Key updating method and device, equipment and medium

Abstract

The invention discloses a secret key updating method and device, equipment and a medium, and relates to the technical field of computers. When the original secure flash memory key is updated, a new secure flash memory key is generated, the basic input / output system firmware of the intermediate version is compiled by using the original private key and the new public key, and firmware updating is carried out; because the signature of the original key exists in the basic input / output system firmware of the intermediate version and corresponds to the original public key in the original basic input / output system firmware, the intermediate version can pass the verification of the secure flash memory; and finally, compiling new basic input / output system firmware by using the new secure flash memory key, and updating the firmware. Due to the fact that the new basic input and output system firmware has the signature of the new secret key and corresponds to the new public key in the basic input and output system firmware of the middle version, in-band non-inductive updating of the secret key of the secure flash memory can be finally achieved through secure flash memory verification, operation is simple, and after-sales cost is greatly reduced.

Description

Technical Field

[0001] The present invention relates to the field of computer technology, and in particular to a key updating method, device, equipment and medium. Background Art

[0002] The Basic Input / Output System (BIOS) is a key component in the computer startup process, responsible for initializing hardware, loading the operating system, providing low-level services, and managing configuration settings. BIOS is also at risk of malware attacks, such as firmware tampering. Secure Flash technology uses asymmetric encryption algorithms to enhance BIOS firmware protection, using private / public key pairs to decrypt and encrypt algorithms to verify the legitimacy of the BIOS binary file to prevent unauthorized firmware modifications. The private key is protected by the manufacturer and is used to encrypt the BIOS firmware to generate a signature, while the public key is used to verify the signature in the BIOS binary file to be updated to ensure its legitimacy.

[0003] However, to ensure the absolute security and reliability of BIOS firmware, manufacturers need to strictly control the key to prevent leakage and update the key in a timely manner. Server platforms can update the key by updating the BIOS out-of-band, while notebook and desktop platforms need to update the BIOS firmware through in-band tools due to interface restrictions, but the Secure Flash verification must be passed. Users cannot update the key by themselves, and manufacturers need to recall the motherboard to update the key through the flash memory chip through the burner, which is very inconvenient.

[0004] In view of the above problems, how to solve the problem that the Secure Flash key of the BIOS firmware cannot be updated in an in-band manner is an urgent problem to be solved by technical personnel in this field. Summary of the invention

[0005] The purpose of the present invention is to provide a key updating method, device, equipment and medium to solve the problem that the Secure Flash key of BIOS firmware cannot be updated in an in-band manner.

[0006] In order to solve the above technical problems, the present invention provides a key updating method, comprising:

[0007] When there is a need to update the original secure flash key of the original basic input / output system firmware, a new secure flash key is generated; wherein the original secure flash key includes an original public key and an original private key; and the new secure flash key includes a new public key and a new private key;

[0008] Compile an intermediate version of BIOS firmware according to the original private key and the new public key, and use an in-band update tool to upgrade the original BIOS firmware to the intermediate version of BIOS firmware;

[0009] Compile new BIOS firmware according to the new private key and the new public key;

[0010] The intermediate version of the BIOS firmware is upgraded to the new BIOS firmware using an in-band update tool, so as to update the secure flash key of the BIOS firmware from the original secure flash key to the new secure flash key.

[0011] On the one hand, generate a new secure flash key, including:

[0012] determining an encryption algorithm for the original secure flash key;

[0013] Selecting a target encryption algorithm according to the encryption algorithm of the original secure flash key; wherein the computational complexity of the target encryption algorithm is higher than the computational complexity of the encryption algorithm of the original secure flash key;

[0014] The new secure flash key is generated according to the target encryption algorithm.

[0015] On the other hand, compiling an intermediate version of basic input and output system firmware according to the original private key and the new public key includes:

[0016] Saving the new public key to the first firmware file system of the binary file of the intermediate version of the basic input and output system firmware;

[0017] Generate an intermediate version signature of a binary file of the intermediate version of the basic input and output system firmware according to the original private key;

[0018] The intermediate version signature is saved in a second firmware file system of a binary file of the intermediate version of the basic input / output system firmware.

[0019] On the other hand, compiling a new basic input / output system firmware according to the new private key and the new public key includes:

[0020] Saving the new public key to the first firmware file system of the binary file of the new basic input and output system firmware;

[0021] Generate a new signature of the binary file of the new basic input and output system firmware according to the new private key;

[0022] The new signature is saved in the second firmware file system of the binary file of the new basic input / output system firmware.

[0023] On the other hand, it also includes:

[0024] Get the build file for the secure flash key;

[0025] Uploading the constructed file to a signature server;

[0026] Uploading the original public key, the original private key, the new public key and the new private key to the signature server;

[0027] Correspondingly, compiling an intermediate version of basic input / output system firmware according to the original private key and the new public key includes:

[0028] Saving the new public key to the first firmware file system of the binary file of the intermediate version of the basic input and output system firmware;

[0029] Uploading the binary file of the intermediate version of the basic input and output system firmware to the signature server;

[0030] Signing the intermediate version of the basic input and output system firmware using the original private key through the signature server to obtain an intermediate version signature;

[0031] Saving the intermediate version signature to a second firmware file system of a binary file of a basic input / output system firmware of the intermediate version;

[0032] Correspondingly, compiling a new basic input / output system firmware according to the new private key and the new public key includes:

[0033] Saving the new public key to the first firmware file system of the binary file of the new basic input and output system firmware;

[0034] Uploading the binary file of the new basic input and output system firmware to the signature server;

[0035] Signing the new basic input and output system firmware using the new private key through the signature server to obtain a new signature;

[0036] The new signature is saved in the second firmware file system of the binary file of the new basic input / output system firmware.

[0037] On the other hand, when there is a need to update the original secure flash key of the original BIOS firmware, it also includes:

[0038] determining whether the original secure flash memory key of the original BIOS firmware is leaked;

[0039] If it is confirmed that the original secure flash memory key is leaked, the number of key leaks is set to be plus 1, and it is determined whether the number of key leaks is greater than a threshold;

[0040] If it is confirmed that the number of key leaks is not greater than the threshold, proceeding to the step of generating a new secure flash memory key;

[0041] If it is confirmed that the number of key leakages is greater than the threshold, the updating process of the original secure flash key is terminated and an alarm message is output.

[0042] On the other hand, it also includes:

[0043] Set a preset period for updating BIOS firmware;

[0044] The original secure flash memory key of the original BIOS firmware is forcibly updated according to the preset period.

[0045] In order to solve the above technical problems, the present invention further provides a key updating device, comprising:

[0046] A generating module, configured to generate a new secure flash key when there is a need to update the original secure flash key of the original basic input / output system firmware; wherein the original secure flash key includes an original public key and an original private key; and the new secure flash key includes a new public key and a new private key;

[0047] A first compiling module, configured to compile an intermediate version of a basic input / output system firmware according to the original private key and the new public key, and upgrade the original basic input / output system firmware to the intermediate version of the basic input / output system firmware using an in-band update tool;

[0048] A second compiling module, used for compiling a new basic input and output system firmware according to the new private key and the new public key;

[0049] The upgrade module is used to upgrade the intermediate version of the basic input and output system firmware to the new basic input and output system firmware using an in-band update tool, so as to update the secure flash key of the basic input and output system firmware from the original secure flash key to the new secure flash key.

[0050] In order to solve the above technical problems, the present invention further provides a key updating device, comprising:

[0051] Memory for storing computer programs;

[0052] A processor is used to implement the steps of the above-mentioned key updating method when executing the computer program.

[0053] In order to solve the above technical problem, the present invention also provides a computer-readable storage medium, on which a computer program is stored, and when the computer program is executed by a processor, the steps of the above key update method are implemented.

[0054] The key updating method provided by the present invention generates a new secure flash key when there is a need to update the original secure flash key of the original basic input / output system firmware; wherein the original secure flash key includes an original public key and an original private key; the new secure flash key includes a new public key and a new private key; the intermediate version of the basic input / output system firmware is compiled according to the original private key and the new public key, and the original basic input / output system firmware is upgraded to the intermediate version of the basic input / output system firmware using an in-band update tool; the new basic input / output system firmware is compiled according to the new private key and the new public key; the intermediate version of the basic input / output system firmware is upgraded to the new basic input / output system firmware using the in-band update tool, so as to update the secure flash key of the basic input / output system firmware from the original secure flash key to the new secure flash key.

[0055] The beneficial effect of the present invention is that when the original secure flash key of the original basic input / output system firmware is leaked and there is a need to update the original secure flash key, a new secure flash key is generated, and the intermediate version of the basic input / output system firmware for transition is compiled using the original private key and the new public key, and the firmware is updated; since the intermediate version of the basic input / output system firmware has the signature of the original key, which corresponds to the original public key in the original basic input / output system firmware, it can pass the secure flash verification during the update; finally, a new basic input / output system firmware is compiled using the new secure flash key, and the firmware is updated; since the new basic input / output system firmware has the signature of the new key, which corresponds to the new public key in the intermediate version of the basic input / output system firmware, it can pass the secure flash verification during the update, and finally the in-band senseless update of the secure flash key is realized, the operation is simple, and the after-sales cost is greatly reduced.

[0056] On the other hand, the present invention specifically improves the security of the new BIOS firmware by determining the encryption algorithm of the original secure flash key; selecting a target encryption algorithm with higher computational complexity according to the encryption algorithm of the original secure flash key, and generating a new secure flash key according to the target encryption algorithm. The construction file of the secure flash key is obtained and uploaded to the signature server. Then the original public key, the original private key, the new public key and the new private key are uploaded to the signature server, and the secure flash key is kept uniformly by the signature server; subsequently, every time the manufacturer releases a new version of the basic input and output system, it only needs to upload the unsigned basic input and output system binary file to the server, and then execute the signed batch command, so that the signature can be completed without touching the key, ensuring the security of the key.

[0057] In addition, the present invention also provides a key updating device, equipment and medium, which have the same effects as above. BRIEF DESCRIPTION OF THE DRAWINGS

[0058] In order to more clearly illustrate the embodiments of the present invention, the following briefly introduces the drawings required for use in the embodiments. Obviously, the drawings described below are only some embodiments of the present invention. For ordinary technicians in this field, other drawings can be obtained based on these drawings without paying creative work.

[0059] Figure 1 A flowchart of a key updating method provided by an embodiment of the present invention;

[0060] Figure 2 A schematic diagram of a key updating device provided by an embodiment of the present invention;

[0061] Figure 3 A schematic diagram of a key updating device provided by an embodiment of the present invention. DETAILED DESCRIPTION

[0062] The following will be combined with the drawings in the embodiments of the present invention to clearly and completely describe the technical solutions in the embodiments of the present invention. Obviously, the described embodiments are only part of the embodiments of the present invention, not all of the embodiments. Based on the embodiments of the present invention, all other embodiments obtained by ordinary technicians in this field without creative work are within the scope of protection of the present invention.

[0063] The core of the present invention is to provide a key update method, device, equipment and medium to solve the problem that the Secure Flash key of the BIOS firmware cannot be updated in an in-band manner.

[0064] In order to enable those skilled in the art to better understand the solution of the present invention, the present invention is further described in detail below in conjunction with the accompanying drawings and specific implementation methods.

[0065] Currently, Secure Flash technology uses asymmetric encryption algorithms and private / public key pairs to enhance BIOS firmware protection and prevent malicious attacks and unauthorized firmware modifications. To ensure the security and reliability of BIOS firmware, manufacturers must strictly control keys to prevent leakage and update keys in a timely manner. The workflow of Secure Flash technology is as follows:

[0066] The private key is owned and protected by the manufacturer and will not be included in the BIOS binary file. The private key is used to encrypt the BIOS firmware and generate a set of signatures, which are stored in a firmware file system (FFS) of the BIOS binary file. The public key is also stored in another FFS of the BIOS binary file. When the BIOS is updated itself, the public key of the BIOS binary file on the motherboard is used to verify the signature in the BIOS binary file to be updated. If the verification passes, it means that the BIOS binary file is legal; if the verification fails, it means that the BIOS binary file is illegal and may be suspected of being tampered with. In this way, Secure Flash technology ensures the integrity and legitimacy of the BIOS firmware and improves the security of the system.

[0067] For server platform products, users can update the BIOS out-of-band through the BMC to update the key. The out-of-band BIOS update is an operation that forces the flash memory chip to be refreshed and does not require the verification of Secure Flash. However, for notebook and desktop platform products, since there is no BMC management interface, the BIOS firmware can only be updated through in-band tools. However, the in-band tool updates the BIOS firmware only after the Secure Flash verifies the BIOS binary file to be updated. Users cannot update the key in time by upgrading the BIOS firmware. The manufacturer needs to recall the motherboard to force the flash memory chip to be refreshed through the burner to update the key, which is very inconvenient. Therefore, in order to solve the above problem, the present invention provides a key update method.

[0068] Figure 1 A flowchart of a key update method provided by an embodiment of the present invention. Figure 1 As shown, the method includes:

[0069] S10: When there is a need to update the original secure flash key of the original BIOS firmware, a new secure flash key is generated.

[0070] The original secure flash key includes an original public key and an original private key; the new secure flash key includes a new public key and a new private key.

[0071] In a specific implementation, when there is a need to update the original Secure Flash key of the original BIOS firmware, a new Secure Flash key is generated using a tool. It should be noted that the original Secure Flash key includes an original public key and an original private key; the new Secure Flash key includes a new public key and a new private key. In this embodiment, there is no restriction on the encryption algorithm used for the new Secure Flash key, which depends on the specific implementation situation.

[0072] It should be noted that this embodiment does not limit the method for generating a new Secure Flash key. For example, a new Secure Flash key can be generated using a command line tool or an encryption library, depending on the specific implementation situation.

[0073] S11: compile an intermediate version of the BIOS firmware according to the original private key and the new public key, and use an in-band update tool to upgrade the original BIOS firmware to the intermediate version of the BIOS firmware.

[0074] Furthermore, an intermediate version of the BIOS firmware is compiled according to the original private key and the new public key, and an in-band update tool is used to upgrade the original BIOS firmware to the intermediate version of the BIOS firmware.

[0075] Note that the intermediate version of the BIOS firmware is signed by the original private key and forms a pair of Secure Flash keys with the original public key in the original BIOS firmware. Therefore, when the in-band update tool is used to upgrade the original BIOS firmware to the intermediate version of the BIOS firmware, the Secure Flash key verification can pass.

[0076] In addition, in this embodiment, there is no restriction on the specific type of the in-band update tool, which depends on the specific implementation situation.

[0077] S12: Compile a new BIOS firmware according to the new private key and the new public key.

[0078] S13: Use an in-band update tool to upgrade the intermediate version of the BIOS firmware to the new BIOS firmware, so as to update the secure flash key of the BIOS firmware from the original secure flash key to the new secure flash key.

[0079] Further, a new BIOS firmware is compiled according to the new private key and the new public key. Finally, an in-band update tool is used to upgrade the intermediate version of the BIOS firmware to the new BIOS firmware.

[0080] It should be noted that since the new BIOS firmware is signed by a new private key, it forms a pair of Secure Flash keys with the new public key in the intermediate version of the BIOS firmware. Therefore, when the in-band update tool is used to upgrade the intermediate version of the BIOS firmware to the new BIOS firmware, the Secure Flash key verification can pass. Finally, the Secure Flash key of the BIOS firmware is updated from the original Secure Flash key to the new Secure Flash key.

[0081] In this embodiment, there is no restriction on the compilation process of the intermediate version of the BIOS firmware and the compilation process of the new BIOS firmware, which depends on the specific implementation situation.

[0082] In this embodiment, when the original secure flash key of the original basic input / output system firmware is leaked and there is a need to update the original secure flash key, a new secure flash key is generated, and the original private key and the new public key are used to compile an intermediate version of the basic input / output system firmware for transition, and the firmware is updated; since the intermediate version of the basic input / output system firmware has a signature of the original key, which corresponds to the original public key in the original basic input / output system firmware, it can pass the secure flash verification during the update; finally, a new basic input / output system firmware is compiled using the new secure flash key, and the firmware is updated; since the new basic input / output system firmware has a signature of the new key, which corresponds to the new public key in the intermediate version of the basic input / output system firmware, it can pass the secure flash verification during the update, and finally the in-band seamless update of the secure flash key is realized, the operation is simple, and the after-sales cost is greatly reduced.

[0083] In order to improve the security of the new Secure Flash key, based on the above embodiments, in some embodiments, generating a new Secure Flash key includes:

[0084] S101: Determine an encryption algorithm for an original secure flash memory key;

[0085] S102: Selecting a target encryption algorithm according to the encryption algorithm of the original secure flash memory key;

[0086] wherein the computational complexity of the target encryption algorithm is higher than the computational complexity of the encryption algorithm of the original secure flash key;

[0087] S103: Generate a new secure flash key according to the target encryption algorithm.

[0088] In a specific implementation, in order to improve the security of the Secure Flash key of the new BIOS firmware, when generating the new Secure Flash key, an encryption algorithm that is more complex than the encryption algorithm of the original Secure Flash key may be used.

[0089] Specifically, it is necessary to first determine the encryption algorithm of the original Secure Flash key, and select the target encryption algorithm according to the encryption algorithm of the original Secure Flash key. It should be noted that the computational complexity of the target encryption algorithm is higher than the computational complexity of the encryption algorithm of the original Secure Flash key, so the theoretical security and anti-attack performance of the target encryption algorithm are higher than the encryption algorithm of the original Secure Flash key. For example, when the encryption algorithm of the original Secure Flash key is the Advanced Encryption Standard with 128-bit key (AES-128), the Advanced Encryption Standard with 256-bit key (AES-256) can be selected as the target encryption algorithm. In this embodiment, there is no restriction on the specific selected target encryption algorithm, and it is only necessary to ensure that its computational complexity is higher than the computational complexity of the encryption algorithm of the original Secure Flash key. Finally, a new Secure Flash key is generated according to the target encryption algorithm, thereby improving the security of the new BIOS firmware.

[0090] In this embodiment, the encryption algorithm of the original secure flash key is determined; a target encryption algorithm with higher computational complexity is selected based on the encryption algorithm of the original secure flash key, and a new secure flash key is generated based on the target encryption algorithm, thereby improving the security of the new BIOS firmware.

[0091] Based on the above embodiments, in some embodiments, compiling an intermediate version of basic input / output system firmware according to the original private key and the new public key includes:

[0092] S111: saving the new public key to the first firmware file system of the binary file of the intermediate version of the basic input and output system firmware;

[0093] S112: Generate an intermediate version signature of a binary file of an intermediate version of basic input and output system firmware according to the original private key;

[0094] S113: Save the intermediate version signature to the second firmware file system of the binary file of the intermediate version of the BIOS firmware.

[0095] In order to compile the intermediate version of the BIOS firmware, in a specific implementation, the new public key is specifically saved in the first firmware file system of the binary file of the intermediate version of the BIOS firmware. Further, the intermediate version signature of the binary file of the intermediate version of the BIOS firmware is generated according to the original private key. Finally, the intermediate version signature is saved in the second firmware file system of the binary file of the intermediate version of the BIOS firmware. In this way, the compilation of the intermediate version of the BIOS firmware is completed.

[0096] It should be noted that, in this embodiment, there is no restriction on the type of compilation tool selected for compiling the intermediate version of the BIOS firmware, which depends on the specific implementation situation.

[0097] Based on the above embodiments, in some embodiments, compiling a new basic input / output system firmware according to a new private key and a new public key includes:

[0098] S121: Save the new public key to the first firmware file system of the binary file of the new basic input and output system firmware;

[0099] S122: Generate a new signature of a new binary file of the basic input and output system firmware according to the new private key;

[0100] S123: Save the new signature to the second firmware file system of the binary file of the new BIOS firmware.

[0101] In order to compile the new BIOS firmware, in a specific implementation, the new public key is specifically saved in the first firmware file system of the binary file of the new BIOS firmware. A new signature of the binary file of the new BIOS firmware is further generated according to the new private key. Finally, the new signature is saved in the second firmware file system of the binary file of the new BIOS firmware. In this way, the compilation of the new BIOS firmware is completed.

[0102] It should be noted that, in this embodiment, there is no restriction on the type of compilation tool selected for compiling the new BIOS firmware, which depends on the specific implementation situation.

[0103] In order to further improve the security of the Secure Flash key, based on the above embodiments, in some embodiments, the following steps are further included:

[0104] S14: Obtain a build file of a secure flash key;

[0105] S15: Upload the build file to the signature server;

[0106] S16: Upload the original public key, the original private key, the new public key, and the new private key to the signature server.

[0107] To improve the security of the Secure Flash key, you can also obtain the Makefile (mak) of the Secure Flash key. Specifically, extract the mak file related to the Secure Flash key signature from the code, and then upload the build file to the signature server. Then upload the original public key, original private key, new public key, and new private key to the signature server, which will keep the Secure Flash key in a unified manner. In the future, every time the manufacturer releases a new version of BIOS, it only needs to upload the unsigned BIOS binary file to the server, and then execute the batch command for signing. In this way, the signature can be completed without touching the key, ensuring the security of the key.

[0108] Therefore, based on the above content, when compiling the intermediate version of the BIOS firmware according to the original private key and the new public key, the new public key is specifically saved in the first firmware file system of the binary file of the intermediate version of the BIOS firmware, and the binary file of the intermediate version of the BIOS firmware is further uploaded to the signature server; the intermediate version of the BIOS firmware is signed by the signature server using the original private key to obtain the intermediate version signature; the intermediate version signature is saved in the second firmware file system of the binary file of the intermediate version of the BIOS firmware. In this way, the compilation of the intermediate version of the BIOS firmware is realized, and the Secure Flash key is not touched during the compilation process, thereby ensuring the security of the key.

[0109] Similarly, when compiling a new BIOS firmware according to the new private key and the new public key, the new public key is specifically saved in the first firmware file system of the binary file of the new BIOS firmware, and the binary file of the new BIOS firmware is further uploaded to the signature server; the new BIOS firmware is signed by the signature server using the new private key to obtain a new signature; and the new signature is saved in the second firmware file system of the binary file of the new BIOS firmware. In this way, the compilation of the new BIOS firmware is realized, and the Secure Flash key is not touched during the compilation process, thereby ensuring the security of the key.

[0110] Based on the above embodiment, in some embodiments, when there is a need to update the original secure flash memory key of the original basic input / output system firmware, it also includes:

[0111] S17: Determine whether the original secure flash key of the original BIOS firmware is leaked; if so, proceed to step S18; if not, proceed to step S10;

[0112] S18: Set the number of key leakage times plus 1, and determine whether the number of key leakage times is greater than a threshold; if not, proceed to step S10; if so, end the update process of the original secure flash key and output an alarm message.

[0113] In a specific implementation, when there is a need to update the original Secure Flash key of the original BIOS firmware, it can be first determined whether the original Secure Flash key of the original BIOS firmware is leaked, so as to determine whether the key update is caused by key leakage. If it is confirmed that the original secure flash key is not leaked, it is considered that the key update is not caused by key leakage, and step S10 is directly entered to generate a new secure flash key. If it is confirmed that the original secure flash key is leaked, it is necessary to set the number of key leaks plus 1, and determine whether the number of key leaks is greater than a threshold. In this embodiment, there is no restriction on the size of the threshold, which depends on the specific implementation situation.

[0114] If the number of confirmed key leakages is not greater than the threshold, the current key leakage risk is considered low, and the Secure Flash key can be updated normally, and the step of generating a new secure flash key is entered. If the number of confirmed key leakages is greater than the threshold, the current key leakage risk is considered high, and there is still a high leakage risk even if the Secure Flash key is updated again. Therefore, the update process of the original Secure Flash key is terminated and an alarm message is output, thereby prompting the user to promptly check the source of Secure Flash key leakage to ensure the security of the BIOS firmware.

[0115] Log analysis is one of the important methods to troubleshoot the source of BIOS firmware Secure Flash key leakage. By analyzing system logs and network traffic logs, abnormal activities or suspicious access patterns can be found to identify potential sources of leakage. Specifically, log data is collected from systems, network devices, and applications, including system event logs, network traffic logs, access logs, and security event logs. Use log management tools to filter and aggregate the collected log data to reduce noise and focus on events related to key leakage. Analyze patterns and trends in log data to find abnormal activities or suspicious access patterns. For example, abnormal login attempts, large amounts of data downloads or uploads, access from unknown IP addresses, etc. Correlate log data from different sources to find potential leakage paths or attack chains. For example, correlate system event logs with network traffic logs to determine whether there is misconduct by insiders or external attacks. Finally, use a Security Information and Event Management (SIEM) system to detect and respond to potential security incidents. SIEM systems can analyze log data in real time and provide alerts and reporting functions to help security teams detect and respond to threats in a timely manner.

[0116] In addition, vulnerability scanning is also one of the important methods to ensure the security of systems and devices. By using vulnerability scanning tools to conduct a comprehensive scan of the system, possible vulnerabilities or weaknesses can be discovered, so that they can be repaired in time and key leakage can be prevented. Specifically select vulnerability scanning tools that are suitable for the target system and device, and configure the scanning tool's scanning range, scanning depth, scanning strategy and other parameters according to the characteristics of the target system and device. Run the scanning tool to conduct a comprehensive scan of the target system and device to discover possible vulnerabilities or weaknesses. Analyze the scan results to determine the severity and scope of the discovered vulnerabilities. Based on the scan results, repair the discovered vulnerabilities or weaknesses in a timely manner. This may include installing security updates and patches, configuring security policies, or replacing affected components.

[0117] By combining log analysis and vulnerability scanning methods, the security of the BIOS firmware's Secure Flash key can be improved, the risk of malicious attacks can be reduced, and potential leak sources can be discovered and fixed in a timely manner.

[0118] In addition, in order to further improve the security of the BIOS firmware key, based on the above embodiments, in some embodiments, the method further includes:

[0119] S19: Setting a preset period for updating the basic input and output system firmware;

[0120] S20: Forcibly updating the original secure flash key of the original BIOS firmware according to a preset period.

[0121] Specifically, a preset period for updating the BIOS firmware is set, and the original Secure Flash key of the original BIOS firmware is further forcibly updated according to the preset period, thereby reducing the risk of leakage of the Secure Flash key and effectively improving the security of the BIOS firmware.

[0122] In the above embodiments, the key updating method is described in detail. The present invention also provides a corresponding embodiment of the key updating device.

[0123] Figure 2 A schematic diagram of a key updating device provided by an embodiment of the present invention. Figure 2 As shown, the device comprises:

[0124] The generation module 10 is used to generate a new secure flash key when there is a need to update the original secure flash key of the original basic input / output system firmware; wherein the original secure flash key includes an original public key and an original private key; and the new secure flash key includes a new public key and a new private key.

[0125] The first compiling module 11 is used to compile an intermediate version of BIOS firmware according to the original private key and the new public key, and use an in-band update tool to upgrade the original BIOS firmware to the intermediate version of BIOS firmware.

[0126] The second compiling module 12 is used to compile new BIOS firmware according to the new private key and the new public key.

[0127] The upgrade module 13 is used to upgrade the intermediate version of the BIOS firmware to the new BIOS firmware using an in-band update tool, so as to update the secure flash key of the BIOS firmware from the original secure flash key to the new secure flash key.

[0128] In some embodiments, the generating module 10 includes:

[0129] A first determination submodule, used to determine an encryption algorithm of an original secure flash memory key;

[0130] A first selection submodule, used to select a target encryption algorithm according to the encryption algorithm of the original secure flash key; wherein the computational complexity of the target encryption algorithm is higher than the computational complexity of the encryption algorithm of the original secure flash key;

[0131] The first generation submodule is used to generate a new secure flash memory key according to a target encryption algorithm.

[0132] In some embodiments, the first compiling module 11 includes:

[0133] A first saving submodule, used for saving the new public key to a first firmware file system of a binary file of an intermediate version of a basic input and output system firmware;

[0134] A second generation submodule is used to generate an intermediate version signature of a binary file of an intermediate version of basic input and output system firmware according to an original private key;

[0135] The second saving submodule is used to save the intermediate version signature to the second firmware file system of the binary file of the intermediate version of the basic input and output system firmware.

[0136] In some embodiments, the second compiling module 12 includes:

[0137] A third saving submodule, used for saving the new public key to the first firmware file system of the binary file of the new basic input and output system firmware;

[0138] A third generation submodule, used to generate a new signature of a binary file of a new basic input and output system firmware according to a new private key;

[0139] The fourth saving submodule is used to save the new signature into the second firmware file system of the binary file of the new basic input and output system firmware.

[0140] In some embodiments, it also includes:

[0141] A build file acquisition module, used to acquire a build file of a secure flash memory key;

[0142] A first uploading module, used to upload the build file to the signature server;

[0143] The second uploading module is used to upload the original public key, the original private key, the new public key and the new private key to the signature server;

[0144] Correspondingly, the first compiling module 11 is specifically used to save the new public key to the first firmware file system of the binary file of the intermediate version of the basic input and output system firmware; upload the binary file of the intermediate version of the basic input and output system firmware to the signature server; sign the intermediate version of the basic input and output system firmware using the original private key through the signature server to obtain the intermediate version signature; save the intermediate version signature to the second firmware file system of the binary file of the intermediate version of the basic input and output system firmware;

[0145] Correspondingly, the second compilation module 12 is specifically used to save the new public key to the first firmware file system of the binary file of the new basic input and output system firmware; upload the binary file of the new basic input and output system firmware to the signature server; sign the new basic input and output system firmware using the new private key through the signature server to obtain a new signature; and save the new signature to the second firmware file system of the binary file of the new basic input and output system firmware.

[0146] In some embodiments, it also includes:

[0147] A first judgment submodule is used to judge whether the original secure flash memory key of the original basic input and output system firmware is leaked; if it is confirmed that the original secure flash memory key is leaked, the second judgment submodule is triggered;

[0148] The second judgment submodule is used to set the number of key leakages plus 1, and judge whether the number of key leakages is greater than a threshold; if it is confirmed that the number of key leakages is not greater than the threshold, the generation module 10 is triggered; if it is confirmed that the number of key leakages is greater than the threshold, the update process of the original secure flash memory key is terminated and an alarm message is output.

[0149] In some embodiments, it also includes:

[0150] A preset period setting module, used to set a preset period for updating the basic input and output system firmware;

[0151] The forced update module is used for forcibly updating the original secure flash memory key of the original basic input and output system firmware according to a preset period.

[0152] Since the embodiments of the apparatus part correspond to the embodiments of the method part, please refer to the description of the embodiments of the method part for the embodiments of the apparatus part, which will not be repeated here.

[0153] In addition, the present invention also provides a computer program product, including a computer program / instruction, which implements the steps of the above-mentioned key updating method when executed by a processor.

[0154] Figure 3 A schematic diagram of a key update device provided by an embodiment of the present invention. Figure 3 As shown, the key update device includes:

[0155] A memory 20, used for storing computer programs;

[0156] The processor 21 is configured to implement the steps of the key updating method mentioned in the above embodiment when executing a computer program.

[0157] The key update device provided in this embodiment may include but is not limited to a smart phone, a tablet computer, a laptop computer, or a desktop computer.

[0158] Among them, the processor 21 may include one or more processing cores, such as a 4-core processor, an 8-core processor, etc. The processor 21 can be implemented in at least one hardware form of a digital signal processor (DSP), a field programmable gate array (FPGA), and a programmable logic array (PLA). The processor 21 may also include a main processor and a coprocessor. The main processor is a processor for processing data in an awake state, also known as a central processing unit (CPU); the coprocessor is a low-power processor for processing data in a standby state. In some embodiments, the processor 21 may be integrated with a graphics processing unit (GPU), and the GPU is responsible for rendering and drawing the content to be displayed on the display screen. In some embodiments, the processor 21 may also include an artificial intelligence (AI) processor, which is used to process computing operations related to machine learning.

[0159] The memory 20 may include one or more computer-readable storage media, which may be non-transitory. The memory 20 may also include a high-speed random access memory, and a non-volatile memory, such as one or more disk storage devices, flash memory storage devices. In this embodiment, the memory 20 is at least used to store the following computer program 201, wherein, after the computer program is loaded and executed by the processor 21, it can implement the relevant steps of the key update method disclosed in any of the aforementioned embodiments. In addition, the resources stored in the memory 20 may also include an operating system 202 and data 203, etc., and the storage method may be temporary storage or permanent storage. Among them, the operating system 202 may include Windows, Unix, Linux, etc. Data 203 may include but is not limited to data related to the key update method.

[0160] In some embodiments, the key update device may further include a display screen 22 , an input / output interface 23 , a communication interface 24 , a power supply 25 , and a communication bus 26 .

[0161] Those skilled in the art will understand that Figure 3 The structure shown in the figure does not constitute a limitation on the key update device, and may include more or less components than those shown in the figure.

[0162] Finally, the present invention also provides an embodiment corresponding to a computer-readable storage medium. The computer-readable storage medium stores a computer program, and when the computer program is executed by a processor, the steps recorded in the above method embodiment are implemented.

[0163] It is understandable that if the method in the above embodiment is implemented in the form of a software functional unit and sold or used as an independent product, it can be stored in a computer-readable storage medium. Based on this understanding, the technical solution of the present invention, or the part that contributes to the prior art, or all or part of the technical solution can be embodied in the form of a software product, and the computer software product is stored in a storage medium to execute all or part of the steps of the method described in each embodiment of the present invention. The aforementioned storage medium includes: U disk, mobile hard disk, read-only memory (ROM), random access memory (RAM), disk or optical disk, etc. Various media that can store program codes.

[0164] The above is a detailed introduction to a key update method, device, equipment and medium provided by the present invention. The various embodiments in the specification are described in a progressive manner, and each embodiment focuses on the differences from other embodiments. The same and similar parts between the embodiments can be referred to each other. For the device disclosed in the embodiment, since it corresponds to the method disclosed in the embodiment, the description is relatively simple, and the relevant parts can be referred to the method part description. It should be pointed out that for ordinary technicians in this technical field, without departing from the principle of the present invention, several improvements and modifications can be made to the present invention, and these improvements and modifications also fall within the scope of protection of the present invention.

[0165] It should also be noted that, in this specification, relational terms such as first and second, etc. are only used to distinguish one entity or operation from another entity or operation, and do not necessarily require or imply any such actual relationship or order between these entities or operations. Moreover, the terms "comprise", "include" or any other variants thereof are intended to cover non-exclusive inclusion, so that a process, method, article or device including a series of elements includes not only those elements, but also other elements not explicitly listed, or also includes elements inherent to such process, method, article or device. In the absence of further restrictions, an element defined by the statement "comprises a ..." does not exclude the presence of other identical elements in the process, method, article or device including the element.

Claims

1. A key updating method, characterized in that: include: When there is a need to update the original secure flash key of the original basic input / output system firmware, a new secure flash key is generated; wherein the original secure flash key includes an original public key and an original private key; and the new secure flash key includes a new public key and a new private key; Compile an intermediate version of BIOS firmware according to the original private key and the new public key, and use an in-band update tool to upgrade the original BIOS firmware to the intermediate version of BIOS firmware; Compile new BIOS firmware according to the new private key and the new public key; The intermediate version of the BIOS firmware is upgraded to the new BIOS firmware using an in-band update tool, so as to update the secure flash key of the BIOS firmware from the original secure flash key to the new secure flash key.

2. The key updating method according to claim 1, characterized in that: Generate a new secure flash key, including: determining an encryption algorithm for the original secure flash key; Selecting a target encryption algorithm according to the encryption algorithm of the original secure flash key; wherein the computational complexity of the target encryption algorithm is higher than the computational complexity of the encryption algorithm of the original secure flash key; The new secure flash key is generated according to the target encryption algorithm.

3. The key updating method according to claim 1, characterized in that: Compiling an intermediate version of basic input / output system firmware according to the original private key and the new public key includes: Saving the new public key to the first firmware file system of the binary file of the intermediate version of the basic input and output system firmware; Generate an intermediate version signature of a binary file of the intermediate version of the basic input and output system firmware according to the original private key; The intermediate version signature is saved in a second firmware file system of a binary file of the intermediate version of the basic input / output system firmware.

4. The key updating method according to claim 1, characterized in that: Compiling a new basic input / output system firmware according to the new private key and the new public key includes: Saving the new public key to the first firmware file system of the binary file of the new basic input and output system firmware; Generate a new signature of the binary file of the new basic input and output system firmware according to the new private key; The new signature is saved in the second firmware file system of the binary file of the new basic input / output system firmware.

5. The key updating method according to claim 1, characterized in that: Also includes: Get the build file for the secure flash key; Uploading the constructed file to a signature server; Uploading the original public key, the original private key, the new public key and the new private key to the signature server; Correspondingly, compiling an intermediate version of basic input / output system firmware according to the original private key and the new public key includes: Saving the new public key to the first firmware file system of the binary file of the intermediate version of the basic input and output system firmware; Uploading the binary file of the intermediate version of the basic input and output system firmware to the signature server; Signing the intermediate version of the basic input and output system firmware using the original private key through the signature server to obtain an intermediate version signature; Saving the intermediate version signature to a second firmware file system of a binary file of a basic input / output system firmware of the intermediate version; Correspondingly, compiling a new basic input / output system firmware according to the new private key and the new public key includes: Saving the new public key to the first firmware file system of the binary file of the new basic input and output system firmware; Uploading the binary file of the new basic input and output system firmware to the signature server; Signing the new basic input and output system firmware using the new private key through the signature server to obtain a new signature; The new signature is saved in the second firmware file system of the binary file of the new basic input / output system firmware.

6. The key updating method according to any one of claims 1 to 5, characterized in that: When there is a need to update the original secure flash key of the original BIOS firmware, it also includes: determining whether the original secure flash memory key of the original BIOS firmware is leaked; If it is confirmed that the original secure flash memory key is leaked, the number of key leaks is set to be plus 1, and it is determined whether the number of key leaks is greater than a threshold; If it is confirmed that the number of key leaks is not greater than the threshold, proceeding to the step of generating a new secure flash memory key; If it is confirmed that the number of key leakages is greater than the threshold, the updating process of the original secure flash key is terminated and an alarm message is output.

7. The key updating method according to claim 1, characterized in that: Also includes: Set a preset period for updating BIOS firmware; The original secure flash memory key of the original BIOS firmware is forcibly updated according to the preset period.

8. A key updating device, characterized in that: include: A generating module, configured to generate a new secure flash key when there is a need to update the original secure flash key of the original basic input / output system firmware; wherein the original secure flash key includes an original public key and an original private key; and the new secure flash key includes a new public key and a new private key; A first compiling module, configured to compile an intermediate version of a basic input / output system firmware according to the original private key and the new public key, and upgrade the original basic input / output system firmware to the intermediate version of the basic input / output system firmware using an in-band update tool; A second compiling module, used for compiling a new basic input and output system firmware according to the new private key and the new public key; The upgrade module is used to upgrade the intermediate version of the basic input and output system firmware to the new basic input and output system firmware using an in-band update tool, so as to update the secure flash key of the basic input and output system firmware from the original secure flash key to the new secure flash key.

9. A key updating device, characterized in that: include: Memory for storing computer programs; A processor, configured to implement the steps of the key updating method according to any one of claims 1 to 7 when executing the computer program.

10. A computer-readable storage medium, characterized in that: The computer-readable storage medium stores a computer program, and when the computer program is executed by a processor, the steps of the key updating method according to any one of claims 1 to 7 are implemented.

Images