A trusted boot method for multi-core BMC firmware system

Abstract

A trusted boot method for a multi-core BMC firmware system belongs to the field of trusted boot of a BMC firmware system. It is characterized by comprising a security core including an integrated TCM trusted cryptographic module and a computing core running a BMC boot program and an operating system kernel. After the boot program is added to the security core ROM, the security core main controller CPU s During the stage of running the security core ROM code, the security core firmware running on it is measured for trustworthiness, and after the measurement is passed, the security core firmware is loaded, and then the centralized active measurement module of the security core firmware is used to complete the trustworthiness measurement of the BMC boot layer, BMC kernel layer and host side BIOS on the computing core, start the BMC firmware boot program UBOOT, load the BMC kernel, and then start the multi-core BMC firmware system to realize a trusted system. The present invention has the advantages of improving the measurement startup efficiency, overcoming safety hazards, being fully localized, and being easy to promote.

Description

Technical Field

[0001] The invention discloses a trusted startup method for a multi-core BMC firmware system, belonging to the technical field of trusted startup of a BMC firmware system. Background Art

[0002] The Baseboard Management Controller (BMC) is a control unit deployed on the server motherboard with independent power supply and independent I / O interface. It does not rely on the server's processor, Basic Input Output System (BIOS) or operating system to work. It is an agentless management subsystem that runs independently in the server. BMC consists of two parts: hardware chip and firmware software. Its software is at risk of being tampered with.

[0003] The server startup process first powers on the BMC, and then powers on the mainboard. Since the BMC is powered on first, it can obtain control of the system, so the BMC is particularly important for server security. During the startup phase of the BMC firmware system, due to the lack of a reasonable security mechanism, its software is more likely to be attacked and tampered with, and it is more difficult to detect. Therefore, to solve the security issues of the BMC firmware system, it is necessary to start from the startup phase of the BMC firmware system.

[0004] As the current processor architecture gradually evolves towards diversification, the central processing unit (CPU) architecture has evolved from the traditional single-core to multi-core parallel. The multi-core heterogeneous processor architecture is also an excellent carrier for the safe operation of the BMC firmware system, so the secure boot of the multi-core BMC firmware system will be a sensitive issue. Therefore, how to use a secure and trusted core to ensure the smooth execution of the BMC firmware program on another untrusted core is the key to solving this problem.

[0005] The invention with the publication number CN 109740353 A and the name “A trusted boot method for the BMC firmware of a server” belongs to the field of secure and trusted boot of the server BMC firmware. It is characterized in that, in a system composed of a BMC chip, a BMC Flash, a BMC firmware, and a trusted cryptographic module, when the BMC firmware is released, the hash value of each part of the BMC firmware is calculated and stored using the trusted cryptographic module. After the BMC chip is powered on, the trusted cryptographic module is called to measure the BMC kernel after UBOOT is started, and then after the BMC kernel is started, the BMC kernel calls the trusted cryptographic module to measure UBOOT and BMC application in turn, and all the measurement results are compared and run after they are all consistent. The transmission mode of the trust chain is chain-type, relying on the trusted cryptographic module, and the measurement order is BMC kernel, UBOOT, and BMC application. However, the mutual verification idea of ​​starting first and then measuring is followed in the UBOOT and BMC kernel parts, which will affect security.

[0006] The invention with the publication number CN 111125707 A and the name "A BMC secure boot method, system and device based on a trusted cryptographic module" relates to the field of server security technology. It is characterized in that a trusted computing mechanism is introduced into an ordinary BMC to realize a server out-of-band management module with a trusted measurement function. The trusted cryptographic module is introduced to measure the BMC firmware. First, the CPLD is trusted. After confirming that the CPLD is correct, the power-on function of the BMC is realized and the boot layer, BMC operating system image and BIOS of the BMC are trusted in turn. After verification, the server host operating system is started. The transmission mode of the trust chain is chain-type, relying on the trusted cryptographic module. The measurement order is CPLD, BMC boot layer, BMC operating system image, and BIOS image, which can prevent firmware-level attacks on the server and improve the trusted startup model of the server. However, the transmission mode of the trust chain of this patent is chain-type. First, the power-on module of the BMC must be measured. There are too many nodes, the trust chain is too long, the startup efficiency is not high, and trust loss may occur.

[0007] The invention with the publication number CN 108460282 A and the name "A computer security boot method based on heterogeneous multi-core chips" relates to the field of modern computer security boot technology. It is characterized in that based on a heterogeneous multi-core platform, at least one trusted core is used to ensure the security of the untrusted core, the trusted core is used as a monitoring core, and the untrusted core is used as a computing core. The trusted core and the untrusted core communicate through shared memory and the cooperation of inter-core interrupts. The trusted core is booted using an independently developed system and provides security services to the outside world, while the untrusted core is booted using the UEFI system. The boot process first controls the startup of the trusted core, completes the initialization of the exclusive hardware, and then starts the startup of the untrusted core. The trusted core decrypts the digital signature of the functional component and measures the integrity by calling the security service of the TPM to ensure the secure startup of the untrusted core. However, the patent does not use the domestically produced trusted cryptographic module TCM, which does not meet national standards, and requires modification of the computer hardware structure, and is not universal.

[0008] The BMC trusted startup method proposed in the above patent application either follows the idea of ​​starting first and then measuring, which cannot guarantee security; or follows the chain-type transmission of the trust chain, which has low startup efficiency; or uses a cryptographic chip TPM that does not comply with the standard of my country's "Trusted Cryptographic Support Platform Function and Interface Specification", which cannot achieve autonomous control. In response to the above problems, the present invention, under the premise of a BMC firmware system serving a multi-core heterogeneous platform, uses a trusted core externally connected to a trusted cryptographic module, follows the idea of ​​measuring first and then starting, and adopts a traditional chain-type plus star-type trust chain structure to propose a trusted startup method for a multi-core BMC firmware system. Summary of the invention

[0009] The present invention is based on a heterogeneous multi-core chip, in which there are secure trusted cores and untrusted cores, which are called security cores and computing cores. The security core integrates the security service of TCM (Trusted Cryptography Module) as TPCM (Trusted Platform Control Module) to achieve autonomous control of the multi-core heterogeneous platform; the firmware system follows the idea of ​​measuring first and then starting, and completes the self-check of the security core with the structure of the traditional chain trust chain. The centralized active measurement module in the security core firmware will actively measure the BMC firmware program running on the computing core with a star-shaped trust chain structure.

[0010] The present invention includes a security core integrating a TCM trusted cryptographic module and a computing core running a BMC boot program and an operating system kernel for a heterogeneous multi-core BMC firmware system. By implementing a self-check of the security core, that is, performing a trusted measurement on the security core firmware running on the security core during the security core ROM code running stage, and loading the security core firmware if the measurement passes; completing the trusted measurement of the BMC boot layer, BMC kernel layer, and host-side BIOS on the computing core through the centralized active measurement module of the security core firmware, starting the BMC firmware boot program UBOOT after completing the above trusted measurement, and then UBOOT boots and loads the BMC kernel, and then continues to start the multi-core BMC firmware system.

[0011] From a structural perspective, the measurement process of the multi-core BMC firmware system can be divided into two parts according to the two cores: self-test measurement of the security core and centralized active measurement of the computing core running firmware; from the firmware perspective, it can be divided into four parts: security core firmware, UBOOT, BMC operating system kernel, and host BIOS. The corresponding last three firmware codes are stored in different allocated locations in the non-volatile storage area, and are copied to the specified location of the shared memory by NV and SFC drivers respectively. After completing the phased trusted measurement, the multi-core BMC firmware system will be started.

[0012] The present invention is characterized in that it is implemented in a trusted boot system of a multi-core BMC firmware system by sequentially following the following steps:

[0013] Step (1), system construction:

[0014] The trusted boot system of the multi-core BMC firmware system, hereinafter referred to as the system, includes: a trusted platform control module TPCM that integrates the trusted cryptographic module TCM security service to realize the security core of the multi-core heterogeneous platform self-check and a computing core that runs the BMC boot program and the operating system kernel. The two communicate through shared memory and the cooperation of inter-core interrupts.

[0015] Established within the security core are:

[0016] Read Only Memory ROM,

[0017] Safety core master CPUs,

[0018] The centralized active measurement module includes, from bottom to top, the following modules: security core firmware, UBOOT measurement module, BMC kernel program measurement module, and BIOS measurement module.

[0019] The computing core has: a BMC related firmware program formed by connecting a BMC boot layer, a BMC kernel layer, and a BMC application software layer in sequence from bottom to top, and a computing core main controller CPUc as a core;

[0020] Step (2), multi-core BMC firmware development phase:

[0021] The developer adds the code for measuring and starting the security core firmware in the security core read-only memory ROM, which exists as the boot program of the entire BMC firmware system;

[0022] Step (3), initialization phase of the multi-core BMC firmware system:

[0023] Step (3.1), initialize four storage spaces in the non-volatile memory of the TCM chip connected to the security core as the standard reference value library, and store the initial reference values ​​of the security core firmware code segment, UBOOT code segment, BMC operating system kernel image code segment and host BIOS code segment respectively, which are the standard reference values.

[0024] The standard reference value library and a national secret SM3 cryptographic hash algorithm module are interconnected to form a TCM trusted cryptographic module.

[0025] Step (3.2), four storage areas are divided in the non-volatile memory of the BMC firmware, which are respectively stored after the code segments of the image files of the security core firmware, UBOOT, BMC operating system kernel and host BIOS that will be read in the following centralized active measurement stage, so as to be used for calculating each actual benchmark value from the corresponding three subsequent code segments;

[0026] Step (4): the system performs the trust measurement of the multi-core BMC firmware system according to the following steps:

[0027] Step (4.1), safety core self-check measurement phase:

[0028] Step (4.1.1), after the BMC firmware system is powered on, the safety core main controller CPUs reads the code segment content of the safety core firmware under the guidance of the system boot program in the safety core ROM, and then calculates the actual reference value of the safety core firmware code segment through the national secret SM3 cryptographic hash algorithm in the trusted cryptographic module TCM.

[0029] Step (4.1.2), read the initial reference value of the security core firmware code segment stored in the non-volatile memory in the TCM chip through the reading function of the non-volatile memory NV READ, and then check whether it is the same as the corresponding actual reference value calculated in step (4.1.1),

[0030] Step (4.1.3), if they are the same, then enter the centralized active measurement stage; if they are not the same, then the CPUs issue an alarm message and stop the subsequent measurement process.

[0031] Step (4.2), centralized active measurement phase:

[0032] Step (4.2.1), the CPUs run the security core firmware code under the guidance of the security core ROM code, and run to the centralized active measurement module, and read the contents of the code segments of each UBOOT, BMC operating system kernel and host BIOS respectively according to the structure of the star trust chain, and call the trusted password module to calculate the corresponding actual benchmark values.

[0033] Step (4.2.2), through the NV READ reading function, respectively read out the initial reference values ​​of the UBOOT code segment, the BMC operating system kernel image code segment and the host BIOS code segment stored in the non-volatile memory in the TCM chip, and determine whether they are the same as the actual reference values ​​calculated in step (4.2.1),

[0034] Step (4.2.3), if they are all the same, the trust measurement phase of the multi-core BMC firmware system is completed, starting from starting UBOOT, and starting the multi-core BMC firmware system; if there is at least one difference, the CPUs issue an alarm message and stop the system startup;

[0035] Step (5), start the multi-core BMC firmware system:

[0036] Step (5.1), start the security core firmware, the CPUs determine:

[0037] If the security core firmware is credible, the boot process loads the security core firmware, runs to the centralized active measurement module, and loads and runs the BMC-related firmware programs on the computing core; if the security core firmware is not credible, the boot process of the multi-core BMC firmware is terminated.

[0038] Step (5.2), start the CPUc to run BMC related firmware on the computing core to determine whether UBOOT, BMC operating system kernel and host BIOS are credible:

[0039] If it is credible, the CPUc executes the UBOOT firmware boot program on the computing core, initializes the BMC hardware device, loads the BMC operating system kernel, and enters the safe and credible operation phase of the multi-core BMC firmware system; if it is not credible, the startup of the multi-core BMC firmware system is terminated.

[0040] The advantages of the present invention are: the present invention proposes a complete trusted startup method for multi-core BMC, follows the idea of ​​measuring first and then starting, relies on a trusted cryptographic module to provide a cryptographic algorithm and initializes the standard reference value library to store reference values, and according to the actual application scenario, adopts a traditional chain plus star trust chain structure, and completes the trusted startup of the system through centralized active measurement. Compared with previous research schemes, it is no longer necessary to use a special Unicore processor, and the measurement method is fully disclosed, which improves universality, increases the number of measurement layers, and adds a safety core self-check measurement stage, which can better ensure the security of the BMC system startup initialization stage, relies on a trusted cryptographic module to meet national safety standards, and uses centralized active measurement to enrich the measurement objects and optimize the measurement efficiency. BRIEF DESCRIPTION OF THE DRAWINGS

[0041] Figure 1 :System main program flow chart.

[0042] Figure 2 : Overall system structure diagram. DETAILED DESCRIPTION

[0043] The present invention controls the security core and computing core respectively through the corresponding central controller, and stores BMC related firmware in the non-volatile memory. The startup sequence of the proposed BMC firmware system startup method is either to measure while starting, or to start first and then measure. Some startup methods use specific processors and chips, which are not universal. The related functions of specific processors are not fully disclosed, which is not conducive to development and use. In view of these shortcomings, the present invention uses the security core main controller CPU s Add a safety core self-test measurement module, relying on the computing core master CPU c Complete the booting of BMC-related firmware and operating system, and propose solutions.

[0044] Abandon the use of TPM trusted platform module and use TCM trusted cryptographic module instead, use domestic TCM chips, and apply national secret hash algorithm to achieve independent control of BMC firmware system measurement startup process; there is no need to use special Unicore processors, and general processor chips can be used, which is more versatile; add security core self-check measurement module and centralized active measurement module, and perform parallel measurement of BMC related firmware in the form of star trust chain, increase measurement objects and measurement layers, improve measurement efficiency, and be more secure.

Claims

1. A trusted boot method for a multi-core BMC firmware system, characterized in that: It is implemented in the trusted boot system of a multi-core BMC firmware system by following the following steps: Step (1), system construction: The trusted boot system of the multi-core BMC firmware system, hereinafter referred to as the system, includes: a trusted platform control module TPCM that integrates the trusted cryptographic module TCM security service to realize the security core of the multi-core heterogeneous platform self-check and a computing core that runs the BMC boot program and the operating system kernel. The two communicate through shared memory and the cooperation of inter-core interrupts. Established within the security core are: Read Only Memory ROM, Safety core master CPU s , The centralized active measurement module includes, from bottom to top, the following modules: security core firmware, UBOOT measurement module, BMC kernel program measurement module, and BIOS measurement module. The computing core has: a BMC-related firmware program formed by connecting the BMC boot layer, the BMC kernel layer, and the BMC application software layer in sequence from bottom to top, and a computing core main controller CPU as the core. c ; Step (2), multi-core BMC firmware development phase: The developer adds the code for measuring and starting the security core firmware in the security core read-only memory ROM, which exists as the boot program of the entire BMC firmware system; Step (3), initialization phase of the multi-core BMC firmware system: Step (3.1), initialize four storage spaces in the non-volatile memory of the TCM chip connected to the security core as the standard reference value library, and store the initial reference values ​​of the security core firmware code segment, UBOOT code segment, BMC operating system kernel image code segment and host BIOS code segment respectively, which are the standard reference values. The standard reference value library and a national secret SM3 cryptographic hash algorithm module are interconnected to form a TCM trusted cryptographic module. Step (3.2), four storage areas are divided in the non-volatile memory of the BMC firmware, which are respectively stored after the code segments of the image files of the security core firmware, UBOOT, BMC operating system kernel and host BIOS that will be read in the following centralized active measurement stage, so as to be used for calculating each actual benchmark value from the corresponding three subsequent code segments; Step (4): the system performs the trust measurement of the multi-core BMC firmware system according to the following steps: Step (4.1), safety core self-check measurement phase: Step (4.1.1), after the BMC firmware system is powered on, the safety core main controller CPU s Under the guidance of the system boot program in the security core ROM, the code segment content of the security core firmware is read, and then the actual baseline value of the security core firmware code segment is calculated through the national secret SM3 cryptographic hash algorithm in the trusted cryptographic module TCM. Step (4.1.2), read the initial reference value of the security core firmware code segment stored in the non-volatile memory in the TCM chip through the reading function of the non-volatile memory NV READ, and then check whether it is the same as the corresponding actual reference value calculated in step (4.1.1), Step (4.1.3), if they are the same, then enter the centralized active measurement stage; if they are not the same, then the CPU s Issue an alarm and stop the subsequent measurement process. Step (4.2), centralized active measurement phase: Step (4.2.1), the CPU s Under the guidance of the security core ROM code, the security core firmware code is run until it reaches the centralized active measurement module. According to the structure of the star-shaped trust chain, the contents of the code segments of each UBOOT, BMC operating system kernel and host BIOS are read respectively, and the trusted password module is called to calculate the corresponding actual benchmark values. Step (4.2.2), through the NV READ reading function, respectively read out the initial reference values ​​of the UBOOT code segment, the BMC operating system kernel image code segment and the host BIOS code segment stored in the non-volatile memory in the TCM chip, and determine whether they are the same as the actual reference values ​​calculated in step (4.2.1), Step (4.2.3), if they are the same, then the trusted measurement phase of the multi-core BMC firmware system is completed, starting from starting UBOOT, starting the multi-core BMC firmware system; if there is at least one difference, then the CPU s Issue an alarm message and stop the system startup; Step (5): Start the multi-core BMC firmware system Step (5.1), start the security core firmware, the CPU s determination: If the security core firmware is credible, the boot process loads the security core firmware, runs to the centralized active measurement module, and loads and runs the BMC-related firmware programs on the computing core; if the security core firmware is not credible, the boot process of the multi-core BMC firmware is terminated. Step (5.2), start the CPU c Run BMC-related firmware on the computing core to determine whether UBOOT, BMC operating system kernel, and host BIOS are trustworthy: If credible, the CPU c The UBOOT firmware boot program is executed on the computing core to initialize the BMC hardware device, load the BMC operating system kernel, and enter the secure and trusted operation phase of the multi-core BMC firmware system; if it is not trusted, the startup of the multi-core BMC firmware system is terminated.

Images