of the server when the target component is in an operational state. For example, in... Figure 2a In the example shown, the target component is a board (or chip) containing the MIMXRT633.

[0094] The target component includes a component interface, which can be connected to a circuit board interface on a circuit board, thereby being electrically connected to at least one of the first circuit and the second circuit.

[0095] Furthermore, the target component in this application also includes a component information storage module, such as an FRU,data (Field Replacement Unit), which stores component information. For example, the component information storage module is as follows: Figure 2aAs shown. Component information may optionally include at least one of the following: component model, component identifier, and component configuration parameters.

[0096] In this application, the target component connected to the circuit board can be one or more, and the functions of different target components can be the same or different.

[0097] For a substrate management controller, some target components need to be measured, meaning the controller needs to determine the reliability of these components; while other target components do not need to be measured, meaning the controller does not need to determine their reliability. How the substrate management controller determines the target components that need to be measured will be explained below.

[0098] III. Baseboard Management Controller.

[0099] The baseboard management controller is an independent system; it does not depend on other hardware on the system (such as the CPU, memory, etc.), nor on the BIOS (Basic Input Output System) or OS. However, the baseboard management controller can interact with the BIOS and OS for better management. The OS has system management software that can work in conjunction with the baseboard management controller to achieve better management results.

[0100] The baseboard management controller in this application is a collection of detection and control functions that operate on the system hardware. For example, it detects system temperature, voltage, fan speed, and / or power supply, and makes corresponding adjustments to ensure the system is in a healthy state. The baseboard management controller also records information and logs from various components to alert users and help locate subsequent problems.

[0101] The substrate management controller in this application includes a management module, a reliability measurement module, and a bus interface, exemplarily, such as... Figure 7 As shown.

[0102] The management module primarily implements the aforementioned management functions of the substrate management controller. For target components that do not require measurement, the substrate management controller only needs to manage their operation. The substrate management controller can connect to the second circuit via its Type II bus interface, thereby communicating with the components that do not require measurement and enabling them to enter the operational state.

[0103] The trusted measurement module is mainly used to implement the measurement function of the baseboard management controller for the components that need to be measured. The baseboard management controller is connected to the first circuit through its first type of bus interface, and then communicates with the components that need to be measured to realize the measurement of the components. The trusted measurement module in this specification has the identity of a trusted root, so when the baseboard management controller is powered on, it can measure the target component as a trusted root.

[0104] Under the control of the substrate management controller in this application, the circuits used by the substrate management controller to implement its management and measurement functions for the target components are different. The selection of the first circuit and the second circuit by the substrate management controller will now be explained.

[0105] like Figure 3 As shown, when the substrate management control is selected, the following steps are executed:

[0106] S300: Determine whether the target component of the server needs to be measured.

[0107] S302: When the target component needs to be measured, the first circuit is triggered to connect, so as to measure the target component through the first type of bus interface and the first circuit.

[0108] S304: When the target component does not need to be measured, the second circuit is triggered to connect, and the target component is communicated through the second type of bus interface and the second circuit so that the target component enters the working state.

[0109] Note: In this application, "connection" is also referred to as "conduction". A connected trigger circuit (e.g., the first circuit or the second circuit) means the trigger circuit is conducting, forming a closed circuit. An open-circuit trigger circuit (e.g., the first circuit or the second circuit) means the trigger circuit is disconnected, forming an open circuit.

[0110] As can be seen from the foregoing, whether the target component in this application is the target component that needs to be measured needs to be determined by the substrate management controller. In an optional embodiment of this application, such as Figure 4 As shown, the substrate management controller (specifically, the determination unit of the reliability measurement module) can perform the following steps to determine whether the target component needs to be measured:

[0111] S400: The baseboard management controller monitors the circuit board interfaces on the circuit board to identify the target components connected to the circuit board interfaces.

[0112] In one optional embodiment of this application, the baseboard management controller is triggered to execute this step when the server is powered on. In another optional embodiment described herein, the baseboard management controller monitors idle circuit board interfaces on the circuit board, and triggers the baseboard management controller to execute this step when it detects that the state of an idle circuit board interface has switched to non-idle.

[0113] In this application, all components recognizable by the board management controller can be used as target components, and subsequent steps can be performed on the target components; while components not recognizable by the board management controller are used as non-target components. For non-target components, the board management controller does not power them on, thus keeping them isolated from the circuit board.

[0114] S402: Read component information from the target component.

[0115] As previously stated, the target component may have a component information storage module, from which the board management controller can read component information. In an optional embodiment of this application, before powering on the target component, communication between the board management controller and the target component uses a first circuit. That is, upon detecting the target component, the first circuit between the controller and the target component is established, and the component information of the target component is read through the first circuit.

[0116] S404: Compare the read component information with the reference information stored locally by the board management controller to determine whether the component information matches the reference information. If the determination result is yes, proceed to step S406; if the determination result is no, proceed to step S408.

[0117] Optionally, prior to this step, the baseboard management controller acquires reference information published by the network side and stores it locally to perform the judgment in this step. The reference information is information that a trustworthy component should possess. Specifically, if the component information is the same as the reference information, they match; if the component information is different from the reference information, they do not match.

[0118] S406: Determine the target component as the target component that needs to be measured, and trigger the trusted measurement unit to perform trusted measurement on the target component.

[0119] Specifically, the substrate management controller sends a first signal to the routing element, which then selects the first circuit to connect. Thereafter, all signals used to measure the target component are transmitted through the first circuit to perform reliable measurements of the target component.

[0120] S408: If the target component is determined to be a target component that does not need to be measured, the management module is triggered to take over the target component.

[0121] Specifically, the substrate management controller sends a second signal to the routing element, which then selects the second circuit to connect. Thereafter, all signals used to manage the target component are transmitted through the second circuit.

[0122] As can be seen, when using the baseboard management controller in this application to control the server, the circuits used for measuring the target component and managing the target component are different. This can effectively isolate the signals interacting with the target unit that causes the risk (risk caused by the target component that has not yet been measured) from other components in the process of measuring the risk, thereby effectively preventing the risk from spreading to other components of the server.

[0123] Furthermore, the measurement of the target component will occupy the communication resources provided by the circuit to a certain extent. The server control implemented by the basic management controller in this application can avoid the measurement of the target unit from affecting the allocation of communication resources when the basic management controller manages the component.

[0124] In this application, for the target component that needs to be measured, the trusted measurement unit (FW unit) of the substrate management controller communicates with the target component through a first type of bus interface and a first circuit to measure the target component using measurement information.

[0125] To enable the trusted measurement unit to measure the target component, in an optional embodiment of this application, the trusted measurement unit pre-acquires measurement information published by the network side, stores the measurement information locally, and then measures the target component based on the measurement information. The measurement information is information that a trusted target component should possess. The measurement information includes the benchmark certificate and the first benchmark value, as described below.

[0126] In an optional embodiment of this application, such as Figure 5 As shown, when the trust measurement unit performs measurement on the target component, it executes the following steps:

[0127] S500: The Trusted Measurement Unit uses the first circuit to read the component certificate from the target component.

[0128] S502: Determine whether the component certificate matches the first base certificate stored locally. If they match, proceed to step S504; if they do not match, proceed to step S512.

[0129] Specifically, if the component certificate is the same as the first reference certificate, they are considered to be matched; if they are not the same, they are considered to be mismatched.

[0130] S504: Using the first circuit, read the component code from the target component.

[0131] S506: Process the component code to obtain the component code hash value.

[0132] Specifically, the trust metric unit generates a component code hash value for the read component code using a hash algorithm (e.g., sha1).

[0133] S508: Determine whether the component code hash value matches the first base value stored locally. If they match, proceed to step S510; if they do not match, proceed to step S512.

[0134] Specifically, if the component code hash value is the same as the first reference value, then the two match; if they are not the same, then the two do not match.

[0135] S510: Determine the reliability of the target component.

[0136] After confirming that the target component is trustworthy, the board management controller powers on the target component.

[0137] S512: The target component is determined to be unreliable.

[0138] In an optional embodiment of this application, the trust measurement module is further configured to issue an isolation command for the target component via a first circuit when the target component is measured to be untrustworthy, thereby cutting off the power supply signal to the target component. Then, log information indicating that the target component is isolated due to untrustworthiness is stored.

[0139] In an optional embodiment of this application, when the trust measurement module measures that the target component is untrustworthy, it generates an isolation command, sends it to the target component through the first circuit, cuts off the enable of the target component, and achieves isolation of the target component.

[0140] In another optional embodiment of this application, when the trust measurement module measures that the target component is untrustworthy, it generates an isolation command and sends it to the routing element. The routing element then controls all circuits connected to the target component to be disconnected, thereby isolating the target component.

[0141] If normal communication is conducted with a target component without knowing its trustworthiness, the risks posed by that component could spread to other components of the server, causing a disaster. Furthermore, refusing to communicate with a target component simply because its trustworthiness is unknown prevents verification of its trustworthiness, rendering the server unable to utilize the functions provided by that component and impacting its overall functionality.

[0142] In an optional embodiment of this application, when the substrate management controller measures the trustworthiness of the target component, it triggers a first circuit to disconnect and a second circuit to connect. Thereafter, the substrate management controller communicates with the target component via a second type of bus interface and the second circuit, causing the target component to enter a working state. Furthermore, during subsequent management of the trustworthy target component, the substrate management controller continues to communicate with it using the second circuit. Therefore, by employing different circuits to communicate with target components of unknown trustworthiness and those already determined to be trustworthy, the technical solution of this application effectively avoids this phenomenon.

[0143] In a further optional embodiment of this application, in order to further improve the server's ability to prevent risks, the baseboard management controller not only examines whether the target components of the server are trustworthy, but also prevents potential risks caused by the BIOS.

[0144] Specifically, such as Figure 6 As shown, when the baseboard management controller (specifically, the trust measurement unit) detects that the server has been powered on, it performs the following steps:

[0145] S600: The baseboard management controller reads the BIOS certificate from the server's BIOS flash memory.

[0146] To avoid potential risks from the BIOS affecting other components of the server, this step can be performed before powering on the circuit board.

[0147] Since the baseboard management controller connects to the BIOS via the SPI bus, it can act as an active measurement device to perform measurements on the BIOS. Because the baseboard management controller itself is a component on the server circuit board, no additional hardware needs to be added to the board to perform the active measurements.

[0148] In an optional embodiment of this application, the baseboard management controller first performs a self-test before executing this step. If the self-test passes, the baseboard management controller executes this step and does not power on the CPU via a timing control circuit (i.e., a power-on timing control module). In this embodiment, a power-on timing control module is also provided on the circuit board. The power-on timing control module is connected to the CPU and to the baseboard management controller via a bus (e.g., an I2C bus). The baseboard management controller can then control the timing of CPU power-on via a routing element.

[0149] The routing element is connected to the board management controller via an I2C bus. Before the CPU powers on, the board management controller can send timing logic control commands to the routing element to achieve power-on timing control of the board.

[0150] S602: Determine whether the BIOS certificate matches the second base certificate of the local storage. If they match, proceed to step S604; if they do not match, proceed to step S612.

[0151] To enable the trusted measurement unit to measure the BIOS, in an optional embodiment of this application, the trusted measurement unit pre-obtains a second benchmark certificate issued by the network side and stores the second benchmark certificate locally. The second benchmark certificate is a certificate that a trusted BIOS should possess.

[0152] Specifically, if the BIOS certificate is the same as the second benchmark certificate, then the two are matched; if the BIOS certificate is different from the second benchmark certificate, then the two are not matched.

[0153] S604: Reads BIOS code from BIOS flash memory.

[0154] S606: Processes the BIOS code to obtain the BIOS code hash value.

[0155] Specifically, the Trust Measurement Unit generates a BIOS code hash value from the read BIOS code using a hash algorithm (e.g., sha1).

[0156] S608: Determine whether the BIOS code hash value matches the second base value stored locally. If they match, proceed to step S610; if they do not match, proceed to step S612.

[0157] In an optional embodiment of this application, the trust measurement unit pre-obtains a second benchmark value published by the network side and stores the second benchmark value locally. The second benchmark value is the result that should be obtained by processing the trusted BIOS code.

[0158] Specifically, if the BIOS code hash value is the same as the second reference value, then the two are matched; if the BIOS code hash value is different from the second reference value, then the two are not matched.

[0159] S610: Measuring BIOS trustworthiness.

[0160] If the BIOS is deemed trustworthy, the baseboard management controller powers on the CPU. Specifically, the baseboard management controller powers on the CPU via a routing element. After the CPU powers on, it reads the BIOS, jumps to the BIOS boot code for execution, and then the BIOS issues an initialization command to begin initializing the CPU and chipset. Afterward, the aforementioned step S300 is executed.

[0161] S612: Measuring BIOS is unreliable.

[0162] If the BIOS is untrusted, the BIOS will not be powered on, log information will be generated and stored locally, and the server startup will be interrupted.

[0163] The baseboard management controller, server, and server control method in this application embodiment measure target components connected to the server to ensure server security. These target components play a role in the server's operation. Measuring these target components in this application avoids the risks and negative impacts on the server caused by attacks on them, thus improving server security. Furthermore, the technical solution in this application uses a first circuit to communicate with target units that require measurement, while using a second circuit with a certain degree of isolation from the first circuit to communicate with target units that do not require measurement. This ensures that the communication between the target units requiring measurement and the baseboard management controller is isolated, preventing the risk from spreading to other components of the server even if the target unit has a certain risk, further enhancing server security.

[0164] Furthermore, during server startup and when a component starts up, the baseboard management controller is responsible for managing the component. That is, the baseboard management controller is one of the earlier stages in the component startup process. Therefore, the technical solution in this application allows for component measurement during startup, ensuring that even if a component has risks, the baseboard management controller cannot be bypassed, facilitating timely risk detection. Moreover, since the baseboard management controller starts up before most other components of the server, and the trusted measurement module for component measurement is located within the baseboard management controller, its startup triggers the component to perform measurement, enabling the baseboard management controller to be proactive in the measurement process.

[0165] This application also provides a computer-readable storage medium storing a computer program that can be used to execute the above-described embodiments. Figure 3 The process controlled by the provided server.

[0166] The embodiments of this application also propose Figure 8 The diagram shows a schematic structural representation of the electronic device. Figure 8 At the hardware level, the electronic device may include a processor, internal bus, network interface, memory, and non-volatile memory, and may also include other hardware required for the services. The processor reads the corresponding computer program from the non-volatile memory into memory and then runs it to implement any of the aforementioned server control processes.

[0167] Of course, in addition to the software implementation, this application does not exclude other implementation methods, such as the combination of hardware and software XOR logic devices, etc. In other words, the execution subject of the following processing flow is not limited to each logic unit, but can also be hardware or logic devices.

[0168] Designers almost always obtain the corresponding hardware circuit structure by programming the improved method flow into the hardware circuit. Therefore, it cannot be said that an improvement in a method flow cannot be implemented using hardware physical modules. For example, a Programmable Logic Device (PLD) (such as a Field Programmable Gate Array (FPGA)) is such an integrated circuit whose logic function is determined by the user programming the device. Designers can program a digital system onto a PLD themselves, without having to ask chip manufacturers to design and manufacture dedicated integrated circuit chips. Moreover, nowadays, instead of manually manufacturing integrated circuit chips, this programming is mostly implemented using "logic compiler" software, which is similar to the software compiler used when writing program development code. The original code before compilation must also be written in a specific programming language, called a Hardware Description Language (HDL). Those skilled in the art should also understand that by simply performing some logic programming on the method flow using the aforementioned hardware description languages ​​and programming it into an integrated circuit, the hardware circuit that implements the logical method flow can be easily obtained.

[0169] The controller can be implemented in any suitable manner. For example, it can take the form of a microprocessor or processor and a computer-readable medium storing computer-readable program code (e.g., software or firmware) executable by the (micro)processor, logic gates, switches, application-specific integrated circuits (ASICs), programmable logic controllers, and embedded microcontrollers. A memory controller can also be implemented as part of the control logic of the memory. Those skilled in the art will also recognize that, in addition to implementing the controller in purely computer-readable program code form, the same functionality can be achieved by logically programming the method steps to make the controller take the form of logic gates, switches, ASICs, programmable logic controllers, and embedded microcontrollers. Therefore, such a controller can be considered a hardware component, and the means included therein for implementing various functions can also be considered as structures within the hardware component. Alternatively, the means for implementing various functions can be considered as both software modules implementing the method and structures within the hardware component.

[0170] The systems, devices, modules, or units described in the above embodiments can be implemented by computer chips or entities, or by products with certain functions. A typical implementation device is a computer. Specifically, a computer can be, for example, a personal computer, laptop computer, cellular phone, camera phone, smartphone, personal digital assistant, media player, navigation device, email device, game console, tablet computer, wearable device, or any combination of these devices.

[0171] For ease of description, the above devices are described separately by function as various units. Of course, in implementing this application, the functions of each unit can be implemented in one or more software and / or hardware.

[0172] Those skilled in the art will understand that embodiments of this application can be provided as methods, systems, or computer program products. Therefore, this application can take the form of a completely hardware embodiment, a completely software embodiment, or an embodiment combining software and hardware aspects. Furthermore, this application can take the form of a computer program product embodied on one or more computer-usable storage media (including but not limited to disk storage, CD-ROM, optical storage, etc.) containing computer-usable program code.

[0173] This application is described with reference to flowchart illustrations and / or block diagrams of methods, apparatus (systems), and computer program products according to embodiments of this application. It will be understood that each block of the flowchart illustrations and / or block diagrams, and combinations of blocks in the flowchart illustrations and / or block diagrams, can be implemented by computer program instructions. These computer program instructions can be provided to a processor of a general-purpose computer, special-purpose computer, embedded processor, or other programmable data processing apparatus to produce a machine, such that the instructions, which execute via the processor of the computer or other programmable data processing apparatus, generate instructions for implementing the flowchart... Figure 1 One or more processes and / or boxes Figure 1 A device that provides the functions specified in one or more boxes.

[0174] These computer program instructions may also be stored in a computer-readable storage medium that can direct a computer or other programmable data processing device to function in a particular manner, such that the instructions stored in the computer-readable storage medium produce an article of manufacture including instruction means, which are implemented in a process Figure 1 One or more processes and / or boxes Figure 1 The function specified in one or more boxes.

[0175] These computer program instructions may also be loaded onto a computer or other programmable data processing equipment to cause a series of operational steps to be performed on the computer or other programmable equipment to produce a computer-implemented process, thereby providing instructions that execute on the computer or other programmable equipment for implementing the process. Figure 1 One or more processes and / or boxes Figure 1 The steps of the function specified in one or more boxes.

[0176] In a typical configuration, a computing device includes one or more processors (CPU), input / output interfaces, network interfaces, and memory.

[0177] Memory may include non-persistent storage in computer-readable media, such as random access memory (RAM) and / or non-volatile memory, such as read-only memory (ROM) or flash RAM. Memory is an example of computer-readable media.

[0178] Computer-readable media includes both permanent and non-permanent, removable and non-removable media that can store information using any method or technology. Information can be computer-readable instructions, data structures, modules of programs, or other data. Examples of computer storage media include, but are not limited to, phase-change memory (PRAM), static random access memory (SRAM), dynamic random access memory (DRAM), other types of random access memory (RAM), read-only memory (ROM), electrically erasable programmable read-only memory (EEPROM), flash memory or other memory technologies, CD-ROM, digital versatile optical disc (DVD) or other optical storage, magnetic tape, magnetic magnetic disk storage or other magnetic storage devices, or any other non-transferable medium that can be used to store information accessible by a computing device. As defined herein, computer-readable media does not include transient computer-readable media, such as modulated data signals and carrier waves.

[0179] It should also be noted that the terms "comprising," "including," or any other variations thereof are intended to cover non-exclusive inclusion, such that a process, method, article, or apparatus that comprises a list of elements includes not only those elements but also other elements not expressly listed, or elements inherent to such a process, method, article, or apparatus. Without further limitation, an element defined by the phrase "comprising one..." does not exclude the presence of other identical elements in the process, method, article, or apparatus that includes said element.

[0180] Those skilled in the art will understand that embodiments of this application can be provided as methods, systems, or computer program products. Therefore, this application can take the form of a completely hardware embodiment, a completely software embodiment, or an embodiment combining software and hardware aspects. Furthermore, this application can take the form of a computer program product embodied on one or more computer-usable storage media (including, but not limited to, disk storage, CD-ROM, optical storage, etc.) containing computer-usable program code.

[0181] This application can be described in the general context of computer-executable instructions, such as program modules, that are executed by a computer. Generally, program modules include routines, programs, objects, components, data structures, etc., that perform a specific task or implement a specific abstract data type. This application can also be practiced in distributed computing environments where tasks are performed by remote processing devices connected via a communication network. In distributed computing environments, program modules can reside in local and remote computer storage media, including storage devices.

[0182] The various embodiments in this application are described in a progressive manner. Similar or identical parts between embodiments can be referred to mutually. Each embodiment focuses on describing the differences from other embodiments. In particular, the system embodiments are basically similar to the method embodiments, so the description is relatively simple; relevant parts can be referred to the descriptions of the method embodiments.

[0183] The above description is merely an embodiment of this application and is not intended to limit the scope of this application. Various modifications and variations can be made to this application by those skilled in the art. Any modifications, equivalent substitutions, improvements, etc., made within the spirit and principles of this application should be included within the scope of the claims of this application.

Claims

1. A baseboard management controller, wherein, include: The first type of bus interface is used to connect to the target component via the first circuit; The second type of bus interface is used to connect to the target component via a second circuit. The trusted measurement module, configured as a trusted root, is used to trigger the first circuit to connect when the target component is determined to be a component that needs to be measured, so as to measure the target component through the first type of bus interface and the first circuit. The management module is used to trigger the second circuit to connect when it is determined that the target component is a component that does not need to be measured, and to communicate with the target component through the second type of bus interface and the second circuit, so that the target component enters the working state.

2. The baseboard management controller according to claim 1, wherein, The trust measurement module is also used to issue an isolation command for the target component through the first circuit when the target component is measured to be untrustworthy, so as to cut off the power supply signal of the target component; It also stores log information of the target component that is isolated due to untrustworthiness.

3. The baseboard management controller according to claim 1 or 2, wherein, The trust measurement module includes a decision unit and a trust measurement unit: The determination unit is used to obtain component information of the target component and determine whether the target component needs to be measured based on the component information; When the target component needs to be measured, the trusted measurement unit is triggered to perform a trusted measurement on the target component; When the target component does not require measurement, the management module is triggered to take over the target component.

4. The baseboard management controller according to claim 3, wherein, The trusted measurement unit has pre-stored measurement information and is used to communicate with the target component through the first type of bus interface and the first circuit when the target component is a component that needs to be measured, so as to measure the target component using the measurement information.

5. The baseboard management controller according to claim 1, wherein, The first type of bus interface is an I3C interface. Correspondingly, the first circuit is a measurement interface management bus circuit that electrically connects the first type of bus interface and the target component and conforms to the I3C protocol standard. The second type of bus interface is an I2C interface. Correspondingly, the second circuit is an out-of-band management bus circuit that electrically connects the second type of bus interface and the target component and conforms to the I2C protocol standard.

6. A server, wherein, include: The substrate management controller according to any one of claims 1 to 5 above; Target component; A circuit board having a first circuit for electrically connecting the first type of bus interface and the target component, and a second circuit for electrically connecting the second type of bus interface and the target component.

7. The server according to claim 6, wherein, The circuit board is equipped with a routing element and at least one level of multi-channel element; The first terminal of the multiplexing element is directly or indirectly connected to the first type of bus interface through at least one preceding multiplexing element. The second terminal of the multiplexing element is directly or indirectly connected to the second type of bus interface through at least one preceding multiplexing element; The third terminal of the multiplexer is directly or indirectly connected to a circuit board port on the circuit board, either through at least one subsequent multiplexer, and the circuit board port is electrically connected to the target component. The routing element is electrically connected to the substrate management controller and to the fourth terminal of the multi-channel element. It is used to send a corresponding routing signal to the multi-channel element based on the result of whether the target component needs to be measured as determined by the substrate management controller, and to control the multi-channel element to switch the connection circuit.

8. A data center comprising one or more servers as described in any one of claims 6 or 7.

9. A server control method, applicable to a baseboard management controller, wherein, include: Determine whether the target components of the server require measurement; When the target component needs to be measured, the first circuit is activated to measure the target component through the first type of bus interface and the first circuit. When the target component does not require measurement, the second circuit is activated, and the target component communicates with the second type of bus interface and the second circuit to enable the target component to enter the working state.

10. The server control method according to claim 9, wherein, The baseboard management controller has a first type of bus interface and a second type of bus interface. The first type of bus interface is connected to the target component through a first circuit, and the second type of bus interface is connected to the target component through a second circuit. Furthermore, the method further includes: When the target component needs to be measured, a first signal is sent to the routing element, which then selects the first circuit to be connected. When the target component does not require measurement, a second signal is sent to the routing element, which then selects the second circuit to connect.

11. The server control method according to claim 9, wherein, Also includes: When the target component is deemed untrustworthy, an isolation command is issued for the target component through the first circuit to cut off the power supply signal to the target component; Store log information about the target component being isolated due to untrustworthiness; When the reliability of the target component is measured, the first circuit is triggered to disconnect and the second circuit is triggered to connect. The target component is then communicated with through the second type of bus interface and the second circuit, so that the target component enters the working state.

12. The server control method according to claim 9, wherein, Also includes: Using the first circuit, read the component certificate from the target component; Compare the component certificate with the first benchmark certificate stored locally; If the component certificate matches the first benchmark certificate, then the component code is read from the target component using the first circuit; The component code is processed to obtain the component code hash value; If the component code hash value matches a first benchmark value stored locally, the component is considered trustworthy.

13. The server control method according to claim 9, wherein, Also includes: Read the Basic Input / Output System (PIS) certificate from the server's PIS flash memory; The basic input / output system certificate is compared with a second benchmark certificate stored locally; If the Basic Input / Output System (PIOS) certificate matches the second benchmark certificate, then PIOS code is read from the PIOS flash memory; The Basic Input / Output System (BIOS) code is processed to obtain the BIOS code hash value; If the hash value of the Basic Input / Output System code matches a second benchmark value stored locally, then the Basic Input / Output System is considered trustworthy.

14. An electronic device comprising a memory, a processor, and a computer program stored in the memory and executable on the processor, wherein, When the processor executes the program, it implements the method described in any one of claims 9-13.

Images