A key update method, device, apparatus, and medium

Abstract

The application discloses a key updating method and device, equipment and medium, and relates to the technical field of computers. When updating an original secure flash key, a new secure flash key is generated, and an intermediate version of basic input and output system firmware is compiled by using the original private key and the new public key, and firmware updating is performed; since the signature of the original key exists in the intermediate version of the basic input and output system firmware, and corresponds to the original public key in the original basic input and output system firmware, the secure flash check can be passed; finally, a new basic input and output system firmware is compiled by using the new secure flash key, and firmware updating is performed; since the new basic input and output system firmware has the signature of the new key, and corresponds to the new public key in the intermediate version of the basic input and output system firmware, the secure flash check can be passed, and the in-band non-inductive updating of the secure flash key is finally realized, the operation is simple, and the after-sales cost is greatly reduced.

Description

Technical Field

[0001] This invention relates to the field of computer technology, and in particular to a key update method, apparatus, device, and medium. Background Technology

[0002] The Basic Input / Output System (BIOS) is a critical component in the computer boot process, responsible for initializing hardware, loading the operating system, providing low-level services, and managing configuration settings. The BIOS is also vulnerable to malware attacks, such as firmware tampering. Secure Flash technology employs asymmetric encryption algorithms to enhance BIOS firmware protection. It uses a private / public key pair to decrypt and encrypt the BIOS binary, verifying its legitimacy to prevent unauthorized firmware modification. The private key, protected by the manufacturer, is used to encrypt and generate the signature for the BIOS firmware, while the public key is used to verify the signature in the BIOS binary to be updated, ensuring its legitimacy.

[0003] However, to ensure the absolute security and trustworthiness of BIOS firmware, manufacturers must strictly control the keys to prevent leakage and update them in a timely manner. Server platforms can update keys through out-of-band BIOS updates, while laptop and desktop platforms, due to interface limitations, require in-band tools to update BIOS firmware. However, this requires Secure Flash verification to pass, and users cannot update the keys themselves. Manufacturers must recall motherboards and use a programmer to force-flash the flash memory chip to update the keys, which is extremely inconvenient.

[0004] Given the above issues, how to solve the problem of not being able to update the Secure Flash key of BIOS firmware via in-band is an urgent issue for technicians in this field. Summary of the Invention

[0005] The purpose of this invention is to provide a key update method, apparatus, device, and medium to solve the problem that the Secure Flash key of BIOS firmware cannot be updated in-band.

[0006] To solve the above-mentioned technical problems, the present invention provides a key update method, comprising:

[0007] When there is a need to update the original secure flash key of the original basic input / output system firmware, a new secure flash key is generated; wherein, the original secure flash key includes the original public key and the original private key; the new secure flash key includes the new public key and the new private key;

[0008] Compile an intermediate version of the Basic Input / Output System firmware based on the original private key and the new public key, and use an in-band update tool to upgrade the original Basic Input / Output System firmware to the intermediate version of the Basic Input / Output System firmware.

[0009] Compile a new Basic Input / Output System firmware based on the new private key and the new public key;

[0010] The intermediate version of the Basic Input / Output System (BIOS) firmware is upgraded to the new BIOS firmware using an in-band update tool, thereby updating the BIOS firmware's security flash key from the original security flash key to the new security flash key.

[0011] On the one hand, a new secure flash key is generated, including:

[0012] Determine the encryption algorithm for the original secure flash key;

[0013] A target encryption algorithm is selected based on the encryption algorithm of the original secure flash key; wherein the computational complexity of the target encryption algorithm is higher than that of the encryption algorithm of the original secure flash key.

[0014] The new secure flash key is generated according to the target encryption algorithm.

[0015] On the other hand, compiling an intermediate version of the basic input / output system firmware based on the original private key and the new public key includes:

[0016] The new public key is saved to the first firmware file system of the binary file of the intermediate version of the basic input / output system firmware;

[0017] An intermediate version signature of the binary file of the intermediate version of the basic input / output system firmware is generated based on the original private key;

[0018] The intermediate version signature is saved to the second firmware file system of the binary file of the intermediate version's basic input / output system firmware.

[0019] On the other hand, compiling new basic input / output system firmware based on the new private key and the new public key includes:

[0020] The new public key is saved to the first firmware file system of the binary file of the new basic input / output system firmware;

[0021] A new signature is generated for the binary file of the new basic input / output system firmware based on the new private key;

[0022] The new signature is saved to the second firmware file system of the binary file of the new basic input / output system firmware.

[0023] On the other hand, it also includes:

[0024] Obtain the build file for the secure flash key;

[0025] Upload the build file to the signature server;

[0026] Upload the original public key, the original private key, the new public key, and the new private key to the signature server;

[0027] Correspondingly, compiling an intermediate version of the basic input / output system firmware based on the original private key and the new public key includes:

[0028] The new public key is saved to the first firmware file system of the binary file of the intermediate version of the basic input / output system firmware;

[0029] Upload the binary file of the intermediate version of the basic input / output system firmware to the signing server;

[0030] The intermediate version of the basic input / output system firmware is signed by the signature server using the original private key to obtain the intermediate version signature;

[0031] The intermediate version signature is saved to the second firmware file system of the binary file of the basic input / output system firmware of the intermediate version;

[0032] Correspondingly, compiling new basic input / output system firmware based on the new private key and the new public key includes:

[0033] The new public key is saved to the first firmware file system of the binary file of the new basic input / output system firmware;

[0034] Upload the binary file of the new basic input / output system firmware to the signing server;

[0035] The new basic input / output system firmware is signed by the signature server using the new private key to obtain a new signature;

[0036] The new signature is saved to the second firmware file system of the binary file of the new basic input / output system firmware.

[0037] On the other hand, when there is a need to update the original security flash key of the original basic input / output system firmware, it also includes:

[0038] Determine whether the original security flash key of the original basic input / output system firmware has been leaked;

[0039] If the original secure flash key is confirmed to have been leaked, the key leak count is incremented by 1, and it is determined whether the key leak count is greater than a threshold.

[0040] If it is confirmed that the number of times the key has been leaked is not greater than the threshold, then proceed to the step of generating a new secure flash key;

[0041] If the number of times the key has been leaked is confirmed to be greater than the threshold, the update process of the original secure flash key is terminated and an alarm message is output.

[0042] On the other hand, it also includes:

[0043] Set the preset cycle for updating the basic input / output system firmware;

[0044] The original security flash key of the original basic input / output system firmware is forcibly updated according to the preset period.

[0045] To address the aforementioned technical problems, the present invention also provides a key update device, comprising:

[0046] A generation module is used to generate a new secure flash key when there is a need to update the original secure flash key of the original basic input / output system firmware; wherein the original secure flash key includes an original public key and an original private key; and the new secure flash key includes a new public key and a new private key;

[0047] The first compilation module is used to compile an intermediate version of the Basic Input / Output System firmware based on the original private key and the new public key, and to use an in-band update tool to upgrade the original Basic Input / Output System firmware to the intermediate version of the Basic Input / Output System firmware.

[0048] The second compilation module is used to compile new basic input / output system firmware based on the new private key and the new public key;

[0049] An upgrade module is used to upgrade the intermediate version of the Basic Input / Output System (BIOS) firmware to the new BIOS firmware using an in-band update tool, thereby updating the BIOS firmware's security flash key from the original security flash key to the new security flash key.

[0050] To address the aforementioned technical problems, the present invention also provides a key update device, comprising:

[0051] Memory, used to store computer programs;

[0052] A processor is configured to implement the steps of the key update method described above when executing the computer program.

[0053] To address the aforementioned technical problems, the present invention also provides a computer-readable storage medium storing a computer program, which, when executed by a processor, implements the steps of the aforementioned key update method.

[0054] The key update method provided by this invention generates a new secure flash key when there is a need to update the original secure flash key of the original basic input / output system firmware. The original secure flash key includes an original public key and an original private key; the new secure flash key includes a new public key and a new private key. An intermediate version of the basic input / output system firmware is compiled based on the original private key and the new public key, and an in-band update tool is used to upgrade the original basic input / output system firmware to the intermediate version. A new basic input / output system firmware is compiled based on the new private key and the new public key; the in-band update tool is used to upgrade the intermediate version of the basic input / output system firmware to the new basic input / output system firmware, thereby updating the secure flash key of the basic input / output system firmware from the original secure flash key to the new secure flash key.

[0055] The beneficial effects of this invention are as follows: When the original secure flash key of the original basic input / output system firmware is leaked and there is a need to update the original secure flash key, a new secure flash key is generated, and an intermediate version of the basic input / output system firmware for transition is compiled using the original private key and the new public key, and then the firmware is updated; since the intermediate version of the basic input / output system firmware contains the signature of the original key, which corresponds to the original public key in the original basic input / output system firmware, it can pass the secure flash verification during the update; finally, a new basic input / output system firmware is compiled using the new secure flash key, and then the firmware is updated; since the new basic input / output system firmware contains the signature of the new key, which corresponds to the new public key in the intermediate version of the basic input / output system firmware, it can pass the secure flash verification during the update, and ultimately achieves seamless in-band update of the secure flash key, which is simple to operate and greatly reduces after-sales costs.

[0056] On the other hand, this invention specifically improves the security of the new BIOS firmware by determining the encryption algorithm of the original secure flash key; selecting a target encryption algorithm with higher computational complexity based on the encryption algorithm of the original secure flash key, and generating a new secure flash key based on the target encryption algorithm. The security flash key construction file is obtained and uploaded to a signing server. Then, the original public key, original private key, new public key, and new private key are uploaded to the signing server, which centrally manages the secure flash key. Subsequently, each time the manufacturer releases a new version of the Basic Input / Output System (BIOS), only the unsigned BIOS binary file needs to be uploaded to the server, and then a batch signing command is executed. This allows signing to be completed without accessing the key, ensuring key security.

[0057] In addition, the present invention also provides a key update device, equipment and medium, which have the same effect as above. Attached Figure Description

[0058] To more clearly illustrate the embodiments of the present invention, the accompanying drawings used in the embodiments will be briefly introduced below. Obviously, the drawings described below are only some embodiments of the present invention. For those skilled in the art, other drawings can be obtained based on these drawings without creative effort.

[0059] Figure 1 A flowchart of a key update method provided in an embodiment of the present invention;

[0060] Figure 2 A schematic diagram of a key update device provided in an embodiment of the present invention;

[0061] Figure 3 This is a schematic diagram of a key update device provided in an embodiment of the present invention. Detailed Implementation

[0062] The technical solutions of the embodiments of the present invention will be clearly and completely described below with reference to the accompanying drawings. Obviously, the described embodiments are only some embodiments of the present invention, and not all embodiments. Based on the embodiments of the present invention, all other embodiments obtained by those of ordinary skill in the art without creative effort are within the protection scope of the present invention.

[0063] The core of this invention is to provide a key update method, apparatus, device, and medium to solve the current problem that the Secure Flash key of BIOS firmware cannot be updated in-band.

[0064] To enable those skilled in the art to better understand the present invention, the present invention will be further described in detail below with reference to the accompanying drawings and specific embodiments.

[0065] Currently, Secure Flash technology uses asymmetric encryption algorithms and private / public key pairs to enhance BIOS firmware protection, preventing malicious attacks and unauthorized firmware modifications. To ensure the security and trustworthiness of the BIOS firmware, manufacturers must strictly control the keys to prevent leakage and update them promptly. The workflow of Secure Flash technology is as follows:

[0066] The private key is owned and protected by the manufacturer and is not included in the BIOS binary. It is used to encrypt the BIOS firmware, generate a signature, and is stored in a Firmware File System (FFS) within the BIOS binary. The public key is also stored in another FFS within the BIOS binary. During a BIOS self-update, the public key of the BIOS binary on the motherboard is used to verify the signature in the BIOS binary to be updated. If the verification passes, the BIOS binary is considered legitimate; if it fails, the BIOS binary is considered illegitimate and may have been tampered with. In this way, Secure Flash technology ensures the integrity and legitimacy of the BIOS firmware, improving system security.

[0067] For server platform products, users can update the BIOS and update the key through out-of-band BMC updates. Out-of-band BIOS updates are a forced flash memory chip refresh operation that does not require Secure Flash verification. However, for laptop and desktop platform products, which lack a BMC management interface, BIOS firmware updates can only be performed using in-band tools. In-band tool updates require Secure Flash to verify the BIOS binary file to be updated before the update can proceed. Users cannot update the key promptly by upgrading the BIOS firmware, and manufacturers must recall motherboards to force flash memory chip refresh via a programmer, which is highly inconvenient. Therefore, to solve these problems, this invention provides a key update method.

[0068] Figure 1 This is a flowchart illustrating a key update method provided in an embodiment of the present invention. Figure 1 As shown, the method includes:

[0069] S10: When there is a need to update the original security flash key of the original basic input / output system firmware, generate a new security flash key.

[0070] The original secure flash key includes the original public key and the original private key; the new secure flash key includes the new public key and the new private key.

[0071] In practice, when there is a need to update the original Secure Flash key of the original BIOS firmware, a tool is used to generate a new Secure Flash key. It should be noted that the original Secure Flash key includes the original public key and the original private key; the new Secure Flash key includes a new public key and a new private key. This embodiment does not limit the encryption algorithm used for the new Secure Flash key; it depends on the specific implementation.

[0072] It should be noted that this embodiment does not restrict the method of generating the new Secure Flash key. For example, a command-line tool can be used to generate the new Secure Flash key, or an encryption library can be used to generate the new Secure Flash key, depending on the specific implementation.

[0073] S11: Compile an intermediate version of the Basic Input / Output System firmware based on the original private key and the new public key, and use the in-band update tool to upgrade the original Basic Input / Output System firmware to the intermediate version of the Basic Input / Output System firmware.

[0074] Furthermore, an intermediate version of the BIOS firmware is compiled based on the original private key and the new public key. Then, an in-band update tool is used to upgrade the original BIOS firmware to the intermediate version.

[0075] It is important to note that since the intermediate version of the BIOS firmware is signed with the original private key, which is a Secure Flash key pair with the original public key in the original BIOS firmware, the Secure Flash key verification will pass when using an in-band update tool to upgrade the original BIOS firmware to the intermediate version of the BIOS firmware.

[0076] Furthermore, this embodiment does not limit the specific type of in-band update tool; it depends on the specific implementation.

[0077] S12: Compile new basic input / output system firmware based on the new private key and the new public key.

[0078] S13: Use the in-band update tool to upgrade the intermediate version of the Basic Input / Output System firmware to the new Basic Input / Output System firmware, thereby updating the security flash key of the Basic Input / Output System firmware from the original security flash key to the new security flash key.

[0079] Furthermore, a new BIOS firmware is compiled based on the new private key and the new public key. Finally, an in-band update tool is used to upgrade the intermediate version of the BIOS firmware to the new BIOS firmware.

[0080] It should be noted that since the new BIOS firmware is signed with a new private key, and this private key forms a Secure Flash key pair with the new public key in the intermediate BIOS firmware, the Secure Flash key verification will pass when using an in-band update tool to upgrade the intermediate BIOS firmware to the new BIOS firmware. Ultimately, this updates the BIOS firmware's Secure Flash key from the original Secure Flash key to the new Secure Flash key.

[0081] In this embodiment, there are no restrictions on the compilation process of intermediate BIOS firmware and the compilation process of new BIOS firmware; it depends on the specific implementation.

[0082] In this embodiment, when the original secure flash key of the original Basic Input / Output System (BIOS) firmware is leaked and there is a need to update the original secure flash key, a new secure flash key is generated. An intermediate version of the BIOS firmware for transition is compiled using the original private key and the new public key, and then the firmware is updated. Since the intermediate version of the BIOS firmware contains the signature of the original key, which corresponds to the original public key in the original BIOS firmware, it can pass the secure flash verification during the update. Finally, a new BIOS firmware is compiled using the new secure flash key, and then the firmware is updated. Since the new BIOS firmware contains the signature of the new key, which corresponds to the new public key in the intermediate version of the BIOS firmware, it can pass the secure flash verification during the update. This ultimately achieves seamless in-band update of the secure flash key, simplifying the operation and significantly reducing after-sales costs.

[0083] To improve the security of the new Secure Flash key, based on the above embodiments, in some embodiments, a new secure flash key is generated, including:

[0084] S101: Determine the encryption algorithm for the original secure flash key;

[0085] S102: Select the target encryption algorithm based on the encryption algorithm of the original secure flash key;

[0086] Among them, the computational complexity of the target encryption algorithm is higher than that of the encryption algorithm for the original secure flash key;

[0087] S103: Generate a new secure flash key based on the target encryption algorithm.

[0088] In practice, to improve the security of the Secure Flash key in the new BIOS firmware, a more complex encryption algorithm can be used when generating the new Secure Flash key compared to the encryption algorithm of the original Secure Flash key.

[0089] Specifically, the first step is to determine the encryption algorithm of the original Secure Flash key, and then select a target encryption algorithm based on it. It's important to note that the computational complexity of the target encryption algorithm is higher than that of the original Secure Flash key encryption algorithm; therefore, the theoretical security and resistance to attacks of the target encryption algorithm are higher. For example, if the original Secure Flash key encryption algorithm is Advanced Encryption Standard with a 128-bit key (AES-128), then Advanced Encryption Standard with a 256-bit key (AES-256) can be selected as the target encryption algorithm. This embodiment does not impose restrictions on the specific target encryption algorithm selected, as long as its computational complexity is higher than that of the original Secure Flash key encryption algorithm. Finally, a new Secure Flash key is generated based on the target encryption algorithm, improving the security of the new BIOS firmware.

[0090] In this embodiment, the encryption algorithm of the original secure flash key is determined; a target encryption algorithm with higher computational complexity is selected based on the encryption algorithm of the original secure flash key, and a new secure flash key is generated based on the target encryption algorithm, thereby improving the security of the new BIOS firmware.

[0091] Based on the above embodiments, in some embodiments, an intermediate version of the basic input / output system firmware is compiled according to the original private key and the new public key, including:

[0092] S111: Save the new public key to the first firmware file system of the binary file of the intermediate version of the basic input / output system firmware;

[0093] S112: Generate an intermediate version signature for the binary file of the basic input / output system firmware based on the original private key;

[0094] S113: Save the intermediate version signature to the second firmware file system of the binary file of the intermediate version's basic input / output system firmware.

[0095] To compile an intermediate version of the BIOS firmware, the specific implementation involves saving the new public key to the first firmware file system of the intermediate version BIOS firmware binary file. Then, an intermediate version signature is generated based on the original private key. Finally, the intermediate version signature is saved to the second firmware file system of the intermediate version BIOS firmware binary file. This completes the compilation of the intermediate version BIOS firmware.

[0096] It should be noted that this embodiment does not restrict the type of compilation tool used to compile the intermediate version of the BIOS firmware; the choice depends on the specific implementation.

[0097] Based on the above embodiments, in some embodiments, new basic input / output system firmware is compiled according to a new private key and a new public key, including:

[0098] S121: Save the new public key to the first firmware file system of the binary file of the new basic input / output system firmware;

[0099] S122: Generate a new signature for the binary file of the new basic input / output system firmware based on the new private key;

[0100] S123: Save the new signature to the second firmware file system of the binary file of the new basic input / output system firmware.

[0101] To compile the new BIOS firmware, the specific implementation involves saving the new public key to the first firmware file system of the new BIOS firmware binary file. Then, a new signature is generated for the new BIOS firmware binary file based on the new private key. Finally, the new signature is saved to the second firmware file system of the new BIOS firmware binary file. This completes the compilation of the new BIOS firmware.

[0102] It should be noted that this embodiment does not restrict the type of compilation tool used to compile the new BIOS firmware; the choice depends on the specific implementation.

[0103] To further enhance the security of Secure Flash keys, in addition to the above embodiments, some embodiments further include:

[0104] S14: Obtain the build file for the secure flash key;

[0105] S15: Upload the build file to the signing server;

[0106] S16: Upload the original public key, original private key, new public key, and new private key to the signature server.

[0107] To enhance the security of Secure Flash keys, a Makefile (mak) for the Secure Flash key can be obtained. Specifically, the makefile related to Secure Flash key signing is extracted from the code and uploaded to a signing server. Then, the original public key, original private key, new public key, and new private key are uploaded to the signing server, which centrally manages the Secure Flash keys. Subsequently, each time the manufacturer releases a new BIOS version, only the unsigned BIOS binary file needs to be uploaded to the server, and then a batch signing command is executed. This allows signing to be completed without accessing the key, ensuring key security.

[0108] Therefore, based on the above, when compiling the intermediate version of the BIOS firmware using the original private key and the new public key, the new public key is specifically saved to the first firmware file system of the intermediate version of the BIOS firmware binary file. The intermediate version of the BIOS firmware binary file is then uploaded to the signing server. The signing server uses the original private key to sign the intermediate version of the BIOS firmware to obtain the intermediate version signature. The intermediate version signature is then saved to the second firmware file system of the intermediate version of the BIOS firmware binary file. This achieves the compilation of the intermediate version of the BIOS firmware without accessing the Secure Flash key during the compilation process, ensuring key security.

[0109] Similarly, when compiling the new BIOS firmware based on the new private key and the new public key, the new public key is specifically saved to the first firmware file system of the new BIOS firmware binary file, and then the new BIOS firmware binary file is uploaded to the signing server. The signing server then uses the new private key to sign the new BIOS firmware to obtain a new signature; the new signature is then saved to the second firmware file system of the new BIOS firmware binary file. This achieves the compilation of the new BIOS firmware without touching the Secure Flash key during the compilation process, ensuring the security of the key.

[0110] Based on the above embodiments, in some embodiments, when there is a need to update the original security flash key of the original basic input / output system firmware, the following method is also included:

[0111] S17: Determine whether the original security flash key of the original basic input / output system firmware has been leaked; if yes, proceed to step S18; if no, proceed to step S10.

[0112] S18: Increment the key leakage count by 1 and determine whether the key leakage count is greater than the threshold; if not, proceed to step S10; if yes, end the update process of the original secure flash key and output an alarm message.

[0113] In practical implementation, when there is a need to update the original Secure Flash key of the original BIOS firmware, it can be first determined whether the original Secure Flash key of the original BIOS firmware has been leaked, thereby determining whether the key update is caused by key leakage. If it is confirmed that the original secure flash key has not been leaked, it is considered that the key update is not caused by key leakage, and the process directly proceeds to step S10 to generate a new secure flash key. If it is confirmed that the original secure flash key has been leaked, the key leakage count needs to be incremented by 1, and it needs to be determined whether the key leakage count is greater than a threshold. In this embodiment, the threshold size is not limited and depends on the specific implementation.

[0114] If the number of key leaks is confirmed to be less than the threshold, the current key leakage risk is considered low, and the Secure Flash key can be updated normally, proceeding to the step of generating a new secure flash key. If the number of key leaks is confirmed to be greater than the threshold, the current key leakage risk is considered high, and even if the Secure Flash key is updated again, there is still a high risk of leakage. Therefore, the update process for the original Secure Flash key is terminated, and an alarm message is output to prompt the user to promptly investigate the source of the Secure Flash key leak and ensure the security of the BIOS firmware.

[0115] Log analysis is a crucial method for investigating the source of BIOS firmware Secure Flash key leaks. By analyzing system logs and network traffic logs, abnormal activity or suspicious access patterns can be identified, thus pinpointing potential leak sources. Specifically, log data is collected from systems, network devices, and applications, including system event logs, network traffic logs, access logs, and security event logs. Log management tools are used to filter and aggregate the collected log data to reduce noise and focus on events related to key leaks. Patterns and trends in the log data are analyzed to look for abnormal activity or suspicious access patterns, such as unusual login attempts, large data downloads or uploads, and access from unknown IP addresses. Correlation analysis of log data from different sources is performed to discover potential leak paths or attack chains. For example, system event logs are correlated with network traffic logs to determine if there is insider misconduct or external attacks. Finally, a Security Information and Event Management (SIEM) system is used to detect and respond to potential security incidents. SIEM systems can analyze log data in real time and provide alerts and reporting capabilities to help security teams promptly identify and respond to threats.

[0116] In addition, vulnerability scanning is also a crucial method for ensuring system and device security. By using vulnerability scanning tools to perform a comprehensive system scan, potential vulnerabilities or weaknesses can be discovered, allowing for timely remediation and preventing key leaks. Specifically, select a vulnerability scanning tool suitable for the target system and device, and configure parameters such as scan scope, scan depth, and scan strategy based on the characteristics of the target system and device. Run the scanning tool to perform a comprehensive scan of the target system and device to discover potential vulnerabilities or weaknesses. Analyze the scan results to determine the severity and scope of impact of the discovered vulnerabilities. Based on the scan results, promptly remediate the discovered vulnerabilities or weaknesses. This may include installing security updates and patches, configuring security policies, or replacing affected components.

[0117] By combining log analysis and vulnerability scanning methods, the security of the Secure Flash key in BIOS firmware can be improved, the risk of malicious attacks can be reduced, and potential sources of leakage can be detected and fixed in a timely manner.

[0118] Furthermore, to further enhance the security of the BIOS firmware key, in some embodiments, based on the above embodiments, the method further includes:

[0119] S19: Set the preset cycle for updating the basic input / output system firmware;

[0120] S20: Force update the original security flash key of the original basic input / output system firmware according to a preset cycle.

[0121] Specifically, a preset cycle for updating the BIOS firmware is set, and the original Secure Flash key of the original BIOS firmware is forcibly updated according to the preset cycle, thereby reducing the risk of leakage of the Secure Flash key and effectively improving the security of the BIOS firmware.

[0122] In the above embodiments, the key update method has been described in detail. The present invention also provides embodiments of the key update device.

[0123] Figure 2 This is a schematic diagram of a key update device provided in an embodiment of the present invention. Figure 2 As shown, the device includes:

[0124] The generation module 10 is used to generate a new secure flash key when there is a need to update the original secure flash key of the original basic input / output system firmware; wherein the original secure flash key includes the original public key and the original private key; and the new secure flash key includes the new public key and the new private key.

[0125] The first compilation module 11 is used to compile an intermediate version of the Basic Input / Output System firmware based on the original private key and the new public key, and to upgrade the original Basic Input / Output System firmware to the intermediate version of the Basic Input / Output System firmware using an in-band update tool.

[0126] The second compilation module 12 is used to compile new basic input / output system firmware based on the new private key and the new public key.

[0127] Upgrade module 13 is used to upgrade an intermediate version of the Basic Input / Output System firmware to a new Basic Input / Output System firmware using an in-band update tool, thereby updating the security flash key of the Basic Input / Output System firmware from the original security flash key to a new security flash key.

[0128] In some embodiments, the generation module 10 includes:

[0129] The first determining submodule is used to determine the encryption algorithm for the original secure flash key;

[0130] The first selection submodule is used to select a target encryption algorithm based on the encryption algorithm of the original secure flash key; wherein the computational complexity of the target encryption algorithm is higher than that of the encryption algorithm of the original secure flash key.

[0131] The first generation submodule is used to generate a new secure flash key based on the target encryption algorithm.

[0132] In some embodiments, the first compilation module 11 includes:

[0133] The first storage submodule is used to save the new public key to the first firmware file system of the binary file of the intermediate version of the basic input / output system firmware;

[0134] The second generation submodule is used to generate an intermediate version signature for the binary file of the intermediate version of the basic input / output system firmware based on the original private key.

[0135] The second storage submodule is used to save the intermediate version signature to the second firmware file system of the binary file of the intermediate version's basic input / output system firmware.

[0136] In some embodiments, the second compilation module 12 includes:

[0137] The third storage submodule is used to save the new public key to the first firmware file system of the binary file of the new basic input / output system firmware;

[0138] The third generation submodule is used to generate a new signature for the binary file of the new basic input / output system firmware based on the new private key;

[0139] The fourth storage submodule is used to save the new signature to the second firmware file system of the binary file of the new basic input / output system firmware.

[0140] In some embodiments, it also includes:

[0141] The build file acquisition module is used to obtain the build file for the secure flash key;

[0142] The first upload module is used to upload the build file to the signature server;

[0143] The second upload module is used to upload the original public key, the original private key, the new public key, and the new private key to the signature server.

[0144] Correspondingly, the first compilation module 11 is specifically used to save the new public key to the first firmware file system of the binary file of the intermediate version of the basic input / output system firmware; upload the binary file of the intermediate version of the basic input / output system firmware to the signature server; sign the intermediate version of the basic input / output system firmware using the original private key through the signature server to obtain the intermediate version signature; and save the intermediate version signature to the second firmware file system of the binary file of the intermediate version of the basic input / output system firmware.

[0145] Correspondingly, the second compilation module 12 is specifically used to save the new public key to the first firmware file system of the binary file of the new basic input / output system firmware; upload the binary file of the new basic input / output system firmware to the signature server; use the new private key to sign the new basic input / output system firmware through the signature server to obtain a new signature; and save the new signature to the second firmware file system of the binary file of the new basic input / output system firmware.

[0146] In some embodiments, it also includes:

[0147] The first judgment submodule is used to determine whether the original security flash key of the original basic input / output system firmware has been leaked; if it is confirmed that the original security flash key has been leaked, the second judgment submodule is triggered.

[0148] The second judgment submodule is used to increment the key leakage count by 1 and determine whether the key leakage count is greater than the threshold. If it is confirmed that the key leakage count is not greater than the threshold, the generation module 10 is triggered. If it is confirmed that the key leakage count is greater than the threshold, the update process of the original secure flash key is terminated and an alarm message is output.

[0149] In some embodiments, it also includes:

[0150] The preset cycle setting module is used to set the preset cycle for updating the basic input / output system firmware;

[0151] The forced update module is used to forcibly update the original security flash key of the original basic input / output system firmware according to a preset period.

[0152] Since the embodiments of the apparatus and the embodiments of the method correspond to each other, please refer to the description of the embodiments of the method for the embodiments of the apparatus, which will not be repeated here.

[0153] In addition, the present invention also provides a computer program product, including a computer program / instruction that, when executed by a processor, implements the steps of the above-described key update method.

[0154] Figure 3 This is a schematic diagram of a key update device provided in an embodiment of the present invention. Figure 3 As shown, the key update device includes:

[0155] Memory 20 is used to store computer programs;

[0156] The processor 21 is configured to implement the steps of the key update method as described in the above embodiments when executing a computer program.

[0157] The key update device provided in this embodiment may include, but is not limited to, smartphones, tablets, laptops, or desktop computers.

[0158] The processor 21 may include one or more processing cores, such as a quad-core processor or an octa-core processor. The processor 21 may be implemented using at least one of the following hardware forms: Digital Signal Processor (DSP), Field-Programmable Gate Array (FPGA), or Programmable Logic Array (PLA). The processor 21 may also include a main processor and a coprocessor. The main processor, also known as the Central Processing Unit (CPU), is used to process data in the wake-up state; the coprocessor is a low-power processor used to process data in the standby state. In some embodiments, the processor 21 may integrate a Graphics Processing Unit (GPU), which is responsible for rendering and drawing the content to be displayed on the screen. In some embodiments, the processor 21 may also include an Artificial Intelligence (AI) processor, which handles computational operations related to machine learning.

[0159] The memory 20 may include one or more computer-readable storage media, which may be non-transitory. The memory 20 may also include high-speed random access memory and non-volatile memory, such as one or more disk storage devices or flash memory devices. In this embodiment, the memory 20 is used to store at least the following computer program 201, which, after being loaded and executed by the processor 21, is capable of implementing the relevant steps of the key update method disclosed in any of the foregoing embodiments. In addition, the resources stored in the memory 20 may also include an operating system 202 and data 203, and the storage method may be temporary or permanent storage. The operating system 202 may include Windows, Unix, Linux, etc. The data 203 may include, but is not limited to, the data involved in the key update method.

[0160] In some embodiments, the key update device may further include a display screen 22, an input / output interface 23, a communication interface 24, a power supply 25, and a communication bus 26.

[0161] Those skilled in the art will understand that Figure 3 The structure shown does not constitute a limitation on the key update device and may include more or fewer components than illustrated.

[0162] Finally, the present invention also provides an embodiment corresponding to a computer-readable storage medium. The computer-readable storage medium stores a computer program, which, when executed by a processor, performs the steps described in the above method embodiments.

[0163] It is understood that if the methods in the above embodiments are implemented as software functional units and sold or used as independent products, they can be stored in a computer-readable storage medium. Based on this understanding, the technical solution of the present invention, in essence, or the part that contributes to the prior art, or all or part of the technical solution, can be embodied in the form of a software product. This computer software product is stored in a storage medium and executes all or part of the steps of the methods described in the various embodiments of the present invention. The aforementioned storage medium includes various media capable of storing program code, such as USB flash drives, portable hard drives, read-only memory (ROM), random access memory (RAM), magnetic disks, or optical disks.

[0164] The foregoing has provided a detailed description of a key update method, apparatus, device, and medium provided by the present invention. The various embodiments in the specification are described in a progressive manner, with each embodiment focusing on its differences from other embodiments. Similar or identical parts between embodiments can be referred to interchangeably. For the apparatus disclosed in the embodiments, since it corresponds to the method disclosed in the embodiments, the description is relatively simple; relevant parts can be referred to in the method section. It should be noted that those skilled in the art can make several improvements and modifications to the present invention without departing from the principles of the invention, and these improvements and modifications also fall within the protection scope of the present invention.

[0165] It should also be noted that, in this specification, relational terms such as "first" and "second" are used only to distinguish one entity or operation from another, and do not necessarily require or imply any such actual relationship or order between these entities or operations. Furthermore, the terms "comprising," "including," or any other variations thereof are intended to cover non-exclusive inclusion, such that a process, method, article, or apparatus that comprises a list of elements includes not only those elements but also other elements not expressly listed, or elements inherent to such a process, method, article, or apparatus. Without further limitations, an element defined by the phrase "comprising one..." does not exclude the presence of other identical elements in the process, method, article, or apparatus that includes said element.

Claims

1. A key update method characterized by comprising: The method comprises: generating a new security flash key when there is a need to update the original security flash key of the original basic input output system firmware; wherein the original security flash key comprises an original public key and an original private key; and the new security flash key comprises a new public key and a new private key; compiling an intermediate version of the basic input output system firmware according to the original private key and the new public key, and upgrading the original basic input output system firmware to the intermediate version of the basic input output system firmware using an in-band update tool; compiling a new basic input output system firmware according to the new private key and the new public key; upgrading the intermediate version of the basic input output system firmware to the new basic input output system firmware using the in-band update tool, so as to update the security flash key of the basic input output system firmware from the original security flash key to the new security flash key; compiling an intermediate version of the basic input output system firmware according to the original private key and the new public key, comprising: saving the new public key into a first firmware file system of a binary file of the intermediate version of the basic input output system firmware; generating an intermediate version signature of the binary file of the intermediate version of the basic input output system firmware according to the original private key; saving the intermediate version signature into a second firmware file system of the binary file of the intermediate version of the basic input output system firmware; compiling a new basic input output system firmware according to the new private key and the new public key, comprising: saving the new public key into a first firmware file system of a binary file of the new basic input output system firmware; generating a new signature of the binary file of the new basic input output system firmware according to the new private key; saving the new signature into a second firmware file system of the binary file of the new basic input output system firmware.

2. The key update method according to claim 1, characterized by, The method of generating a new security flash key comprises: determining an encryption algorithm of the original security flash key; selecting a target encryption algorithm according to the encryption algorithm of the original security flash key; wherein the calculation complexity of the target encryption algorithm is higher than that of the encryption algorithm of the original security flash key; generating the new security flash key according to the target encryption algorithm.

3. The key update method according to claim 1, characterized by, The method further comprises: obtaining a construction file of the security flash key; uploading the construction file to a signature server; uploading the original public key, the original private key, the new public key and the new private key to the signature server; wherein the binary file of the intermediate version of the basic input output system firmware is uploaded to the signature server; signing the intermediate version of the basic input output system firmware by the signature server using the original private key to obtain an intermediate version signature; uploading the binary file of the new basic input output system firmware to the signature server; signing the new basic input output system firmware by the signature server using the new private key to obtain a new signature.

4. The key update method according to any one of claims 1 to 3, characterized by, When there is a need to update the original security flash key of the original basic input output system firmware, further comprising: determining whether the original security flash key of the original basic input output system firmware is leaked; if it is confirmed that the original security flash key is leaked, setting the number of key leakage times to 1, and determining whether the number of key leakage times is greater than a threshold value; if it is confirmed that the number of key leakage times is not greater than the threshold value, entering the step of generating a new security flash key; if it is confirmed that the number of key leakage times is greater than the threshold value, ending the updating process of the original security flash key and outputting an alarm information.

5. The key update method according to claim 1, wherein Further comprising: setting a preset period for updating the basic input output system firmware; according to the preset period, forcibly updating the original security flash key of the original basic input output system firmware.

6. A key update apparatus characterized by comprising: Comprise: a generating module, configured to generate a new security flash key when there is a need to update the original security flash key of the original basic input output system firmware; wherein the original security flash key comprises an original public key and an original private key; and the new security flash key comprises a new public key and a new private key; a first compiling module, configured to compile an intermediate version of the basic input output system firmware according to the original private key and the new public key, and use an in-band update tool to upgrade the original basic input output system firmware to the intermediate version of the basic input output system firmware; a second compiling module, configured to compile a new basic input output system firmware according to the new private key and the new public key; an upgrading module, configured to use the in-band update tool to upgrade the intermediate version of the basic input output system firmware to the new basic input output system firmware, so as to update the security flash key of the basic input output system firmware from the original security flash key to the new security flash key; the first compiling module comprises: a first saving submodule, configured to save the new public key into a first firmware file system of a binary file of the intermediate version of the basic input output system firmware; a second generating submodule, configured to generate an intermediate version signature of the binary file of the intermediate version of the basic input output system firmware according to the original private key; a second saving submodule, configured to save the intermediate version signature into a second firmware file system of the binary file of the intermediate version of the basic input output system firmware; the second compiling module comprises: a third saving submodule, configured to save the new public key into a first firmware file system of a binary file of the new basic input output system firmware; a third generating submodule, configured to generate a new signature of the binary file of the new basic input output system firmware according to the new private key; a fourth saving submodule, configured to save the new signature into a second firmware file system of the binary file of the new basic input output system firmware.

7. A key update device characterized by comprising: Comprise: a memory, configured to store a computer program; a processor, configured to implement the steps of the key updating method according to any one of claims 1 to 5 when executing the computer program.

8. A computer-readable storage medium, characterized in that, The computer readable storage medium stores a computer program, and the computer program, when executed by a processor, implements the steps of the key update method according to any one of claims 1 to 5.

Images