A BMC-based firmware security upgrade system, method, device and medium

Abstract

The application provides a BMC-based firmware security upgrade system, method, device and medium, the system comprises: a firmware encryption package generation module, a firmware upgrade control module and a firmware upgrade validation module; the firmware encryption package generation module is used for generating a firmware encryption package according to upgrade requirements, the firmware encryption package comprises a firmware name to be upgraded, a collocation and dependency relationship description file of the firmware to be upgraded, a target version file of the firmware to be upgraded and an intermediate firmware version file depended by the target version file; the firmware upgrade control module is used for parsing the firmware encryption package through the BMC and performing firmware upgrade process control; and the firmware upgrade validation module is used for starting corresponding validation actions according to the firmware after the upgrade is completed. The application realizes automatic upgrading of a device with an arbitrary version firmware combination to a specified version according to the dependency relationship of the firmware, without manual intervention and upgrade sequence formulation, and ensures the reliability of the upgrade process.

Description

TECHNICAL FIELD

[0001] The present application relates to the technical field of computer, more particularly, to a BMC-based firmware security upgrade system, method, device and medium. BACKGROUND

[0002] BMC (Baseboard Manager Controller) is mainly applied in servers and white-box switches, and mainly shoulders the responsibility of device management. Firmware upgrade is a very important function in BMC whole machine management. BMC firmware upgrade refers to the upgrade management of device firmware through BMC, including BMC, BIOS, CPLD, FPGA, PSU and other firmware.

[0003] In the prior art, when upgrading firmware through BMC, a single image is generally used to upgrade a single firmware, and the single image is encrypted and security checked. However, using this method to upgrade firmware can only upgrade specified images after evaluating the images to be upgraded in the whole machine. Moreover, when upgrading multiple firmware, the firmware upgrade sequence can only be controlled manually, and if the firmware upgrade has a dependency relationship, the upgrade sequence can only be controlled manually, and the upgrade security cannot be effectively controlled. In addition, for various firmware versions of devices to be upgraded, firmware upgrade schemes need to be analyzed manually. Therefore, the prior art has the defects of high labor input and unreliable manual execution. SUMMARY

[0004] To solve the above problems, the present application provides a BMC-based firmware security upgrade system, method, device and medium.

[0005] To achieve the above purpose, the present application realizes the following technical scheme: a BMC-based firmware security upgrade system, comprising: a firmware encryption package generation module, a firmware upgrade control module and a firmware upgrade validation module; the firmware encryption package generation module is used to generate a firmware encryption package according to upgrade requirements, the firmware encryption package comprising the firmware name to be upgraded, the collocation and dependency relationship description file of the firmware to be upgraded, the target version file of the firmware to be upgraded and the intermediate firmware version file it depends on; the firmware upgrade control module is used to parse the firmware encryption package through BMC and control the firmware upgrade process; the firmware upgrade validation module is used to start the corresponding validation action according to the firmware that has completed the upgrade.

[0006] Further, the firmware to be upgraded comprises any one or any combination of BMC firmware, BIOS firmware, CPLD firmware, FPGA firmware and PSU firmware.

[0007] Further, the dictionary information describing the information of the firmware to be upgraded is recorded in the description file of the collocation and dependency relationship of the firmware to be upgraded, and the dictionary information specifically includes the following information:

[0008] version information, used for describing the latest version information of the firmware and the target version of the firmware to be upgraded;

[0009] depends information, used for describing the minimum version information of other firmware that needs to be depended on for normal running of the firmware;

[0010] need information, used for describing the dependency relationship of the firmware upgrade.

[0011] Further, the firmware encryption package generation module is specifically used for generating an upgrade package according to an upgrade requirement, and encrypting and signing the upgrade package by using a preset signature and secret means, so as to generate the firmware encryption package.

[0012] Correspondingly, the application further discloses a BMC-based firmware security upgrade method, which comprises the following steps:

[0013] determining firmware version information to be upgraded;

[0014] generating a firmware encryption package according to the firmware version information to be upgraded;

[0015] analyzing the firmware encryption package by using the BMC and performing firmware upgrade process control;

[0016] starting corresponding effective actions according to the firmware after the upgrade is completed.

[0017] Further, the firmware encryption package is generated according to the firmware version information to be upgraded, and the firmware encryption package generation method comprises the following steps:

[0018] determining the firmware name to be upgraded, the collocation and dependency relationship of the firmware to be upgraded, the target version file of the firmware to be upgraded and the intermediate firmware version information depended on, and generating a corresponding firmware encryption package according to the firmware version information to be upgraded; the firmware encryption package includes a description file fw.json used for firmware collocation and dependency relationship.

[0019] Further, the firmware encryption package is analyzed by using the BMC, and the firmware upgrade process control comprises the following steps:

[0020] performing integrity and signature verification of the firmware encryption package by using a general mode;

[0021] obtaining firmware version information of a current device by using the BMC;

[0022] analyzing the fw.json file to obtain target version information of the firmware to be upgraded;

[0023] Parse the fw.json file to obtain the compatibility relationships between firmware components;

[0024] Parse the fw.json file to obtain strong dependencies between firmware versions;

[0025] The firmware upgrade process is executed based on the acquired data. If the firmware cannot be upgraded to the specified version in one attempt, a pending upgrade flag is set.

[0026] After the firmware upgrade process is completed, if an upgrade flag is detected, the corresponding firmware will continue to be upgraded until the firmware is upgraded to the specified version.

[0027] Furthermore, the step of initiating the corresponding activation action based on the upgraded firmware includes:

[0028] If the upgraded firmware is BMC firmware, then perform a BMC reboot to make the firmware take effect.

[0029] If the upgraded firmware is BIOS firmware, then the firmware will take effect by performing a CPU power cycle.

[0030] If the upgraded firmware is CPLD firmware, then the firmware will take effect by refreshing the file or by controlling the CPU to power off.

[0031] If the upgraded firmware is FPGA firmware, the firmware will take effect by controlling the CPU to power off.

[0032] Accordingly, this invention discloses a firmware security upgrade device based on BMC, comprising:

[0033] Memory used to store BMC-based firmware security upgrade programs;

[0034] A processor, configured to implement the steps of the BMC-based firmware security upgrade method as described above when executing the BMC-based firmware security upgrade program.

[0035] Accordingly, the present invention discloses a readable storage medium storing a firmware security upgrade program based on BMC, wherein when the firmware security upgrade program based on BMC is executed by a processor, it implements the steps of the firmware security upgrade method based on BMC as described in any of the above.

[0036] Compared with the prior art, the application has the beneficial effects that the application provides a BMC-based firmware security upgrade system, method, device and medium, realizes automatic upgrade of a device with an arbitrary version firmware combination to a specified version according to the dependency relationship of the firmware, does not need manual intervention and upgrade sequence, guarantees the reliability of the upgrade process, avoids the need for manual analysis of the upgrade device to form an upgrade scheme due to the complexity of the firmware version dependency relationship, reduces the labor input, and avoids the unreliability of manual execution.

[0037] Therefore, compared with the prior art, the application has outstanding substantial characteristics and significant progress, and the beneficial effects of the implementation are also obvious. BRIEF DESCRIPTION OF DRAWINGS

[0038] In order to more clearly illustrate the technical solutions in the embodiments of the application or the prior art, the following will briefly introduce the drawings needed to be used in the embodiments or the prior art description. Obviously, the drawings in the following description are only embodiments of the application, and for those skilled in the art, other drawings can also be obtained without creative labor on the basis of the provided drawings.

[0039] Figure 1 is a system structure diagram of the embodiment of the application.

[0040] Figure 2 is a method flowchart of the embodiment of the application.

[0041] In the figure, 1 is a firmware encryption package generation module; 2 is a firmware upgrade control module; and 3 is a firmware upgrade validation module. DETAILED DESCRIPTION

[0042] The core of the application is to provide a BMC-based firmware security upgrade method. In the prior art, when upgrading firmware through BMC, a single image is generally used to upgrade a single firmware, and the single image is encrypted and security checked. However, using this method to upgrade firmware, the whole machine to be upgraded image is evaluated, and only the specified image can be upgraded. Moreover, when multiple firmware upgrades are performed, the firmware upgrade sequence can only be controlled manually. If there is a dependency relationship in the firmware upgrade, the upgrade sequence can only be controlled manually, and the upgrade security cannot be effectively grasped. In addition, for various firmware versions of the to-be-upgraded device, manual analysis of the firmware upgrade scheme is also needed. It can be seen that the prior art has the defects of high labor input and unreliable manual execution.

[0043] The firmware security upgrade method based on BMC provided by this invention first determines the firmware version information to be upgraded and generates a firmware encryption package based on the firmware version information. Then, the firmware encryption package is parsed through BMC, and the firmware upgrade process is controlled. Finally, the corresponding activation actions are initiated based on the upgraded firmware. Therefore, this invention enables devices with any combination of firmware versions to automatically upgrade to a specified version according to firmware dependencies, without manual intervention or the determination of the upgrade order. This ensures the reliability of the upgrade process, avoids the need for manual analysis of the devices to be upgraded and the formation of upgrade plans due to complex firmware version dependencies, reduces manpower input, and avoids the unreliability of manual execution.

[0044] To enable those skilled in the art to better understand the present invention, the invention will be further described in detail below with reference to the accompanying drawings and specific embodiments. Obviously, the described embodiments are merely some embodiments of the present invention, and not all embodiments. Based on the embodiments of the present invention, all other embodiments obtained by those skilled in the art without creative effort are within the scope of protection of the present invention.

[0045] Example 1:

[0046] like Figure 1 As shown, this embodiment provides a firmware security upgrade system based on BMC, including: a firmware encryption package generation module 1, a firmware upgrade control module 2, and a firmware upgrade activation module 3.

[0047] Firmware encryption package generation module 1 is used to generate firmware encryption packages according to upgrade requirements. Specifically, it is used to: generate an upgrade package according to upgrade requirements, and encrypt and sign the upgrade package using preset signature and confidentiality methods to generate the firmware encryption package.

[0048] The firmware encryption package includes the name of the firmware to be upgraded, a description file of the firmware to be upgraded and its dependencies, the target version file of the firmware to be upgraded and the intermediate firmware version files it depends on.

[0049] As an example, the firmware encryption package contains all the firmware that needs to be upgraded via BMC, including: BMC firmware, BIOS firmware, CPLD firmware, FPGA firmware, PSU firmware, etc.

[0050] The firmware encryption package contains a description of firmware configuration and dependencies (fw.json file). For example:

[0051]

[0052]

[0053] As shown above, the JSON file contains the following content:

[0054] Dictionary information describing the firmware to be upgraded: such as "BMC":{}.

[0055] The firmware to be upgraded contains the following information:

[0056] "version": Describes the latest version of the firmware and the target version to be upgraded.

[0057] "depends": Describes the version information that this firmware depends on, that is, the minimum version information of other firmware that this firmware needs to run normally.

[0058] "need": This describes the dependencies of the BMC firmware. For example, if you want to upgrade the CPLD feature raw version, you need to upgrade the feature raw version first before you can upgrade the CPLD version normally.

[0059] In this context, "BMC": "2.0.0" indicates that if the BMC firmware to be upgraded is lower than version 2.0.0, the CPLD version needs to be upgraded to version 2.0.0 or higher first. "refresh": false indicates whether this dependency relationship needs to be restarted before other firmware upgrades can take effect.

[0060] In addition, the firmware encryption package also contains the target version required for firmware upgrades and the intermediate firmware versions it depends on.

[0061] Firmware upgrade control module 2 is used to parse firmware encrypted packets through the BMC and control the firmware upgrade process. Firmware upgrade process control includes controlling the firmware to be upgraded and the firmware upgrade sequence. Specifically, firmware upgrade control module 2 is used to: perform upgrade package integrity and signature verification using a general mode to ensure the integrity and reliability of the upgrade package; parse firmware encrypted packets and specify the upgrade plan.

[0062] Firmware upgrade activation module 3 is used to initiate the corresponding activation action based on the upgraded firmware.

[0063] This module categorizes firmware upgrade activation actions into the following types:

[0064] 1. BMC firmware activation method: BMC reboot.

[0065] 2. BIOS firmware activation method: CPU power cycle.

[0066] 3. CPLD firmware activation method: using a refresh file or CPU power off.

[0067] 4. FPGA firmware activation method: CPU power off.

[0068] 5. Firmware activation: A combination of reboot + refresh + CPU power off is used.

[0069] This embodiment provides a firmware security upgrade system based on BMC, which enables devices with any combination of firmware versions to automatically upgrade to a specified version according to firmware dependencies, without manual intervention or setting the upgrade order. This ensures the reliability of the upgrade process and avoids the need for manual analysis of the devices to be upgraded to form an upgrade plan due to complex firmware version dependencies, thereby reducing manpower input and avoiding the unreliability of manual execution.

[0070] Example 2:

[0071] Based on Example 1, such as Figure 2 As shown, this invention also discloses a firmware security upgrade method based on BMC, comprising the following steps:

[0072] S1: Determine the firmware version information to be upgraded.

[0073] Based on the upgrade requirements, determine the basic information such as the name and version number of the firmware to be upgraded.

[0074] S2: Generate a firmware encryption package based on the firmware version information to be upgraded.

[0075] Specifically, based on the firmware version information to be upgraded, the name of the firmware to be upgraded, the matching and dependencies of the firmware to be upgraded, the target version file of the firmware to be upgraded and the intermediate firmware version information it depends on are determined, and a corresponding firmware encryption package is generated; the firmware encryption package includes a description file fw.json for firmware matching and dependencies.

[0076] S3: Uses BMC to parse firmware encryption packages and control the firmware upgrade process.

[0077] This step specifically includes the following process:

[0078] 1. Use a general mode to verify the integrity and signature of the firmware encryption package;

[0079] 2. Obtain the current device firmware version information via BMC;

[0080] 3. Parse the fw.json file to obtain the target version information of the firmware to be upgraded;

[0081] 4. Parse the fw.json file to obtain the compatibility relationships between firmware components;

[0082] 5. Parse the fw.json file to obtain strong dependencies between firmware versions;

[0083] 6. Execute the firmware upgrade process based on the acquired data.

[0084] 7. During the upgrade process, if an upgrade fails to reach the specified firmware version in one attempt, a pending upgrade flag is set. After the firmware upgrade process is complete, if the pending upgrade flag is detected, the corresponding firmware upgrade operation continues until the firmware is upgraded to the specified version. In other words, after the above process, if an upgrade fails to reach the specified firmware version in one attempt, a pending upgrade flag is set. After the entire device refresh process, if this flag is detected, the version upgrade operation continues until the specified version is reached.

[0085] The above steps reveal how many firmware versions the device needs upgrading, and whether there are compatibility or dependency relationships between these firmware versions. If a compatibility relationship exists (the compatible firmware may not yet be released), and the upgrade package cannot satisfy this relationship, the upgrade will abort with an error message. If a dependency relationship exists, and the upgrade package cannot satisfy this dependency, the upgrade will abort with an error message. If the dependency relationship contains a configuration with `refresh` set to `true`, it means that the specified dependency version needs to be upgraded first, and a full device refresh must take effect before proceeding with subsequent firmware version upgrades.

[0086] As can be seen, through this step, BMC will specify the corresponding upgrade order or require special upgrade processing based on the differences between the current firmware version and the target firmware version, and execute the upgrade actions in sequence until the firmware is upgraded to the target version.

[0087] S4: Initiate the corresponding activation actions based on the upgraded firmware.

[0088] Specifically, it includes:

[0089] If the upgraded firmware is BMC firmware, then perform a BMC reboot to make the firmware take effect.

[0090] If the upgraded firmware is BIOS firmware, then the firmware will take effect by performing a CPU power cycle.

[0091] If the upgraded firmware is CPLD firmware, then the firmware will take effect by refreshing the file or by controlling the CPU to power off.

[0092] If the upgraded firmware is FPGA firmware, the firmware will take effect by controlling the CPU to power off.

[0093] Based on the above method description, to better understand the execution process of this method, taking the application in white-box switch products and upgrading the firmware of BMC, BIOS, CPLD, and FPGA via BMC as an example, the specific execution process of the firmware security upgrade method based on BMC is as follows:

[0094] 1. The firmware version information of the device to be upgraded is as follows:

[0095] BMC: 1.0.0, BIOS: 1.0.0, CPLD: 1.0.0, FPGA: 1.0.0.

[0096] 2. The generated upgrade package contains the following:

[0097] Includes BMC firmware versions 3.0.0 and 2.0.0.

[0098] Includes BIOS firmware version 3.0.0

[0099] Includes CPLD firmware versions 3.0.0 and 2.0.0.

[0100] Includes FPGA firmware: version 3.0.0.

[0101] The fw.json file, used for firmware compatibility and dependency descriptions, contains the following:

[0102]

[0103]

[0104] 3. BMC automatically parses the fw.json file and performs the following upgrades based on dependencies:

[0105] a. Set the upgrade flag.

[0106] b. Upgrade BMC to version 2.0.0.

[0107] c. Upgrade CPLD to version 2.0.0.

[0108] d. Full machine refresh operation.

[0109] e.BMC startup completes the upgrade check and the upgrade flag is set. Continue upgrading, and parsing the fw.json file reveals no upgrade dependencies.

[0110] f. Upgrade the BMC, BIOS, CPLD, and FPGA in the default order.

[0111] g. After the upgrade is complete, perform a full system refresh process.

[0112] 4. After the entire device upgrade is completed, check if the firmware version matches the target version and clear the upgrade flag.

[0113] This embodiment provides a firmware security upgrade method based on BMC (Browser Control Center), which enables devices with any combination of firmware versions to automatically upgrade to a specified version according to firmware dependencies. This eliminates the need for manual intervention and specifying the upgrade order, ensuring the reliability of the upgrade process. It avoids the need for manual analysis of the devices to be upgraded and the creation of upgrade plans due to complex firmware version dependencies, reducing manpower and avoiding the unreliability of manual execution. This method can be applied not only to switch products but also to the upgrade management of servers and other devices.

[0114] Example 3:

[0115] This embodiment discloses a firmware security upgrade device based on BMC, including a processor and a memory; wherein, when the processor executes the firmware security upgrade program based on BMC stored in the memory, it performs the following steps:

[0116] 1. Determine the firmware version information to be upgraded.

[0117] 2. Generate a firmware encryption package based on the firmware version information to be upgraded.

[0118] 3. Use BMC to parse the firmware encryption package and control the firmware upgrade process.

[0119] 4. Initiate the corresponding activation actions based on the upgraded firmware.

[0120] Furthermore, the firmware security upgrade device based on BMC in this embodiment may also include:

[0121] The input interface is used to acquire externally imported BMC-based firmware security upgrade programs and save them to the memory. It can also acquire various instructions and parameters transmitted from external terminal devices and transmit them to the processor, allowing the processor to perform corresponding processing using these instructions and parameters. In this embodiment, the input interface may specifically include, but is not limited to, a USB interface, a serial interface, a voice input interface, a fingerprint input interface, and a hard disk read interface.

[0122] An output interface is used to output various data generated by the processor to connected terminal devices, so that other terminal devices connected to the output interface can obtain the various data generated by the processor. In this embodiment, the output interface may specifically include, but is not limited to, a USB interface, a serial interface, etc.

[0123] A communication unit is used to establish a remote communication connection between the BMC-based firmware security upgrade device and an external server, so that the BMC-based firmware security upgrade device can mount the image file to the external server. In this embodiment, the communication unit may specifically include, but is not limited to, a remote communication unit based on wireless communication technology or wired communication technology.

[0124] The keyboard is used to acquire various parameter data or commands input by the user through real-time keystrokes.

[0125] The monitor is used to display relevant information in real time regarding the process of locating a short circuit in the server's power supply line.

[0126] A mouse can be used to assist users in inputting data and simplifying user operations.

[0127] Example 4:

[0128] This embodiment also discloses a readable storage medium, which includes random access memory (RAM), main memory, read-only memory (ROM), electrically programmable ROM, electrically erasable programmable ROM, registers, hard disk, removable hard disk, CD-ROM, or any other form of storage medium known in the art. The readable storage medium stores a BMC-based firmware security upgrade program, which, when executed by a processor, performs the following steps:

[0129] 1. Determine the firmware version information to be upgraded.

[0130] 2. Generate a firmware encryption package based on the firmware version information to be upgraded.

[0131] 3. Use BMC to parse the firmware encryption package and control the firmware upgrade process.

[0132] 4. Initiate the corresponding activation actions based on the upgraded firmware.

[0133] In summary, this invention enables devices with any combination of firmware versions to automatically upgrade to a specified version according to firmware dependencies, without manual intervention or the need to determine the upgrade order. This ensures the reliability of the upgrade process, avoids the need for manual analysis of the devices to be upgraded and the formation of upgrade plans due to complex firmware version dependencies, reduces manpower input, and avoids the unreliability of manual execution.

[0134] The various embodiments in this specification are described in a progressive manner, with each embodiment focusing on its differences from other embodiments. Similar or identical parts between embodiments can be referred to interchangeably. The methods disclosed in the embodiments are described simply because they correspond to the systems disclosed in the embodiments; relevant details can be found in the method section.

[0135] Those skilled in the art will further recognize that the units and algorithm steps of the various examples described in conjunction with the embodiments disclosed herein can be implemented in electronic hardware, computer software, or a combination of both. To clearly illustrate the interchangeability of hardware and software, the components and steps of the various examples have been generally described in terms of functionality in the foregoing description. Whether these functions are implemented in hardware or software depends on the specific application and design constraints of the technical solution. Those skilled in the art can use different methods to implement the described functions for each specific application, but such implementations should not be considered beyond the scope of this invention.

[0136] In the embodiments provided by this invention, it should be understood that the disclosed systems, methods, and approaches can be implemented in other ways. For example, the system embodiments described above are merely illustrative; for instance, the division of units is only a logical functional division, and in actual implementation, there may be other division methods. For example, multiple units or components may be combined or integrated into another system, or some features may be ignored or not executed. Furthermore, the coupling or direct coupling or communication connection shown or discussed may be through some interfaces; the indirect coupling or communication connection between systems or units may be electrical, mechanical, or other forms.

[0137] The units described as separate components may or may not be physically separate. The components shown as units may or may not be physical units; that is, they may be located in one place or distributed across multiple network units. Some or all of the units can be selected to achieve the purpose of this embodiment according to actual needs.

[0138] In addition, the functional modules in the various embodiments of the present invention can be integrated into one processing unit, or each module can exist physically separately, or two or more modules can be integrated into one unit.

[0139] Similarly, in the various embodiments of the present invention, each processing unit can be integrated into a functional module, or each processing unit can exist physically, or two or more processing units can be integrated into a functional module.

[0140] The steps of the methods or algorithms described in conjunction with the embodiments disclosed herein can be implemented directly by hardware, a software module executed by a processor, or a combination of both. The software module can be located in random access memory (RAM), main memory, read-only memory (ROM), electrically programmable ROM, electrically erasable programmable ROM, registers, hard disk, removable disk, CD-ROM, or any other form of storage medium known in the art.

[0141] Finally, it should be noted that in this document, relational terms such as "first" and "second" are used only to distinguish one entity or operation from another, and do not necessarily require or imply any such actual relationship or order between these entities or operations. Furthermore, the terms "comprising," "including," or any other variations thereof are intended to cover non-exclusive inclusion, such that a process, method, article, or apparatus that comprises a list of elements includes not only those elements but also other elements not expressly listed, or elements inherent to such a process, method, article, or apparatus. Without further limitations, an element defined by the phrase "comprising one..." does not exclude the presence of other identical elements in the process, method, article, or apparatus that includes said element.

[0142] The firmware security upgrade method, system, apparatus, and readable storage medium based on BMC provided by this invention have been described in detail above. Specific examples have been used to illustrate the principles and implementation methods of this invention. The descriptions of the embodiments above are only for the purpose of helping to understand the method and core ideas of this invention. It should be noted that those skilled in the art can make several improvements and modifications to this invention without departing from the principles of this invention, and these improvements and modifications also fall within the protection scope of the claims of this invention.

Claims

1. A firmware security upgrade system based on BMC, characterized in that, include: Firmware encryption package generation module, firmware upgrade control module, and firmware upgrade activation module; The firmware encryption package generation module is used to generate a firmware encryption package according to the upgrade requirements. The firmware encryption package includes the name of the firmware to be upgraded, a description file of the firmware to be upgraded and its dependencies, the target version file of the firmware to be upgraded and the intermediate firmware version file it depends on. Generate a firmware encryption package based on the firmware version information to be upgraded, including: Based on the firmware version information to be upgraded, determine the name of the firmware to be upgraded, the firmware pairing and dependencies, the target version file of the firmware to be upgraded and the intermediate firmware version information it depends on, and generate the corresponding firmware encryption package; the firmware encryption package includes a description file fw.json for firmware pairing and dependencies. The firmware upgrade control module is used to parse the firmware encrypted package through the BMC and control the firmware upgrade process. The process of parsing the firmware encryption package through BMC and controlling the firmware upgrade process includes: A general mode is used to verify the integrity and signature of the firmware encryption package; Obtain the current device firmware version information via BMC; Parse the fw.json file to obtain the target version information of the firmware to be upgraded; Parse the fw.json file to obtain the compatibility relationships between firmware versions; Parse the fw.json file to obtain strong dependencies between firmware versions; The firmware upgrade process is executed based on the acquired data. If the firmware cannot be upgraded to the specified version in one attempt, a pending upgrade flag is set. After the firmware upgrade process is completed, if an upgrade flag is detected, the corresponding firmware will continue to be upgraded until the firmware is upgraded to the specified version. The firmware upgrade activation module is used to initiate the corresponding activation actions based on the upgraded firmware.

2. The firmware security upgrade system based on BMC according to claim 1, characterized in that, The firmware to be upgraded includes any one or any combination of BMC firmware, BIOS firmware, CPLD firmware, FPGA firmware, and PSU firmware.

3. The firmware security upgrade system based on BMC according to claim 1, characterized in that, The firmware to be upgraded and its dependencies description file contains dictionary information describing the firmware to be upgraded; the dictionary information specifically includes the following: Version information describes the latest version of the firmware and the target version to be upgraded to. The depends information describes the minimum firmware version that the firmware needs to depend on for normal operation. The need information describes the dependencies for firmware upgrades.

4. The firmware security upgrade system based on BMC according to claim 1, characterized in that, The firmware encryption package generation module is specifically used to: generate an upgrade package according to upgrade requirements, and encrypt and sign the upgrade package using preset signature and confidentiality methods to generate a firmware encryption package.

5. A firmware security upgrade method based on BMC, characterized in that, include: Determine the firmware version information to be upgraded; Generate a firmware encryption package based on the firmware version information to be upgraded; The firmware encryption package is parsed using BMC, and the firmware upgrade process is controlled accordingly. The corresponding activation actions will be initiated based on the upgraded firmware; The step of generating a firmware encryption package based on the firmware version information to be upgraded includes: Based on the firmware version information to be upgraded, determine the name of the firmware to be upgraded, the firmware pairing and dependencies, the target version file of the firmware to be upgraded and the intermediate firmware version information it depends on, and generate the corresponding firmware encryption package; the firmware encryption package includes a description file fw.json for firmware pairing and dependencies. The process of parsing the firmware encryption package through BMC and controlling the firmware upgrade process includes: A general mode is used to verify the integrity and signature of the firmware encryption package; Obtain the current device firmware version information via BMC; Parse the fw.json file to obtain the target version information of the firmware to be upgraded; Parse the fw.json file to obtain the compatibility relationships between firmware versions; Parse the fw.json file to obtain strong dependencies between firmware versions; The firmware upgrade process is executed based on the acquired data. If the firmware cannot be upgraded to the specified version in one attempt, a pending upgrade flag is set. After the firmware upgrade process is completed, if an upgrade flag is detected, the corresponding firmware will continue to be upgraded until the firmware is upgraded to the specified version.

6. The firmware security upgrade method based on BMC according to claim 5, characterized in that, The step of initiating the corresponding activation action based on the upgraded firmware includes: If the upgraded firmware is BMC firmware, then perform a BMC reboot to make the firmware take effect. If the upgraded firmware is BIOS firmware, then CPU powercycle will be performed to make the firmware effective. If the upgraded firmware is CPLD firmware, then the firmware will take effect by refreshing the file or by controlling the CPU to power off. If the upgraded firmware is FPGA firmware, the firmware will take effect by controlling the CPU to power off.

7. A firmware security upgrade device based on BMC, characterized in that, include: Memory used to store BMC-based firmware security upgrade programs; A processor, configured to implement the steps of the BMC-based firmware security upgrade method as described in any one of claims 5 to 6 when executing the BMC-based firmware security upgrade program.

8. A readable storage medium, characterized in that: The readable storage medium stores a BMC-based firmware security upgrade program, which, when executed by a processor, implements the steps of the BMC-based firmware security upgrade method as described in any one of claims 5 to 6.

Images