Firmware non-inductive upgrading method and ARM server system for firmware non-inductive upgrading

Abstract

The invention discloses a firmware non-inductive upgrading method of an ARM platform and an ARM server system for firmware non-inductive upgrading, and the method comprises the following steps: a computing subsystem CSS initiates a UEFI firmware upgrading request, loads a UEFI firmware upgrading package into a memory, notifies a system control processor SCP to carry out UEFI firmware upgrading, and sends the UEFI firmware upgrading package to a server; the memory address of the SCPUEFI firmware upgrade package stored in the memory is informed to the system control processor; the system control processor SCP verifies the validity of a root certificate of the FLASH, a sub-certificate of the UEFI firmware upgrade package and a firmware signature of the UEFI firmware upgrade package layer by layer through certificate hash of an algorithm module of the security module and an OTP module so as to verify the validity of the UEFI firmware upgrade package, if verification succeeds, the UEFI firmware upgrade package is used for flashing the FLASH so as to carry out firmware upgrade, and if verification succeeds, the system control processor SCP carries out firmware upgrade. If verification fails, UEFI firmware upgrading is not executed, the security module comprises an algorithm module and an OTP module, and certificate hash of a FLASH root certificate is stored in the OTP module. According to the invention, the security of the firmware certificate chain can be ensured while non-inductive upgrading is carried out on the firmware.

Description

Technical Field

[0001] The present invention relates to an ARM server, and in particular to a firmware seamless upgrade of the ARM server. Background Art

[0002] There are four existing firmware online upgrade solutions for ARM platform devices: Solution 1 is to upgrade under firmware, including interface upgrade and shell upgrade. The validity and integrity of the firmware upgrade package are guaranteed by signing the firmware upgrade package and verifying the signature during the upgrade; Solution 2 is to upgrade under the operating system. After basic verification of the upgrade package through scripts or tools, the upgrade file is saved on the hard disk, and then the BIOS firmware is restarted to perform the upgrade. The steps for BIOS firmware upgrade are the same as those of Solution 1; Solution 3 is mainly for server devices, and the firmware upgrade package is verified and upgraded through the BMC; Solution 4 is to flash FLASH through the SPI interface under the operating system.

[0003] The above solution 3 is an upgrade solution for servers. Solution 4 has great limitations, relying on the adaptation of the FLASH driver under the operating system and the FLASH is not write-protected, and has great security risks. This method is generally not recommended. Solution 1 and Solution 2 are general solutions, but there are three problems: 1. Security verification mostly uses software algorithms, which are not very secure, or relies on external TPM implementation, which is not very versatile; 2. The security root of trust is "untrusted", and the public key used for firmware signature verification is stored in FLASH, which is not very secure; 3. The upgrade process requires restarting or waiting for the upgrade to complete, which requires interrupting user services and affects user experience.

[0004] Therefore, a firmware upgrade method that can solve the above problems is urgently needed. Summary of the invention

[0005] The purpose of the present invention is to provide a firmware seamless upgrade method and an ARM server system for seamless firmware upgrade, which can seamlessly upgrade the firmware while ensuring the security of the firmware certificate chain.

[0006] In order to achieve the above-mentioned purpose, the present invention provides a firmware senseless upgrade method for an ARM platform, comprising: a computing subsystem CSS initiates a UEFI firmware upgrade request, and loads a UEFI firmware upgrade package into a memory; the computing subsystem CSS notifies the system control processor SCP to perform a UEFI firmware upgrade, and informs the system control processor SCP of the memory address of the UEFI firmware upgrade package stored in the memory; after receiving the notification of the UEFI firmware upgrade, the system control processor SCP verifies the validity of the root certificate of the FLASH, the sub-certificate of the UEFI firmware upgrade package, and the firmware signature of the UEFI firmware upgrade package layer by layer through the algorithm module of the security module and the certificate hash of the OTP module to verify the validity of the UEFI firmware upgrade package, if the verification is successful, the UEFI firmware upgrade package is used to flash the FLASH for firmware upgrade, if the verification fails, the UEFI firmware upgrade is not performed, the security module includes an algorithm module and an OTP module, and the certificate hash of the FLASH root certificate is stored in the OTP module.

[0007] Preferably, the specific process of the system control processor SCP verifying the validity of the UEFI firmware upgrade package through the security module includes: the system control processor SCP accesses the memory address to read the UEFI firmware upgrade package; the system control processor SCP reads the root certificate of FLASH, calls the corresponding hash algorithm in the algorithm module to calculate the hash of the root certificate, compares the hash of the root certificate with the certificate hash pre-stored in the OTP module, and verifies the legitimacy of the root certificate; when the root certificate is legal, the system control processor SCP reads the sub-certificate of the UEFI firmware upgrade package, and uses the root certificate to call the corresponding public key algorithm in the algorithm module to verify the legitimacy of the sub-certificate; when the sub-certificate is legal, the system control processor SCP reads the firmware signature of the UEFI firmware upgrade package, and uses the sub-certificate to call the corresponding public key algorithm in the algorithm module to verify the legitimacy of the firmware signature; when the firmware signature is legal, confirming that the UEFI firmware upgrade package verification is successful; when one of the root certificate, sub-certificate, and firmware signature is illegal, confirming that the UEFI firmware upgrade package verification fails.

[0008] Preferably, the computing subsystem CSS divides the FLASH into a running area and a recovery area. When the system control processor SCP performs a firmware upgrade, the running area is flashed with the UEFI firmware upgrade package, and after the upgrade is successful, the running area and the recovery area are synchronized.

[0009] Preferably, when performing firmware upgrade, the system control processor SCP also modifies the restart function and shutdown function in the system control processor SCP so that system restart and shutdown are ineffective during the firmware upgrade, and restores the restart function and shutdown function after the firmware upgrade is completed.

[0010] Preferably, after performing the firmware upgrade, the system control processor SCP also records the upgrade result in a designated location of the FLASH.

[0011] Preferably, the system control processor SCP performs firmware upgrade by flashing FLASH via QSPI.

[0012] Preferably, the security module is hardware integrated in the CPU, and the security module only interacts with the system control processor SCP and the trusted firmware ATF for security software. The hardware decryption algorithm and hash algorithm of the integrated security module are faster and more secure than the commonly used TPM.

[0013] Preferably, the computing subsystem CSS notifies the system control processor SCP to perform UEFI firmware upgrade via SCMI.

[0014] The present invention also provides an ARM server system with seamless firmware upgrade, including a computing subsystem CSS, a system control processor SCP, FLASH, a memory and a security module, the security module including an algorithm module and an OTP module, the OTP module storing a certificate hash of a FLASH root certificate, the computing subsystem CSS, the system control processor SCP, FLASH, the memory and the security module executing the seamless firmware upgrade method as described above.

[0015] Compared with the prior art, the present invention can realize the safe and senseless upgrade of the firmware. When upgrading the firmware, the computing subsystem CSS notifies the system control processor SCP to implement the upgrade operation without the user's awareness. When executing the firmware upgrade, the system control processor SC verifies the validity of the root certificate of the FLASH, the sub-certificate of the UEFI firmware upgrade package, and the firmware signature of the UEFI firmware upgrade package layer by layer through the algorithm module of the security module and the certificate hash of the OTP module to verify the validity of the UEFI firmware upgrade package and ensure the security of the firmware certificate chain. BRIEF DESCRIPTION OF THE DRAWINGS

[0016] Figure 1 It is a structural diagram of the ARM platform in the ARM server system of the present invention.

[0017] Figure 2 It is a working process diagram of the ARM platform of the present invention for performing a senseless firmware upgrade.

[0018] Figure 3It is a flow chart of the firmware seamless upgrade method of the present invention. DETAILED DESCRIPTION

[0019] In order to explain the technical content, structural features, achieved objectives and effects of the present invention in detail, the following is a detailed description in conjunction with the implementation methods and the accompanying drawings.

[0020] refer to Figure 1 The present invention also provides an ARM server system for seamless firmware upgrade, including a computing subsystem CSS10, a system control processor SCP20, FLASH50, a memory 40 and a security module 30, wherein the security module 30 includes an algorithm module and an OTP module, wherein the OTP module stores a certificate hash of the FLASH50 root certificate, and the computing subsystem CSS10, the system control processor SCP20, FLASH50, the memory 40 and the security module 30 execute a firmware seamless upgrade method.

[0021] The algorithm module of the security module 30 includes an integrated symmetric algorithm, a public key algorithm, a hash algorithm, and a true random number.

[0022] refer to Figure 2 and Figure 3 , a firmware seamless upgrade method includes steps S1 to S4.

[0023] S1, the computing subsystem CSS10 initiates a UEFI firmware upgrade request and loads a UEFI firmware upgrade package into the memory 40.

[0024] Specifically, the computing subsystem CSS10 determines in real time whether to upgrade the UEFI firmware, and if so, starts the UEFI firmware upgrade: loads the UEFI firmware upgrade package into the memory 40, notifies the system control processor SCP20 through SCMI to upgrade the UEFI firmware, and informs the system control processor SCP20 of the memory address where the UEFI firmware upgrade package is stored in the memory 40.

[0025] Among them, the computing subsystem CSS10 initiates a firmware upgrade request, verifies basic information such as the version of the firmware package, and then loads the UEFI firmware upgrade package into the memory.

[0026] Among them, the computing subsystem CSS10 then continues to execute the current task. The computing subsystem CSS10 starts the UEFI firmware upgrade in stages including but not limited to ARM-ATF, UEFI and operating system. If the computing subsystem CSS10 is currently in the startup state, it continues to start normally. If the computing subsystem CSS10 is currently executing an application, it continues to execute the application.

[0027] The computing subsystem CSS10 notifies the system control processor SCP20 to perform UEFI firmware upgrade via SCMI.

[0028] Among them, the structure definition of SCMI passing parameters is as follows:

[0029] typedef struct update_info{

[0030] u64magic;

[0031] u64fwaddr;

[0032] u64fwlen;

[0033] }

[0034] S2, after the system control processor SCP20 receives the notification of the UEFI firmware upgrade, it verifies the validity of the root certificate of the FLASH50, the sub-certificate of the UEFI firmware upgrade package, and the firmware signature of the UEFI firmware upgrade package layer by layer through the algorithm module of the security module 30 and the certificate hash of the OTP module to verify the validity of the UEFI firmware upgrade package.

[0035] Specifically, step S2 includes step S21 to step S27.

[0036] S21, the system control processor SCP20 accesses the memory address to read the UEFI firmware upgrade package.

[0037] Specifically, the system control processor SCP20 obtains the memory address and length of the UEFI firmware upgrade package, and accesses the memory address to read the UEFI firmware upgrade package.

[0038] S22, the system control processor SCP20 reads the root certificate of FLASH50, and calls the corresponding hash algorithm in the algorithm module to calculate the hash of the root certificate.

[0039] S23, the system control processor SCP20 compares the hash of the root certificate with the hash of the certificate pre-stored in the OTP module to verify the legitimacy of the root certificate.

[0040] S24, when the root certificate is legal, the system control processor SCP20 reads the sub-certificate of the UEFI firmware upgrade package.

[0041] S25, the system control processor SCP20 uses the root certificate to call the corresponding public key algorithm in the algorithm module to verify the legitimacy of the sub-certificate.

[0042] S26, when the sub-certificate is legal, the system control processor SCP20 reads the firmware signature of the UEFI firmware upgrade package.

[0043] S27, the system control processor SCP20 uses the sub-certificate to call the corresponding public key algorithm in the algorithm module to verify the legitimacy of the firmware signature.

[0044] When the firmware signature is legal, it is confirmed that the UEFI firmware upgrade package verification succeeds; when one of the root certificate, sub-certificate, and firmware signature is illegal, it is confirmed that the UEFI firmware upgrade package verification fails.

[0045] S3, if the verification is successful, use the UEFI firmware upgrade package to flash FLASH50 to perform firmware upgrade.

[0046] Specifically, if the verification is successful, the UEFI firmware upgrade package is used to flash the FLASH 50, and the upgrade result is recorded in a specified location of the FLASH 50. The system control processor SCP20 flashes the FLASH 50 through QSPI to perform the firmware upgrade.

[0047] Specifically, the computing subsystem CSS10 divides the FLASH50 into a running area and a recovery area. When the system control processor SCP20 performs a firmware upgrade, the running area is flashed with the UEFI firmware upgrade package, and after the upgrade is successful, the running area and the recovery area are synchronized.

[0048] S4: If the verification fails, the UEFI firmware upgrade will not be performed.

[0049] Specifically, if the verification fails, the UEFI firmware upgrade is not performed and the upgrade result is recorded in a specified location of the FLASH50.

[0050] Preferably, when performing a firmware upgrade, the system control processor SCP20 also modifies the restart function and shutdown function in the system control processor SCP20 so that system restart and shutdown are ineffective during the firmware upgrade, and restores the restart function and shutdown function after the firmware upgrade is completed.

[0051] Specifically, the security module 30 is hardware integrated in the CPU, and the security module 30 only performs security software interaction with the system control processor SCP20 and the trusted firmware ATF.

[0052] SCMI (System Control and Management Interface), a standardized system control and management interface. MCP: Management Control Processor. SCP: System Control Processor. ATF: arm-trusted-firmware. UEFI: Unified Extensible Firmware Interface. OTP, One time Program, a one-time programmable circuit, is a non-volatile memory. QSPI, Quad SPI, is a serial peripheral interface technology.

[0053] Compared with the prior art, 1. When upgrading the UEFI firmware, the present invention notifies SCP through SCMI to implement the upgrade operation, without interrupting user services, and the user is unaware. 2. The verification tag of the UEFI firmware upgrade package is compatible with international algorithms and national encryption algorithms, and supports multiple usage scenarios. 3. When the UEFI firmware upgrade package is verified for validity, the certificate hash of the root certificate verification of FLASH50 is stored in the OTP module, and the hardware is more trusted and secure. 4. The UEFI firmware upgrade of the present invention is run in the system control processor SCP20, and the system control processor SCP20 defaults to a security attribute to avoid the risk of being attacked during the upgrade process. 5. The present invention uses the hardware algorithm of the security module integrated in the CPU to verify the validity of the UEFI firmware upgrade package, and ensures the security of the firmware certificate chain from the hardware. 6. The hardware decryption algorithm and hash algorithm of the integrated security module have a higher rate and stronger security than the commonly used TPM. 7. The present invention can support firmware upgrades for a variety of devices such as desktops, notebooks, servers and embedded devices, and has a wide range of applicability.

[0054] The above disclosure is only the preferred embodiment of the present invention, which certainly cannot be used to limit the scope of rights of the present invention. Therefore, equivalent changes made according to the scope of the patent application of the present invention are still within the scope covered by the present invention.

Claims

1. A firmware non-sensing upgrade method for an ARM platform, characterized in that: include: The computing subsystem CSS initiates a UEFI firmware upgrade request and loads the UEFI firmware upgrade package into the memory; The computing subsystem CSS notifies the system control processor SCP to perform UEFI firmware upgrade, and informs the system control processor SCP of the memory address where the UEFI firmware upgrade package is stored in the memory; After receiving the notification of the UEFI firmware upgrade, the system control processor SCP verifies the validity of the root certificate of the FLASH, the sub-certificate of the UEFI firmware upgrade package, and the firmware signature of the UEFI firmware upgrade package layer by layer through the algorithm module of the security module and the certificate hash of the OTP module to verify the validity of the UEFI firmware upgrade package. If the verification is successful, the UEFI firmware upgrade package is used to flash the FLASH for firmware upgrade. If the verification fails, the UEFI firmware upgrade is not performed. The security module includes an algorithm module and an OTP module, and the certificate hash of the FLASH root certificate is stored in the OTP module.

2. The firmware upgrade method for the ARM platform as claimed in claim 1, characterized in that: The specific process of the system control processor SCP verifying the validity of the UEFI firmware upgrade package through the security module includes: The system control processor SCP accesses the memory address to read the UEFI firmware upgrade package; The system control processor SCP reads the root certificate of FLASH, calls the corresponding hash algorithm in the algorithm module to calculate the hash of the root certificate, compares the hash of the root certificate with the hash of the certificate pre-stored in the OTP module, and verifies the legitimacy of the root certificate; When the root certificate is legitimate, the system control processor SCP reads the sub-certificate of the UEFI firmware upgrade package, and uses the root certificate to call the corresponding public key algorithm in the algorithm module to verify the legitimacy of the sub-certificate; When the sub-certificate is legitimate, the system control processor SCP reads the firmware signature of the UEFI firmware upgrade package, and uses the sub-certificate to call the corresponding public key algorithm in the algorithm module to verify the legitimacy of the firmware signature; When the firmware signature is legal, confirm that the UEFI firmware upgrade package verification is successful; When one of the root certificate, the sub-certificate, and the firmware signature is illegal, it is confirmed that the UEFI firmware upgrade package verification fails.

3. The firmware non-sensing upgrade method of the ARM platform as claimed in claim 1, characterized in that: The computing subsystem CSS divides the FLASH into a running area and a recovery area. When the system control processor SCP performs a firmware upgrade, the running area is flashed with the UEFI firmware upgrade package, and after the upgrade is successful, the running area and the recovery area are synchronized.

4. The firmware upgrade method for the ARM platform as claimed in claim 1, characterized in that: When the system control processor SCP is performing a firmware upgrade, the restart function and the shutdown function in the system control processor SCP are also modified so that the system restart and shutdown are not effective during the firmware upgrade, and the restart function and the shutdown function are restored after the firmware upgrade is completed.

5. The firmware upgrade method for the ARM platform as claimed in claim 1, characterized in that: After upgrading the firmware, the system control processor SCP also records the upgrading result in a designated location of the FLASH.

6. The firmware non-sensing upgrade method of the ARM platform as claimed in claim 1, characterized in that: The system control processor SCP upgrades the firmware by flashing FLASH via QSPI.

7. The firmware upgrade method for the ARM platform as claimed in claim 1, characterized in that: The security module is hardware integrated in the CPU, and the security module only performs security software interaction with the system control processor SCP and the trusted firmware ATF.

8. The firmware upgrade method for the ARM platform as claimed in claim 1, characterized in that: The computing subsystem CSS notifies the system control processor SCP to perform UEFI firmware upgrade through SCMI.

9. An ARM server system with no firmware upgrade, characterized in that: The method comprises a computing subsystem CSS, a system control processor SCP, FLASH, a memory and a security module. The security module comprises an algorithm module and an OTP module. The certificate hash of the FLASH root certificate is stored in the OTP module. The computing subsystem CSS, the system control processor SCP, FLASH, the memory and the security module execute the firmware seamless upgrade method of the ARM platform as described in any one of claims 1 to 8.

Images