Server firmware management method

Abstract

The present invention belongs to the technical field of server management and diagnosis, and specifically relates to a server firmware management method. The method integrates multiple server firmware encryption algorithms in a server, establishes a mapping relationship between the server firmware encryption algorithms and the data types of firmware files, identifies the data type of the file to be encrypted, encrypts the current server firmware file, stores the encrypted ciphertext and key in a designated storage area, and deploys an access permission mechanism in the designated storage area. A user initiates a server firmware file access request, triggering the access permission mechanism to verify the user's identity and determine whether the user's identity is legitimate. If so, corresponding access permissions are assigned based on the role corresponding to the identity. The corresponding firmware file is obtained and decrypted based on the permissions. The firmware file obtained by decryption is integrity checked to determine whether the firmware file has been tampered with. If not, the corresponding firmware file operation is executed. This ensures the confidentiality and security of firmware file management.

Description

Technical Field

[0001] The present invention belongs to the technical field of server management, and in particular relates to a server firmware management method. Background Art

[0002] Firmware encryption is becoming increasingly important as society evolves. Firmware is the software in embedded devices that controls their various functions and operations. Because firmware often contains sensitive device information and critical algorithms, protecting it is crucial to preventing malicious attacks and data leaks.

[0003] Firmware encryption is a technology that encrypts firmware files. Using an encryption algorithm and a key, the firmware file is converted into an encrypted form that can only be decrypted and used by those with the correct key. This prevents unauthorized access and tampering with the firmware, protecting the security and stability of the device.

[0004] Firmware encryption technology plays a vital role in server management and hardware upgrades. It ensures the security of firmware during transmission and storage, preventing malicious tampering. It also prevents unauthorized access to sensitive device information, protecting user data privacy.

[0005] Current server firmware encryption methods require the use of keys to encrypt and decrypt the firmware, but key management is a complex issue. If the key is leaked or obtained by an attacker, the security of the entire firmware is compromised. Firmware encryption requires decryption at runtime, which increases processor load and memory consumption, leading to performance degradation. This performance loss can adversely impact device functionality and response time, particularly for resource-constrained embedded devices. Firmware encryption also complicates firmware updates. During firmware updates, it is necessary to ensure that the new firmware correctly decrypts and replaces the old one. Errors or interruptions during the update process can prevent the device from booting or functioning properly. The security of firmware encryption relies primarily on key protection. Improper key management or access by an attacker can compromise the security of the entire firmware. Therefore, key protection and management are critical issues in firmware encryption technology. After firmware encryption, the authenticity of the firmware must be ensured. This requires verifying its integrity and authenticity to ensure it has not been tampered with or replaced. This requires additional verification mechanisms and security measures, increasing system complexity and development costs.

[0006] Therefore, how to improve the existing server firmware encryption process, enhance the security of firmware information during server management and hardware upgrades, prevent unauthorized access and tampering, and protect sensitive information from being leaked or abused is a technical problem that urgently needs to be solved. Summary of the Invention

[0007] The purpose of the present invention is to provide a server firmware management method to improve the existing server firmware encryption process, enhance the security of firmware information during server management and hardware upgrades, prevent unauthorized access and tampering, and protect sensitive information from being leaked or abused.

[0008] In order to solve the above technical problems, the technical solutions adopted by the present invention are as follows:

[0009] A server firmware management method includes the following steps:

[0010] S1: Integrate multiple server firmware encryption algorithms into the server and establish a mapping relationship between the server firmware encryption algorithms and the data types of the firmware files;

[0011] S2: Before writing the firmware file to the server, identify the data type of the firmware file to be encrypted;

[0012] S3: Based on the mapping relationship between the server firmware encryption algorithm and the data type of the firmware file, call the encryption algorithm that matches the data type of the current server firmware file to be encrypted to encrypt the current server firmware file;

[0013] S4: storing the encrypted server firmware file in a designated storage area of the server in ciphertext form, and storing the corresponding key in a designated file in the designated storage area;

[0014] S5: Deploy access permission mechanisms in designated storage areas, including visitor authentication, role management, and permission allocation;

[0015] S6: The user initiates a request to access the server firmware file, triggering the access permission mechanism to verify the user's identity and permissions to determine whether the user's identity is legitimate. If so, the corresponding access permission is assigned based on the role corresponding to the identity;

[0016] S7: Obtain the corresponding firmware file according to the permission, and decrypt it using the matching decryption algorithm of the corresponding data type;

[0017] S8: Perform integrity check on the firmware file obtained by decryption to determine whether the firmware file has been tampered with. If not, perform operations corresponding to the firmware file;

[0018] The formula for calculating the hash value of the server firmware file is:

[0019] hash [ x ]= hash [ x- 1]* P + idx [ x [ i ]];

[0020] in, x This is one of the strings converted from the server firmware file. x- 1 for x The subsequent string of idx [ x [ i ]] is the operation of converting a string into an integer. P A prime number to prevent duplicate hash values.

[0021] Preferably, the server firmware encryption algorithm in step S1 includes an RSA encryption algorithm, an AES encryption algorithm, and a DES encryption algorithm.

[0022] Preferably, the process of accessing the access permission mechanism in step S5 is as follows:

[0023] S51: The user initiates a firmware file access request, and the system automatically pops up an authentication window;

[0024] S52: The user enters identity information;

[0025] S53: The system verifies the identity information entered by the user and determines whether the user's identity is legal based on the verification result. If so, step S54 is executed. If not, a prompt indicating that access is denied is popped up.

[0026] S54: Obtain the user identity, and obtain the role corresponding to the user identity and the corresponding permissions of the role;

[0027] S55: The user operates the corresponding server firmware file according to the matched permissions.

[0028] Preferably, the identity information is a user name and password or a biometric instruction or a token.

[0029] Preferably, at the same time as step S5, the security environment where the server system is located is monitored in real time, the security of the current environment is evaluated, and based on the evaluation results, it is determined whether to adjust the access permission mechanism, including adjustment of the permission policy and identity authentication.

[0030] Preferably, the integrity check in step S8 includes the following specific processes:

[0031] S81: Calculate the hash value of the obtained server firmware file using a hash algorithm;

[0032] S82: Compare the calculated hash value with the original hash value of the original server firmware file;

[0033] S83: Determine whether the currently calculated hash value is consistent with the original hash value. If so, the integrity check succeeds. If not, the integrity check fails, and step S7 is executed again.

[0034] Preferably, in the process of managing the server firmware, a log recording monitoring mechanism is also provided, including log records of all processes of accessing, modifying, and upgrading the server firmware. The log records include system startup, shutdown, and access time logs, authentication logs during access, encryption and decryption process logs of server firmware files, errors during access, and security events.

[0035] Preferably, a safety management method is also included, and the specific process is as follows:

[0036] Q1: Create a security early warning model and obtain server historical log data and security event data;

[0037] Q2: Input the server's historical log data and security event data into the security early warning model to train the security early warning model;

[0038] Q3: Obtain server log files in real time and input them into the trained security warning model;

[0039] Q4: Analyze the current server log file through the security warning model and input the security warning results.

[0040] Preferably, the safety warning result includes risk type, risk level, risk location, and risk handling suggestions.

[0041] The beneficial effects of the present invention include:

[0042] The server firmware management method provided by the present invention integrates multiple server firmware encryption algorithms in a server, establishes a mapping relationship between the server firmware encryption algorithms and the data type of the firmware file; identifies the data type of the file to be encrypted; encrypts the current server firmware file; stores the encrypted ciphertext and key in a designated storage area; deploys an access permission mechanism in the designated storage area; a user initiates a server firmware file access request, triggers the access permission mechanism, verifies the user's identity, and determines whether the user's identity is legal. If so, allocates corresponding access permissions according to the role corresponding to the identity; obtains and decrypts the corresponding firmware file according to the permission; performs an integrity check on the firmware file obtained by decryption to determine whether the firmware file has been tampered with. If not, executes the corresponding firmware file operation.

[0043] First, different firmware data types are encrypted using multiple encryption algorithms, effectively ensuring the encryption security and efficiency requirements of different firmware data types. Access rights mechanisms enable refined management of firmware file access, preventing unauthorized access and further improving security during server firmware management.

[0044] Next, a hash algorithm is used to calculate the hash value of the obtained server firmware file. This calculated hash value is compared with the original hash value of the original server firmware file. The calculated hash value is then compared to the original hash value to determine whether it is consistent, and then an integrity check is performed. The hash algorithm processes the converted string using the above formula to generate a unique hash value. This irreversible process greatly improves the accuracy of the integrity check. This ensures the integrity and consistency of the firmware file during access, upgrade, and modification, preventing tampering. A logging monitoring mechanism monitors the security status of firmware information in real time, allowing for timely detection and response to security incidents, thereby improving the security and stability of the server firmware. BRIEF DESCRIPTION OF THE DRAWINGS

[0045] Figure 1 Schematic diagram of the server firmware management method of the present invention.

[0046] Figure 2 Schematic diagram of the server firmware management principle of the present invention.

[0047] Figure 3 This is a flow chart of the hash algorithm for integrity verification of the present invention. DETAILED DESCRIPTION

[0048] The following is combined with Figure 1-Figure 3 The present invention is described in further detail:

[0049] Example 1

[0050] A server firmware management method, see Figure 1 , including the following steps:

[0051] S1: Integrate multiple server firmware encryption algorithms into the server and establish a mapping relationship between the server firmware encryption algorithms and the data types of the firmware files;

[0052] S2: Before writing the firmware file to the server, identify the data type of the firmware file to be encrypted;

[0053] S3: Based on the mapping relationship between the server firmware encryption algorithm and the data type of the firmware file, call the encryption algorithm that matches the data type of the current server firmware file to be encrypted to encrypt the current server firmware file;

[0054] S4: storing the encrypted server firmware file in a designated storage area of the server in ciphertext form, and storing the corresponding key in a designated file in the designated storage area;

[0055] S5: Deploy access permission mechanisms in designated storage areas, including visitor authentication, role management, and permission allocation;

[0056] S6: The user initiates a request to access the server firmware file, triggering the access permission mechanism to verify the user's identity and permissions to determine whether the user's identity is legitimate. If so, the corresponding access permission is assigned based on the role corresponding to the identity;

[0057] S7: Obtain the corresponding firmware file according to the permission, and decrypt it using the matching decryption algorithm of the corresponding data type;

[0058] S8: Perform integrity check on the firmware file obtained by decryption to determine whether the firmware file has been tampered with. If not, perform operations corresponding to the firmware file.

[0059] In this embodiment, before step S1, the server firmware files must first be classified according to their data types. The classification criteria for the firmware files here include the importance of the firmware files, which are set to at least three levels, including heavy, medium, and light. The heavy level indicates that the firmware file is very important during the operation of the server and has a significant impact on the security of the server. The medium level indicates that the firmware file is of minor importance during the service operation process and has an impact on the server operation, but the impact is relatively small. The light level indicates that the data in the firmware file has a slight impact on the operation of the server. Different encryption methods are used for the firmware files according to their importance. For example, a more complex but stronger encryption algorithm, such as the RSA encryption algorithm, is used for heavy-level firmware files. For light-level firmware files, the DES algorithm is used, but the encryption efficiency is relatively high and the encryption process is relatively simple.

[0060] The classification standard of firmware files is the data structure type of the firmware files, including structured data and unstructured data. Different firmware data structure types are encrypted separately through multiple encryption algorithms to effectively ensure encryption efficiency requirements.

[0061] Deploy an access rights mechanism in designated storage areas, including visitor authentication, role management, and permission allocation. When a user initiates a server firmware file access request, the access rights mechanism is triggered, which verifies the user's identity and permissions to determine whether the user's identity is legitimate. If so, the access rights mechanism assigns corresponding access rights based on the role corresponding to the identity. This allows for refined management of firmware file access, prevents unauthorized access, and further enhances the security of the server firmware management process. Combined with the integrity verification process during firmware access, this ensures the integrity and consistency of firmware files during access, upgrades, and modifications, preventing tampering with firmware files. Through a logging monitoring mechanism, the security status of firmware information is monitored in real time, allowing for timely detection and response to security incidents, thereby enhancing the security and stability of server firmware.

[0062] The server firmware encryption algorithm in step S1 includes the RSA encryption algorithm, the AES encryption algorithm and the DES encryption algorithm.

[0063] Example 2

[0064] Based on Example 1, the process of accessing the access permission mechanism in step S5 is as follows:

[0065] S51: The user initiates a firmware file access request, and the system automatically pops up an authentication window;

[0066] S52: The user enters identity information, which may be a user name and password or a biometric instruction or token;

[0067] S53: The system verifies the identity information entered by the user and determines whether the user's identity is legal based on the verification result. If so, step S54 is executed. If not, a prompt indicating that access is denied is popped up.

[0068] S54: Obtain the user identity, and obtain the role corresponding to the user identity and the corresponding permissions of the role;

[0069] S55: The user operates the corresponding server firmware file according to the matched permissions.

[0070] Users can be assigned different roles based on their responsibilities and needs within the organization. Each role corresponds to a specific set of permissions. For example, a system administrator role might have full server management permissions, while a user role might have limited access rights. Depending on the user's role and needs, they can be assigned appropriate access rights. These permissions can include read, write, modify, delete, and other operations, as well as access to specific resources or data.

[0071] At the same time as step S5, the security environment of the server system is monitored in real time, the security of the current environment is evaluated, and based on the evaluation results, it is determined whether to adjust the access permission mechanism, including adjustment of the permission policy and identity authentication.

[0072] Example 3

[0073] See also Figure 3 Based on Example 1 or Example 2, the integrity check in step S8 includes the following specific processes:

[0074] S81: Calculate the hash value of the obtained server firmware file using a hash algorithm;

[0075] S82: Compare the calculated hash value with the original hash value of the original server firmware file;

[0076] S83: Determine whether the currently calculated hash value is consistent with the original hash value. If so, the integrity check succeeds. If not, the integrity check fails, and step S7 is executed again.

[0077] The formula for calculating the hash value of the server firmware file is:

[0078] hash [ x ]= hash [ x- 1]* P + idx [ x [ i ]];

[0079] in, x This is one of the strings converted from the server firmware file. x- 1 for x The subsequent string of idx [ x [ i ]] is the operation of converting a string into an integer. P is a prime number to prevent duplicate hash values. The hash algorithm generates a unique hash value by applying the converted string to the above formula. This irreversible process greatly improves the accuracy of the integrity check process.

[0080] Setting up the integrity check process described above, by verifying the integrity of the firmware file, ensures that the firmware has not been tampered with or damaged during transmission or storage, thereby improving system security. Firmware integrity checking effectively prevents malicious attackers from modifying the firmware file, thereby protecting system stability and reliability. If problems arise during firmware file transmission or storage, integrity checking can help quickly locate the cause and simplify error diagnosis. By ensuring the integrity of the firmware file, system crashes and malfunctions caused by firmware corruption or tampering can be reduced.

[0081] In the process of managing server firmware, a log recording monitoring mechanism is also provided, including log records of all processes of accessing, modifying, and upgrading the server firmware. The log records include system startup, shutdown, and access time logs, authentication logs during access, encryption and decryption process logs of server firmware files, errors during access, and security events.

[0082] Logging and monitoring are critical components of server management and hardware upgrades. They provide administrators with detailed records of system activity, potential issues, and security incidents, aiding troubleshooting, performance optimization, and security protection. When a system failure or unusual behavior occurs, administrators can review logs to identify the root cause and quickly resolve the issue. Logging helps administrators monitor and detect potential security incidents, such as unauthorized access and malicious activity. Monitoring provides administrators with real-time insights into system performance bottlenecks for optimization. Monitoring can also detect unusual behavior and security incidents in real time, enabling timely response.

[0083] The server firmware management method also includes a security management method, the specific process is as follows:

[0084] Q1: Create a security early warning model and obtain server historical log data and security event data;

[0085] Q2: Input the server's historical log data and security event data into the security early warning model to train the security early warning model;

[0086] Q3: Obtain server log files in real time and input them into the trained security warning model;

[0087] Q4: Analyze the current server log file through the security warning model and input the security warning result, which includes risk type, risk level, risk location, and risk handling suggestions.

[0088] See also Figure 2 Schematic diagram of the principle of server firmware management in the prior art. The management system includes several server nodes, communication control modules, management display modules, calculation display modules, and node information storage modules. The communication control modules, management display modules, calculation display modules, and node information storage modules constitute the system management software, which implements the overall management of the server firmware. The server nodes are Figure 2 Node 1, Node 2, ..., Node N. Node 1, Node 2, ..., Node N, together with the power supply system and cooling system, form a complete cabinet hyper-converged server. It can be seen that in the existing firmware management technology, the server is divided into several nodes, and the firmware data of each node is obtained. This data is then transmitted to the communication control module, and the status of each server firmware is displayed through the management display module. The calculation and display module calculates and evaluates the data of each server firmware, manages it based on the evaluation results, and stores it based on the node information. The entire management process has no security guarantees, which makes this firmware management process have security risks.

[0089] The server firmware management method provided by the present invention integrates multiple server firmware encryption algorithms in the server, establishes a mapping relationship between the server firmware encryption algorithm and the data type of the firmware file; identifies the data type of the file to be encrypted; encrypts the current server firmware file; stores the encrypted ciphertext and key in a designated storage area; deploys an access permission mechanism in the designated storage area; the user initiates a server firmware file access request, triggers the access permission mechanism, verifies the user's identity, and determines whether the user's identity is legal. If so, allocates corresponding access permissions according to the role corresponding to the identity; obtains the corresponding firmware file according to the permission and decrypts it; performs an integrity check on the firmware file obtained by decryption to determine whether the firmware file has been tampered with. If not, executes the corresponding firmware file operation.

[0090] Different firmware data types are encrypted using multiple encryption algorithms, effectively ensuring the encryption security and efficiency requirements for each firmware data type. An access rights mechanism enables refined management of firmware file access, preventing unauthorized access and further enhancing the security of server firmware management. A hash algorithm is used to calculate the hash value of the server firmware file and compare it with the original hash value of the original server firmware file. The calculated hash value is then compared to the original hash value to determine its consistency and perform an integrity check. The hash algorithm processes the converted string using the aforementioned formula to generate a unique hash value, and this irreversible process significantly improves the accuracy of the integrity check. This ensures the integrity and consistency of firmware files during access, upgrades, and modifications, preventing tampering. A logging and monitoring mechanism monitors the security status of firmware information in real time, enabling timely detection and response to security incidents, thereby improving the security and stability of server firmware.

Claims

1. A server firmware management method, characterized in that: The following steps are involved: S1: Integrate multiple server firmware encryption algorithms into the server and establish a mapping relationship between the server firmware encryption algorithms and the data types of the firmware files; S2: Before writing the firmware file to the server, identify the data type of the firmware file to be encrypted; S3: Based on the mapping relationship between the server firmware encryption algorithm and the data type of the firmware file, call the encryption algorithm that matches the data type of the current server firmware file to be encrypted to encrypt the current server firmware file; S4: storing the encrypted server firmware file in a designated storage area of the server in ciphertext form, and storing the corresponding key in a designated file in the designated storage area; S5: Deploy access permission mechanisms in designated storage areas, including visitor authentication, role management, and permission allocation; S6: The user initiates a request to access the server firmware file, triggering the access permission mechanism to verify the user's identity and permissions to determine whether the user's identity is legitimate. If so, the corresponding access permission is assigned based on the role corresponding to the identity; S7: Obtain the corresponding firmware file according to the permission, and decrypt it using the matching decryption algorithm of the corresponding data type; S8: Perform integrity check on the firmware file obtained by decryption to determine whether the firmware file has been tampered with. If not, perform operations corresponding to the firmware file; The process of the access permission mechanism in step S5 is as follows: S51: The user initiates a firmware file access request, and the system automatically pops up an authentication window; S52: The user enters identity information; S53: The system verifies the identity information entered by the user and determines whether the user's identity is legal based on the verification result. If so, step S54 is executed. If not, a prompt indicating that access is denied is popped up. S54: Obtain the user identity, and obtain the role corresponding to the user identity and the corresponding permissions of the role; S55: The user operates the corresponding server firmware file according to the matched permissions; At the same time as step S3, the system performs multi-factor authentication in the process of verifying the identity information entered by the user. The system automatically sends a verification token to the visitor's mobile phone number. The visitor enters the verification token in the corresponding position, and the system automatically matches the verification token; The integrity check in step S8 includes the following specific processes: S81: Convert the server firmware file into a character string, and calculate a hash value of the converted character string of the server firmware file using a hash algorithm; S82: Compare the calculated hash value with the original hash value of the original server firmware file; S83: Determine whether the currently calculated hash value is consistent with the original hash value. If so, the integrity check succeeds. If not, the integrity check fails, and step S7 is executed again. The formula for calculating the hash value of the server firmware file is: hash [ x ]= hash [ x- 1]* P + idx [ x [ i ]]； in, x This is one of the strings converted from the server firmware file. x- 1 for x The subsequent string of idx [ x [ i ]] is the operation of converting a string into an integer value. P is a prime number to prevent duplicate hash values from being calculated; It also includes safety management methods, the specific process is as follows: Q1: Create a security early warning model and obtain server historical log data and security event data; Q2: Input server historical log data and security event data into the security early warning model to train the security early warning model; Q3: Obtain server log files in real time and input them into the trained security warning model; Q4: Analyze the current server log file through the security warning model and input the security warning results.

2. A server firmware management method according to claim 1, characterized in that: The server firmware encryption algorithm in step S1 includes the RSA encryption algorithm, the AES encryption algorithm and the DES encryption algorithm.

3. A server firmware management method according to claim 1, characterized in that: The identity information is a user name and password or a biometric instruction or a token.

4. A server firmware management method according to claim 1, characterized in that: At the same time as step S5, the security environment of the server system is monitored in real time, the security of the current environment is evaluated, and based on the evaluation results, it is determined whether to adjust the access permission mechanism, including adjustment of the permission policy and identity authentication.

5. A server firmware management method according to claim 1, characterized in that: In the process of managing server firmware, a log recording monitoring mechanism is also provided, including log records of all processes of accessing, modifying, and upgrading the server firmware. The log records include system startup, shutdown, and access time logs, authentication logs during access, encryption and decryption process logs of server firmware files, errors during access, and security events.

6. A server firmware management method according to claim 1, characterized in that: The safety warning results include risk type, risk level, risk location, and risk handling suggestions.

Images