Server startup verification system

Abstract

The embodiment of the present application provides a server startup verification system, wherein the system includes: a system startup device and a target verifier, the system startup device includes a system controller, a management controller, a switch and a memory, the memory stores the target startup firmware of the server system, and the target verifier stores the target verification information of the server system; the switch is used to control the system controller to communicate with the memory when the server system is started; when the startup firmware in the memory is to be updated, the management controller is controlled to communicate with the memory; the system controller is used to access the target verifier and the memory when the server system is started; and the target startup firmware is verified using the target verification information. Through this application, the problem of low security in the server startup phase in the related art is solved, thereby achieving the effect of improving the security of the server startup phase.

Description

Technical Field

[0001] The embodiments of the present application relate to the field of computers, and in particular, to a server startup verification system. Background Art

[0002] The server startup phase is the initial stage of the system operation cycle, and its security will directly affect the subsequent operation process of the system. Therefore, security verification of the server startup process is crucial for the safe operation of the server system. In the related technology, the server architecture generally adopts a configuration in which the management controller and the system controller are connected to the memory together. In this configuration, the management controller is used to update and maintain the boot firmware stored in the memory, and the system controller is used to call the boot firmware in the memory to start the system when the system starts. However, under this architecture, on the one hand, there is a problem that the management controller and the system controller call the memory at the same time, which leads to errors or damage to the boot firmware data. On the other hand, since the boot firmware in the memory is at risk of being tampered with, the system controller is prone to call the tampered boot firmware to start the system when the system starts, resulting in low security in the server startup phase. Summary of the invention

[0003] The embodiment of the present application provides a server startup verification system to at least solve the problem of low security in the server startup phase in the related art.

[0004] According to an embodiment of the present application, a server startup verification system is provided, including:

[0005] A system startup device and a target verifier, wherein the system startup device includes a system controller, a management controller, a switch and a memory, wherein the management controller, the system controller and the memory are all connected to the switch, and the target verifier is connected to the system startup device, wherein the memory stores the target startup firmware of the server system, and the target verifier stores the target verification information of the server system, wherein the target verification information is used to indicate the firmware data of the startup firmware allowed to be used when the server system is started;

[0006] The switch is used to control the system controller to communicate with the memory when the server system is started; and to control the management controller to communicate with the memory when the startup firmware in the memory is to be updated;

[0007] The system controller is used to access the target verifier and the memory when the server system is started; and use the target verification information to verify the target startup firmware.

[0008] Optionally, the target verifier is connected to a connection link between the system controller and the switch.

[0009] Optionally, the server startup verification system further includes a reference verifier, wherein the reference verifier is connected to the connection link between the management controller and the switch, and the reference verifier stores reference verification information of the server system, wherein the reference verification information is used to indicate firmware data of the startup firmware allowed to be written into the memory;

[0010] The management controller is used to access the reference verifier when the boot firmware in the memory needs to be updated; use the reference verification information to verify the reference boot firmware to be updated in the memory; and access the memory and update the reference boot firmware to the memory when the reference boot firmware passes the verification.

[0011] Optionally, the server startup verification system further includes a synchronization controller, wherein the synchronization controller is connected to the reference verifier and the target verifier respectively;

[0012] The synchronization controller is used to match the first information version of the reference verification information and the second information version of the target verification information; when the first information version and the second information version do not match each other, the reference verification information is used to update the target verification information stored in the target verifier.

[0013] Optionally, the switch is configured with a first interface, a second interface and a third interface, wherein the first interface is used to connect to the system controller, the second interface is used to connect to the management controller, and the third interface is used to connect to the memory;

[0014] The switch is used to control the first interface and the third interface to be connected when the server system is started; and to control the second interface and the third interface to be connected when the startup firmware in the memory is to be updated.

[0015] Optionally, the switch is further configured with a fourth interface, the target checker is connected to the fourth interface, and the target checker further stores reference check information, the reference check information being used to indicate firmware data of the startup firmware allowed to be written into the memory;

[0016] The switch is used to control the first interface and the fourth interface to be connected when the server system is started, and to control the first interface and the third interface to be connected when the system controller accesses the target verification information stored in the target verifier; when the startup firmware in the memory is to be updated, control the second interface and the fourth interface to be connected, and when the management controller accesses the reference verification information stored in the target verifier, control the second interface and the third interface to be connected.

[0017] Optionally, the memory includes a plurality of sub-memories, and the switch is connected to each of the sub-memories respectively;

[0018] The multiple sub-memory devices are used to redundantly store the startup firmware required for starting the server system.

[0019] Optionally, the memory further comprises a memory controller, wherein a first port of the memory controller is connected to the switch, and a second port of the memory controller is respectively connected to each of the sub-memory;

[0020] The storage controller is used to control the access status of each of the sub-memory.

[0021] Optionally, the second port of the storage controller includes a plurality of sub-ports, and each of the sub-ports is connected to the sub-memory in a one-to-one correspondence;

[0022] The storage controller is used for selecting a target sub-memory to be accessed from the multiple sub-memories when receiving an access request to the sub-memory; and controlling the sub-port connected to the target sub-memory to be in a connected state with the first port.

[0023] Optionally, the storage controller includes a logic control device and a reference switch, the logic control device is connected to the reference switch, and the reference switch is configured with the first port and the plurality of sub-ports;

[0024] The logic control device is used to control the reference switch to adjust the on / off state of the first port and each of the sub-ports.

[0025] Optionally, the logic control device is used to, upon receiving an access request to the sub-memory, filter out a first sub-memory in an unoccupied state from a plurality of the sub-memories; and in the case where there are multiple first sub-memories, filter out a target sub-memory having a calling priority greater than or equal to a target priority from the plurality of the first sub-memories according to priority information of the sub-memories, wherein the priority information is determined according to the storage performance of each of the sub-memory.

[0026] Optionally, the logic control device is also used to detect the occupancy status of each second sub-memory when the access request is a request to update the startup firmware, wherein the second sub-memory is a memory among the multiple sub-memories except the target sub-memory; and when the second sub-memory is in an unoccupied state, the updated startup firmware stored in the target sub-memory is updated to the second sub-memory.

[0027] Optionally, the logic control device is also used to obtain the access failure frequency of each of the sub-memory when it was accessed before the current moment; sort the multiple sub-memory in order of the access failure frequency from low to high to obtain the access order of the multiple sub-memory; and determine the access order as the priority information of the multiple sub-memory when being accessed.

[0028] Optionally, the target checker is connected to a connection link between the storage controller and the switch, and the target checker further stores reference check information of the server system, the reference check information being used to indicate firmware data of the boot firmware allowed to be written into the memory;

[0029] The management controller is used to access the target verifier when the boot firmware in the memory needs to be updated; use the reference verification information to verify the reference boot firmware to be updated in the memory; and access the memory and update the reference boot firmware to the memory when the reference boot firmware passes the verification.

[0030] Optionally, the target checker is connected to a connection link between the sub-storage and a corresponding sub-port, and the target checker further stores reference check information of the server system, the reference check information being used to indicate firmware data of the boot firmware that is allowed to be written into the storage;

[0031] The management controller is used to access the target verifier when the boot firmware in the memory needs to be updated; use the reference verification information to verify the reference boot firmware to be updated in the memory; and access the target sub-memory and update the reference boot firmware to the target sub-memory when the reference boot firmware passes the verification.

[0032] Through the present application, by deploying a switch connected between the system controller, the management controller and the memory, when the server system is started, the system controller is connected to the memory; when the boot firmware in the memory is to be updated, the management controller is controlled to be connected to the memory, thereby effectively avoiding the system controller and the management controller from accessing the memory at the same time, thereby avoiding the data misalignment and data damage problems of the boot firmware stored in the memory, and at the same time, by deploying a target verifier connected to the system boot device, when the system controller is in the process of starting the server system, the target verifier can be accessed to verify the target boot firmware stored in the memory, avoiding the system controller from using the boot firmware that has been tampered with to start the system, thereby improving the security of the server system startup process. Therefore, the problem of low security in the server startup phase in the related art can be solved, and the effect of improving the security of the server startup phase can be achieved. BRIEF DESCRIPTION OF THE DRAWINGS

[0033] Figure 1 is a hardware connection diagram of a server startup verification system according to an embodiment of the present application;

[0034] Figure 2 A schematic diagram of a server startup verification system according to an embodiment of the present application Figure 1 ;

[0035] Figure 3 A schematic diagram of a server startup verification system according to an embodiment of the present application Figure 2 ;

[0036] Figure 4 A schematic diagram of a server startup verification system according to an embodiment of the present application Figure 3 ;

[0037] Figure 5 A schematic diagram of a server-start verification system switching connection link according to an embodiment of the present application Figure 1 ;

[0038] Figure 6 A schematic diagram of a server-start verification system switching connection link according to an embodiment of the present application Figure 2 ;

[0039] Figure 7A schematic diagram of a server startup verification system according to an embodiment of the present application Figure 4 ;

[0040] Figure 8 A schematic diagram of a server startup verification system according to an embodiment of the present application Figure 5 ;

[0041] Fig. 9 A schematic diagram of a server startup verification system according to an embodiment of the present application Figure 6 ;

[0042] Fig.10 A schematic diagram of a server startup verification system according to an embodiment of the present application Figure 7 ;

[0043] Fig.11 A schematic diagram of a server startup verification system according to an embodiment of the present application Figure 8 ;

[0044] Fig.12 A schematic diagram of a server BIOS security verification system according to an embodiment of the present application Figure 1 ;

[0045] Fig.13 A schematic diagram of a server BIOS security verification system according to an embodiment of the present application Figure 2 ;

[0046] Fig.14 This is a schematic diagram of an optimized server BIOS security verification system according to an embodiment of the present application. Figure 1 ;

[0047] Fig.15 This is a schematic diagram of an optimized server BIOS security verification system according to an embodiment of the present application. Figure 2 . DETAILED DESCRIPTION

[0048] The embodiments of the present application will be described in detail below with reference to the accompanying drawings and in combination with the embodiments.

[0049] It should be noted that the terms "first", "second", etc. in the specification and claims of this application and the above-mentioned drawings are used to distinguish similar objects, and are not necessarily used to describe a specific order or sequence.

[0050] In this embodiment, a server startup verification system is provided. Figure 1 is a hardware connection diagram of a server startup verification system according to an embodiment of the present application, such as Figure 1 As shown, the system includes:

[0051] A system startup device and a target verifier, wherein the system startup device includes a system controller, a management controller, a switch and a memory, wherein the management controller, the system controller and the memory are all connected to the switch, and the target verifier is connected to the system startup device, wherein the memory stores the target startup firmware of the server system, and the target verifier stores the target verification information of the server system, wherein the target verification information is used to indicate the firmware data of the startup firmware allowed to be used when the server system is started;

[0052] The switch is used to control the system controller to communicate with the memory when the server system is started; and to control the management controller to communicate with the memory when the startup firmware in the memory is to be updated;

[0053] The system controller is used to access the target verifier and the memory when the server system is started; and use the target verification information to verify the target startup firmware.

[0054] Through the above content, by deploying a switch connected between the system controller, the management controller and the memory, when the server system is started, the system controller is connected to the memory; when the startup firmware in the memory is to be updated, the management controller is controlled to be connected to the memory, thereby effectively avoiding the system controller and the management controller from accessing the memory at the same time, thereby avoiding the data misalignment and data damage problems of the startup firmware stored in the memory, and at the same time, by deploying a target verifier connected to the system startup device, when the system controller is in the process of starting the server system, the target verifier can be accessed to verify the target startup firmware stored in the memory, avoiding the system controller from using the startup firmware that has been tampered with to start the system, thereby improving the security of the server system startup process. Therefore, the problem of low security in the server startup stage in the related technology can be solved, and the effect of improving the security of the server startup stage can be achieved.

[0055] Optionally, in an embodiment of the present application, the system controller is used to communicate with the memory through a switch when the server system is started, wherein the system controller and the switch are connected via an SPI bus. When the system needs to be started, the switch switches the connection link between the system controller and the storage control to be in a connected state, and controls the connection link between the management controller and the memory to be in a disconnected state, so that the system controller can load and run the startup firmware of the server system stored in the memory. At the same time, during the startup process, the system controller can access the target verifier and use the target verification information stored therein to perform a validity check on the startup firmware to ensure that the server is started in a safe state. In an embodiment of the present application, the system controller can be, but is not limited to, a PCH (Platform Controller Hub), a CPU (Central Processing Unit), etc., and this solution does not limit this.

[0056] Optionally, in an embodiment of the present application, the management controller is used to connect to the memory through the switch during the startup firmware update phase, and then the management controller sends an access request to the memory to the switch when the management controller needs to access the memory. When the switch receives the access request, it controls the connection link between the management controller and the memory to be in a pass state, and controls the connection link between the system controller and the memory to be in a disconnected state, so that the management controller can access and update the startup firmware in the memory. In the process of updating the startup firmware stored in the memory, in order to ensure the security of the startup firmware update, the management controller can communicate with the verifier to access the reference verification information stored in the verifier (the reference verification information is used to indicate the firmware data of the startup firmware in the memory that is allowed to be written), and use the reference verification information to perform a legality check on the updated firmware to ensure the security and integrity of the updated firmware. In an embodiment of the present application, the management controller can be, but is not limited to, a BMC (Baseboard Management Controller), iLO (Integrated Light-Out), etc.; wherein, iLO is a control device with a remote management function for a server, and iLO is a remote server management processor embedded on the server and computing module motherboard. By using iLO, the server can be monitored and controlled from a remote location. When the management controller is iLO, remote access to the server can be achieved by remotely accessing iLO, and then a request to access the memory can be sent to the switch through external access. When the switch connects the connection link between the management controller and the memory, the boot firmware in the memory can be accessed through iLO, thereby updating and upgrading the boot firmware.

[0057] Optionally, in an embodiment of the present application, the switch is used to dynamically switch the data path according to the server status (startup or to be updated) to achieve separate access to the memory by the system controller and the management controller. When the server is in the startup state, the switch will open the data path between the system controller and the memory. When the startup firmware in the memory is in the to-be-updated state, the switch will switch to the data path between the system controller and the memory, thereby ensuring the independence and security of data updates. In an embodiment of the present application, the switch can be, but is not limited to, a MUX (Multiplexer), SPI Switch ICs (SPI bus switching integrated circuit), etc., and this solution does not limit this.

[0058] Optionally, in an embodiment of the present application, a memory is used to store the startup firmware of the server system. The memory is connected to the system controller and the management controller through a switch, ensuring secure and independent access to the firmware during the startup and update process. The memory can be a single-chip design or a multiple-chip redundant design. The design of multiple redundant memories can ensure that even if a certain memory fails, the system can still read data from other healthy memories. For example, when the server system starts, the firmware in multiple memories can be verified separately. If it is found that the firmware data in a certain memory is tampered with or damaged, the system can automatically switch to another memory to read the correct firmware data, preventing the server from starting abnormally due to the damage of the firmware data of a single memory. In an embodiment of the present application, the memory can be, but not limited to, Flash, SSD (Solid State Drive), MRAM (Magnetoresistive Random Access Memory), etc., and this solution does not limit this.

[0059] Optionally, in an embodiment of the present application, the verifier is used to perform security verification on the firmware data in the memory during the server system startup phase and the firmware data update phase in the memory. The verifier stores the verification information of the server system. During the firmware data update phase in the memory, the management controller will communicate with the verifier before writing the updated firmware into the memory, and use the verification information in the verifier to verify the updated firmware. Only when the verification passes will the management controller be allowed to write the updated firmware into the memory; during the server system startup phase, the system controller will first access the verifier, and use the verification information in the verifier to verify the firmware data in the memory. Only when the verification passes will the system controller be allowed to use the firmware data to start the server system. In an embodiment of the present application, the verifier can be, but is not limited to, a TPM (Trusted Platform Module), an SBR (Secure Boot ROM), etc., and this solution does not limit this.

[0060] Optionally, in the embodiments of the present application, Figure 1 is a hardware connection diagram of a server startup verification system according to an embodiment of the present application, such as Figure 1 As shown, the system startup device includes a system controller, a management controller, a switch and a memory, wherein the management controller, the system controller and the memory are directly connected to the switch through an SPI bus, and the target verifier is connected to the system startup device. When it is necessary to update the startup firmware in the memory through the management controller, the management controller will send an SEL signal to the switch, and then the switch will switch the SPI bus path to control the management controller to connect with the memory. The management controller will load the new firmware file and communicate with the TPM before writing to the memory, and use the verification information stored therein to verify the legitimacy of the updated firmware. If the verification passes, the management controller is allowed to write the updated firmware into the memory; when the server is in a booted state, the switch will disconnect the connection between the management controller and the memory, and switch to the path between the system controller and the memory. The system controller then accesses the TPM to obtain the target verification information, and verifies the integrity and legitimacy of the target startup firmware in the memory to ensure that the firmware data completely matches the verification information. If the verification passes, the system controller is allowed to use the target startup firmware to start the server.

[0061] As an optional embodiment, the target checker is connected to a connection link between the system controller and the switch.

[0062] Optionally, in the embodiments of the present application, Figure 2 A schematic diagram of a server startup verification system according to an embodiment of the present application Figure 1 ,like Figure 2As shown, TPM (target verifier) ​​is connected to the connection link between PCH (system controller) and MUX (switch), PCH, management controller, TPM and FLASH (memory) are connected through SPI bus, TPM is directly connected to PCH, management controller and PCH can access FLASH independently through MUX switching, when the server system is in the startup stage, MUX will control PCH to connect with FLASH, then PCH accesses TPM located between PCH and MUX, obtains target verification information stored in TPM, PCH uses target verification information to perform security verification on target boot firmware stored in FLASH, and then when the verification passes, PCH uses target boot firmware to start the server system.

[0063] Through the above configuration, by connecting the target verifier to the connection link between the system controller and the switch, the target verifier can be used to verify the legitimacy and integrity of the startup firmware in the memory when the server system is started, thereby ensuring the security of the server during startup and operation.

[0064] As an optional embodiment, the server startup verification system further includes a reference verifier, wherein the reference verifier is connected to the connection link between the management controller and the switch, and the reference verifier stores reference verification information of the server system, and the reference verification information is used to indicate firmware data of the startup firmware that is allowed to be written into the memory;

[0065] The management controller is used to access the reference verifier when the boot firmware in the memory needs to be updated; use the reference verification information to verify the reference boot firmware to be updated in the memory; and access the memory and update the reference boot firmware to the memory when the reference boot firmware passes the verification.

[0066] Optionally, in the embodiments of the present application, Figure 3 A schematic diagram of a server startup verification system according to an embodiment of the present application Figure 2 ,like Figure 3As shown, the server startup verification system includes TPM0 (target verifier) ​​and TPM1 (reference verifier). TPM1 is connected to the connection link between the management controller and MUX (switch). When the startup firmware in the memory is to be updated, the management controller will send a SEL signal to the MUX, and then the MUX will switch the path to control the management controller to connect with the FLASH after receiving the signal sent by the management controller. Before writing the updated firmware to the FLASH, the management controller will access TPM1 and obtain the reference verification information stored therein, and then the management controller uses the reference verification information to perform integrity and legality verification on the new firmware data to be written to the FLASH, and allows the management controller to write the new firmware data to the FLASH if the verification passes, and completes the update of the startup firmware in the FLASH; when the server is in the state of being started, the MUX will disconnect the connection path between the management controller and the FLASH, switch the path to control the PCH to connect with the FLASH, and the PCH will then access TPM0 and obtain the target verification information stored therein, and then the PCH uses the target verification information to perform integrity and legality verification on the target startup firmware in the FLASH, and allows the PCH to use the target startup firmware to start the server system if the verification passes.

[0067] Through the above configuration, by connecting the reference verifier to the connection link between the management controller and the switch, it can ensure that the server can perform security verification on the startup firmware through the verifier on the corresponding link during the upgrade and startup process, preventing the FLASH information from being illegally damaged or tampered with during the upgrade of the startup firmware, thereby ensuring the security of the server system during upgrade and startup.

[0068] As an optional embodiment, the server startup verification system further includes a synchronization controller, wherein the synchronization controller is connected to the reference verifier and the target verifier respectively;

[0069] The synchronization controller is used to match the first information version of the reference verification information and the second information version of the target verification information; when the first information version and the second information version do not match each other, the reference verification information is used to update the target verification information stored in the target verifier.

[0070] Optionally, in the embodiments of the present application, Figure 4 A schematic diagram of a server startup verification system according to an embodiment of the present application Figure 3 ,like Figure 4As shown, the server startup verification system also includes a synchronization controller, which is connected to the reference verifier (TPM1) and the target verifier (TPM0) respectively. The synchronization controller is used to monitor and maintain the consistency of verification information between different verifiers in the server system.

[0071] Optionally, in an embodiment of the present application, during the server startup process or within a specific maintenance cycle, the synchronization controller will actively trigger the synchronization of the verification information between the target verifier and the reference verifier, and the synchronization controller will read the current latest first information version from the reference verifier, and at the same time read the current latest second information version from the target verifier. The synchronization controller will then compare the two versions of the verification information to check whether the two are consistent. If the first information version and the second information version are inconsistent, the synchronization controller will use the latest verification information in the reference verifier to update the information in the target verifier to ensure that the information versions of all verifiers are consistent.

[0072] Through the above configuration, by setting up a synchronization controller between the target verifier and the reference verifier, it is possible to ensure that the verification information stored in the system remains consistent and up-to-date, reduce the risk of using outdated or erroneous verification information for verification, and further improve the security and reliability of the entire server system.

[0073] As an optional embodiment, the switch is configured with a first interface, a second interface and a third interface, wherein the first interface is used to connect to the system controller, the second interface is used to connect to the management controller, and the third interface is used to connect to the memory;

[0074] The switch is used to control the first interface and the third interface to be connected when the server system is started; and to control the second interface and the third interface to be connected when the startup firmware in the memory is to be updated.

[0075] Optionally, in the embodiments of the present application, Figure 5 A schematic diagram of a server-start verification system switching connection link according to an embodiment of the present application Figure 1 ,like Figure 5 As shown, the switch (MUX) is configured with a first interface, a second interface and a third interface, wherein the first interface is used to connect to the system controller (PCH), the second interface is used to connect to the management controller, and the third interface is used to connect to the memory (FLASH). When the server system is started, the switch (MUX) controls the first interface and the third interface to be connected, that is, controls the system controller (PCH) and the memory (FLASH) to be connected; when the startup firmware in the memory needs to be updated, the switch (MUX) controls the second interface and the third interface to be connected, that is, controls the management controller and the memory (FLASH) to be connected.

[0076] Through the above configuration, it is possible to achieve independent and secure access to the memory by the management controller and the system controller through the switch, avoiding the problem of simultaneous access to the memory by the management controller and the system controller, which may cause startup firmware errors, thereby improving the security and stability of the server system operation.

[0077] As an optional embodiment, the switch is further configured with a fourth interface, the target checker is connected to the fourth interface, and the target checker also stores reference check information, the reference check information is used to indicate the firmware data of the startup firmware allowed to be written into the memory;

[0078] The switch is used to control the first interface and the fourth interface to be connected when the server system is started, and to control the first interface and the third interface to be connected when the system controller accesses the target verification information stored in the target verifier; when the startup firmware in the memory is to be updated, control the second interface and the fourth interface to be connected, and when the management controller accesses the reference verification information stored in the target verifier, control the second interface and the third interface to be connected.

[0079] Optionally, in the embodiments of the present application, Figure 6 A schematic diagram of a server-start verification system switching connection link according to an embodiment of the present application Figure 2 ,like Figure 6 As shown, the switch (MUX) is also configured with a fourth interface, and the target checker (TPM) is connected to the fourth interface. The TPM stores target check information for indicating the firmware data status of the startup firmware allowed to be used when the server system is started, and also stores reference check information for indicating the firmware data of the startup firmware allowed to be written into the memory.

[0080] Optionally, in an embodiment of the present application, when the boot firmware in the memory needs to be updated, the management controller sends a SEL signal to the MUX, and then the MUX controls the second interface and the fourth interface to be connected, that is, controls the management controller to be connected to the TPM, and then the management controller can access the TPM and obtain the reference verification information stored therein. After the management controller obtains the reference verification information, the MUX controls the second interface and the third interface to be connected, that is, controls the management controller to be connected to the FLASH, and then the management controller uses the obtained reference verification information to perform a security check on the new boot firmware, and allows the management controller to write the new firmware data to the FLASH if the check passes; when the server system is started, the MUX disconnects the second interface and the third interface, controls the first interface and the fourth interface to be connected, that is, controls the PCH to be connected to the TPM, and then the PCH can access the TPM and obtain the target verification information stored therein. After the PCH obtains the target verification information, the MUX controls the first interface and the third interface to be connected, that is, controls the PCH to be connected to the FLASH, and then the PCH uses the obtained target verification information to perform a security check on the target boot firmware in the FLASH, and allows the PCH to use the target boot firmware to start the server if the check passes.

[0081] Through the above configuration, by adding a fourth interface to connect the target verifier and adding the control logic of the switch, it is possible to simultaneously perform security verification on the firmware data in the server update and startup phases through a verifier, which not only improves the security of the server during the startup and update process, but also simplifies the system configuration.

[0082] As an optional embodiment, the memory includes a plurality of sub-memories, and the switch is connected to each of the sub-memories respectively;

[0083] The multiple sub-memory devices are used to redundantly store the startup firmware required for starting the server system.

[0084] Optionally, in the embodiments of the present application, Figure 7 A schematic diagram of a server startup verification system according to an embodiment of the present application Figure 4 ,like Figure 7 As shown, the memory includes multiple sub-memories (such as FLASH0, FLASH1, etc.), and the switch (MUX) is connected to each sub-memory respectively. Each sub-memory independently stores a complete copy of the server startup firmware. This redundant storage memory design allows the system to load the firmware from other healthy sub-memories when one or more sub-memories fail or the data is damaged, thereby ensuring the normal startup and operation of the server.

[0085] Through the above configuration, the memory is designed to include multiple sub-memories, and the switch can be connected to each sub-memory separately, which can provide the system with higher data redundancy and fault tolerance, thereby enhancing the stability and security of the server.

[0086] As an optional embodiment, the memory further includes a memory controller, wherein a first port of the memory controller is connected to the switch, and a second port of the memory controller is respectively connected to each of the sub-memories;

[0087] The storage controller is used to control the access status of each of the sub-memory.

[0088] Optionally, in the embodiments of the present application, Figure 8 A schematic diagram of a server startup verification system according to an embodiment of the present application Figure 5 ,like Figure 8 As shown, the memory also includes a memory controller, a first port of the memory controller is connected to the switch (MUX), and is responsible for receiving access requests and instructions from the switch (MUX), and a second port of the memory controller is respectively connected to each sub-memory (such as FLASH0, FLASH1), and can dynamically control the access status of each sub-memory according to the instructions of the switch, that is, determine which sub-memories can be read or written.

[0089] Through the above configuration, the storage controller is connected to the sub-memory one-to-one through its second port, so that the storage controller can independently control the access to each sub-memory without affecting the status of other sub-memories, thereby improving the security of data storage and the flexibility of access control.

[0090] As an optional embodiment, the second port of the storage controller includes a plurality of sub-ports, and each of the sub-ports is connected to the sub-memory in a one-to-one correspondence;

[0091] The storage controller is used for selecting a target sub-memory to be accessed from the multiple sub-memories when receiving an access request to the sub-memory; and controlling the sub-port connected to the target sub-memory to be in a connected state with the first port.

[0092] Optionally, in an embodiment of the present application, the second port of the storage controller includes multiple sub-ports, each sub-port is connected to a sub-memory in a one-to-one correspondence, and the storage controller can control the connection state between the switch and the multiple sub-memories by controlling the connection state of the first port and the multiple sub-ports. When the server is started or a firmware update is required, the system controller or the management controller sends an access request to the storage controller through the switch. When the storage controller receives the access request, it will perform a status check and screening on the multiple sub-memories. It can be that the main memory and the slave memory are preset in the multiple sub-memories, and then the status check of the main memory is prioritized. If the main memory is currently in a good health state, the current main memory is determined as the target sub-memory. If the main memory fails or the data is damaged, the status check of the multiple slave memories is performed in turn, and the first slave memory in a good health state is used as the target sub-memory. In an embodiment of the present application, the storage controller can also check the access history of each sub-memory, and based on the access frequency or load balancing of each sub-memory, the sub-memory that is less accessed within a period of time is preferentially selected as the target sub-memory to avoid data overload or wear problems caused by multiple consecutive accesses to the same sub-memory, so as to achieve balanced data access. After the target sub-memory is determined, the storage controller controls the sub-port connected to the target sub-memory to be in a connected state with the first port (ie, the port connected to the switch), thereby allowing data reading or writing operations.

[0093] Through the above configuration, by setting up a storage controller in the memory and adopting a sub-port design that corresponds one-to-one with the sub-memory, the security of data storage and the flexibility of access control are improved, and the stability and security of the server during startup and firmware update are enhanced.

[0094] As an optional embodiment, the storage controller includes a logic control device and a reference switch, the logic control device is connected to the reference switch, and the reference switch is configured with the first port and the plurality of sub-ports;

[0095] The logic control device is used to control the reference switch to adjust the on / off state of the first port and each of the sub-ports.

[0096] Optionally, in an embodiment of the present application, the storage controller includes a logic control device and a reference switch, wherein the logic control device is used to control the reference switch to adjust the on / off states of the first port and multiple sub-ports corresponding to the multiple sub-memories, and the logic control device may be, but is not limited to, a CPLD (Complex Programmable Logic Device), an FPGA (Field-Programmable Gate Array), etc., and this solution does not limit this. Fig. 9 A schematic diagram of a server startup verification system according to an embodiment of the present application Figure 6 ,like Fig. 9 As shown, the logic control device (CPLD) is connected to the reference switch (MUX1), and the reference switch (MUX1) is configured with a first port (a port connected to the switch MUX0) and a plurality of sub-ports (ports connected to a plurality of sub-memories).

[0097] Optionally, in an embodiment of the present application, in the BIOS security verification system of the server, the sub-memory is assigned to the main FLASH (assuming FLASH0) and the slave FLASH (assuming FLASH1). Under this design, the PCH (system controller) can only operate and interact with data on the main FLASH during normal startup, and the management controller can only operate and interact with data on the main FLASH when performing a BIOS firmware update. The slave FLASH is in an isolated state at this stage and does not accept direct external access, ensuring the security and stability of its data. The CPLD will periodically synchronize the data of FLASH0 to FLASH1, thereby isolating the direct operation of FLASH1 by the PCH and management controller, ensuring the security and stability of FLASH1 data.

[0098] Optionally, in an embodiment of the present application, when FLASH0 works abnormally or the management controller refreshes abnormally, causing FLASH0 to fail the TPM check, the CPLD will switch the permissions of FLASH, switching FLASH1 to the main LFASH for normal use of the system, and switching FLASH0 to the slave FLASH, thereby ensuring the stable operation of the machine and isolating the impact of FLASH0 data abnormalities on the system. At the same time, the CPLD reports the abnormal events to the system and notifies the operation and maintenance personnel to take timely measures.

[0099] Through the above configuration, the combination of logic control devices and reference switches provides advanced data access control and storage resource management capabilities for the server security verification system, significantly improving the system's security, stability and management efficiency.

[0100] As an optional embodiment, the logic control device is used to, upon receiving an access request to the sub-memory, filter out a first sub-memory in an unoccupied state from a plurality of the sub-memories; and in the case where there are multiple first sub-memories, filter out a target sub-memory whose calling priority is greater than or equal to the target priority from the plurality of the first sub-memories according to priority information of the sub-memories, wherein the priority information is determined according to the storage performance of each of the sub-memory.

[0101] Optionally, in an embodiment of the present application, when the logic control device receives an access request to a sub-memory, the logic control device first filters out all first sub-memories that are in an unoccupied state, that is, sub-memories that currently have no read or write operations in progress. When there is only one first sub-memory, the current only first sub-memory is determined as the target sub-memory. When there are multiple first sub-memories, the logic control device further filters based on the priority information of each sub-memory, where the priority information is determined based on the storage performance of the sub-memory, such as the read and write speed, storage capacity, data access delay, etc. of the memory. Then, the logic control device filters out the best target sub-memory from the first sub-memory that has never been occupied and whose priority is greater than or equal to the target priority.

[0102] With the above configuration, through the intelligent screening and priority management mechanism of the logic control device, the server security verification system can realize efficient and safe calling of the sub-memory, ensuring data security and system stability during the startup phase and firmware update process.

[0103] As an optional embodiment, the logic control device is also used to detect the occupancy status of each second sub-memory when the access request is a request to update the startup firmware, wherein the second sub-memory is a memory other than the target sub-memory among the multiple sub-memories; and when the second sub-memory is in an unoccupied state, the updated startup firmware stored in the target sub-memory is updated to the second sub-memory.

[0104] Optionally, in an embodiment of the present application, upon receiving a request to update the startup firmware, the logic control device will check the occupancy status of all second sub-memories (i.e., sub-memories other than the target sub-memories) in order to ensure that after the firmware update in the target sub-memories is performed, there are other unoccupied sub-memories for backup or subsequent updates. Upon detecting that one or more second sub-memories are in an unoccupied state, the logic control device will update the updated startup firmware stored in the target sub-memories to the second sub-memories.

[0105] Through the above configuration, a redundant firmware backup is provided for the server. Even if the target sub-storage fails, the system can be normally started through the second sub-storage, thereby improving the stability and availability of the server.

[0106] As an optional embodiment, the logic control device is also used to obtain the access failure frequency of each of the sub-memory when it is accessed before the current moment; sort the multiple sub-memory in order of the access failure frequency from low to high to obtain the access order of the multiple sub-memory; and determine the access order as the priority information of the multiple sub-memory when being accessed.

[0107] Optionally, in an embodiment of the present application, the logic control device continuously monitors the access history of each sub-memory, records the number of failures that occur when the sub-memory is accessed within a specific time window, including but not limited to data read failure, write delay, data integrity check failure and other events, and then comprehensively extracts the access failure frequency of each sub-memory. Based on the obtained access failure frequency data, the logic control device sorts the multiple sub-memories in order of access failure frequency from low to high, obtains the access order of the multiple sub-memories, and determines the access order as the priority information of the multiple sub-memories when they are accessed, and as the failure frequency changes dynamically, the priority of the sub-memory can also be adjusted in real time. For example, during the sub-memory access process, if it is detected that the failure frequency of the sub-memory currently being accessed suddenly increases, the logic control device will immediately lower its priority and isolate it from the normal access list when the failure frequency of the sub-memory is higher than a certain threshold, so as to avoid further impact on the system.

[0108] Optionally, in the embodiments of the present application, Fig. 9 A schematic diagram of a server startup verification system according to an embodiment of the present application Figure 6 ,like Fig. 9As shown, when the server system boot firmware needs to be upgraded online, the management controller sends a SEL signal to MUX0 (switch), and then MUX0 controls the management controller to connect with the storage controller. After receiving the access request to the sub-memory, the storage controller selects the target sub-memory from multiple sub-memories according to the priority information of the sub-memory. Then, during the firmware update process, the management controller will safely write the new firmware data into the target sub-memory. When the firmware update is completed on the target sub-memory (such as FLASH0), the logic control device (CPLD) starts to perform firmware data redundancy backup between sub-memories. First, the CPLD detects the current occupancy status of other sub-memories (i.e., the second sub-memory, such as FLASH1) in the system except the target sub-memory. When the second sub-memory is not occupied, the CPLD sends a control signal to MUX1 (reference switch), adjusts the connection status between MUX1 and the sub-memory, and switches the data path from the target sub-memory to the second sub-memory. Then, the CPLD updates the updated boot firmware stored in the target sub-memory to the second sub-memory. When the server is in the state of being started, MUX0 will disconnect the connection between the management controller and MUX1, and switch the link control PCH to connect with MUX1. Then PCH accesses TPM (target checker) and obtains the target verification information stored in it, and verifies the integrity and legality of the target startup firmware in the target sub-memory to ensure that the firmware data and the verification information are completely matched. If the verification passes, PCH is allowed to use the target startup firmware to start the server; if the target startup firmware in the target sub-memory fails to be verified, CPLD will automatically switch the data access link between MUX1 and the sub-memory according to the pre-set priority information of the sub-memory, and connect the second sub-memory in normal state with MUX1, so that PCH can use the startup firmware in the second sub-memory to start, ensuring that the server can quickly recover in the face of memory failure and maintain the stable operation of the system. At the same time, during the operation of the server, CPLD will continuously monitor the status and failure frequency of all sub-memories, dynamically adjust the priority information, and ensure that the system can select the optimal sub-memory for data access based on the latest performance data and health status.

[0109] Through the above configuration, the server security verification system can not only complete the firmware update safely and efficiently, but also reduce the system interruption time caused by a certain storage anomaly through data redundancy synchronization and fault switching strategies, thereby improving the stability and security of the server in a complex operating environment.

[0110] As an optional embodiment, the target checker is connected to the connection link between the storage controller and the switch, and the target checker also stores reference check information of the server system, wherein the reference check information is used to indicate firmware data of the startup firmware that is allowed to be written into the memory;

[0111] The management controller is used to access the target verifier when the boot firmware in the memory needs to be updated; use the reference verification information to verify the reference boot firmware to be updated in the memory; and access the memory and update the reference boot firmware to the memory when the reference boot firmware passes the verification.

[0112] Optionally, in the embodiments of the present application, Fig.10 A schematic diagram of a server startup verification system according to an embodiment of the present application Figure 7 ,like Fig.10 As shown, the target checker (TPM) is connected to the connection link between the storage controller and the switch (MUX0). The TPM stores target check information for indicating the firmware data status of the boot firmware allowed to be used when the server system is started, and also stores reference check information for indicating the firmware data of the boot firmware allowed to be written into the memory.

[0113] Optionally, in the embodiment of the present application, TPM is set on the connection link between MUX0 and the storage controller, ensuring that both PCH and management controller can directly access TPM without MUX0 frequently switching data paths, reducing the frequency and complexity of data switching and improving the efficiency and stability of data transmission. Whether it is BIOS upgrade or BIOS startup, the legitimacy and integrity of the startup firmware can be directly verified by accessing TPM.

[0114] Through the above configuration, the target checker is connected to the connection link between the storage controller and the switch, which can ensure that the system controller and the management controller can directly access the TPM, reduce the processing load of the switch, and reduce the resource consumption of the server system.

[0115] As an optional embodiment, the target checker is connected to the connection link between the sub-storage and the corresponding sub-port, and the target checker also stores reference check information of the server system, and the reference check information is used to indicate the firmware data of the startup firmware allowed to be written into the storage;

[0116] The management controller is used to access the target verifier when the boot firmware in the memory needs to be updated; use the reference verification information to verify the reference boot firmware to be updated in the memory; and access the target sub-memory and update the reference boot firmware to the target sub-memory when the reference boot firmware passes the verification.

[0117] Optionally, in the embodiments of the present application, Fig.11 A schematic diagram of a server startup verification system according to an embodiment of the present application Figure 8 ,like Fig.11 As shown, the target verifying device (TPM) is connected to the connection link between the sub-storage and the corresponding sub-port, so that the TPM can directly participate in the verification of the firmware data stored in the sub-storage without the need for transfer through the switch, thereby simplifying the data path and reducing delays and potential errors in the data transmission process.

[0118] Optionally, in the embodiment of the present application, the TPM and multiple sub-memories are all set after the SPI bus MUX1 (reference checker), so that the TPM can monitor and check the integrity and legitimacy of the firmware data in the sub-memories in real time. When the BIOS is upgraded online, since the upgrade of the BIOS firmware requires the server to enter the S5 state (STBY standby state), the PWRON signal is at a low level at this time, and then the MUX0 chip is controlled to switch to the management controller, which ensures that the control of the SPI bus is in the management controller and is completely isolated from the PCH. The management controller first selects the first FLASH through the SEL signal to ensure that the SPI path from the management controller to FLASH0 is connected, and then loads the burning file of the BIOS FW (that is, the BIOS firmware file). The management controller then calls the TPM's HASH check value to verify the security and legality of the BIOS FW burning file. Only after the check passes is the management controller allowed to burn the BIOS FW file into FLASH0. After the burning is successful, the management controller selects the SPI bus of FLASH1 through the SEL signal, and then repeats the previous step to burn the BIOS FW file into FALSH1, ensuring that the BIOS FW files in the two FLASH particles are consistent. When the server is running and the enabled FLASH is tampered with or the FW integrity check fails, it can switch to another FLASH for startup, ensuring the normal startup of the server BIOS and improving the security and stability of the server.

[0119] In the normal server startup scenario, when the server is powered on, the PWRON signal is high, and MUX0 is controlled to switch to PCH, and the connection of the management controller is completely isolated, ensuring the security of the channel and avoiding the risk of tampering with the BIOS FW by the management controller channel; at this time, PCH will load the BIOS FW in FLASH0, and verify the integrity and legitimacy of the BIOS FW through TPM. When the verification passes, the BIOS FW will be run to the normal startup of the server. When the verification fails, PCH will switch to FLASH1 through the SEL signal and perform the same FW integrity and legitimacy verification. If the verification is normal, the server will continue to start. If it fails, the server will be prohibited from starting, and the user will be informed that there is an abnormality in the server BIOS and it cannot be started, and take measures to deal with it as soon as possible.

[0120] Through the above configuration, the design of directly connecting the target verifier between the sub-storage and the corresponding sub-port can simplify the data transmission path, avoid the complex switching of data in components such as switches, and effectively improve the server system's defense capabilities against firmware security threats through real-time security verification.

[0121] Optionally, in an embodiment of the present application, a server BIOS security verification system is also provided. Fig.12 A schematic diagram of a server BIOS security verification system according to an embodiment of the present application Figure 1 ,like Fig.12 As shown in the figure, PCH (system controller), BMC (management controller), TPM (target checker) and FLASH (memory) particles are connected through the SPI bus, TPM is directly connected to PCH, BMC and PCH can access BIOS FLASH in time-sharing mode through MUX (switch) switching to upgrade BIOS FW (boot firmware), but BMC cannot interact with TPM. The BIOS FLASH is set to FLASH0 and FLASH1. When one of the FLASH works abnormally or the BIOS FW in the FLASH cannot pass the TPM verification, it will automatically switch to the other FLASH for startup. When both FLASH are damaged or the verification fails, the service refuses to start and reminds the user that the BIOS FLASH is damaged or tampered with. Through the setting of dual BIOS FLASH, the hard backup of BIOS FW can be achieved, ensuring the security and stability of BIOS.

[0122] When the BIOS FW needs to be upgraded online, the BMC can control the SPI MUX chip to switch the SPI bus to the BMC, and then burn the BIOS FW into the FLASH. The BIOS FW upgrade of 1 or 2 FLASH can be realized as needed, which improves convenience.

[0123] When the BIOS FW is upgraded online, if there is illegal operation or tampering of FLASH information, the FW file can still be written into the FALSH particles, causing the BIOS information to be tampered or the firmware to be damaged, resulting in the server being unable to start normally, posing a great threat to the security and reliability of the server. Because the BMC cannot access the TPM during the online upgrade, it cannot verify whether the BIOS FW upgrade file is complete and legal. The BMC only verifies the integrity of the BIOS FW file, so it cannot guarantee the security and legality of the BIOS FW upgrade file.

[0124] Fig.13 A schematic diagram of a server BIOS security verification system according to an embodiment of the present application Figure 2 ,like Fig.13 As shown, the single BIOS FLASH of the TPM module is connected to the BMC and PCH through the SPI bus, and switched between them through MUX, which ensures that both PCH and BMC can access the BIOS FLASH, but only PCH can access TPM, and BMC cannot access it normally, ensuring that the legitimacy and integrity of the FW can be verified through TPM during BIOS startup, ensuring the security of the server during startup and operation.

[0125] PCH and BMC communicate with BIOS FLASH respectively by switching MUX chips. This solution can only ensure the integrity and legitimacy of BIOS FW when BIOS starts. That is, when BIOS starts, BIOS will be verified through TPM. After the verification passes, BIOS will be allowed to start normally. If BIOS is illegally tampered with or BIOS FW is damaged, the verification will be abnormal, that is, fail, and BIOS startup will be prohibited, ensuring the security and legitimacy of BIOS startup.

[0126] When upgrading the BIOS through the BMC, the BMC switches the MUX connected to the BMC through the SEL signal, and the FW file can be directly burned to the BIOS FLAH. It only involves the BMC to verify the integrity of the file burned by the BIOS FW. Because the TPM cannot be accessed, the BIOS FW can be directly burned or modified. After the burning is complete, the legitimacy of the BIOS FW is verified when the computer is turned on. If the BIOS FW is illegally modified at this time, the system cannot intercept the behavior, which eventually causes the server to be abnormally tampered with, resulting in the failure of the legitimacy check and the inability to start, affecting the security and stability of the server.

[0127] Fig.14 This is a schematic diagram of an optimized server BIOS security verification system according to an embodiment of the present application. Figure 1 ,like Fig.14As shown, the TPM module and two BIOS FLASH are set after the SPI bus MUX, ensuring that both PCH and BMC can access TPM. Whether it is BIOS upgrade or BIOS startup, the legitimacy and integrity of FW can be verified through TPM, ensuring the security of the server during upgrade and startup.

[0128] Set up two BIOS FLASH and TPM to connect directly through the SPI bus, so that TPM can monitor and verify the integrity and legitimacy of the two FLASH data in real time. When the BIOS is upgraded online, the server needs to enter the S5 state (STBY standby state) because the upgrade of BIOS FW requires the server to enter the S5 state. At this time, the PWRON signal is low, and then the MUX chip is controlled to switch to the BMC, which ensures that the control of the SPI bus is in the BMC and is completely isolated from the PCH. BMC first selects the first FLASH through the SEL signal to ensure that the SPI path from BMC to FLASH0 is connected, and then loads the BIOS burning file. Then BMC calls the TPM's HASH check value to verify the security and legality of the BIOS FW burning file. Only after the check passes, BMC is allowed to burn the BIOS FW file into FLASH0. After the burning is successful, BMC selects the SPI bus of FLASH1 through the SEL signal, and then repeats the previous step to burn the BIOS FW file into FALSH1, ensuring that the BIOS FW files in the two FLASH particles are consistent. When the server is running and the enabled FLASH is tampered with or the FW integrity check fails, it can switch to another FLASH for startup, ensuring the normal startup of the server BIOS and improving the security and stability of the server.

[0129] In the normal server startup scenario, when the server is powered on, the PWRON signal is high, the control MUX is switched to PCH, and the BMC connection is completely isolated, ensuring the security of the channel and avoiding the risk of tampering with the BIOS FW by the BMC channel; at this time, PCH will load the BIOS FW in FLASH0, and verify the integrity and legitimacy of the BIOS FW through TPM. When the verification passes, the BIOS FW will be run to the normal startup of the server. When the verification fails, PCH will switch to FLASH1 through the SEL signal and perform the same FW integrity and legitimacy verification. If the verification is normal, the server will continue to start. If it fails, the server will be prohibited from starting, and the user will be informed that there is an abnormality in the server BIOS and it cannot be started, and take measures to deal with it as soon as possible.

[0130] In the normal operation scenario of the server, the PWRON signal is always high, and the SPI path is always kept PCH on, which can verify the integrity and legality of the data in real time. After normal startup, PCH has the sole control right and cannot be modified, avoiding the risk of BMC tampering and damaging BIOS FW or data.

[0131] The dual BIOS FLASH setting ensures the hardware redundancy design of BIOS FW and improves the security and stability of the server; setting BMC access to TPM channels ensures the security and legality of online upgrades of BIOS FW files and prevents BIOS from being tampered with and damaged.

[0132] Fig.15 This is a schematic diagram of an optimized server BIOS security verification system according to an embodiment of the present application. Figure 2 ,like Fig.15 As shown in the figure, the three hosts involved in the topology: PCH\BMC\CPLD (Logic Control Device) need to pass TPM verification to perform read and write operations on the two flash memories.

[0133] FLASH0 is the master FLASH, FLASH1 is the slave FLASH, when PCH normally starts, it can access the flash and interact with data, or when BMC upgrades the bios FW, it can only operate the master flash, that is, flash0. FLASH1 is the slave FLASH, and CPLD will periodically synchronize the data of flash0 to FLASH1, thereby isolating the direct operation of PCH and BMC on FLASH1, ensuring the security and stability of FLASH1 data.

[0134] When FLASH0 works abnormally or BMC refreshes abnormally, causing FLASH to fail TPM verification, CPLD will switch the permissions of the two FLASHes, switching FLASH1 to the master LFASH for normal use of the system, and switching FLASH0 to the slave FLASH, which ensures the stable operation of the machine and isolates the impact of flash data abnormalities on the system. At the same time, CPLD reports abnormal events to the system and notifies operation and maintenance personnel to take timely measures.

[0135] For specific examples in this embodiment, reference may be made to the examples described in the above embodiments and exemplary implementation modes, and this embodiment will not be described in detail herein.

[0136] Obviously, those skilled in the art should understand that the above modules or steps of the present application can be implemented by a general computing device, they can be concentrated on a single computing device, or distributed on a network composed of multiple computing devices, they can be implemented by a program code executable by a computing device, so that they can be stored in a storage device and executed by the computing device, and in some cases, the steps shown or described can be executed in a different order from that herein, or they can be made into individual integrated circuit modules, or multiple modules or steps therein can be made into a single integrated circuit module for implementation. Thus, the present application is not limited to any specific combination of hardware and software.

[0137] The above description is only the preferred embodiment of the present application and is not intended to limit the present application. For those skilled in the art, the present application may have various modifications and variations. Any modification, equivalent replacement, improvement, etc. made within the principles of the present application shall be included in the protection scope of the present application.

Claims

1. A server startup verification system, It is characterized in that The system comprises: a system startup device and a target checker, wherein the system startup device comprises a system controller, a management controller, a switch and a memory, wherein the management controller, the system controller and the memory are all connected to the switch, and the target checker is connected to the system startup device, wherein the memory stores the target startup firmware of the server system, and the target checker stores the target check information of the server system, wherein the target check information is used to indicate the firmware data of the startup firmware allowed to be used when the server system is started; The switch is used to control the system controller to communicate with the memory when the server system is started; and to control the management controller to communicate with the memory when the startup firmware in the memory is to be updated; The system controller is used to access the target checker and the memory when the server system is started; and use the target check information to check the target startup firmware; wherein the target checker is connected to the connection link between the system controller and the switch; The server startup verification system also includes a reference verifier, wherein the reference verifier is connected to the connection link between the management controller and the switch, and the reference verifier stores reference verification information of the server system, and the reference verification information is used to indicate the firmware data of the startup firmware in the memory that is allowed to be written; the management controller is used to access the reference verifier when the startup firmware in the memory is to be updated; use the reference verification information to verify the reference startup firmware to be updated in the memory; and access the memory and update the reference startup firmware to the memory when the reference startup firmware passes the verification; The server startup verification system also includes a synchronization controller, wherein the synchronization controller is connected to the reference verifier and the target verifier respectively; the synchronization controller is used to match the first information version of the reference verification information and the second information version of the target verification information; when the first information version and the second information version do not match each other, the reference verification information is used to update the target verification information stored in the target verifier.

2. The system according to claim 1, characterized in that The switch is configured with a first interface, a second interface and a third interface, wherein the first interface is used to connect to the system controller, the second interface is used to connect to the management controller, and the third interface is used to connect to the memory; The switch is used to control the first interface and the third interface to be connected when the server system is started; and to control the second interface and the third interface to be connected when the startup firmware in the memory is to be updated.

3. The system according to claim 2, characterized in that The switch is also provided with a fourth interface, the target checker is connected to the fourth interface, and the target checker also stores reference check information, the reference check information is used to indicate the firmware data of the startup firmware allowed to be written into the memory; The switch is used to control the first interface and the fourth interface to be connected when the server system is started, and to control the first interface and the third interface to be connected when the system controller accesses the target verification information stored in the target verifier; when the startup firmware in the memory is to be updated, control the second interface and the fourth interface to be connected, and when the management controller accesses the reference verification information stored in the target verifier, control the second interface and the third interface to be connected.

4. The system according to claim 1, characterized in that The memory includes a plurality of sub-memories, and the switch is connected to each of the sub-memories respectively; The plurality of sub-memory devices are used to redundantly store the startup firmware required for starting the server system.

5. The system according to claim 4, characterized in that The memory further comprises a memory controller, wherein a first port of the memory controller is connected to the switch, and a second port of the memory controller is respectively connected to each of the sub-memories; The storage controller is used to control the access status of each of the sub-memory.

6. The system according to claim 5, characterized in that The second port of the storage controller includes a plurality of sub-ports, each of the sub-ports being connected to the sub-memory in a one-to-one correspondence; The storage controller is used for selecting a target sub-memory to be accessed from the multiple sub-memories when receiving an access request to the sub-memory; and controlling the sub-port connected to the target sub-memory to be in a connected state with the first port.

7. The system according to claim 6, characterized in that The storage controller comprises a logic control device and a reference switch, wherein the logic control device is connected to the reference switch, and the reference switch is configured with the first port and the plurality of sub-ports; The logic control device is used to control the reference switch to adjust the on / off state of the first port and each of the sub-ports.

8. The system according to claim 7, characterized in that The logic control device is used to select a first sub-memory in an unoccupied state from the plurality of sub-memories when receiving an access request to the sub-memory; In the case where there are multiple first sub-memories, the target sub-memories whose calling priority is greater than or equal to the target priority are filtered out from the multiple first sub-memories according to priority information of the sub-memories, wherein the priority information is determined according to the storage performance of each of the sub-memories.

9. The system according to claim 7, characterized in that The logic control device is also used to detect the occupancy status of each second sub-memory when the access request is a request to update the boot firmware, wherein the second sub-memory is a memory other than the target sub-memory among the multiple sub-memories; and when the second sub-memory is in an unoccupied state, update the updated boot firmware stored in the target sub-memory to the second sub-memory.

10. The system according to claim 8, characterized in that The logic control device is also used to obtain the access failure frequency of each of the sub-memory when it is accessed before the current moment; sort the multiple sub-memory in order of the access failure frequency from low to high to obtain the access order of the multiple sub-memory; and determine the access order as the priority information of the multiple sub-memory when being accessed.

11. The system according to claim 5, characterized in that The target checker is connected to the connection link between the storage controller and the switch, and the target checker also stores reference check information of the server system, wherein the reference check information is used to indicate firmware data of the startup firmware that is allowed to be written into the memory; The management controller is used to access the target checker when the boot firmware in the memory is to be updated; Using the reference verification information to verify the reference startup firmware to be updated in the memory; When the reference startup firmware passes the verification, the memory is accessed and the reference startup firmware is updated to the memory.

12. The system according to claim 6, characterized in that The target checker is connected to the connection link between the sub-storage and the corresponding sub-port, and the target checker also stores reference check information of the server system, wherein the reference check information is used to indicate firmware data of the startup firmware that is allowed to be written into the storage; The management controller is used to access the target checker when the boot firmware in the memory is to be updated; Using the reference verification information to verify the reference startup firmware to be updated in the memory; When the reference startup firmware passes the verification, the target sub-memory is accessed and the reference startup firmware is updated to the target sub-memory.

Images