Firmware upgrading method and device, equipment, medium and program product

Abstract

The invention relates to a firmware upgrading method and device, equipment, a medium and a program product. The method comprises the following steps: firstly, acquiring a target BIOS file to be upgraded comprising an identifier of an encrypted target data segment, then, determining the target data segment from the target BIOS file to be upgraded according to the identifier of the target data segment, finally, carrying out security verification processing on the target data segment, and if the security verification of the target data segment is passed, updating the target data segment according to the target data segment. And if yes, performing firmware upgrading on the server based on the target to-be-upgraded BIOS file. By adopting the method, the encrypted target data segment in the target to-be-upgraded BIOS file can be subjected to security verification processing, and if the security verification is passed, the target to-be-upgraded BIOS file is used for performing firmware upgrading on the server, so that the condition that the server cannot be upgraded if the target to-be-upgraded BIOS file is tampered or damaged is avoided; and therefore, the BIOS firmware upgrading failure can be caused.

Description

Technical Field

[0001] The present application relates to the field of information security technology, and in particular to a firmware upgrade method, device, equipment, medium and program product. Background Art

[0002] BIOS (Basic Input Output System) is the first program software loaded when the server starts. During the life cycle of the server product, the server BIOS firmware needs to be upgraded in order to regularly fix vulnerabilities or expand functions.

[0003] Currently, operation and maintenance tool software can quickly upgrade the BIOS firmware of a large number of servers in batches through the BMC (Baseboard Management Controller). However, during the BIOS firmware upgrade process, if the BIOS firmware file is tampered with or damaged, the BIOS firmware upgrade will fail, and the server will be unable to start and run. Summary of the invention

[0004] Based on this, it is necessary to provide a firmware upgrade method, device, equipment, medium and program product that can perform security verification on firmware files in response to the above technical problems.

[0005] In a first aspect, the present application provides a firmware upgrade method, the method comprising:

[0006] Obtaining a target basic input and output system BIOS file to be upgraded; the target BIOS file to be upgraded includes an identifier of the encrypted target data segment;

[0007] Determine the target data segment from the target BIOS file to be upgraded according to the identifier of the target data segment;

[0008] A security verification process is performed on the target data segment. If the security verification of the target data segment passes, the server firmware is upgraded based on the target BIOS file to be upgraded.

[0009] In one embodiment, the target BIOS file to be upgraded includes multiple data segments to be upgraded, and the step of determining the target data segment from the target BIOS file to be upgraded according to the identifier of the target data segment includes:

[0010] The identifier of the target data segment is matched among the multiple data segments to be upgraded, and the target data segment is determined from the multiple data segments to be upgraded.

[0011] In this embodiment, by determining the target data segment from multiple data segments to be upgraded so as to perform security verification on the target BIOS to be upgraded based on the target data segment, the accuracy and success rate of the security verification are improved. At the same time, there is no need to perform security verification on the entire file, and the efficiency of the security verification is higher.

[0012] In one embodiment, the obtaining of the target BIOS file to be upgraded includes:

[0013] Obtain at least one candidate BIOS file to be upgraded; each candidate BIOS file to be upgraded includes a respective verification certificate;

[0014] Get the target verification certificate corresponding to the currently running BIOS;

[0015] The verification certificate of each candidate BIOS file to be upgraded is verified according to the target verification certificate, and a target BIOS file to be upgraded is determined from at least one candidate BIOS file to be upgraded.

[0016] In this embodiment, servers of different models are verified through different verification certificates. When servers are refreshed in large quantities, corresponding upgrade files can be automatically matched according to the server's verification without manual screening, thereby improving the efficiency of firmware upgrades.

[0017] In one embodiment, the target BIOS file to be upgraded includes first verification data corresponding to the target data segment, and the security verification process for the target data segment includes:

[0018] Calculate second verification data corresponding to the target data segment; and perform security verification processing on the target data segment according to the second verification data and the first verification data.

[0019] In this embodiment, by comparing the first verification data and the second verification data of the target data segment, it is determined whether the target data segment remains consistent during the transmission process, thereby obtaining a security verification result. The security verification calculation is convenient and efficient.

[0020] In a second aspect, the present application provides a firmware upgrade method, the method comprising:

[0021] Determine at least one candidate BIOS file to be upgraded;

[0022] At least one candidate BIOS file to be upgraded is sent to the server; wherein the candidate BIOS file to be upgraded is used to instruct the server to determine the target BIOS file to be upgraded from the at least one candidate BIOS file to be upgraded, and perform security verification processing on the corresponding target data segment according to the identifier of the encrypted target data segment included in the target BIOS file to be upgraded, and perform firmware upgrade after the target data segment security verification passes.

[0023] In this embodiment, the candidate BIOS files to be upgraded are sent to the server, and the server can determine the target BIOS file to be upgraded based on the verification certificate of the candidate BIOS file to be upgraded, and then perform the firmware upgrade after the target BIOS file to be upgraded passes the security verification, thereby improving the security of the firmware upgrade.

[0024] In one embodiment, the method further comprises:

[0025] Dividing the candidate BIOS file to be upgraded into a plurality of data segments to be upgraded;

[0026] Determine a target data segment from the data segments to be upgraded according to the security level of the server;

[0027] Determine the encrypted data corresponding to the target data segment, and add the encrypted data of the target data segment to the corresponding candidate BIOS file to be upgraded; the encrypted data includes the identifier of the target data segment and its verification data.

[0028] In this embodiment, the candidate BIOS files to be upgraded are divided into different data segments to be upgraded, and different target data segments can be determined according to the security levels of different servers, which can further improve the efficiency of security verification.

[0029] In a third aspect, the present application also provides a firmware upgrade device, including:

[0030] An acquisition module, used for acquiring a target basic input and output system BIOS file to be upgraded; the target BIOS file to be upgraded includes an identifier of an encrypted target data segment;

[0031] A data segment determination module, used to determine a target data segment from a target BIOS file to be upgraded according to an identifier of the target data segment;

[0032] The upgrade module is used to perform security verification processing on the target data segment. If the target data segment passes the security verification, the server firmware is upgraded based on the target BIOS file to be upgraded.

[0033] In a fourth aspect, the present application further provides a firmware upgrade device, comprising:

[0034] A file determination module, used to determine at least one candidate BIOS file to be upgraded;

[0035] A sending module, used for sending at least one candidate BIOS file to be upgraded to a server;

[0036] Among them, the candidate BIOS file to be upgraded is used to instruct the server to determine the target BIOS file to be upgraded from at least one candidate BIOS file to be upgraded, and perform security verification processing on the corresponding target data segment according to the identifier of the encrypted target data segment included in the target BIOS file to be upgraded, and perform firmware upgrade after the target data segment security verification passes.

[0037] In a fifth aspect, the present application further provides a server, comprising a memory and a processor, wherein the memory stores a computer program, and when the processor executes the computer program, the firmware upgrade method described in any one of the first aspects is implemented.

[0038] In a sixth aspect, the present application further provides a terminal, comprising a memory and a processor, wherein the memory stores a computer program, and when the processor executes the computer program, the firmware upgrade method described in any one of the second aspects is implemented.

[0039] In a seventh aspect, the present application further provides a computer-readable storage medium having a computer program stored thereon, and when the computer program is executed by a processor, the firmware upgrade method of the first aspect and / or the second aspect described above is implemented.

[0040] In an eighth aspect, the present application further provides a computer program product, including a computer program, which, when executed by a processor, implements the firmware upgrade method of the first aspect and / or the second aspect mentioned above.

[0041] The above-mentioned firmware upgrade method, device, equipment, medium and program product first obtain the target basic input and output system BIOS file to be upgraded including the identifier of the encrypted target data segment, then determine the target data segment from the target BIOS file to be upgraded according to the identifier of the target data segment, and finally perform security verification processing on the target data segment. If the target data segment passes the security verification, the server is firmware upgraded based on the target BIOS file to be upgraded. In this way, according to the encrypted target data segment in the target BIOS file to be upgraded, the server is firmware upgraded using the target BIOS file to be upgraded if the security verification passes, thus avoiding the problem that if the target BIOS file to be upgraded is tampered with or destroyed, it will cause the BIOS firmware upgrade to fail. Furthermore, by determining the target data segment and then performing security verification on the target data segment, the accuracy and success rate of the security verification can be improved, and at the same time, there is no need to perform security verification on the entire file, and the efficiency of security verification is higher. BRIEF DESCRIPTION OF THE DRAWINGS

[0042] In order to more clearly illustrate the technical solutions in the embodiments of the present application or the related technologies, the drawings required for use in the embodiments or the related technical descriptions are briefly introduced below. Obviously, the drawings described below are only some embodiments of the present application. For ordinary technicians in this field, other drawings can be obtained based on these drawings without paying creative work.

[0043] Figure 1 An application environment diagram of a firmware upgrade method in an embodiment;

[0044] Figure 2 A flowchart of a firmware upgrade method in an embodiment;

[0045] Figure 3 is a flowchart of a firmware upgrade method in another embodiment;

[0046] Figure 4 is a flowchart of a firmware upgrade method in another embodiment;

[0047] Figure 5 is a flowchart of a firmware upgrade method in another embodiment;

[0048] Figure 6 is a flowchart of a firmware upgrade method in another embodiment;

[0049] Figure 7 A flowchart of a firmware upgrade method BIOS file generation in another embodiment;

[0050] Figure 8 A flowchart of security verification of a firmware upgrade method in another embodiment;

[0051] Fig. 9 is a structural block diagram of a firmware upgrade device in an embodiment;

[0052] Fig.10 is a structural block diagram of a firmware upgrade device in another embodiment;

[0053] Fig.11 is an internal structure diagram of a server in one embodiment;

[0054] Fig.12 FIG. 4 is a diagram showing the internal structure of a terminal in an embodiment. DETAILED DESCRIPTION

[0055] In order to make the purpose, technical solution and advantages of the present application more clearly understood, the present application is further described in detail below in conjunction with the accompanying drawings and embodiments. It should be understood that the specific embodiments described herein are only used to explain the present application and are not used to limit the present application.

[0056] The firmware upgrade method provided in the embodiment of the present application can be applied to Figure 1 In the application environment shown. Among them, the terminal 10 communicates with the server 20 through the network. The terminal 10 can send the generated BIOS file to the server 20, and the server 20 performs a BIOS firmware upgrade based on the received BIOS file. Among them, the terminal 10 can be, but is not limited to, various personal computers, laptops, smart phones, tablet computers, Internet of Things devices and portable wearable devices. The Internet of Things devices can be smart speakers, smart TVs, smart air conditioners, smart car-mounted devices, etc. Portable wearable devices can be smart watches, smart bracelets, head-mounted devices, etc. The server 20 can be implemented with an independent server or a server cluster consisting of multiple servers.

[0057] The following embodiment first describes a firmware upgrade method on the server side.

[0058] In one embodiment, Figure 2 As shown, a firmware upgrade method is provided, which is applied to Figure 1 Taking the server in as an example, the method may include the following steps:

[0059] S202, obtaining a target basic input and output system BIOS file to be upgraded.

[0060] The target BIOS file to be upgraded is the BIOS file that the server currently wants to upgrade, and the target BIOS file to be upgraded can be obtained by the server through the network. The target BIOS file to be upgraded can be divided into different data segments according to functions and attributes, and different data segments are distinguished by different data segment identifiers. The target BIOS file to be upgraded includes an identifier of an encrypted target data segment, and the target data segment can be at least one of multiple data segments. Optionally, the identifier of the encrypted target data segment is an identifier of a target data segment determined during the compilation process of the target BIOS file to be upgraded for security verification. At the same time, in order to improve the security during the transmission process, the identifier of the target data segment can also be encrypted.

[0061] S204: determining a target data segment from the target BIOS file to be upgraded according to the identifier of the target data segment.

[0062] Among them, the identifier of the target data segment can be the serial number of the target data segment, or it can be the position of the target data segment, such as the offset address of the target data segment. The method of determining the target data segment from the target BIOS file to be upgraded through the identifier of the target data segment can be matching in the target BIOS file to be upgraded according to the serial number, or searching in the target BIOS file to be upgraded according to the offset address.

[0063] S206, performing security verification processing on the target data segment, if the target data segment passes the security verification, then performing firmware upgrade on the server based on the target BIOS file to be upgraded.

[0064] In this step, since the target BIOS file to be upgraded can be obtained by the server through the network, but the target BIOS file to be upgraded may be tampered with or damaged during the data transmission process, in order to avoid the failure of the BIOS firmware upgrade causing the server to be unable to run, the obtained target BIOS file to be upgraded needs to be security verified.

[0065] During verification, specifically, security verification processing may be performed based on the target data segment determined from the target BIOS file to be upgraded. If the security verification of the target data segment passes, it means that the target BIOS file to be upgraded is secure. Therefore, the target BIOS file to be upgraded may be used to perform firmware upgrades on the server. Optionally, if the security verification of the target data segment fails, it means that the target BIOS file to be upgraded may be tampered with or destroyed during the transmission process, and the firmware upgrade of the server is stopped. Among them, security verification processing may be performed based on the hash value of the target data segment, or based on the specific content of the target data segment. Of course, security verification may also be performed in other ways, which are not specifically limited here.

[0066] In the above firmware upgrade method, firstly, the target basic input / output system BIOS file to be upgraded including the identifier of the encrypted target data segment is obtained, then the target data segment is determined from the target BIOS file to be upgraded according to the identifier of the target data segment, and finally the target data segment is subjected to security verification processing. If the target data segment passes the security verification, the server is subjected to firmware upgrade based on the target BIOS file to be upgraded. In this way, security verification processing is performed on the encrypted target data segment in the target BIOS file to be upgraded. If the security verification passes, the server is subjected to firmware upgrade using the target BIOS file to be upgraded, thus avoiding the problem that the BIOS firmware upgrade fails if the target BIOS file to be upgraded is tampered with or destroyed. Furthermore, by determining the target data segment and then conducting security verification on the target data segment, the accuracy and success rate of the security verification can be improved, and at the same time, there is no need to conduct security verification on the entire file, and the efficiency of the security verification is higher.

[0067] In another embodiment, another firmware upgrade method is provided. Based on the above embodiment, the target BIOS file to be upgraded includes multiple data segments to be upgraded, and the above S204 may include the following steps:

[0068] The identifier of the target data segment is matched among the multiple data segments to be upgraded, and the target data segment is determined from the multiple data segments to be upgraded.

[0069] The target BIOS file to be upgraded may include multiple data segments to be upgraded, such as a code segment responsible for CPU initialization, data for storing data, etc. Usually, before performing security verification on the target BIOS file to be upgraded according to the target data segment, it is necessary to first match the identifier of the target data segment with the data segment identifiers of the multiple data segments to be upgraded included in the target BIOS file to be upgraded one by one, and the data segment with the consistent identifier is the target data segment.

[0070] In this embodiment, by determining the target data segment from multiple data segments to be upgraded so as to perform security verification on the target BIOS to be upgraded based on the target data segment, the accuracy and success rate of the security verification are improved. At the same time, there is no need to perform security verification on the entire file, and the efficiency of the security verification is higher.

[0071] Currently, when performing firmware upgrades on all servers, in order to simplify the upgrade process, all candidate BIOS files to be upgraded that are suitable for different server models can be sent to different servers for the servers to perform BIOS upgrades. This requires each server to obtain the corresponding version of the BIOS file, that is, the target BIOS file to be upgraded, from all candidate BIOS files to be upgraded for upgrading. The following embodiment illustrates this process.

[0072] In another embodiment, another firmware upgrade method is provided. Based on the above embodiment, Figure 3 As shown, the above S202 may include the following steps:

[0073] S302: Obtain at least one candidate BIOS file to be upgraded.

[0074] There may be one or more candidate BIOS files to be upgraded, which are used for upgrading BIOS firmware of servers of different models.

[0075] Each candidate BIOS file to be upgraded includes its own verification certificate, which can be a CA digital certificate. The CA digital certificate in each candidate BIOS file to be upgraded is obtained by applying for the candidate BIOS file to be upgraded from a third-party CA digital certificate issuing authority during the generation phase. At the same time, when generating each candidate BIOS file to be upgraded, the digital signature generated by encrypting the CA digital certificate with the respective CA private key can also be saved to a specified location in the corresponding candidate BIOS file to be upgraded, so that the legitimacy can be quickly verified later through the digital signature. Optionally, the server can also obtain the CA public key, decrypt the encrypted CA digital certificate with the CA public key, and then perform a legitimacy verification.

[0076] S304, obtaining a target verification certificate corresponding to the currently running BIOS.

[0077] Among them, the currently running BIOS file is the BIOS file being used by the system on the server. The verification certificate of the currently running BIOS file can be recorded as the target verification certificate. Specifically, the target verification certificate corresponding to the currently running BIOS can be obtained through the BMC. The target verification certificate can also be the digital signature of a CA digital certificate.

[0078] S306: Verify the verification certificate of each candidate BIOS file to be upgraded according to the target verification certificate, and determine a target BIOS file to be upgraded from at least one candidate BIOS file to be upgraded.

[0079] In this step, verification is performed based on the digital signature of the obtained CA digital certificate and the digital signature of the CA digital certificate saved in each candidate BIOS file to be upgraded. Optionally, the CA digital certificate is decrypted by the obtained CA public key, and then verified with the CA digital certificate of the candidate BIOS file to be upgraded. If they are consistent, it is confirmed that the candidate BIOS file to be upgraded is the target BIOS file to be upgraded, and the CA digital certificate of the target BIOS file to be upgraded is valid. Then the digital signature of the CA digital certificate and the CA digital certificate are sent to the certificate authority for identity authentication. If the authentication is successful, it means that the CA digital certificate has not been tampered with, and the CA digital certificate is valid. If the authentication fails, the CA digital certificate is invalid. The CA digital certificate also saves the user public key generated when the target BIOS file to be upgraded is compiled. If the CA digital certificate is valid, that is, the user public key saved therein is valid. If the CA digital certificate is invalid, that is, the user public key saved therein is invalid, then the service upgrade according to the target BIOS file to be upgraded is stopped. If the CA digital certificates of the candidate BIOS files to be upgraded are not successfully verified, the security verification fails.

[0080] In this embodiment, by using different verification certificates for servers of different models for verification, when a large number of servers are refreshed, the corresponding upgrade files can be automatically matched according to the verification certificates of the servers without the need for manual screening, thereby improving the efficiency of firmware upgrades.

[0081] In another embodiment, another firmware upgrade method is provided. Based on the above embodiment, the target BIOS file to be upgraded includes first verification data corresponding to the target data segment, and the first verification data is pre-stored in the target BIOS file to be upgraded. The step of performing security verification processing on the target data segment is as follows: Figure 4 As shown, including:

[0082] S402, the server calculates second verification data corresponding to the target data segment.

[0083] Optionally, after determining the target data segment, the second verification data can be calculated based on the content of the target data segment of the current target BIOS file to be upgraded. The second verification data can be a hash value, that is, the hash value of the current target data segment is obtained.

[0084] S404, the server performs security verification processing on the target data segment according to the second verification data and the first verification data.

[0085] The first verification data can be a hash value corresponding to the target data segment generated during the compilation process of the target BIOS file to be upgraded. When the terminal generates the target BIOS file to be upgraded, the hash value corresponding to the target data segment is stored in the specified location of the target BIOS file to be upgraded. After the second verification data is calculated based on the current target data segment, the first verification data and the second verification data are compared. If they are consistent, it is determined that the content of the target data segment has not changed, that is, the target BIOS file to be upgraded has not been tampered with, that is, the security verification has passed. If the first verification data and the second verification data are inconsistent, it is determined that the content of the target data segment has changed, that is, the target BIOS file to be upgraded may be damaged, that is, the security verification has failed. If the security verification fails, the target BIOS file to be upgraded is not used to upgrade the server firmware.

[0086] Optionally, in order to further improve the security of security verification, the first verification data can be encrypted and stored in a specified location in the target BIOS file to be upgraded during the compilation phase. The server obtains the target BIOS file to be upgraded, obtains the user public key stored in the CA digital certificate if the CA digital certificate is valid, and uses the user public key to decrypt the stored first verification data. Then the first verification data and the second verification data are matched.

[0087] In the above embodiment, by comparing the first verification data and the second verification data of the target data segment, it is determined whether the target data segment remains consistent during the transmission process, thereby obtaining a security verification result. The security verification calculation is convenient and efficient.

[0088] The following embodiments illustrate the firmware upgrade method on the terminal side.

[0089] In an exemplary embodiment, Figure 5 As shown, a firmware upgrade method is provided, which is applied to Figure 1 The following is an example of a terminal in the example, including:

[0090] S502: Determine at least one candidate BIOS file to be upgraded.

[0091] Optionally, the terminal determines a candidate BIOS file to be upgraded according to a model of a server to be upgraded.

[0092] S504: Send at least one candidate BIOS file to be upgraded to a server.

[0093] Among them, the candidate BIOS file to be upgraded is used to instruct the server to determine the target BIOS file to be upgraded from at least one candidate BIOS file to be upgraded, and perform security verification processing on the corresponding target data segment according to the identifier of the encrypted target data segment included in the target BIOS file to be upgraded, and perform firmware upgrade after the target data segment security verification passes. Optionally, each candidate BIOS file to be upgraded also includes a verification certificate. The candidate BIOS file to be upgraded can be authenticated according to the verification certificate. The verification certificate can be a CA digital certificate. The generation process of the CA digital certificate includes generating a pair of user keys according to an asymmetric encryption algorithm. The user key can include a user private key for encryption and a user public key for decryption. Then, a dedicated CA digital certificate is applied for from a third CA digital certificate issuing authority through the user public key. The CA digital certificate contains the user public key, user information, certificate issuing authority and certificate validity period, and the digital signature of the certificate.

[0094] In this embodiment, the candidate BIOS files to be upgraded are sent to the server, and the server can determine the target BIOS file to be upgraded based on the verification certificate of the candidate BIOS file to be upgraded, and then perform the firmware upgrade after the target BIOS file to be upgraded passes the security verification, thereby improving the security of the firmware upgrade.

[0095] In another embodiment, another firmware upgrade method is provided. Based on the above embodiment, the terminal generates a candidate BIOS file to be upgraded including an encrypted target data segment. Figure 6 As shown, including:

[0096] S602: The terminal divides the candidate BIOS file to be upgraded into a plurality of data segments to be upgraded.

[0097] The candidate BIOS file to be upgraded is a binary file, which can be divided into multiple data segments to be upgraded according to the content and the offset address in the file, and according to the function and attribute.

[0098] S604: The terminal determines a target data segment from the data segments to be upgraded according to the security level of the server.

[0099] Optionally, the terminal may determine the number of target data segments according to the security level of the server. Different servers have different security levels due to the different services and functions they run. Different security verification policies may be set for servers with different security levels. For example, for a server with a high security level, all the data segments to be upgraded in the target BIOS file to be upgraded may be determined as target data segments, and for a server with a low security level, only some of the data segments to be upgraded, such as code segments, may be selected as target data segments for security checks.

[0100] S606: The terminal determines the encrypted data corresponding to the target data segment, and adds the encrypted data of the target data segment to the corresponding candidate BIOS file to be upgraded.

[0101] Wherein, the encrypted data includes the identification of the target data segment and its verification data. The verification data can be the hash value of the target data segment. Optionally, in the process of compiling the candidate BIOS file to be upgraded to generate each target data segment, the hash value of each target data segment is calculated, and then the hash value of each target data segment is encrypted according to the user private key generated above to generate the corresponding target data segment digital signature. Then, the identification of the target data segment of each target data segment and its corresponding hash value are stored in the designated location in the candidate BIOS file to be upgraded. At the same time, the verification certificate of the candidate BIOS file to be upgraded generated by the above embodiment is saved together to the designated location in the candidate BIOS file to be upgraded.

[0102] In this embodiment, the candidate BIOS files to be upgraded are divided into different data segments to be upgraded, and different target data segments can be determined according to the security levels of different servers, which can further improve the efficiency of security verification.

[0103] In the embodiments of the present application, in order to facilitate the understanding of the reader, the generation process of the BIOS file to be upgraded in the firmware upgrade method provided by the present application is illustrated by way of example. Figure 7 . First, create a user public key and a user private key, send the user public key to the CA digital certificate authority to apply for a CA digital certificate and CA public key, then compile the BIOS file to be upgraded, and then generate the binary content of the data segment. According to the security level of the server, determine the target data segment to be security verified, generate the hash value of the target data segment, encrypt the hash value of the target data segment with the user private key to generate a digital signature, and then save it together with the identifier of the target data segment.

[0104] The next step is to determine whether the current target data segment is the last data segment of the BIOS file to be upgraded. If it is, the digital signatures of all the target data segments generated above and the identifiers of the target data segments are saved in the specified location of the BIOS file to be upgraded, and the digital signature of the CA digital certificate is saved at the same time, and finally the BIOS file to be upgraded is generated. If it is not the last data segment, the steps after generating the binary content of the data segment are repeated until all the data segments are completed. At this time, the terminal generates the BIOS file to be upgraded, which can be sent to the server together with the CA public key.

[0105] In one embodiment, the security verification process of the firmware upgrade method of the present application is illustrated by way of example. For the specific process, please refer to Figure 8 . You can upgrade servers in batches at the same time. First, obtain the IP address list of all servers to be upgraded, select a server that has not been upgraded through the IP address list, and obtain the CA digital signature of the BIOS currently running on the server through the BMC. Then, decrypt the CA digital signature through the CA public key and match it with the CA digital signature of the candidate BIOS file to be upgraded. If the match is successful, the target BIOS file to be upgraded is determined, and then the validity of the CA digital certificate is confirmed by the CA digital certificate authority. If the CA digital certificate is verified, the user public key in it is obtained. If the verification fails, the firmware upgrade is stopped.

[0106] Calculate the second verification data of the target data segment of the target BIOS file to be upgraded, then obtain the first verification data of the target data segment stored in the BIOS file to be upgraded through the identifier of the target data segment, decrypt using the user's public key, and determine whether the first verification data and the second verification data are consistent. If they are consistent, determine whether all the target data segments have been verified. If they are completed, upgrade according to the target BIOS file to be upgraded. If the target data segment has not been verified, continue to verify the next target data segment. If the first verification data and the second verification data are inconsistent, the security verification fails and the upgrade is stopped.

[0107] After the current server is upgraded, continue to determine whether it is the last IP according to the server IP address list. If it is, all servers have been upgraded. If not, continue to repeat the above steps until the last server is upgraded.

[0108] In the above embodiment, through security verification, the validity, integrity and security of the target BIOS file to be upgraded can be verified before the target BIOS file to be upgraded is upgraded. At the same time, when the server is updated in batches, the BIOS files to be upgraded can be automatically matched without manual screening, and the upgrade efficiency is higher.

[0109] It should be understood that, although the various steps in the flowcharts involved in the above-mentioned embodiments are displayed in sequence according to the indication of the arrows, these steps are not necessarily executed in sequence according to the order indicated by the arrows. Unless there is a clear explanation in this article, the execution of these steps does not have a strict order restriction, and these steps can be executed in other orders. Moreover, at least a part of the steps in the flowcharts involved in the above-mentioned embodiments can include multiple steps or multiple stages, and these steps or stages are not necessarily executed at the same time, but can be executed at different times, and the execution order of these steps or stages is not necessarily to be carried out in sequence, but can be executed in turn or alternately with other steps or at least a part of the steps or stages in other steps.

[0110] Based on the same inventive concept, the embodiment of the present application also provides a firmware upgrade device for implementing the firmware upgrade method involved above. The implementation scheme for solving the problem provided by the device is similar to the implementation scheme recorded in the above method, so the specific limitations in one or more firmware upgrade device embodiments provided below can refer to the limitations on the firmware upgrade method above, and will not be repeated here.

[0111] In an exemplary embodiment, Fig. 9 As shown, a firmware upgrade device is provided, comprising: an acquisition module, a data segment determination module and an upgrade module, wherein:

[0112] The acquisition module is used to acquire a target basic input and output system BIOS file to be upgraded; the target BIOS file to be upgraded includes an identifier of an encrypted target data segment.

[0113] The data segment determination module is used to determine the target data segment from the target BIOS file to be upgraded according to the identifier of the target data segment.

[0114] The upgrade module is used to perform security verification processing on the target data segment. If the target data segment passes the security verification, the server firmware is upgraded based on the target BIOS file to be upgraded.

[0115] In one embodiment, the target BIOS file to be upgraded includes multiple data segments to be upgraded, and the data segment determination module includes:

[0116] The matching unit is used to match the identifier of the target data segment among the multiple data segments to be upgraded, and determine the target data segment from the multiple data segments to be upgraded.

[0117] In one embodiment, the acquisition module 901 includes:

[0118] A first acquisition unit is used to acquire at least one candidate BIOS file to be upgraded; each candidate BIOS file to be upgraded includes a respective verification certificate;

[0119] A second acquisition unit is used to acquire a target verification certificate corresponding to the currently running BIOS;

[0120] The verification unit is used to verify the verification certificate of each candidate BIOS file to be upgraded according to the target verification certificate, and determine the target BIOS file to be upgraded from at least one candidate BIOS file to be upgraded.

[0121] In one embodiment, the target BIOS file to be upgraded includes first verification data corresponding to the target data segment, and the upgrade module 903 includes:

[0122] A calculation unit, used to calculate second verification data corresponding to the target data segment;

[0123] The security verification unit is used to perform security verification processing on the target data segment according to the second verification data and the first verification data.

[0124] Each module in the above firmware upgrade device can be implemented in whole or in part by software, hardware, or a combination thereof. Each module can be embedded in or independent of a processor in a computer device in the form of hardware, or can be stored in a memory in a computer device in the form of software, so that the processor can call and execute operations corresponding to each module.

[0125] In an exemplary embodiment, Fig.10 As shown, a firmware upgrade device is provided, including: a file determination module and a sending module, wherein:

[0126] The file determination module is used to determine at least one candidate BIOS file to be upgraded.

[0127] The sending module is used to send at least one candidate BIOS file to be upgraded to a server.

[0128] Among them, the candidate BIOS file to be upgraded is used to instruct the server to determine the target BIOS file to be upgraded from at least one candidate BIOS file to be upgraded, and perform security verification processing on the corresponding target data segment according to the identifier of the encrypted target data segment included in the target BIOS file to be upgraded, and perform firmware upgrade after the target data segment security verification passes.

[0129] In one embodiment, a partitioning module is further included, including:

[0130] A data segment division unit, used for dividing the candidate BIOS file to be upgraded into a plurality of data segments to be upgraded;

[0131] A first determining unit, configured to determine a target data segment from the data segments to be upgraded according to a security level of the server;

[0132] The second determination unit determines the encrypted data corresponding to the target data segment, and adds the encrypted data of the target data segment to the corresponding candidate BIOS file to be upgraded; the encrypted data includes the identifier of the target data segment and its verification data.

[0133] In an exemplary embodiment, a server is provided, whose internal structure diagram can be as follows: Fig.11 As shown. The computer device includes a processor, a memory, an input / output interface (Input / Output, referred to as I / O) and a communication interface. The processor, the memory and the input / output interface are connected through a system bus, and the communication interface is connected to the system bus through the input / output interface. The processor of the computer device is used to provide computing and control capabilities. The memory of the computer device includes a non-volatile storage medium and an internal memory. The non-volatile storage medium stores an operating system, a computer program and a database. The internal memory provides an environment for the operation of the operating system and the computer program in the non-volatile storage medium. The database of the computer device is used to store BIOS file data. The input / output interface of the computer device is used to exchange information between the processor and an external device. The communication interface of the computer device is used to communicate with an external terminal through a network connection. When the computer program is executed by the processor, a firmware upgrade method is implemented.

[0134] Those skilled in the art will understand that Fig.11 The structure shown in the figure is only a block diagram of a part of the structure related to the solution of the present application, and does not constitute a limitation on the computer device to which the solution of the present application is applied. The specific computer device may include more or fewer components than those shown in the figure, or combine certain components, or have a different arrangement of components.

[0135] In an exemplary embodiment, a server is provided, including a memory and a processor, wherein a computer program is stored in the memory, and the processor implements the following steps when executing the computer program: obtaining a target basic input and output system BIOS file to be upgraded; the target BIOS file to be upgraded includes an identifier of an encrypted target data segment; determining a target data segment from the target BIOS file to be upgraded according to the identifier of the target data segment; performing security verification processing on the target data segment, and if the security verification of the target data segment passes, performing a firmware upgrade on the server based on the target BIOS file to be upgraded.

[0136] In one embodiment, the target BIOS file to be upgraded includes multiple data segments to be upgraded, and the processor further implements the following steps when executing the computer program: matching the identifier of the target data segment among the multiple data segments to be upgraded, and determining the target data segment from the multiple data segments to be upgraded.

[0137] In one embodiment, when the processor executes the computer program, the following steps are also implemented: obtaining at least one candidate BIOS file to be upgraded; each candidate BIOS file to be upgraded includes its own verification certificate; obtaining a target verification certificate corresponding to the currently running BIOS; verifying the verification certificate of each candidate BIOS file to be upgraded according to the target verification certificate, and determining the target BIOS file to be upgraded from at least one candidate BIOS file to be upgraded.

[0138] In one embodiment, the target BIOS file to be upgraded includes first verification data corresponding to the target data segment, and the processor also implements the following steps when executing the computer program: calculating second verification data corresponding to the target data segment; and performing security verification processing on the target data segment based on the second verification data and the first verification data.

[0139] In an exemplary embodiment, a terminal is provided, and its internal structure diagram can be as follows: Fig.12 As shown. The computer device includes a processor, a memory, an input / output interface, a communication interface, a display unit and an input device. Among them, the processor, the memory and the input / output interface are connected through a system bus, and the communication interface, the display unit and the input device are connected to the system bus through the input / output interface. Among them, the processor of the computer device is used to provide computing and control capabilities. The memory of the computer device includes a non-volatile storage medium and an internal memory. The non-volatile storage medium stores an operating system and a computer program. The internal memory provides an environment for the operation of the operating system and the computer program in the non-volatile storage medium. The input / output interface of the computer device is used to exchange information between the processor and the external device. The communication interface of the computer device is used to communicate with an external terminal in a wired or wireless manner, and the wireless manner can be implemented through WIFI, a mobile cellular network, NFC (near field communication) or other technologies. When the computer program is executed by the processor, a firmware upgrade method is implemented. The display unit of the computer device is used to form a visually visible picture, which can be a display screen, a projection device or a virtual reality imaging device. The display screen can be a liquid crystal display screen or an electronic ink display screen, and the input device of the computer device can be a touch layer covering the display screen, or a button, trackball or touchpad set on the computer device shell, or an external keyboard, touchpad or mouse.

[0140] Those skilled in the art will understand that Fig.12The structure shown in the figure is only a block diagram of a part of the structure related to the solution of the present application, and does not constitute a limitation on the computer device to which the solution of the present application is applied. The specific computer device may include more or fewer components than those shown in the figure, or combine certain components, or have a different arrangement of components.

[0141] In an exemplary embodiment, a terminal is provided, including a memory and a processor, wherein a computer program is stored in the memory, and the processor implements the following steps when executing the computer program: determining at least one candidate BIOS file to be upgraded; sending at least one candidate BIOS file to be upgraded to a server; wherein the candidate BIOS file to be upgraded is used to instruct the server to determine a target BIOS file to be upgraded from at least one candidate BIOS file to be upgraded, and perform security verification processing on the corresponding target data segment according to the identifier of the encrypted target data segment included in the target BIOS file to be upgraded, and perform firmware upgrade after the target data segment passes the security verification.

[0142] In one embodiment, the processor implements the following steps when executing a computer program: dividing a candidate BIOS file to be upgraded into multiple data segments to be upgraded; determining a target data segment from the data segments to be upgraded according to the security level of the server; determining the encrypted data corresponding to the target data segment, and adding the encrypted data of the target data segment to the corresponding candidate BIOS file to be upgraded; the encrypted data includes an identifier of the target data segment and its verification data.

[0143] In one embodiment, a computer-readable storage medium is provided, on which a computer program is stored. When the computer program is executed by a processor, the following steps are implemented: obtaining a target basic input and output system BIOS file to be upgraded; the target BIOS file to be upgraded includes an identifier of an encrypted target data segment; determining a target data segment from the target BIOS file to be upgraded according to the identifier of the target data segment; performing security verification processing on the target data segment, and if the security verification of the target data segment passes, performing a firmware upgrade on the server based on the target BIOS file to be upgraded.

[0144] In one embodiment, the target BIOS file to be upgraded includes multiple data segments to be upgraded, and when the computer program is executed by the processor, the following steps are also implemented: matching the identifier of the target data segment among the multiple data segments to be upgraded, and determining the target data segment from the multiple data segments to be upgraded.

[0145] In one embodiment, when the computer program is executed by a processor, the following steps are implemented: obtaining at least one candidate BIOS file to be upgraded; each candidate BIOS file to be upgraded includes its own verification certificate; obtaining a target verification certificate corresponding to the currently running BIOS; verifying the verification certificate of each candidate BIOS file to be upgraded according to the target verification certificate, and determining the target BIOS file to be upgraded from at least one candidate BIOS file to be upgraded.

[0146] In one embodiment, the target BIOS file to be upgraded includes first verification data corresponding to the target data segment, and the computer program implements the following steps when executed by the processor: calculating second verification data corresponding to the target data segment; and performing security verification processing on the target data segment based on the second verification data and the first verification data.

[0147] In one embodiment, when the computer program is executed by a processor, the following steps are implemented: determining at least one candidate BIOS file to be upgraded; sending at least one candidate BIOS file to be upgraded to a server; wherein the candidate BIOS file to be upgraded is used to instruct the server to determine a target BIOS file to be upgraded from at least one candidate BIOS file to be upgraded, and perform security verification processing on the corresponding target data segment according to the identifier of the encrypted target data segment included in the target BIOS file to be upgraded, and perform firmware upgrade after the target data segment passes the security verification.

[0148] In one embodiment, when the computer program is executed by a processor, the following steps are implemented: dividing the candidate BIOS file to be upgraded into multiple data segments to be upgraded; determining the target data segment from the data segments to be upgraded according to the security level of the server; determining the encrypted data corresponding to the target data segment, and adding the encrypted data of the target data segment to the corresponding candidate BIOS file to be upgraded; the encrypted data includes the identifier of the target data segment and its verification data.

[0149] In one embodiment, a computer program product is provided, comprising a computer program, which, when executed by a processor, implements the following steps:

[0150] Obtain a target basic input / output system BIOS file to be upgraded; the target BIOS file to be upgraded includes an identifier of an encrypted target data segment; determine a target data segment from the target BIOS file to be upgraded according to the identifier of the target data segment; perform security verification on the target data segment, and if the security verification of the target data segment passes, perform a firmware upgrade on the server based on the target BIOS file to be upgraded.

[0151] In one embodiment, the target BIOS file to be upgraded includes multiple data segments to be upgraded, and when the computer program is executed by the processor, the following steps are also implemented: matching the identifier of the target data segment among the multiple data segments to be upgraded, and determining the target data segment from the multiple data segments to be upgraded.

[0152] In one embodiment, when the computer program is executed by a processor, the following steps are implemented: obtaining at least one candidate BIOS file to be upgraded; each candidate BIOS file to be upgraded includes its own verification certificate; obtaining a target verification certificate corresponding to the currently running BIOS; verifying the verification certificate of each candidate BIOS file to be upgraded according to the target verification certificate, and determining the target BIOS file to be upgraded from at least one candidate BIOS file to be upgraded.

[0153] In one embodiment, the target BIOS file to be upgraded includes first verification data corresponding to the target data segment, and the computer program implements the following steps when executed by the processor: calculating second verification data corresponding to the target data segment; and performing security verification processing on the target data segment based on the second verification data and the first verification data.

[0154] In one embodiment, when the computer program is executed by a processor, the following steps are implemented: determining at least one candidate BIOS file to be upgraded; sending at least one candidate BIOS file to be upgraded to a server; wherein the candidate BIOS file to be upgraded is used to instruct the server to determine a target BIOS file to be upgraded from at least one candidate BIOS file to be upgraded, and perform security verification processing on the corresponding target data segment according to the identifier of the encrypted target data segment included in the target BIOS file to be upgraded, and perform firmware upgrade after the target data segment passes the security verification.

[0155] In one embodiment, when the computer program is executed by a processor, the following steps are implemented: dividing the candidate BIOS file to be upgraded into multiple data segments to be upgraded; determining the target data segment from the data segments to be upgraded according to the security level of the server; determining the encrypted data corresponding to the target data segment, and adding the encrypted data of the target data segment to the corresponding candidate BIOS file to be upgraded; the encrypted data includes the identifier of the target data segment and its verification data.

[0156] It should be noted that the data involved in this application (including but not limited to data used for analysis, data stored, data displayed, etc.) are all data fully authorized by all parties, and the collection, use and processing of relevant data must comply with relevant regulations.

[0157] Those skilled in the art can understand that all or part of the processes in the above-mentioned embodiment methods can be completed by instructing the relevant hardware through a computer program, and the computer program can be stored in a non-volatile computer-readable storage medium. When the computer program is executed, it can include the processes of the embodiments of the above-mentioned methods. Among them, any reference to the memory, database or other medium used in the embodiments provided in the present application can include at least one of non-volatile and volatile memory. Non-volatile memory can include read-only memory (ROM), magnetic tape, floppy disk, flash memory, optical memory, high-density embedded non-volatile memory, resistive random access memory (ReRAM), magnetoresistive random access memory (MRAM), ferroelectric random access memory (FRAM), phase change memory (PCM), graphene memory, etc. Volatile memory can include random access memory (RAM) or external cache memory, etc. As an illustration and not limitation, RAM can be in various forms, such as static random access memory (SRAM) or dynamic random access memory (DRAM). The database involved in each embodiment provided in this application may include at least one of a relational database and a non-relational database. Non-relational databases may include distributed databases based on blockchains, etc., but are not limited to this. The processor involved in each embodiment provided in this application may be a general-purpose processor, a central processing unit, a graphics processor, a digital signal processor, a programmable logic device, a data processing logic device based on quantum computing, etc., but are not limited to this.

[0158] The technical features of the above embodiments may be combined arbitrarily. To make the description concise, not all possible combinations of the technical features in the above embodiments are described. However, as long as there is no contradiction in the combination of these technical features, they should be considered to be within the scope of this specification.

[0159] The above-described embodiments only express several implementation methods of the present application, and the descriptions thereof are relatively specific and detailed, but they cannot be understood as limiting the scope of the present application. It should be pointed out that, for a person of ordinary skill in the art, several variations and improvements can be made without departing from the concept of the present application, and these all belong to the protection scope of the present application. Therefore, the protection scope of the present application shall be subject to the attached claims.

Claims

1. A firmware upgrade method, characterized in that: The method comprises: Obtaining a target basic input and output system BIOS file to be upgraded; the target BIOS file to be upgraded includes an identifier of the encrypted target data segment; Determining the target data segment from the target BIOS file to be upgraded according to the identifier of the target data segment; The target data segment is subjected to security verification processing. If the target data segment passes the security verification, the server firmware is upgraded based on the target BIOS file to be upgraded.

2. The method according to claim 1, characterized in that The target BIOS file to be upgraded includes a plurality of data segments to be upgraded, and determining the target data segment from the target BIOS file to be upgraded according to the identifier of the target data segment includes: The identifier of the target data segment is matched among the multiple data segments to be upgraded, and the target data segment is determined from the multiple data segments to be upgraded.

3. The method according to claim 1, characterized in that The step of obtaining the target BIOS file to be upgraded includes: Obtain at least one candidate BIOS file to be upgraded; each of the candidate BIOS files to be upgraded includes a respective verification certificate; Get the target verification certificate corresponding to the currently running BIOS; The verification certificate of each candidate BIOS file to be upgraded is verified according to the target verification certificate, and the target BIOS file to be upgraded is determined from the at least one candidate BIOS file to be upgraded.

4. The method according to any one of claims 1 to 3, characterized in that: The target BIOS file to be upgraded includes first verification data corresponding to the target data segment, and the security verification processing of the target data segment includes: Calculating second verification data corresponding to the target data segment; The target data segment is subjected to security verification processing according to the second verification data and the first verification data.

5. A firmware upgrade method, characterized in that: The method comprises: Determine at least one candidate BIOS file to be upgraded; Sending the at least one candidate BIOS file to be upgraded to a server; Among them, the candidate BIOS file to be upgraded is used to instruct the server to determine the target BIOS file to be upgraded from the at least one candidate BIOS file to be upgraded, and perform security verification processing on the corresponding target data segment according to the identifier of the encrypted target data segment included in the target BIOS file to be upgraded, and perform firmware upgrade after the security verification of the target data segment passes.

6. The method according to claim 5, characterized in that The method further comprises: Dividing the candidate BIOS file to be upgraded into a plurality of data segments to be upgraded; Determining the target data segment from the data segments to be upgraded according to the security level of the server; Determine the encrypted data corresponding to the target data segment, and add the encrypted data of the target data segment to the corresponding candidate BIOS file to be upgraded; the encrypted data includes an identifier of the target data segment and verification data thereof.

7. A firmware upgrade device, characterized in that: The device comprises: An acquisition module, used for acquiring a target basic input and output system BIOS file to be upgraded; the target BIOS file to be upgraded includes an identifier of an encrypted target data segment; A data segment determination module, used to determine the target data segment from the target BIOS file to be upgraded according to the identifier of the target data segment; The upgrade module is used to perform security verification processing on the target data segment. If the security verification of the target data segment passes, the server firmware is upgraded based on the target BIOS file to be upgraded.

8. A firmware upgrade device, characterized in that: The device comprises: A file determination module, used to determine at least one candidate BIOS file to be upgraded; A sending module, used for sending the at least one candidate BIOS file to be upgraded to a server; Among them, the candidate BIOS file to be upgraded is used to instruct the server to determine the target BIOS file to be upgraded from the at least one candidate BIOS file to be upgraded, and perform security verification processing on the corresponding target data segment according to the identifier of the encrypted target data segment included in the target BIOS file to be upgraded, and perform firmware upgrade after the security verification of the target data segment passes.

9. A server, comprising a memory and a processor, wherein the memory stores a computer program, characterized in that: When the processor executes the computer program, the steps of the method according to any one of claims 1 to 4 are implemented.

10. A terminal comprising a memory and a processor, wherein the memory stores a computer program, characterized in that: When the processor executes the computer program, the steps of the method according to any one of claims 5 to 6 are implemented.

11. A computer-readable storage medium having a computer program stored thereon, characterized in that: When the computer program is executed by a processor, the steps of the method according to any one of claims 1 to 6 are implemented.

12. A computer program product, comprising a computer program, characterized in that When the computer program is executed by a processor, the steps of the method according to any one of claims 1 to 6 are implemented.

Images