Mirror image updating method and device, computer equipment and storage medium

Abstract

The invention relates to a mirror image updating method and device, computer equipment, a storage medium and a computer program product. The method can be applied to an application scene for carrying out mirror image updating on a cloud server, a block chain node or other equipment, and comprises the following steps: when a mirror image updating request initiated by a substrate controller is received, opening a write-in channel of a backup storage block; an update signal is sent to the substrate controller, so that the substrate controller transmits the update mirror image file to the backup storage block through the write-in channel; when a transmission completion signal sent by the substrate controller is received, verifying the updated mirror image file to obtain a verification result; and sending the verification result to the substrate controller, and updating the updating mirror image file in the backup storage block to the target storage block based on the verification result, so that the substrate controller performs mirror image updating based on the verification result and the updating mirror image file. By adopting the method, the processing efficiency of the system on mirror image updating can be effectively improved while the security of the system is ensured.

Description

Technical Field

[0001] The present application relates to the field of computer technology, and in particular to an image updating method, apparatus, computer equipment, storage medium and computer program product. Background Art

[0002] With the development of computer technology and Internet technology, the development and use of hardware security systems play an important role in fields such as computer vision. The hardware security system protects the process of hardware startup, operation and exit by building a reasonable hardware mechanism. At the same time, when the system security is threatened or damaged, the hardware security system has the ability to restore the entire system to a safe state or issue an alarm.

[0003] In the current image update method, when the baseboard management controller (Baseboard Manager Controller, BMC) image or the basic input output system (Basic Input Output System, Bios) image needs to be updated, the new version of the image file is usually written into the backup storage block, and the system needs to distinguish from the backup storage block and the formal storage block respectively to determine the read and write control rights corresponding to the backup storage block and the formal storage block, which increases the time for the system to inspect different types of storage blocks, thereby affecting the system's processing efficiency for image updates. Summary of the invention

[0004] Based on this, it is necessary to provide an image update method, device, computer equipment, computer readable storage medium and computer program product to address the above technical problems, which can effectively improve the system's processing efficiency for image updates while ensuring the security of the system.

[0005] In a first aspect, the present application provides a mirror image update method. The method comprises: when receiving a mirror image update request initiated by a baseboard controller, opening a write channel of a backup storage block; sending an update signal to the baseboard controller, so that the baseboard controller transmits an update mirror image file to the backup storage block through the write channel; when receiving a transmission completion signal sent by the baseboard controller, verifying the update mirror image file to obtain a verification result; sending the verification result to the baseboard controller, and updating the update mirror image file in the backup storage block to a target storage block based on the verification result, so that the baseboard controller performs a mirror image update based on the verification result and the update mirror image file.

[0006] In the second aspect, the present application also provides a mirror image update device. The device includes: an opening module, which is used to open the write channel of the backup storage block when receiving the mirror image update request initiated by the baseboard controller; a sending module, which is used to send an update signal to the baseboard controller, so that the baseboard controller transmits the update mirror file to the backup storage block through the write channel; a verification module, which is used to verify the update mirror file and obtain a verification result when receiving the transmission completion signal sent by the baseboard controller; an update module, which is used to send the verification result to the baseboard controller, and update the update mirror file in the backup storage block to the target storage block based on the verification result, so that the baseboard controller performs a mirror image update based on the verification result and the update mirror file.

[0007] In a third aspect, the present application also provides a computer device. The computer device includes a memory and a processor, the memory stores a computer program, and the processor implements the following steps when executing the computer program: when receiving a mirror update request initiated by a baseboard controller, opening the write channel of the backup storage block; sending an update signal to the baseboard controller, so that the baseboard controller transmits the update mirror file to the backup storage block through the write channel; when receiving a transmission completion signal sent by the baseboard controller, verifying the update mirror file to obtain a verification result; sending the verification result to the baseboard controller, and updating the update mirror file in the backup storage block to the target storage block based on the verification result, so that the baseboard controller performs a mirror update based on the verification result and the update mirror file.

[0008] In a fourth aspect, the present application also provides a computer-readable storage medium. The computer-readable storage medium stores a computer program, and when the computer program is executed by a processor, the following steps are implemented: when receiving an image update request initiated by a substrate controller, opening the write channel of the backup storage block; sending an update signal to the substrate controller, so that the substrate controller transmits the update image file to the backup storage block through the write channel; when receiving a transmission completion signal sent by the substrate controller, verifying the update image file to obtain a verification result; sending the verification result to the substrate controller, and updating the update image file in the backup storage block to the target storage block based on the verification result, so that the substrate controller performs an image update based on the verification result and the update image file.

[0009] In a fifth aspect, the present application also provides a computer program product. The computer program product includes a computer program, which implements the following steps when executed by a processor: when receiving an image update request initiated by a baseboard controller, opening the write channel of the backup storage block; sending an update signal to the baseboard controller, so that the baseboard controller transmits the update image file to the backup storage block through the write channel; when receiving a transmission completion signal sent by the baseboard controller, verifying the update image file to obtain a verification result; sending the verification result to the baseboard controller, and updating the update image file in the backup storage block to the target storage block based on the verification result, so that the baseboard controller performs an image update based on the verification result and the update image file.

[0010] The above-mentioned image update method, device, computer equipment, storage medium and computer program product, when receiving an image update request initiated by a substrate controller, open the write channel of the backup storage block; send an update signal to the substrate controller, so that the substrate controller transmits the updated image file to the backup storage block through the write channel; when receiving a transmission completion signal sent by the substrate controller, verify the updated image file to obtain a verification result, send the verification result to the substrate controller, and update the updated image file in the backup storage block to the target storage block based on the verification result, so that the substrate controller performs an image update based on the verification result and the updated image file. Since a new topological connection relationship between the trusted root component and the storage block is constructed, the read and write control of the storage block is taken over by the trusted root component. Therefore, when the trusted root component receives the image update request initiated by the baseboard controller, the trusted root component can control the opening of the write channel of the backup storage block and send an update signal to the baseboard controller, so that the baseboard controller transmits the updated image file to the backup storage block through the opened write channel; at the same time, when the trusted root component receives the transmission completion signal sent by the baseboard controller, the trusted root component verifies the updated image file, obtains the verification result, sends the verification result to the baseboard controller, and updates the updated image file in the backup storage block to the target storage block based on the verification result, so that the baseboard controller performs the image update at an appropriate time based on the verification result and the updated image file. During the entire image update process, the system does not know the existence of the backup storage block, and the introduction of the trusted root component can be achieved with minimal impact on the architecture of the original system (system without RoT configuration), realizing the unified design of non-RoT and RoT solutions, while ensuring the security of the system, and effectively improving the system's processing efficiency for image updates.

[0011] In a sixth aspect, the present application provides a mirror update method. The method comprises: sending a mirror update request to a trusted root component so that the trusted root component opens a write channel of a backup storage block; wherein the trusted root component is in a plug-in physical form; when receiving an update signal sent by the trusted root component, transmitting an update mirror file to the backup storage block through the write channel; when the update mirror file is transmitted, sending a transmission completion signal to the trusted root component so that the trusted root component verifies the update mirror file and obtains a verification result; when receiving the verification result sent by the trusted root component, performing a mirror update based on the verification result and the update mirror file.

[0012] In the seventh aspect, the present application also provides a mirror update device. The device includes: a sending module, which is used to send a mirror update request to the trusted root component, so that the trusted root component opens the write channel of the backup storage block; wherein the trusted root component is a plug-in physical form; a transmission module, which is used to transmit the update mirror file to the backup storage block through the write channel when receiving the update signal sent by the trusted root component; the sending module is also used to send a transmission completion signal to the trusted root component when the update mirror file is transmitted, so that the trusted root component verifies the update mirror file and obtains a verification result; an update module, which is used to perform a mirror update based on the verification result and the update mirror file when receiving the verification result sent by the trusted root component.

[0013] In an eighth aspect, the present application also provides a computer device. The computer device includes a memory and a processor, the memory stores a computer program, and the processor implements the following steps when executing the computer program: sending an image update request to a trusted root component so that the trusted root component opens a write channel of a backup storage block; wherein the trusted root component is in a plug-in physical form; when receiving an update signal sent by the trusted root component, transmitting an update image file to the backup storage block through the write channel; when the update image file is transmitted, sending a transmission completion signal to the trusted root component so that the trusted root component verifies the update image file and obtains a verification result; when receiving the verification result sent by the trusted root component, performing an image update based on the verification result and the update image file.

[0014] In a ninth aspect, the present application also provides a computer-readable storage medium. The computer-readable storage medium stores a computer program, and when the computer program is executed by a processor, the following steps are implemented: sending an image update request to a trusted root component, so that the trusted root component opens a write channel of a backup storage block; wherein the trusted root component is in a plug-in physical form; when receiving an update signal sent by the trusted root component, transmitting an update image file to the backup storage block through the write channel; when the update image file is transmitted, sending a transmission completion signal to the trusted root component, so that the trusted root component verifies the update image file and obtains a verification result; when receiving the verification result sent by the trusted root component, performing an image update based on the verification result and the update image file.

[0015] In the tenth aspect, the present application also provides a computer program product. The computer program product includes a computer program, which implements the following steps when executed by a processor: sending an image update request to a trusted root component so that the trusted root component opens a write channel of a backup storage block; wherein the trusted root component is in a plug-in physical form; when receiving an update signal sent by the trusted root component, transmitting an updated image file to the backup storage block through the write channel; when the updated image file is transmitted, sending a transmission completion signal to the trusted root component so that the trusted root component verifies the updated image file and obtains a verification result; when receiving the verification result sent by the trusted root component, performing an image update based on the verification result and the updated image file.

[0016] The above-mentioned image update method, device, computer equipment, storage medium and computer program product send an image update request to the trusted root component so that the trusted root component opens the write channel of the backup storage block; wherein the trusted root component is a plug-in physical form; when receiving the update signal sent by the trusted root component, the updated image file is transmitted to the backup storage block through the write channel; when the updated image file is transmitted, a transmission completion signal is sent to the trusted root component so that the trusted root component verifies the updated image file and obtains a verification result; when receiving the verification result sent by the trusted root component, the image is updated based on the verification result and the updated image file. Since a new topological connection relationship between the trusted root component and the storage block is constructed, the read and write control of the storage block is taken over by the trusted root component. Therefore, when the trusted root component receives the image update request initiated by the baseboard controller, the trusted root component can control the opening of the write channel of the backup storage block and send an update signal to the baseboard controller, so that the baseboard controller transmits the updated image file to the backup storage block through the opened write channel; at the same time, when the trusted root component receives the transmission completion signal sent by the baseboard controller, the trusted root component verifies the updated image file, obtains the verification result, and sends the verification result to the baseboard controller, so that the baseboard controller performs the image update at an appropriate time based on the verification result and the updated image file. During the entire image update process, the system is unaware of the existence of the backup storage block, and the introduction of the trusted root component can be achieved with minimal impact on the architecture of the original system (system without RoT configuration), realizing the unified design of non-RoT and RoT solutions, while ensuring the security of the system, and effectively improving the system's processing efficiency for image updates. BRIEF DESCRIPTION OF THE DRAWINGS

[0017] Figure 1 A schematic diagram of a process flow of a mirror image updating method in an embodiment;

[0018] Figure 2 A schematic diagram of a flow chart of the steps of opening a write channel of a backup storage block in one embodiment;

[0019] Figure 3 It is a flowchart of a host-unaware RoT Flash arrangement solution in one embodiment;

[0020] Figure 4 is a flowchart of a mirror image updating method in another embodiment;

[0021] Figure 5 A schematic diagram of a server solution integrating RoT in one embodiment;

[0022] Figure 6 is a schematic diagram of a Non-RoT solution in an embodiment;

[0023] Figure 7 It is a schematic diagram of a specific implementation of a Host-unaware RoT Flash arrangement solution in an embodiment;

[0024] Figure 8 is a structural block diagram of a mirror image updating device in one embodiment;

[0025] Fig. 9 is a structural block diagram of a mirror image updating device in another embodiment;

[0026] Fig.10 FIG. 4 is a diagram showing the internal structure of a computer device in one embodiment. DETAILED DESCRIPTION

[0027] In order to make the purpose, technical solution and advantages of the present application more clearly understood, the present application is further described in detail below in conjunction with the accompanying drawings and embodiments. It should be understood that the specific embodiments described herein are only used to explain the present application and are not used to limit the present application.

[0028] Cloud technology refers to a hosting technology that unifies hardware, software, network and other resources within a wide area network or local area network to achieve data computing, storage, processing and sharing.

[0029] Cloud technology is a general term for network technology, information technology, integration technology, management platform technology, application technology, etc. based on the cloud computing business model. It can form a resource pool, which is used on demand and is flexible and convenient. Cloud computing technology will become an important support. The services of technical network systems require a large amount of computing and storage resources, such as video websites, image websites and more portal websites. With the rapid development and application of the Internet industry, in the future, each item may have its own identification mark, which needs to be transmitted to the system for logical processing. Data of different levels will be processed separately. All kinds of industry data need strong system backing support, which can only be achieved through cloud computing.

[0030] Cloud storage is a new concept that extends and develops from the concept of cloud computing. A distributed cloud storage system (hereinafter referred to as storage system) refers to a storage system that uses cluster applications, grid technology, and distributed storage file systems to bring together a large number of different types of storage devices (storage devices are also called storage nodes) in the network through application software or application interfaces to work together and provide external data storage and business access functions.

[0031] With the research and advancement of artificial intelligence technology, artificial intelligence technology has been studied and applied in many fields, such as common smart homes, smart wearable devices, virtual assistants, smart speakers, smart marketing, unmanned driving, automatic driving, drones, robots, smart medical care, smart customer service, Internet of Vehicles, automatic driving, smart transportation, etc. I believe that with the development of technology, artificial intelligence technology will be applied in more fields and play an increasingly important role.

[0032] It should be noted that in the following description, the terms "first, second and third" involved are merely used to distinguish similar objects and do not represent a specific ordering of the objects. It can be understood that "first, second and third" can be interchanged in a specific order or sequence where permitted, so that the embodiments of the present application described here can be implemented in an order other than that illustrated or described here.

[0033] In one embodiment, Figure 1 As shown, a mirror image update method is provided. This embodiment takes the method applied to a system including a server as an example for illustration. It can be understood that the method can also be applied to a server, and can also be applied to a system including a terminal and a server. In this embodiment, the method is applied to a trusted root component in a system including a server as an example for illustration, and includes the following steps:

[0034] Step 102: when receiving a mirror update request initiated by a baseboard controller, opening a write channel of a backup storage block.

[0035] Among them, the baseboard controller (BMC) refers to the remote management controller that executes the server, which can also be called the baseboard management controller. The baseboard management controller can perform operations such as upgrading the firmware of the machine and checking the machine equipment when the machine is not turned on. For example, the baseboard controller in this application is used to upgrade the firmware of the host in the system and protect the process of hardware startup, operation and exit in the system.

[0036] Platform management refers to a series of monitoring and control functions, and the object of operation is the system hardware. For example, by monitoring the system's temperature, voltage, fan, power supply, etc., and making corresponding adjustments, the system is kept in a healthy state. At the same time, platform management is also responsible for recording various hardware information and log records to prompt users and locate subsequent problems. The above functions can be integrated into a controller, which is called the baseboard management controller. BMC is the housekeeper of the entire server board. From the moment a server is powered on, all its components are managed by BMC.

[0037] Host: mainly refers to the central processing unit (CPU) of the server. The instruction set format is not specifically restricted and can be X86, ARM, MIPS or RISC-V, etc.

[0038] Root of trust (RoT): A component (chip or system) that verifies, updates, and reads and writes protections on server images.

[0039] Hardware security system: refers to the protection of the hardware startup, operation and exit processes through the construction of reasonable hardware mechanisms. At the same time, when the system security is threatened and damaged, the hardware security system has the ability to restore the entire system to a safe state or issue an alarm.

[0040] An image update request refers to a request for updating an image. For example, the image update request in the present application may include a BMC image update request and a BIOS (Basic Input Output System) image update request, wherein the BIOS image update request may also be understood as a server CPU image update request.

[0041] The backup storage block refers to a flash storage block used to temporarily store the upgraded system image (Image) when the image is updated. For example, the backup storage blocks in this application include staging flash, backup flash, etc.

[0042] Staging flash refers to the flash storage block used to temporarily store the upgraded system image (Image) when the system image is updated. Under the preset conditions, the staging flash can be converted to the official flash (or not, depending on the system settings).

[0043] A write channel refers to a channel used to write data to a backup storage block. For example, the write channel in this application can be to send configuration information through a finite state machine, and open the write permission of a backup storage block based on the configuration information, and then open the write channel corresponding to the backup storage block.

[0044] Specifically, the image update method provided in the present application can be applied to a system in which a root of trust (RoT), an image storage Flash and a protected system are connected. The purpose is to decouple the RoT and the host system as much as possible under the premise of realizing system hardware protection. That is, when the trusted root component in the system receives an image update request initiated by the substrate controller, the trusted root component can open the write channel of the backup storage block corresponding to the image update request.

[0045] The root of trust component, namely RoT, is the root of trust of the system. Its important role is to protect Flash and support image updates. In order to support the update of BMC Flash image and Bios Flash image, the introduction of RoT will affect the system's access to read and write the original Flash. In order to achieve the consistency of the design scheme that supports the RoT function and does not support the RoT function (RoT is an optional configuration), the method provided in the embodiment of the present application adopts: a board designed with the same size as the IO card that does not support RoT. If the user chooses a solution with RoT, it is only necessary to replace the original IO card with a RoT card of the same size; secondly, the method provided in the embodiment of the present application adopts dual BMC flash and dual Bios Flash, a total of 4 flashes. BMC has two flashes: BMC flash0 and BMC Flash1 are backed up by each other, namely active flash and backup flash. The Flash used for BMC startup is active flash, and the other BMC flash is backup flash. When the image needs to be updated, the new version of the image is written to the backup flash (backup storage block) through BMC (OOB). Bios flash, also two flashes, divided into Staging flash and Bios flash. Bios Flash is the flash used to start Bios, and Staging flash is the flash used to store the update files of Bios image.

[0046] For example, when the trusted root component in the system receives a Bios image update request initiated by the baseboard controller, since the Bios flash is also two flashes, namely, Staging flash and Bios flash, the Bios Flash is a flash used to start the Bios, and the Staging flash is a flash used to store the update file of the Bios image, that is, the Staging flash is a backup storage block, the trusted root component can open the write channel of the Staging flash corresponding to the Bios image update request, for example, the trusted root component sends configuration information through the FSM (Finite State Machine) to open the write permission of the Bios Staging Flash based on the configuration information, and then open the write channel of the Staging flash.

[0047] Step 104 : sending an update signal to the baseboard controller so that the baseboard controller transmits the update image file to the backup storage block through the write channel.

[0048] Among them, the update signal refers to a signal used to identify that the backup storage block is allowed to be updated. The update signal in this application can be presented in the form of a flag signal. For example, when a signal of signal=0 is sent, it indicates that the signal is a signal that allows the backup storage block to be updated.

[0049] The updated image file refers to the updated file of the image, which can also be understood as the new version of the image file. For example, the updated image file in this application includes the updated file of the Bios image and the updated file of the BMC image.

[0050] Specifically, after the trusted root component in the system receives the image update request initiated by the substrate controller, the trusted root component can confirm whether the system is in the update process of the storage block at the current moment. When the trusted root component confirms that the system is not in the update process of the storage block at the current moment, the trusted root component will send a signal allowing the backup storage block to be updated to the substrate controller, so that the substrate controller transmits the updated image file to the backup storage block through the enabled write channel. That is, when the substrate controller receives the signal allowing the backup storage block to be updated sent by the trusted root component, the substrate controller can transmit the updated image file corresponding to the image update request through the enabled write channel.

[0051] For example, when the trusted root component in the system receives a Bios image update request initiated by the baseboard controller, the trusted root component can confirm whether the system is currently in the update process of the storage block. When the trusted root component confirms that the system is not currently in the update process of the storage block, the trusted root component sends a signal allowing the storage block to be updated to the baseboard controller, so that the baseboard controller transmits the Bios update image file to the Bios Staging Flash through the enabled write channel. That is, when the baseboard controller receives a signal sent by the trusted root component allowing the backup storage block to be updated, the baseboard controller can transmit the Bios update image file to the Bios Staging Flash through the enabled write channel of the Bios Staging Flash.

[0052] Step 106: When a transmission completion signal sent by the baseboard controller is received, the updated image file is verified to obtain a verification result.

[0053] Among them, the transmission completion signal refers to a signal used to indicate that the transmission of the updated image file has been completed. The transmission completion signal in the present application can be presented in the form of a flag signal. For example, when a signal of signal0=0 is sent, it indicates that the signal is a signal used to indicate that the transmission of the updated image file has been completed.

[0054] The verification result refers to the result obtained after the legality and integrity check of the update image file. For example, the verification result in this application may include a verification result indicating that the verification passed and a verification result indicating that the verification failed, which may also be referred to as a verification success result and a verification failure result.

[0055] Specifically, when the trusted root component in the system sends an update signal to the substrate controller so that the substrate controller transmits the updated image file to the backup storage block through the opened write channel, when the trusted root component receives the signal sent by the substrate controller indicating that the transmission of the updated image file is complete, the trusted root component can verify the updated image file to obtain a verification result, that is, when the trusted root component receives the signal sent by the substrate controller indicating that the transmission of the updated image file is complete, the trusted root component can start to verify the new image file and record the verification result obtained by verifying the new image file.

[0056] For example, when the baseboard controller receives a signal from the RoT allowing the backup storage block to be updated, the baseboard controller can transfer the Bios update image file to the BiosStaging Flash through the enabled write channel of the Bios Staging Flash. After the baseboard controller completes the transmission of the Bios update image file, the baseboard controller can send a signal indicating the completion of the transmission to the RoT through the SMBus, so that when the RoT receives the signal from the baseboard controller indicating the completion of the transmission of the Bios update image file, the RoT can start to verify the new version of the Bios image file and record the verification result of the new version of the Bios image file as R (pass).

[0057] Step 108 , sending the verification result to the baseboard controller, and updating the update image file in the backup storage block to the target storage block based on the verification result, so that the baseboard controller performs image update based on the verification result and the update image file.

[0058] Among them, the target storage block refers to the formal storage block, which is different from the backup storage block and is used for startup. For example, the target storage block in this application includes active flash and Bios flash, among which active flash is the Flash used for BMC startup and Bios Flash is the flash used to start Bios.

[0059] Specifically, after the trusted root component verifies the new image file and records the verification result obtained by verifying the new image file, the trusted root component can send the verification result obtained by verifying the new image file to the baseboard controller, that is, when the baseboard controller receives the verification result sent by the trusted root component indicating that the verification is passed, the baseboard controller can restart and update the image from the backup storage block at an appropriate time. After the restart is successful, the trusted root component can move the new image in the backup storage block to the target storage block before the restart, and mark the backup storage block before the restart as the new target storage block, and mark the target storage block before the restart as the new backup storage block.

[0060] For example, after the trusted root component verifies the new BMC image file and records the verification result R (pass) obtained from the verification of the new BMC image file, the trusted root component can send the verification result R (pass) obtained from the verification of the new image file to the baseboard controller, so that when the baseboard controller receives the verification result R (pass) sent by the trusted root component indicating that the verification passed, the baseboard controller can restart and update the image from Backup Flash0 at an appropriate time. After the restart is successful, the trusted root component can move the new image in Backup Flash0 to the active flash0 before the restart, and mark Backup Flash0 as the new active flash1, and mark the active flash0 before the restart as the new Backup Flash1.

[0061] In this embodiment, when an image update request initiated by a baseboard controller is received, a write channel of a backup storage block is opened; an update signal is sent to the baseboard controller, so that the baseboard controller transmits the updated image file to the backup storage block through the write channel; when a transmission completion signal sent by the baseboard controller is received, the updated image file is verified to obtain a verification result, the verification result is sent to the baseboard controller, and based on the verification result, the updated image file in the backup storage block is updated to the target storage block, so that the baseboard controller performs an image update based on the verification result and the updated image file. Since a new topological connection relationship between the trusted root component and the storage block is constructed, the read and write control of the storage block is taken over by the trusted root component. Therefore, when the trusted root component receives the image update request initiated by the baseboard controller, the trusted root component can control the opening of the write channel of the backup storage block and send an update signal to the baseboard controller, so that the baseboard controller transmits the updated image file to the backup storage block through the opened write channel; at the same time, when the trusted root component receives the transmission completion signal sent by the baseboard controller, the trusted root component verifies the updated image file, obtains the verification result, sends the verification result to the baseboard controller, and updates the updated image file in the backup storage block to the target storage block based on the verification result, so that the baseboard controller performs the image update at an appropriate time based on the verification result and the updated image file. During the entire image update process, the system does not know the existence of the backup storage block, and the introduction of the trusted root component can be achieved with minimal impact on the architecture of the original system (system without RoT configuration), realizing the unified design of non-RoT and RoT solutions, while ensuring the security of the system, and effectively improving the system's processing efficiency for image updates.

[0062] In one embodiment, Figure 2 As shown, the image update request includes a first image update request of a baseboard controller type; the backup storage block includes a first backup storage block of a baseboard controller type; when receiving the image update request initiated by the baseboard controller, the step of opening the write channel of the backup storage block includes:

[0063] Step 202, when receiving a first image update request initiated by the baseboard controller through the first thread and determining that the storage block is not in the update process at the current moment, sending configuration information through the finite state machine;

[0064] Step 204: Enable a write channel of the first backup storage block based on the configuration information.

[0065] The first image update request of the baseboard controller type refers to a request for updating the BMC image. For example, the first image update request in the present application may be a BMC image update request.

[0066] The first backup storage block of the baseboard controller type refers to the backup storage block corresponding to the BMC. For example, the first backup storage block in the present application may be a backup flash in the BMC flash, and the backup flash is a flash used to store update files of the BMC image.

[0067] Specifically, the image update method provided by the present application can be applied to a system in which a root of trust (RoT), an image storage Flash and a protected system have a connection relationship. The purpose is to decouple the RoT from the host system as much as possible under the premise of realizing system hardware protection, that is, when the root of trust component in the system receives a BMC image update request initiated by the baseboard controller through the first thread, and determines that the system is not in the update process of the storage block at the current moment, the root of trust component can send configuration information through a finite state machine, and open the write channel of the backup flash corresponding to the BMC image update request based on the configuration information. Since dual BMC flash and dual Bios Flash are used in the embodiment of the present application, there are a total of 4 flashes. BMC has two flashes corresponding to it, BMC flash0 and BMC Flash1 are backed up by each other, namely active flash and backup flash, the Flash used for BMC startup is active flash, and the other BMC flash is backup flash, backup flash is used to store the update file of BMC image, and backup flash is the first backup storage block of the baseboard controller type.

[0068] For example, Figure 3 As shown in FIG. 1 , it is a flowchart of the RoT Flash arrangement solution without host perception. Figure 3 As shown in , the interaction between BMC, PCH and RoT is realized through SPI and SMBus. FSM (Finite State Machine), Mailbox and DMA are implemented inside RoT. Among them, FSM is used to realize the control flow of the whole system, Mailbox establishes a handshake mechanism with BMC through SMBus (the process is more standardized), and DMA is used to move data between Flash. Figure 3As shown in the figure, BMC has two flashes: BMC flash0 and BMC Flash1 are backed up to each other, namely active flash and backup flash. The flash used for BMC startup is active flash, and the other BMC flash is backup flash. When the image needs to be updated, the new version of the image is written to the backup flash (backup storage block) through BMC (OOB). Biosflash is also two flashes, divided into Bios Staging flash and Bios flash. Bios Flash is used to start Bios, and Bios Staging flash is used to store the update file of Bios image.

[0069] like Figure 3 As shown in, the BMC Flash update path includes: BMC initiates a BMC Flash update request, and sends the BMC Flash update request to the RoT Mailbox through the SMBus, that is, the first thread in the present application can be the SMBus; after the RoT receives the BMC Flash update request through the RoT Mailbox, the RoT needs to detect whether the system is in the Flash update process at the current moment. When the RoT confirms that the system is not in the Flash update process at the current moment, the RoT will allow the BMC Flash update signal to be sent to the BMC through the SMbus; at the same time, the RoT can send configuration information through the FSM, and open the write permission of the BMC Backup Flash based on the configuration information, and then open the write channel of the BMC Backup Flash, so that the BMC can transmit the BMC update image through the opened write channel of the BMC Backup Flash. As a result, by building a new topological connection relationship between RoT and Flash, the Host is unaware of the Staging Flash, and the Host's read and write control of the Flash is taken over by RoT. During the entire image update process, the system is unaware of the existence of the backup storage block, and the introduction of the trusted root component can be achieved with minimal impact on the architecture of the original system (system without RoT configuration), realizing a unified design of non-RoT and RoT solutions, while ensuring the security of the system and effectively improving the system's processing efficiency for image updates.

[0070] In one embodiment, the step of sending an update signal to a baseboard controller so that the baseboard controller transmits the update image file to a backup storage block through a write channel includes:

[0071] An update signal is sent to the baseboard controller through the first thread, so that the baseboard controller transmits the update image file to the first backup storage block on the write channel through the second thread.

[0072] Among them, the first thread in this application can be as follows Figure 3 The SMBus shown in FIG. 14 , the second thread can be as follows Figure 3 The SPI shown in the figure, that is, the first thread and the second thread in the present application are only used to distinguish the threads used to transmit different data. For example, the second thread in the present application is used to transmit the update image file, and the first thread is used to transmit other data.

[0073] Specifically, as shown in Figure 3, the BMC Flash update path includes: BMC initiates a BMC Flash update request, and sends the BMC Flash update request to the RoT Mailbox through the SMBus. After the RoT receives the BMC Flash update request through the RoT Mailbox, the RoT needs to detect whether the system is in the Flash update process at the current moment. When the RoT confirms that the system is not in the Flash update process at the current moment, the RoT sends a signal to allow the BMC Flash update through the SMbus to the BMC; at the same time, the RoT can send configuration information through the FSM, and based on the configuration information, open the write permission of the BMC Backup Flash, and then open the write channel of the BMC Backup Flash, so that the BMC transmits the BMC update image to the BMC Backup Flash through the SPI on the open write channel of the BMC Backup Flash. Therefore, by constructing a new topological connection relationship between the RoT and the Flash, the Host is unaware of the Staging Flash, and the read and write control of the Host on the Flash is taken over by the RoT, without the need for the Host to identify, which reduces the time for the system to inspect different storage block types, thereby effectively improving the processing efficiency of the hungry system for image updates.

[0074] In one embodiment, when a transmission completion signal sent by the baseboard controller is received, the step of verifying the updated image file to obtain a verification result includes:

[0075] When receiving a transmission completion signal sent by the baseboard controller through the first thread, verifying the legitimacy and integrity of the updated image file, and obtaining a verification result indicating that the verification is passed;

[0076] The step of sending the verification result to the baseboard controller and updating the update image file in the backup storage block to the target storage block based on the verification result includes:

[0077] A verification result indicating that the verification has passed is sent to the baseboard controller, and based on the verification result indicating that the verification has passed, a direct memory access function is configured through a finite state machine, and based on the direct memory access function, the updated image file in the first backup storage block is updated to the first target storage block.

[0078] The first target storage block refers to a formal storage block, which is different from a backup storage block and is a storage block used for BMC startup. For example, the first target storage block in the present application may be an active flash.

[0079] Specifically, the BMC Flash update path shown in Figure 3 includes: after the BMC completes the transmission of the BMC update image, the BMC sends a transmission completion signal (flag signal) to the RoT through the SMBus; when the RoT receives the transmission completion signal sent by the BMC through the SMbus, the RoT can start to verify the legitimacy and integrity of the BMC update image file, and obtain a verification result R (passed) indicating that the verification passed. The RoT records the verification result R (passed). At the same time, the RoT sends the verification result R (passed) to the BMC, so that the BMC restarts the update image from Backup Flash0 when necessary. After correct startup, the RoT configures the direct memory access function through the finite state machine, DMAs the new image of Backup Flash0 to the last active flash0, and marks the previous Backup flash0 as the new active flash1, and marks the previous active flash0 as the new Backup flash1. As a result, under the premise of achieving system hardware protection, the RoT and the Host system are decoupled as much as possible, and the introduction of RoT can have as little impact on the architecture of the original system (system without RoT configuration) as possible. When the Host image needs to be upgraded, the new version of the image is first updated to the backup storage block in an out-of-band manner. When the system confirms that the image can be updated, the new version of the image replaces the old version. After passing the RoT verification, the update is completed and the system runs the new image. While ensuring the security of the system, it can effectively improve the system's processing efficiency for image updates.

[0080] In one embodiment, the method is applied to a pluggable root-of-trust component; before opening a write channel for a backup storage block, the method further includes:

[0081] In response to the functional operation, the default card reader / writer function is switched to a trusted root function corresponding to the trusted root component; wherein the card reader / writer function does not support the trusted root function.

[0082] Among them, the functional operation refers to the operation of whether to configure the trusted root function. For example, the functional operation in this application can be an operation of the user selecting the trusted root function option displayed in the configuration interface, or it can be an operation of replacing the original IO card with a plug-in RoT card of the same size to enable the trusted root function.

[0083] Specifically, the image update method provided by the present application can be applied to a system in which a root of trust (RoT), an image storage Flash and a protected system are connected. In response to a function operation triggered by a user, the system switches the default card reader / writer function to a root of trust function corresponding to the root of trust component; wherein the card reader / writer function does not support the root of trust function. That is, in order to achieve consistency between the mainboard design scheme that supports RoT and that that does not support RoT (RoT is an optional configuration), in the embodiments of the present application, Figure 3 As shown in , the board in the embodiment of the present application adopts a design of the same size as the IO card that does not support RoT. If a solution with RoT is selected, it is only necessary to replace the original IO card with a RoT card of the same size to achieve flexible opening or closing of the RoT function, so that RoT forms a minimum independent system, which is an optional configuration of the newly developed server platform and a plug-in option.

[0084] In one embodiment, the target storage block is a primary storage block; the step of sending the verification result to the baseboard controller, and updating the updated image file in the backup storage block to the target storage block based on the verification result includes:

[0085] The verification result is sent to the baseboard controller, and the primary and backup tags between the primary storage block and the backup storage block are exchanged based on the verification result to update the image file from the backup storage block to the target storage block.

[0086] Specifically, Figure 3As shown in , the BMC Flash update path includes: when the RoT receives the transmission completion signal sent by the BMC through the SMbus, the RoT can start to verify the legitimacy and integrity of the BMC update image file, and obtain the verification result R (passed) indicating that the verification is passed. The RoT records the verification result R (passed). At the same time, the RoT sends the verification result R (passed) to the BMC so that the BMC restarts the update image from Backup Flash0 when necessary. After correctly starting, the RoT marks the previous Backup flash0 as the new active flash1 and the previous active flash0 as the new Backup flash1 to update the BMC update image file from the backup storage block Backup flash0 to the target storage block active flash1. In addition, the RoT can also configure the direct memory access function through the finite state machine to DMA the new image of active flash1 to the Backup flash1 to realize the backup of the new image. Therefore, during the entire image update process, the system is unaware of the existence of the backup storage block, and the introduction of the trusted root component can be achieved with minimal impact on the original system (system without RoT configuration) architecture, achieving a unified design of non-RoT and RoT solutions, while ensuring the security of the system and effectively improving the system's processing efficiency for image updates.

[0087] In one embodiment, the image update request includes a second image update request of a central processing unit type; the backup storage block includes a second backup storage block of a central processing unit type; when receiving the image update request initiated by the baseboard controller, the step of opening the write channel of the backup storage block includes:

[0088] When receiving a second image update request initiated by the baseboard controller through the first thread and determining that the storage block is not in the update process at the current moment, sending configuration information through the finite state machine;

[0089] A write channel of the second backup storage block is opened based on the configuration information.

[0090] The second image update request of the CPU type refers to a request for updating the BIOS image. For example, the second image update request in the present application may be a BIOS image update request.

[0091] The second backup storage block of the central processing unit type refers to the backup storage block corresponding to the Bios. For example, the second backup storage block in the present application can be the Bios Staging Flash in the Bios flash. The Bios Staging Flash is a flash used to store update files of the Bios image.

[0092] Specifically, the image update method provided by the present application can be applied to a system in which a root of trust (RoT), an image storage Flash and a protected system are connected. The purpose is to decouple the RoT from the Host system as much as possible under the premise of realizing system hardware protection, that is, when the root of trust component in the system receives a Bios image update request initiated by the baseboard controller through the first thread, and determines that the storage block is not in the update process at the current moment, the root of trust component can send configuration information through a finite state machine, and open the write channel of the Staging flash corresponding to the Bios image update request based on the configuration information. Since dual BMC flash and dual Bios Flash are used in the embodiment of the present application, there are a total of 4 flashes. Biosflash is also two flashes, divided into Staging flash and Bios flash. Bios Flash is a flash used to start Bios, and Staging flash is used to store the update file of Bios image. Staging flash is the second backup storage block of the central processing unit type.

[0093] For example, Figure 3 As shown in FIG. 1 , it is a flowchart of the RoT Flash arrangement solution without host perception. Figure 3As shown in, the Bios Flash update path includes: BMC initiates a Bios image update request, and sends the Bios image update request to the RoT Mailbox through the SMBus, that is, the first thread in this application can be the SMBus; after the RoT receives the Bios image update request through the RoT Mailbox, the RoT needs to detect whether the system is in the Flash update process at the current moment. When the RoT confirms that the system is not in the Flash update process at the current moment, the RoT will allow the Bios image update signal to be sent to the BMC through the SMbus; at the same time, the RoT can send configuration information through the FSM, and open the write permission of the Bios Staging Flash based on the configuration information, and then open the write channel of the Bios Staging Flash, so that the BMC can transmit the Bios update image through the opened write channel of the Bios Staging Flash. As a result, by building a new topological connection relationship between RoT and Flash, the Host is unaware of the Staging Flash, and the Host's read and write control of the Flash is taken over by RoT. During the entire image update process, the system is unaware of the existence of the backup storage block, and the introduction of the trusted root component can be achieved with minimal impact on the architecture of the original system (system without RoT configuration), realizing a unified design of non-RoT and RoT solutions, while ensuring the security of the system and effectively improving the system's processing efficiency for image updates.

[0094] In one embodiment, the step of sending an update signal to a baseboard controller so that the baseboard controller transmits the update image file to a backup storage block through a write channel includes:

[0095] An update signal is sent to the baseboard controller through the first thread, so that the baseboard controller transmits the update image file to the second backup storage block on the write channel through the second thread.

[0096] Specifically, as shown in Figure 3, the Bios Flash update path includes: BMC initiates a Bios image update request, and sends the Bios image update request to the RoT Mailbox through the SMBus, that is, the first thread in the present application can be the SMBus; after the RoT receives the Bios image update request through the RoT Mailbox, the RoT needs to detect whether the system is in the Flash update process at the current moment. When the RoT confirms that the system is not in the Flash update process at the current moment, the RoT will allow the Bios image update signal to be sent to the BMC through the SMbus; at the same time, the RoT can send configuration information through the FSM, and open the write permission of the Bios Staging Flash based on the configuration information, and then open the write channel of the Bios Staging Flash, so that the BMC can transmit the Bios update image to the Bios Staging Flash through the SPI on the enabled write channel of the Bios Staging Flash. Therefore, by constructing a new topological connection relationship between RoT and Flash, the Host is unaware of the Staging Flash. The Host's read and write control of the Flash is taken over by RoT, and the Host does not need to identify it. This reduces the time for the system to inspect different storage block types, thereby effectively improving the system's processing efficiency for image updates.

[0097] In one embodiment, when a transmission completion signal sent by the baseboard controller is received, the step of verifying the updated image file to obtain a verification result includes:

[0098] When receiving a transmission completion signal sent by the baseboard controller through the first thread, verifying the legitimacy and integrity of the updated image file, and obtaining a verification result indicating that the verification is passed;

[0099] The step of sending the verification result to the baseboard controller and updating the update image file in the backup storage block to the target storage block based on the verification result includes:

[0100] A verification result indicating that the verification has passed is sent to the baseboard controller, and based on the verification result indicating that the verification has passed, a direct memory access function is configured through a finite state machine, and based on the direct memory access function, the updated image file in the second backup storage block is updated to the second target storage block.

[0101] Among them, the second target storage block refers to a formal storage block, which is different from a backup storage block and is a storage block used for Bios startup. For example, the second target storage block in this application may be Bios Flash.

[0102] Specifically, as shown in Figure 3, the BMC Flash update path includes: after the BMC completes the transmission of the Bios update image, the BMC sends a transmission completion signal (flag signal) to the RoT through the SMBus; when the RoT receives the transmission completion signal sent by the BMC through the SMbus, the RoT can start to verify the legality and integrity of the Bios update image file, obtain a verification result R (passed) indicating that the verification has passed, and record the verification result R (passed). At the same time, when the Host is working normally, the RoT configures DMA through the FSM to move the new image in the Staging Flash to the BiosFlash. After the relocation is completed, the RoT starts to verify the Bios flash. When the RoT verifies the image in the Bios flash and passes it, the RoT sends the verification result indicating that the verification has passed to the BMC, so that the BMC can restart at an appropriate time to complete the update of the Bios image. As a result, under the premise of achieving system hardware protection, the RoT and the Host system are decoupled as much as possible, so that the introduction of RoT can have as little impact on the original system (system without RoT) architecture as possible. During the entire Bios Image update process, the Host system is unaware of the existence of the Staging flash and writes to the Bios Staging flash according to the address arrangement in the non-RoT solution, thus realizing the free selection of the RoT solution at the system level.

[0103] In one embodiment, Figure 4 As shown, another image update method is provided. This embodiment takes the method applied to a system including a server as an example. It can be understood that the method can also be applied to a server, and can also be applied to a system including a terminal and a server. In this embodiment, the method is applied to a baseboard controller in a system including a server as an example, and includes the following steps:

[0104] Step 402, sending an image update request to the trusted root component, so that the trusted root component opens a write channel for the backup storage block; wherein the trusted root component is in a pluggable physical form.

[0105] Step 404: When an update signal sent by the trusted root component is received, the update image file is transmitted to the backup storage block through the write channel.

[0106] Step 406, when the update image file is completely transmitted, a transmission completion signal is sent to the trusted root component, so that the trusted root component verifies the update image file and obtains a verification result.

[0107] Step 408: When the verification result sent by the trusted root component is received, the image is updated based on the verification result and the updated image file.

[0108] Among them, the trusted root component in the present application is a plug-in physical form. For example, the trusted root component in the present application can be: a RoT card of the same size as an IO card that does not support RoT, that is, the RoT card is plug-in.

[0109] Specifically, the image update method provided in the present application can be applied to a system in which a root of trust (RoT), an image storage Flash and a protected system are connected. The purpose is to decouple the RoT and the Host system as much as possible under the premise of realizing system hardware protection, that is, the substrate controller can send an image update request to the trusted root component so that the trusted root component can open the write channel of the backup storage block; wherein the trusted root component is a pluggable physical form, that is, when the trusted root component in the system receives the image update request initiated by the substrate controller, the trusted root component can open the write channel of the backup storage block corresponding to the image update request.

[0110] Furthermore, when the baseboard controller receives an update signal sent by the trusted root component, the update image file is transmitted to the backup storage block through the write channel. When the update image file is transmitted, the baseboard controller can send a signal indicating that the transmission is completed to the trusted root component, so that the trusted root component verifies the transmitted update image file, obtains the verification result, and sends the verification result to the baseboard controller. That is, when the baseboard controller receives the verification result sent by the trusted root component, the baseboard controller can update the image in the target time period based on the verification result and the update image file, that is, the baseboard controller can restart the target storage block in the target time period based on the verification result and the update image file to complete the update of the image. The system in the embodiment of the present application can restart at an appropriate time to complete the update of the image.

[0111] In this embodiment, an image update request is sent to the trusted root component so that the trusted root component opens a write channel of the backup storage block; wherein the trusted root component is in a pluggable physical form; when an update signal sent by the trusted root component is received, the updated image file is transmitted to the backup storage block through the write channel; when the updated image file is transmitted, a transmission completion signal is sent to the trusted root component so that the trusted root component verifies the updated image file and obtains a verification result; when the verification result sent by the trusted root component is received, the image is updated based on the verification result and the updated image file. Since a new topological connection relationship between the trusted root component and the storage block is constructed, the read and write control of the storage block is taken over by the trusted root component. Therefore, when the trusted root component receives the image update request initiated by the baseboard controller, the trusted root component can control the opening of the write channel of the backup storage block and send an update signal to the baseboard controller, so that the baseboard controller transmits the updated image file to the backup storage block through the opened write channel; at the same time, when the trusted root component receives the transmission completion signal sent by the baseboard controller, the trusted root component verifies the updated image file, obtains the verification result, and sends the verification result to the baseboard controller, so that the baseboard controller performs the image update at an appropriate time based on the verification result and the updated image file. During the entire image update process, the system is unaware of the existence of the backup storage block, and the introduction of the trusted root component can be achieved with minimal impact on the architecture of the original system (system without RoT configuration), realizing the unified design of non-RoT and RoT solutions, while ensuring the security of the system, and effectively improving the system's processing efficiency for image updates.

[0112] In one embodiment, the backup storage block includes a first backup storage block of a baseboard controller type; when an update signal sent by a trusted root component is received, the step of transmitting the update image file to the backup storage block through a write channel includes:

[0113] When an update signal sent by the trusted root component through the first thread is received, the update image file is transmitted to the first backup storage block on the write channel through the second thread.

[0114] Among them, the first thread in this application can be as follows Figure 3 The SMBus shown in FIG. 14 , the second thread can be as follows Figure 3 The SPI shown in the figure, that is, the first thread and the second thread in the present application are only used to distinguish the threads used to transmit different data. For example, the second thread in the present application is used to transmit the update image file, and the first thread is used to transmit other data.

[0115] Specifically, as shown in Figure 3, the BMC Flash update path includes: BMC initiates a BMC Flash update request, and sends the BMC Flash update request to the RoT Mailbox through the SMBus. After the RoT receives the BMC Flash update request through the RoT Mailbox, the RoT needs to detect whether the system is in the Flash update process at the current moment. When the RoT confirms that the system is not in the Flash update process at the current moment, the RoT sends a signal to allow the BMC Flash update through the SMbus to the BMC; at the same time, the RoT can send configuration information through the FSM, and based on the configuration information, open the write permission of the BMC Backup Flash, and then open the write channel of the BMC Backup Flash, so that the BMC transmits the BMC update image to the BMC Backup Flash through the SPI on the open write channel of the BMC Backup Flash. Therefore, by constructing a new topological connection relationship between the RoT and the Flash, the Host is unaware of the Staging Flash, and the read and write control of the Host on the Flash is taken over by the RoT, without the need for the Host to identify, which reduces the time for the system to inspect different storage block types, thereby effectively improving the processing efficiency of the hungry system for image updates.

[0116] In one embodiment, when the update image file is transmitted, a transmission completion signal is sent to the trusted root component so that the trusted root component verifies the update image file, and the step of obtaining the verification result includes:

[0117] When the update image file is transmitted, a transmission completion signal is sent to the trusted root component through the first thread, so that the trusted root component verifies the legitimacy and integrity of the update image file and obtains a verification result indicating that the verification is passed;

[0118] When the verification result sent by the trusted root component is received, performing image updating based on the verification result and the updated image file includes:

[0119] When a verification result indicating that the verification has passed is received from the trusted root component, an image update is performed based on the verification result indicating that the verification has passed and the updated image file in the first backup storage block.

[0120] Specifically, the BMC Flash update path shown in Figure 3 includes: after the BMC completes the transmission of the BMC update image, the BMC sends a transmission completion signal (flag signal) to the RoT through the SMBus; when the RoT receives the transmission completion signal sent by the BMC through the SMbus, the RoT can start to verify the legitimacy and integrity of the BMC update image file, and obtain a verification result R (passed) indicating that the verification passed. The RoT records the verification result R (passed). At the same time, the RoT sends the verification result R (passed) to the BMC, so that the BMC restarts the update image from Backup Flash0 when necessary. After correct startup, the RoT configures the direct memory access function through the finite state machine, DMAs the new image of Backup Flash0 to the last active flash0, and marks the previous Backup flash0 as the new active flash1, and marks the previous active flash0 as the new Backup flash1. As a result, under the premise of achieving system hardware protection, the RoT and the Host system are decoupled as much as possible, and the introduction of RoT can have as little impact on the architecture of the original system (system without RoT configuration) as possible. When the Host image needs to be upgraded, the new version of the image is first updated to the backup storage block in an out-of-band manner. When the system confirms that the image can be updated, the new version of the image replaces the old version. After passing the RoT verification, the update is completed and the system runs the new image. While ensuring the security of the system, it can effectively improve the system's processing efficiency for image updates.

[0121] In one embodiment, the backup storage block includes a second backup storage block of a central processing unit type; when an update signal sent by a trusted root component is received, the step of transmitting the update image file to the backup storage block through a write channel includes:

[0122] When an update signal sent by the trusted root component through the first thread is received, the update image file is transmitted to the second backup storage block on the write channel through the second thread.

[0123] Specifically, as shown in Figure 3, the Bios Flash update path includes: BMC initiates a Bios image update request, and sends the Bios image update request to the RoT Mailbox through the SMBus, that is, the first thread in the present application can be the SMBus; after the RoT receives the Bios image update request through the RoT Mailbox, the RoT needs to detect whether the system is in the Flash update process at the current moment. When the RoT confirms that the system is not in the Flash update process at the current moment, the RoT will allow the Bios image update signal to be sent to the BMC through the SMbus; at the same time, the RoT can send configuration information through the FSM, and open the write permission of the Bios Staging Flash based on the configuration information, and then open the write channel of the Bios Staging Flash, so that the BMC can transmit the Bios update image to the Bios Staging Flash through the SPI on the enabled write channel of the Bios Staging Flash. Therefore, by constructing a new topological connection relationship between RoT and Flash, the Host is unaware of the Staging Flash. The Host's read and write control of the Flash is taken over by RoT, and the Host does not need to identify it. This reduces the time for the system to inspect different storage block types, thereby effectively improving the system's processing efficiency for image updates.

[0124] In one embodiment, when the update image file is transmitted, a transmission completion signal is sent to the trusted root component so that the trusted root component verifies the update image file, and the step of obtaining the verification result includes:

[0125] When the update image file is transmitted, a transmission completion signal is sent to the trusted root component through the first thread, so that the trusted root component verifies the legitimacy and integrity of the update image file and obtains a verification result indicating that the verification is passed;

[0126] When the verification result sent by the trusted root component is received, performing image updating based on the verification result and the updated image file includes:

[0127] When a verification result indicating that the verification has passed is received from the trusted root component, an image update is performed based on the verification result indicating that the verification has passed and the updated image file in the second backup storage block.

[0128] Specifically, as shown in Figure 3, the BMC Flash update path includes: after the BMC completes the transmission of the Bios update image, the BMC sends a transmission completion signal (flag signal) to the RoT through the SMBus; when the RoT receives the transmission completion signal sent by the BMC through the SMbus, the RoT can start to verify the legality and integrity of the Bios update image file, obtain a verification result R (passed) indicating that the verification has passed, and record the verification result R (passed). At the same time, when the Host is working normally, the RoT configures DMA through the FSM to move the new image in the Staging Flash to the BiosFlash. After the relocation is completed, the RoT starts to verify the Bios flash. When the RoT verifies the image in the Bios flash and passes it, the RoT sends the verification result indicating that the verification has passed to the BMC, so that the BMC updates the image based on the verification result indicating that the verification has passed and the updated image file in the Staging Flash, that is, the BMC can restart at an appropriate time to complete the update of the Bios image. As a result, under the premise of achieving system hardware protection, the RoT and the Host system are decoupled as much as possible, so that the introduction of RoT can have as little impact on the original system (system without RoT) architecture as possible. During the entire Bios Image update process, the Host system is unaware of the existence of the Staging flash and writes to the Bios Staging flash according to the address arrangement in the non-RoT solution, thus realizing the free selection of the RoT solution at the system level.

[0129] In one embodiment, a mirror image update system is provided, the system comprising:

[0130] The baseboard controller is used to send an image update request to the trusted root component so that the trusted root component opens a write channel of the backup storage block;

[0131] A trusted root component, used to send an update signal to the baseboard controller, so that the baseboard controller transmits the update image file to the backup storage block through the write channel; wherein the trusted root component is a plug-in physical form;

[0132] The baseboard controller is also used to send a transmission completion signal to the trusted root component, so that the trusted root component verifies the updated image file to obtain a verification result; when receiving the verification result sent by the trusted root component, the image is updated based on the verification result and the updated image file.

[0133] In one embodiment, the present application further provides an application scenario, and the application scenario applies the above-mentioned image update method. Specifically, the application of the image update method in the application scenario is as follows:

[0134] When it is desired to achieve the service experience without affecting the server (host) side, while effectively improving the processing efficiency of the entire system (host) for image updates, the above-mentioned image update method can be used, that is, in the scenario where the root of trust (RoT), the image storage Flash and the protected system have a connection relationship, the baseboard controller can send an image update request to the trusted root component, so that the trusted root component can open the write channel of the backup storage block; wherein the trusted root component is a plug-in physical form, that is, when the trusted root component in the system receives the image update request initiated by the baseboard controller, the trusted root component can open the write channel of the backup storage block corresponding to the image update request. Further, when the baseboard controller receives the update signal sent by the trusted root component, the updated image file is transmitted to the backup storage block through the write channel, and when the updated image file is transmitted, the baseboard controller can send a signal indicating the completion of the transmission to the trusted root component, so that the trusted root component verifies the transmitted updated image file, obtains the verification result, and sends the verification result to the baseboard controller, that is, when the baseboard controller receives the verification result sent by the trusted root component, the baseboard controller can perform image updates in the target time period based on the verification result and the updated image file. Compared with the traditional method, a Host-unaware server root of trust Flash arrangement method designed in the embodiment of the present application decouples the RoT from the Host system as much as possible under the premise of realizing system hardware protection, so that the introduction of RoT can have as little impact on the original system (system without RoT configuration) architecture as possible. When the Host's image needs to be upgraded, the new version of the image is first updated to the backup storage block in an out-of-band form. When the system confirms that the image can be updated, the new version of the image replaces the old version. After passing the RoT verification, the update is completed, and the system can directly run the new image without the system inspecting different storage block types to determine the read and write control rights corresponding to the backup storage block and the formal storage block. While ensuring the security of the system, it can effectively improve the system's processing efficiency for image updates.

[0135] The method provided in the embodiment of the present application can be applied to various scenarios where the root of trust (RoT), the image storage Flash and the protected system have a connection relationship. The following takes the scenario of connecting the plug-in RoT card to the mainboard of the whole machine as an example to illustrate the image update method provided in the embodiment of the present application.

[0136] Host: mainly refers to the server CPU. The instruction set format is not restricted and can be X86, ARM, MIPS or RISC-V, etc.

[0137] RoT: Root of trust, is a component (Chip or system) that verifies, updates, and reads and writes protection for server images.

[0138] Hardware security system: By building a reasonable hardware mechanism, the hardware startup, operation and exit processes are protected. At the same time, when the system security is threatened or damaged, the hardware security system has the ability to restore the entire system to a safe state or issue an alarm.

[0139] Staging Flash: A flash storage block used to temporarily store the upgraded system image (Image) when the system image is updated. Under certain conditions, the Staging Flash can be converted to the official Flash (or not, depending on the system settings).

[0140] SoC: System on Chip.

[0141] Disadvantages of traditional image update methods:

[0142] (1) Discussions are basically centered around the trust chain transfer framework of the root of trust, with emphasis on the integrity of the framework. However, how to integrate it with existing Data Center facilities remains a problem to be solved. For servers under development or iterative server products, it is difficult to achieve plug-and-play configuration of RoT as an independent plug-in type.

[0143] (2) After RoT is integrated into the system as the system trust root, when the BMC image or Bios image needs to be updated, the traditional method is to write the image file to the corresponding Staging flash through the OOB channel. The system needs to identify the Staging flash and Active flash to determine the read and write control rights corresponding to the Staging flash and Active flash respectively. In particular, the time for patrolling the flash type is increased for Bios startup, which is likely to affect the startup efficiency and thus affect the system's processing efficiency for image updates.

[0144] Therefore, in order to solve the above problems, the present application provides a solution, that is, the present application proposes a server trust root Flash arrangement method that is not perceived by the Host, by constructing a new topological connection relationship between RoT and Flash, so that the Host is unaware of the Staging Flash, and the read and write control of the Host to the Flash is taken over by RoT; at the same time, the RoT in the present application forms the smallest independent system, as an optional configuration of the newly developed server platform, plug-in optional; that is, the present application proposes a connection relationship between a trust root (RoT), an image storage Flash and a protected system for the trust root solution, the purpose is to decouple the RoT from the Host system as much as possible under the premise of realizing system hardware protection. Specifically, the method provided by the present application can make the introduction of RoT have as little impact on the architecture of the original system (system without RoT configuration) as possible. When the Host's image needs to be upgraded, the new version of the image is first updated to the Staging flash in the form of out-of-band (OOB). When the system confirms that the image can be updated, the new version of the image replaces the old version. After the RoT verification, the update is completed and the system runs the new image. Compared with the traditional method, the Flash solution involved in the embodiment of the present application realizes a unified design of the Host side for non-RoT and RoT solutions, and realizes the free selection of RoT solutions at the system level. While ensuring the security of the system, it can effectively improve the system's processing efficiency for image updates.

[0145] On the product side, the method provided in this application develops an independent component for the self-developed server platform, which is in the form of an I / O card. The product side provides an optional RoT configuration for the self-developed server platform. After selecting the RoT, the IO card carrying the RoT is connected to the system motherboard through a plug-in card. At the same time, as an independent component, RoT can be adapted to all platforms, including Intel platform, AMD platform and ARM platform, as well as other foreseeable platforms such as RISC-V platform. Figure 5 The following is a schematic diagram of a server solution with integrated RoT. Figure 5 In the system, the IO card carrying the RoT can be connected to the system mainboard by plugging and unplugging.

[0146] On the technical side, Figure 6 As shown in the figure, it is a schematic diagram of the Non-RoT solution. Figure 6In the server machine solution that does not support RoT shown in , the storage Flash of the system startup Image includes BMC Flash and Bios Flash. BMC Flash includes two flashes: BMC flash0 and BMC Flash1 back up each other, active flash and backup flash respectively. These Flashes are usually used as independent IO cards and connected to the mainboard of the whole machine through plug-in cards. As the root of trust of the system, RoT plays an important role in protecting Flash and supporting image updates. In order to support updates to BMC Flash and Bios Flash images, the introduction of RoT will affect the system's access to read and write the original Flash. In order to achieve consistency between the motherboard side design solutions that support RoT and those that do not support RoT (RoT is an optional configuration), this solution provides a solution, please refer to Figure 7 as shown in .

[0147] First, the board of this solution is designed with the same size as the IO card that does not support RoT. If you choose the solution with RoT, you only need to replace the original IO card with a RoT card of the same size;

[0148] Secondly, this solution uses dual BMC flash and dual Bios Flash, a total of 4 flashes. BMC has two flashes, BMC flash0 and BMC Flash1 are backed up by each other, namely active flash and backup flash. The flash used for BMC startup is active flash, and the other BMC flash is backup flash. When an update is required, the image is written to the backup flash through BMC (OOB). The active flash and backup flash can be rotated according to the actual BMC. Bios flash is also two flashes, divided into Staging flash and Bios flash. Bios Flash is used to start Bios, and Staging flash is used to store the update file of Bios image. When BMC wants to update the Bios image, the Bios image file is written to the Bios Staging flash, and then RoT starts to verify the updated file. When the Host is running, RoT moves the Bios update image to the Bios flash. After the move is completed, RoT verifies the Bios image again. If the verification passes, Bios will restart at an appropriate time to update the image. This implements a server trust root Flash layout solution that is unaware of the host.

[0149] The specific implementation process is as follows:

[0150] like Figure 7 As shown in Figure 1, it is a schematic diagram of the specific implementation of the Host-unaware RoT Flash arrangement solution. Figure 7 As shown in the figure, the interaction between BMC, PCH and RoT in this application is realized through SPI and SMBus. FSM (Finite State Machine), Mailbox and DMA are implemented inside RoT, among which FSM is used to realize the control flow of the whole system, Mailbox establishes a handover mechanism with BMC through SMBus (the process is more standardized), and DMA is used to move data between Flash.

[0151] 1.BMC Flash update path

[0152] (1) The BMC initiates a BMC image update and sends the BMC update request to the RoT Mailbox via the SMBus.

[0153] (2) After receiving the BMC Flash update request, if the RoT confirms that the Flash is not currently in the update process, the RoT sends a signal to allow the BMC Flash update to the BMC via the SMbus;

[0154] (3) RoT starts sending configuration information through FSM, opens the write permission of BMC Backup Flash, and opens the write channel;

[0155] (4) BMC transmits BMC update image;

[0156] (5) After the BMC completes the transmission, it sends a transmission completion signal to the RoT via the SMBus;

[0157] (6) After receiving the transmission completion signal, the RoT starts to verify the new image, records the verification result, and sends the verification result to the BMC;

[0158] (7) The BMC restarts and updates the image from the Backup Flash when necessary. After the BMC is correctly started, the RoT DMAs the new image of the Backup Flash to the last active flash. The RoT marks the previous Backup flash as the new active flash.

[0159] 2. Bios Flash update path

[0160] (1) BMC initiates a Bios image update and sends the Bios update request to the RoT Mailbox via the SMBus;

[0161] (2) After receiving the Bios image update request, if the RoT confirms that it is not currently in the Flash update process, the RoT will send a signal to allow the Bios image update to the BMC via the SMbus;

[0162] (3) RoT sends configuration information through FSM, opens the write permission of Bios Staging Flash, and opens the write channel;

[0163] (4) BMC transmits Bios update image;

[0164] (5) After the BMC completes the transfer, it sends a transfer completion signal to the RoT via the SMBus;

[0165] (6) After receiving the transmission completion signal, the RoT starts to verify the new image and records the verification result;

[0166] (7) When the host is working normally, RoT configures DMA through FSM to move the image of Staging Flash to Bios Flash. After the migration is completed, the verification of Bios Flash is enabled;

[0167] (8) After the Bios flash image is verified, RoT sends the verification result to BMC;

[0168] (9) The system will restart at an appropriate time to complete the update of the Bios image.

[0169] During the entire Bios Image update process, the Host system is unaware of the existence of the Staging flash and writes the Bios Staging flash according to the address arrangement in the non-RoT solution, thus achieving a unified host-side design for the non-RoT and RoT solutions and enabling free selection of the RoT solution at the system level.

[0170] In addition, 1. the PCH mentioned in this application can be removed according to the evolution of the X-86 platform;

[0171] 2. In principle, this application is not targeted at any specific vendor's platform and is not bound to any X-86 platform;

[0172] 3. This application is also applicable to ARM platform and other RISC platforms;

[0173] 4. This application does not restrict the Flash capacity and model;

[0174] 5. In the implementation of this application, the physical form of the RoT is not limited, that is, it is not limited to ASIC, FPGA or other logic devices that can implement functions such as FSM and DMA;

[0175] 6. This application focuses on the overall solution description. The characterization of certain signals and the adjustment of local signals (including the modification of the number of Muxes) during the specific implementation process also fall within the description scope of this solution.

[0176] The beneficial effects of the technical solution of the present application include: during the entire Bios Image update process, the Host system is unaware of the existence of the Staging flash, and writes into the Bios Staging flash according to the address arrangement in the non-RoT solution, thereby realizing a unified design of the Host side for the non-RoT and RoT solutions, and realizing free selection of the RoT solution at the system level, which can effectively improve the system's processing efficiency for image updates while ensuring the security of the system.

[0177] It should be understood that, although the various steps in the flowcharts involved in the above-mentioned embodiments are displayed in sequence according to the indication of the arrows, these steps are not necessarily executed in sequence according to the order indicated by the arrows. Unless there is a clear explanation in this article, the execution of these steps is not strictly limited in order, and these steps can be executed in other orders. Moreover, at least a part of the steps in the flowcharts involved in the above-mentioned embodiments can include multiple steps or multiple stages, and these steps or stages are not necessarily executed at the same time, but can be executed at different times, and the execution order of these steps or stages is not necessarily carried out in sequence, but can be executed in turn or alternately with other steps or at least a part of the steps or stages in other steps.

[0178] Based on the same inventive concept, the embodiment of the present application also provides an image update device for implementing the image update method involved above. The implementation solution provided by the device to solve the problem is similar to the implementation solution recorded in the above method, so the specific limitations in one or more image update device embodiments provided below can refer to the limitations of the image update method above, and will not be repeated here.

[0179] In one embodiment, Figure 8 As shown, a mirror image update device is provided, including: an opening module 802, a sending module 804, a verification module 806 and an update module 808, wherein:

[0180] The enabling module 802 is used to enable the write channel of the backup storage block when receiving the mirror update request initiated by the baseboard controller.

[0181] The sending module 804 is used to send an update signal to the baseboard controller, so that the baseboard controller transmits the update image file to the backup storage block through the write channel.

[0182] The verification module 806 is used to verify the update image file and obtain a verification result when receiving the transmission completion signal sent by the baseboard controller.

[0183] The update module 808 is used to send the verification result to the baseboard controller, and update the update image file in the backup storage block to the target storage block based on the verification result, so that the baseboard controller performs image update based on the verification result and the update image file.

[0184] In one embodiment, the image update request includes a first image update request of the substrate controller type; the backup storage block includes a first backup storage block of the substrate controller type; the sending module is also used to send configuration information through a finite state machine when receiving the first image update request initiated by the substrate controller through a first thread and determining that the storage block is not in the update process at the current moment; the opening module is also used to open the write channel of the first backup storage block based on the configuration information.

[0185] In one embodiment, the sending module is further used to send an update signal to the baseboard controller through the first thread, so that the baseboard controller transmits the update image file to the first backup storage block on the write channel through the second thread.

[0186] In one embodiment, the verification module is further used to verify the legitimacy and integrity of the updated image file when receiving a transmission completion signal sent by the baseboard controller through the first thread, and obtain a verification result indicating that the verification has passed; the update module is also used to send the verification result indicating that the verification has passed to the baseboard controller, and based on the verification result indicating that the verification has passed, configure a direct memory access function through a finite state machine, and update the updated image file in the first backup storage block to the first target storage block based on the direct memory access function.

[0187] In one embodiment, the device further includes: a switching module, configured to switch the default card reader / writer function to a trusted root function corresponding to the trusted root function of the trusted root component in response to a functional operation; wherein the card reader / writer function does not support the trusted root function.

[0188] In one embodiment, the target storage block is a primary storage block; the sending module is also used to send the verification result to the baseboard controller, and based on the verification result, the primary and backup tags between the primary storage block and the backup storage block are exchanged to realize the update of the update image file from the backup storage block to the target storage block.

[0189] In one embodiment, the mirror update request includes a second mirror update request of the central processing unit type; the backup storage block includes a second backup storage block of the central processing unit type; the sending module is also used to send configuration information through a finite state machine when receiving a second mirror update request initiated by the baseboard controller through a first thread and determining that the storage block is not in the update process at the current moment; the opening module is also used to open the write channel of the second backup storage block based on the configuration information.

[0190] In one embodiment, the sending module is further used to send an update signal to the baseboard controller through the first thread, so that the baseboard controller transmits the update image file to the second backup storage block on the write channel through the second thread.

[0191] In one embodiment, the verification module is further used to verify the legitimacy and integrity of the updated image file when receiving a transmission completion signal sent by the baseboard controller through the first thread, and obtain a verification result indicating that the verification has passed; the update module is also used to send the verification result indicating that the verification has passed to the baseboard controller, and based on the verification result indicating that the verification has passed, configure a direct memory access function through a finite state machine, and update the updated image file in the second backup storage block to the second target storage block based on the direct memory access function.

[0192] In one embodiment, Fig. 9 As shown, another image update device is provided, including: a sending module 902, a transmission module 904 and an update module 906, wherein:

[0193] The sending module 902 is used for the trusted root component to send a mirror update request so that the trusted root component can open a write channel of the backup storage block; wherein the trusted root component is in a pluggable physical form.

[0194] The transmission module 904 is used to transmit the updated image file to the backup storage block through the write channel when receiving the update signal sent by the trusted root component.

[0195] The sending module 902 is further configured to send a transmission completion signal to the trusted root component when the transmission of the update image file is completed, so that the trusted root component verifies the update image file to obtain a verification result.

[0196] The updating module 906 is configured to perform image updating based on the verification result and the updated image file when receiving the verification result sent by the trusted root component.

[0197] In one embodiment, the backup storage block includes a first backup storage block of the substrate controller type; the transmission module is also used to transmit the update image file to the first backup storage block on the write channel through the second thread when receiving an update signal sent by the trusted root component through the first thread.

[0198] In one embodiment, the sending module is further used to send a transmission completion signal to the trusted root component through the first thread when the transmission of the update image file is completed, so that the trusted root component verifies the legitimacy and integrity of the update image file and obtains a verification result indicating that the verification has passed; the update module is further used to perform an image update based on the verification result indicating that the verification has passed and the update image file in the first backup storage block when receiving the verification result indicating that the verification has passed sent by the trusted root component.

[0199] In one embodiment, the backup storage block includes a second backup storage block of the central processing unit type; the transmission module is also used to transmit the updated image file to the second backup storage block on the write channel through the second thread when receiving an update signal sent by the trusted root component through the first thread.

[0200] In one embodiment, the sending module is further used to send a transmission completion signal to the trusted root component through the first thread when the transmission of the update image file is completed, so that the trusted root component verifies the legitimacy and integrity of the update image file and obtains a verification result indicating that the verification has passed; the update module is further used to perform an image update based on the verification result indicating that the verification has passed and the update image file in the second backup storage block when receiving the verification result indicating that the verification has passed sent by the trusted root component.

[0201] Each module in the above-mentioned image update device can be implemented in whole or in part by software, hardware or a combination thereof. Each module can be embedded in or independent of a processor in a computer device in the form of hardware, or can be stored in a memory in a computer device in the form of software, so that the processor can call and execute the operations corresponding to each module above.

[0202] In one embodiment, a computer device is provided. The computer device may be a terminal or a server. In this embodiment, the computer device is described as a server. The internal structure diagram thereof may be as follows: Fig.10As shown. The computer device includes a processor, a memory, an input / output interface (Input / Output, referred to as I / O) and a communication interface. The processor, the memory and the input / output interface are connected through a system bus, and the communication interface is connected to the system bus through the input / output interface. The processor of the computer device is used to provide computing and control capabilities. The memory of the computer device includes a non-volatile storage medium and an internal memory. The non-volatile storage medium stores an operating system, a computer program and a database. The internal memory provides an environment for the operation of the operating system and the computer program in the non-volatile storage medium. The database of the computer device is used to store image update data. The input / output interface of the computer device is used to exchange information between the processor and an external device. The communication interface of the computer device is used to communicate with an external terminal through a network connection. When the computer program is executed by the processor, a method for image update is implemented.

[0203] Those skilled in the art will understand that Fig.10 The structure shown in the figure is only a block diagram of a part of the structure related to the solution of the present application, and does not constitute a limitation on the computer device to which the solution of the present application is applied. The specific computer device may include more or fewer components than those shown in the figure, or combine certain components, or have a different arrangement of components.

[0204] In one embodiment, a computer device is provided, including a memory and a processor, wherein a computer program is stored in the memory, and the processor implements the steps in the above-mentioned method embodiments when executing the computer program.

[0205] In one embodiment, a computer-readable storage medium is provided, on which a computer program is stored. When the computer program is executed by a processor, the steps in the above-mentioned method embodiments are implemented.

[0206] In one embodiment, a computer program product is provided, including a computer program, which implements the steps in the above method embodiments when executed by a processor.

[0207] It should be noted that the user information (including but not limited to user device information, user personal information, etc.) and data (including but not limited to data used for analysis, stored data, displayed data, etc.) involved in this application are all information and data authorized by the user or fully authorized by all parties, and the collection, use and processing of relevant data must comply with relevant laws, regulations and standards of relevant countries and regions.

[0208] Those skilled in the art can understand that all or part of the processes in the above-mentioned embodiment methods can be completed by instructing the relevant hardware through a computer program, and the computer program can be stored in a non-volatile computer-readable storage medium. When the computer program is executed, it can include the processes of the embodiments of the above-mentioned methods. Among them, any reference to the memory, database or other medium used in the embodiments provided in the present application can include at least one of non-volatile and volatile memory. Non-volatile memory can include read-only memory (ROM), magnetic tape, floppy disk, flash memory, optical memory, high-density embedded non-volatile memory, resistive random access memory (ReRAM), magnetoresistive random access memory (MRAM), ferroelectric random access memory (FRAM), phase change memory (PCM), graphene memory, etc. Volatile memory can include random access memory (RAM) or external cache memory, etc. As an illustration and not limitation, RAM can be in various forms, such as static random access memory (SRAM) or dynamic random access memory (DRAM). The database involved in each embodiment provided in this application may include at least one of a relational database and a non-relational database. Non-relational databases may include distributed databases based on blockchains, etc., but are not limited to this. The processor involved in each embodiment provided in this application may be a general-purpose processor, a central processing unit, a graphics processor, a digital signal processor, a programmable logic device, a data processing logic device based on quantum computing, etc., but are not limited to this.

[0209] The technical features of the above embodiments may be combined arbitrarily. To make the description concise, not all possible combinations of the technical features in the above embodiments are described. However, as long as there is no contradiction in the combination of these technical features, they should be considered to be within the scope of this specification.

[0210] The above-described embodiments only express several implementation methods of the present application, and the descriptions thereof are relatively specific and detailed, but they cannot be understood as limiting the scope of the present application. It should be pointed out that, for a person of ordinary skill in the art, several variations and improvements can be made without departing from the concept of the present application, and these all belong to the protection scope of the present application. Therefore, the protection scope of the present application shall be subject to the attached claims.

Claims

1. A mirror image update method, characterized in that: The method comprises: When receiving a mirror update request initiated by the baseboard controller, opening a write channel of the backup storage block; Sending an update signal to the baseboard controller so that the baseboard controller transmits the update image file to the backup storage block through the write channel; When receiving the transmission completion signal sent by the baseboard controller, verifying the updated image file to obtain a verification result; The verification result is sent to the baseboard controller, and based on the verification result, the update image file in the backup storage block is updated to the target storage block, so that the baseboard controller performs image update based on the verification result and the update image file.

2. The method according to claim 1, characterized in that The image update request includes a first image update request of a baseboard controller type; the backup storage block includes a first backup storage block of the baseboard controller type; When receiving the mirror update request initiated by the baseboard controller, opening the write channel of the backup storage block includes: When receiving the first image update request initiated by the baseboard controller through the first thread and determining that the storage block is not in the update process at the current moment, sending configuration information through the finite state machine; A write channel of the first backup storage block is enabled based on the configuration information.

3. The method according to claim 2, characterized in that The sending of the update signal to the baseboard controller so that the baseboard controller transmits the update image file to the backup storage block through the write channel includes: An update signal is sent to the baseboard controller through the first thread, so that the baseboard controller transmits the update image file to the first backup storage block on the write channel through the second thread.

4. The method according to claim 3, characterized in that When receiving the transmission completion signal sent by the baseboard controller, verifying the updated image file to obtain a verification result includes: When receiving a transmission completion signal sent by the baseboard controller through the first thread, verifying the legitimacy and integrity of the update image file to obtain a verification result indicating that the verification is passed; The step of sending the verification result to the baseboard controller and updating the update image file in the backup storage block to the target storage block based on the verification result includes: The verification result indicating that the verification has passed is sent to the baseboard controller, and based on the verification result indicating that the verification has passed, a direct memory access function is configured through a finite state machine, and based on the direct memory access function, the updated image file in the first backup storage block is updated to a first target storage block.

5. The method according to claim 1, characterized in that The method is applied to a pluggable root-of-trust component; before opening the write channel of the backup storage block, the method further includes: In response to the functional operation, the default card reader / writer function is switched to the trusted root function corresponding to the trusted root function of the trusted root component; wherein the card reader / writer function does not support the trusted root function.

6. The method according to claim 1, characterized in that The target storage block is a main storage block; The step of sending the verification result to the baseboard controller and updating the update image file in the backup storage block to the target storage block based on the verification result includes: The verification result is sent to the baseboard controller, and based on the verification result, the primary and backup tags between the primary storage block and the backup storage block are exchanged to implement the updating of the update image file from the backup storage block to the target storage block.

7. The method according to claim 1, characterized in that The image update request includes a second image update request of a central processing unit type; the backup storage block includes a second backup storage block of the central processing unit type; When receiving the mirror update request initiated by the baseboard controller, opening the write channel of the backup storage block includes: When receiving a second image update request initiated by the baseboard controller through the first thread and determining that the storage block is not in the update process at the current moment, sending configuration information through the finite state machine; A write channel of the second backup storage block is enabled based on the configuration information.

8. The method according to claim 7, characterized in that The sending of the update signal to the baseboard controller so that the baseboard controller transmits the update image file to the backup storage block through the write channel includes: An update signal is sent to the baseboard controller through the first thread, so that the baseboard controller transmits the update image file to the second backup storage block on the write channel through the second thread.

9. The method according to claim 8, characterized in that When receiving the transmission completion signal sent by the baseboard controller, verifying the updated image file to obtain a verification result includes: When receiving a transmission completion signal sent by the baseboard controller through the first thread, verifying the legitimacy and integrity of the update image file to obtain a verification result indicating that the verification is passed; The step of sending the verification result to the baseboard controller and updating the update image file in the backup storage block to the target storage block based on the verification result includes: The verification result indicating that the verification has passed is sent to the baseboard controller, and based on the verification result indicating that the verification has passed, a direct memory access function is configured through a finite state machine, and based on the direct memory access function, the updated image file in the second backup storage block is updated to a second target storage block.

10. A mirror image update method, characterized in that: The method comprises: Sending an image update request to a trusted root component so that the trusted root component opens a write channel of a backup storage block; wherein the trusted root component is in a pluggable physical form; When receiving the update signal sent by the trusted root component, transmitting the update image file to the backup storage block through the write channel; When the transmission of the update image file is completed, sending a transmission completion signal to the trusted root component, so that the trusted root component verifies the update image file and obtains a verification result; When the verification result sent by the trusted root component is received, image update is performed based on the verification result and the update image file.

11. The method according to claim 10, characterized in that The backup storage block includes a first backup storage block of the baseboard controller type; when receiving the update signal sent by the trusted root component, transmitting the update image file to the backup storage block through the write channel, including: When an update signal sent by the trusted root component through the first thread is received, the update image file is transmitted to the first backup storage block on the write channel through the second thread.

12. The method according to claim 11, characterized in that When the transmission of the update image file is completed, sending a transmission completion signal to the trusted root component so that the trusted root component verifies the update image file to obtain a verification result, including: When the transmission of the update image file is completed, sending a transmission completion signal to the trusted root component through the first thread, so that the trusted root component verifies the legitimacy and integrity of the update image file and obtains a verification result indicating that the verification is passed; When the verification result sent by the trusted root component is received, performing image updating based on the verification result and the updated image file includes: When the verification result indicating that the verification has passed is received from the trusted root component, an image update is performed based on the verification result indicating that the verification has passed and the update image file in the first backup storage block.

13. The method according to claim 10, characterized in that The backup storage block includes a second backup storage block of the CPU type; When receiving the update signal sent by the trusted root component, transmitting the update image file to the backup storage block through the write channel includes: When an update signal sent by the trusted root component through the first thread is received, the update image file is transmitted to the second backup storage block on the write channel through the second thread.

14. The method according to claim 13, characterized in that When the transmission of the update image file is completed, sending a transmission completion signal to the trusted root component so that the trusted root component verifies the update image file to obtain a verification result, including: When the transmission of the update image file is completed, sending a transmission completion signal to the trusted root component through the first thread, so that the trusted root component verifies the legitimacy and integrity of the update image file and obtains a verification result indicating that the verification is passed; When the verification result sent by the trusted root component is received, performing image updating based on the verification result and the updated image file includes: When the verification result indicating that the verification has passed is received from the trusted root component, an image update is performed based on the verification result indicating that the verification has passed and the update image file in the second backup storage block.

15. A mirror image updating device, characterized in that: The device comprises: An opening module, used for opening a write channel of a backup storage block when receiving a mirror update request initiated by a baseboard controller; A sending module, used for sending an update signal to the baseboard controller, so that the baseboard controller transmits the update image file to the backup storage block through the write channel; A verification module, configured to verify the update image file and obtain a verification result when receiving a transmission completion signal sent by the baseboard controller; The update module is used to send the verification result to the baseboard controller, and update the update image file in the backup storage block to the target storage block based on the verification result, so that the baseboard controller performs image update based on the verification result and the update image file.

16. A mirror image update device, characterized in that: The device comprises: A sending module, used for sending an image update request to a trusted root component, so that the trusted root component opens a write channel of a backup storage block; wherein the trusted root component is in a pluggable physical form; A transmission module, configured to transmit the updated image file to the backup storage block through the write channel when receiving an update signal sent by the trusted root component; The sending module is further configured to send a transmission completion signal to the trusted root component when the transmission of the update image file is completed, so that the trusted root component verifies the update image file and obtains a verification result; An update module is used to perform image update based on the verification result and the update image file when receiving the verification result sent by the trusted root component.

17. An image update system, characterized in that: The system comprises: The baseboard controller is used to send an image update request to the trusted root component so that the trusted root component opens a write channel of the backup storage block; A trusted root component, used for sending an update signal to the baseboard controller, so that the baseboard controller transmits the update image file to the backup storage block through the write channel; wherein the trusted root component is a plug-in physical form; The baseboard controller is further used to send a transmission completion signal to the trusted root component so that the trusted root component verifies the updated image file to obtain a verification result; when receiving the verification result sent by the trusted root component, the image is updated based on the verification result and the updated image file.

18. A computer device comprising a memory and a processor, wherein the memory stores a computer program, wherein: When the processor executes the computer program, the steps of the method according to any one of claims 1 to 9 or 10 to 14 are implemented.

19. A computer-readable storage medium having a computer program stored thereon, characterized in that: When the computer program is executed by a processor, the steps of the method according to any one of claims 1 to 9 or 10 to 14 are implemented.

20. A computer program product comprising a computer program, characterized in that When the computer program is executed by a processor, the steps of the method according to any one of claims 1 to 9 or 10 to 14 are implemented.

Images