A firmware boot control system for a server

Abstract

The application relates to a server firmware startup control system, which comprises a storage module, a physical storage medium and a data processing device. The storage module comprises a basic input / output system and an initial encryption key, and the physical storage medium comprises a self-defined database and a secondary encryption key. The data processing device loads and executes the basic input / output system additional module through verification of the initial and secondary encryption keys. The system adopts a dynamic security token generated by an independent security module for authentication, and dynamically adjusts the authentication process based on the system environment and security requirements. An update module is used for dynamically updating the encryption key, so that the security of the system is improved. An intelligent algorithm is used for real-time evaluation and adjustment of the key and security token strategy, and a log recording and feedback mechanism is used for optimizing the system performance.

Description

Technical Field

[0001] This invention relates to the field of server technology, and more specifically to a firmware boot control system for servers. Background Technology

[0002] With the rapid development of information technology, servers are increasingly widely used in various fields. As a core device for information processing and storage, the security and reliability of the server's firmware boot control system directly affect the stable operation of the entire system and the security protection of data. The firmware boot control system mainly includes the basic input / output system, which is the interface between computer hardware and the operating system, responsible for system startup and hardware initialization.

[0003] Since the 1980s, the traditional Basic Input / Output System (BIOS) has been the standard for computer system startup. It executes a series of preset procedures when the computer is powered on, including hardware detection, self-test (POST), and booting the operating system. However, with the continuous development of computer and network technologies, the traditional BIOS faces many new challenges and shortcomings in terms of security and flexibility.

[0004] Traditional basic input / output (BIO) systems have fixed code and startup procedures, making them easy targets for attacks. Once attackers gain control of a BIO system, they can implant malicious code that executes automatically upon system startup, thus compromising the entire system. Common attack methods include BIO viruses, firmware tampering, and malicious code injection.

[0005] Furthermore, traditional basic input / output systems lack effective security authentication mechanisms, allowing any unauthorized code to be executed, which further increases the system's security risks. To address these issues, modern basic input / output systems have gradually introduced various security mechanisms, such as program authentication based on cryptographic signatures and hardware-based security modules, to improve system security.

[0006] Traditional basic input / output (BIO) systems are highly closed and fixed in design, lacking flexibility and scalability. This design approach cannot adapt to constantly changing hardware environments and user needs. For example, when new hardware devices or peripherals are added to the system, traditional BIO systems may fail to recognize and correctly configure these devices, requiring manual setup and adjustments. Summary of the Invention

[0007] To address the aforementioned problems in the prior art, this invention proposes a firmware boot control system for a server, comprising: a storage module 101, the storage module 101 including a basic input / output system and a database 103, the database 103 including an initial encryption key 104, used to authenticate an initial program executable by the basic input / output system by verifying the initial encryption identifier;

[0008] The physical storage medium 102 includes a custom database 105, which contains a secondary encryption key 106 for authenticating a secondary program executable by the basic input / output system by verifying the secondary encryption identifier.

[0009] Data processing device 107, the data processing device 107 being used to load a basic input / output system add-on module into the basic input / output system through the following steps:

[0010] The initial encryption key 104 is determined not to contain a key for authenticating the Basic Input / Output System Add-on Module (PIS Module); the secondary encryption key 106 is determined to contain a dedicated key for authenticating the PIS Module; the PIS Module is authenticated using the dedicated key and a dynamically generated security token; after authentication, the PIS Module is loaded and executed.

[0011] The security token is generated by the data processing device 107 sending a request to an independent security module using a recorded dedicated key. The independent security module uses the dedicated key to perform encryption operations and generates a unique identifier based on the system's current timestamp and dynamic parameters of the hardware status. It then combines the encryption operation result and the unique identifier to generate a dynamic security token. The independent security module returns the generated dynamic security token to the data processing device 107.

[0012] Both the storage module 101 and the physical storage medium 102 include an update module for dynamically updating the encryption key. The update module is connected to the security module to receive the security token generated by the security module and trigger the dynamic update process based on the verification result of the security token. When a potential security threat is detected or a technology update requirement is received, the update module automatically generates a new encryption key and distributes it to the corresponding storage module 101 and physical storage medium 102 through a secure channel to replace the old encryption key.

[0013] The loading and authentication process of the basic input / output system add-on modules is dynamically adjusted according to changes in the system environment and security requirements. The data processing device 107 integrates intelligent algorithms to evaluate the current security status in real time and dynamically adjust the key and security token generation strategies during the authentication process. The intelligent algorithm analyzes the system's operating data in real time and dynamically adjusts the key update frequency, key strength, and security token generation strategy based on the evaluation results. Detailed logs of each authentication and key update are recorded through a feedback mechanism, and the parameters and strategies of the intelligent algorithm are adjusted according to the analysis results.

[0014] The security module is equipped with a timer, which is set to periodically trigger the security token generation process. When the timer is triggered, the security module collects the current system status information, obtains the current timestamp (T) and system status information (S), generates a hash value H1 = SHA-256(T||S), and uses a dedicated key K to generate the final token L = HMAC(K,H1). The generated security token is sent to the update module and data processing device 107 through a secure channel.

[0015] The intelligent algorithm collects system operation data in real time, including CPU utilization, memory usage, network traffic, hardware status, and external threats.

[0016] After collecting the operational data, the intelligent algorithm uses a smoothing algorithm to remove random fluctuations and noise from the data; it converts data from different sources to a unified standard range, extracts key features such as average CPU load, peak memory usage, and network traffic change rate from the raw data, analyzes the preprocessed data, and assesses the current security status.

[0017] The intelligent algorithm determines the key update frequency based on the system's security status and threat assessment results; selects a stronger encryption algorithm and a longer key length according to the current threat level, and dynamically adjusts the security token generation parameters.

[0018] The data processing device 107 modifies the key update time interval and conditions according to the adjustment strategy provided by the intelligent algorithm, generates and distributes new keys, modifies the security token generation algorithm and parameters, and adjusts the system configuration parameters.

[0019] The firmware boot control system is applied to the server.

[0020] The server firmware boot control system of the present invention has the following beneficial effects:

[0021] An initial and secondary encryption key authentication mechanism ensures that only trusted programs can execute, preventing unauthorized code from running. A dynamic security token and update module are employed to dynamically update encryption keys, improving the system's responsiveness to potential security threats. Integrated intelligent algorithms evaluate and adjust key and security token generation strategies in real time during the authentication process, enhancing the system's adaptability and security. A dedicated security module generates unique dynamic security tokens, improving the security and reliability of encryption operations. Detailed logging and feedback mechanisms continuously optimize the intelligent algorithm, improving the overall security performance and operational efficiency of the system. Attached Figure Description

[0022] The accompanying drawings, which are provided to further illustrate the invention and form part of this application, are not intended to unduly limit the invention. In the drawings:

[0023] Figure 1 This is a schematic diagram of the firmware boot control system of the server of the present invention. Detailed Implementation

[0024] The present invention will now be described in detail with reference to the accompanying drawings and specific embodiments. The illustrative embodiments and descriptions are only used to explain the present invention and are not intended to limit the present invention.

[0025] Example 1: Firmware boot control system structure for a server

[0026] like Figure 1 As shown, this embodiment provides a firmware boot control system for a server. The system includes a storage module 101 and a physical storage medium 102, wherein the storage module 101 includes a basic input / output system and a database 103, and the database 103 includes one or more sets of initial encryption keys 104, which can be used to authenticate an initial program executable by the basic input / output system by verifying one or more initial encryption identifiers associated with the initial program.

[0027] The physical storage medium 102 differs from the storage module 101 in that it includes a custom database 105 containing one or more sets of secondary encryption keys 106, which can be used to authenticate a secondary program executable by the basic input / output system by verifying one or more secondary encryption identifiers associated with the secondary program.

[0028] Data processing device 107 is configured to load a basic input / output system add-on module into the basic input / output system through the following steps:

[0029] 1. Key determination:

[0030] a. The data processing device 107 first accesses the database 103 in the storage module 101.

[0031] b. The data processing device 107 retrieves the initial encryption key 104 stored in the database 103.

[0032] c. The data processing device 107 verifies whether the initial encryption key 104 contains a key capable of authenticating the basic input / output system add-on module.

[0033] d. If the initial encryption key 104 does not contain any key that can be used to authenticate the basic input / output system add-on module, the data processing device 107 records this state.

[0034] 2. Private Key Verification:

[0035] a. The data processing device 107 accesses the custom database 105 in the physical storage medium 102.

[0036] b. The data processing device 107 retrieves the secondary encryption key 106 stored in the custom database 105.

[0037] c. The data processing device 107 verifies whether the secondary encryption key 106 contains a dedicated key capable of authenticating the basic input / output system add-on module.

[0038] d. If the secondary encryption key 106 contains a special key that can be used to authenticate the basic input / output system add-on module, the data processing device 107 records the key.

[0039] 3. Dynamically generate security tokens:

[0040] a. The data processing device 107 sends a request to an independent security module using a recorded private key to generate a dynamic security token.

[0041] b. An independent security module generates a unique dynamic security token based on the current system state and a private key. The generation process includes:

[0042] Encryption operations are performed using a dedicated key;

[0043] A unique identifier is generated based on dynamic parameters such as the system's current timestamp and hardware status.

[0044] The result of the encryption operation and the unique identifier are combined to generate a dynamic security token.

[0045] c. The independent security module returns the generated dynamic security token to the data processing device 107.

[0046] 4. Loading and execution:

[0047] a. The data processing device 107 uses a dynamic security token and a private key to authenticate the basic input / output system add-on module.

[0048] b. If authentication is successful, the data processing device 107 loads the basic input / output system add-on module into the basic input / output system.

[0049] c. The data processing unit 107 starts and executes the loaded basic input / output system add-on module to expand the functionality of the basic input / output system.

[0050] In this embodiment, the above content ensures the security and reliability of the server firmware boot control system. Dynamically generated security tokens provide uniqueness and security for each loading process, avoiding potential security risks associated with static keys. The data processing device 107 works in conjunction with an independent security module, employing intelligent algorithms and encryption technology to achieve dynamic and secure authentication and loading processes. This implementation ensures the system's flexibility and adaptability under different operating environments and security requirements.

[0051] Example 2: Dynamic Key Update and Dynamic Authentication Adjustment

[0052] The control system of the present invention also includes a dynamic key update mechanism and a dynamic authentication adjustment mechanism, which are implemented as follows:

[0053] 1. Dynamic key update:

[0054] a. Both storage module 101 and physical storage medium 102 include an update module for dynamically updating the encryption key. The update module is connected to the security module to receive a security token generated by the security module and trigger the dynamic update process based on the verification result of the security token.

[0055] b. The update module is configured to periodically check the validity of the initial encryption key 104 and the secondary encryption key 106. The check process includes:

[0056] Read each key from the initial encryption key 104 and the secondary encryption key 106;

[0057] Perform integrity verification on each key to check for any signs of tampering or invalidation;

[0058] The validity and security of the key are determined based on preset security policies and standards.

[0059] c. Upon detecting a potential security threat or receiving a technology update request, the update module automatically generates a new encryption key. The process of generating a new encryption key includes:

[0060] Choose an appropriate encryption algorithm, such as AES, RSA, or elliptic curve cryptography (ECC);

[0061] Generate a key pair or symmetric key based on the selected encryption algorithm;

[0062] The newly generated encryption key is encrypted to prevent unauthorized access during transmission and storage.

[0063] d. The new encryption key is distributed via a secure channel to the corresponding storage module 101 and physical storage medium 102 to replace the old encryption key. The distribution process includes:

[0064] Encrypted communication is performed using a security token generated by the security module;

[0065] Ensure the confidentiality and integrity of key transmission;

[0066] Replace the old key on the target storage device and perform storage verification on the new key.

[0067] 2. Dynamic authentication adjustments:

[0068] a. The loading and authentication process of the basic input / output system add-on modules is dynamically adjusted according to changes in the system environment and security requirements. The data processing device 107 integrates intelligent algorithms that can assess the current security status in real time and dynamically adjust the key and security token generation strategies during the authentication process.

[0069] b. Intelligent algorithms analyze system operational data in real time, including hardware status, software configuration, and external threats. The analysis process includes:

[0070] Collect system hardware status data, such as CPU utilization, memory usage, and hard drive read / write speed;

[0071] Collect software configuration data, such as operating system version, installed applications, currently running services, etc.

[0072] Monitor external threat information, such as network attack logs, abnormal access records, and system vulnerability reports.

[0073] c. Based on the evaluation results, the intelligent algorithm dynamically adjusts the key update frequency, key strength, and security token generation strategy. The adjustment process includes:

[0074] Determine the frequency and timing of key updates based on current system security requirements;

[0075] Adjust the encryption algorithm and key length used to generate the key to ensure that the key strength meets current security standards;

[0076] The security token generation strategy is dynamically adjusted, including the token generation algorithm, validity period, and complexity, to adapt to different security requirements.

[0077] d. Intelligent algorithms continuously optimize and improve the authentication process through feedback mechanisms. These feedback mechanisms include:

[0078] Record detailed logs for each authentication and key update, including time, operation details, and results;

[0079] Analyze log data to identify potential security vulnerabilities and areas for improvement;

[0080] Based on the analysis results, the parameters and strategies of the intelligent algorithm are adjusted to improve the overall security and adaptability of the system.

[0081] The detailed steps outlined above ensure the security and reliability of the server firmware boot control system in dynamic environments. The combination of dynamic key update and dynamic authentication adjustment mechanisms enables the system to respond to security threats and technical needs in real time, providing efficient and secure key management and authentication services.

[0082] Example 3: Security Module and Real-time Monitoring

[0083] The independent security module plays a crucial role in this invention, and its functions and specific implementation are as follows:

[0084] 1. Security Token Generation:

[0085] a. The security module is configured with a timer, which is set to periodically trigger the security token generation process. The time interval for the generation process can be adjusted according to system requirements, such as every 1 hour or every 24 hours.

[0086] b. When the timer is triggered, the security module collects current system status information, including timestamps, system load, network status, etc.

[0087] c. The security module uses a preset encryption algorithm (such as SHA-256, HMAC, etc.) to combine system status information with a specific private key to generate a unique security token. The specific algorithm steps are as follows:

[0088] Get the current timestamp (T) and system status information (S).

[0089] Generate a hash value H1 = SHA-256(T||S).

[0090] The final token L = HMAC(K, H1) is generated using the private key K.

[0091] d. The generated security token is sent to the update module and data processing device 107 through a secure channel for subsequent authentication and key update processes.

[0092] 2. Real-time monitoring and recording:

[0093] a. The safety module is equipped with multiple sensors and monitoring units for real-time monitoring of the system's operational status. The monitored content includes, but is not limited to:

[0094] Encryption key usage: Record the generation, use, and destruction time of each key.

[0095] The security token generation and verification process: Record the time of each security token generation, the participating system status information, the generated hash value, and the final token.

[0096] System security events and abnormal behaviors: Monitor and record security events such as abnormal login attempts, unauthorized access, and data tampering.

[0097] b. Real-time monitoring data is stored in the security module's built-in database and protected by encryption to ensure data integrity and confidentiality.

[0098] 3. Record keeping and auditing:

[0099] a. The security module keeps detailed records of all authentication and key update operations, including operation time, operation type, keys and tokens involved, and operation results.

[0100] b. Recorded data is stored in a structured manner to facilitate subsequent queries and analysis. For example, each record includes the following fields:

[0101] Timestamp: The time when the operation occurred.

[0102] Operation types: such as key generation, key verification, security token generation, etc.

[0103] Participation Key / Token: Identifiers of the key and token used in the operation.

[0104] Operation result: success or failure, and related error messages.

[0105] c. System administrators can access and analyze these records through the auditing interface provided by the security module. The auditing interface supports various query and filtering conditions, such as filtering by time range, operation type, and operation result.

[0106] d. The security module generates audit reports periodically, including the system's security status, common security incidents, and potential security issues. These reports are sent to the system administrator via encrypted email or a secure communication channel.

[0107] Through the detailed steps outlined above, this embodiment ensures the security and auditability of the server firmware boot control system. The security module, by generating security tokens, real-time monitoring, and detailed logging, achieves comprehensive monitoring and management of the system's operational status, providing reliable security and problem tracing capabilities. These functions ensure that the system maintains a high level of security and reliability even in complex and ever-changing security environments.

[0108] Example 4: Application of Intelligent Algorithms

[0109] To achieve dynamic adjustment and optimization, the system of this invention integrates intelligent algorithms, the specific applications of which are as follows:

[0110] 1. Real-time assessment:

[0111] a. Intelligent algorithms collect system operational data in real time. Data sources include:

[0112] CPU utilization: Real-time CPU usage is obtained through system monitoring tools, and the utilization rate at each point in time is recorded.

[0113] Memory usage: Monitor memory usage, including used memory, free memory, and memory usage trends.

[0114] Network traffic: Obtain system network traffic data through network monitoring tools, and record the inflow and outflow traffic for each time period.

[0115] Hardware status: Monitor the operating status of hardware devices, including hard drive read / write speed, temperature sensor data, fan speed, etc.

[0116] External threats: Collect and analyze threat intelligence from system firewall logs, intrusion detection systems (IDS), and intrusion prevention systems (IPS).

[0117] b. After data collection, intelligent algorithms preprocess the data, including noise removal, data standardization, and feature extraction. The preprocessing steps are as follows:

[0118] Noise removal: Use smoothing algorithms (such as moving averages) to remove random fluctuations and noise from the data.

[0119] Data standardization: Converting data from different sources to a unified standard for subsequent processing.

[0120] Feature extraction: Extract key features from the raw data, such as average CPU load, peak memory usage, and network traffic change rate.

[0121] c. Intelligent algorithms analyze the preprocessed data to assess the current security status. Analysis methods include:

[0122] Statistical analysis: Calculate the statistical characteristics of various indicators, such as mean, variance, peak value, etc.

[0123] Anomaly detection: Using machine learning algorithms (such as Isolation Forest, Support Vector Machine, etc.) to detect anomalous patterns in data.

[0124] Threat assessment: Based on external threat intelligence, assess the potential threats currently facing the system.

[0125] 2. Dynamic adjustment strategy:

[0126] a. Based on real-time evaluation results, the intelligent algorithm formulates a dynamic adjustment strategy. The strategy includes:

[0127] Adjust the key update frequency: Determine the key update frequency based on the system's security status and threat assessment results. Increase the update frequency for high-risk states and appropriately decrease the update frequency for low-risk states.

[0128] Enhance key strength: Select a stronger encryption algorithm and a longer key length based on the current threat level. Algorithm choices include AES-256, RSA-4096, etc.

[0129] Modify security token generation rules: Dynamically adjust security token generation parameters, such as token validity period, complexity, and generation algorithm.

[0130] b. Intelligent algorithms use optimization algorithms (such as genetic algorithms, particle swarm optimization, etc.) to optimize the adjustment strategy, ensuring that safety requirements are met while minimizing the impact on system performance.

[0131] 3. Implement adjustments:

[0132] a. The data processing device 107 adjusts the system configuration and authentication process in real time according to the adjustment strategy provided by the intelligent algorithm. Specific operations include:

[0133] Update key management policy: Modify the key update interval and conditions, and generate and distribute new keys.

[0134] Adjust the security token generation strategy: Modify the security token generation algorithm and parameters to ensure that the generated tokens meet the new security requirements.

[0135] Configure system parameters: Adjust system configuration parameters, such as memory allocation and process priority, to optimize system performance.

[0136] b. The data processing device 107 communicates with the storage module 101 and the physical storage medium 102 through a secure channel to ensure that the execution process of the adjustment strategy is safe and reliable.

[0137] 4. User interaction:

[0138] a. The intelligent algorithm provides a user interface that allows system administrators to view analysis results and adjust strategies. The user interface includes:

[0139] Real-time monitoring dashboard: Displays key system metrics and current security status.

[0140] Adjustment strategy recommendations: Provide dynamic adjustment suggestions based on the analysis results of intelligent algorithms.

[0141] Historical data query: Allows administrators to query and analyze historical operational data and adjustment records.

[0142] b. System administrators can manually intervene and optimize through the user interface. Operations include:

[0143] Manually adjust the key update strategy: Modify the frequency and conditions of key updates according to specific needs.

[0144] Adjust security token generation rules: Manually modify the token generation parameters according to the actual situation.

[0145] Optimize system configuration: Manually adjust system configuration parameters based on operating status to ensure optimal performance.

[0146] Through the detailed steps outlined above, this embodiment ensures the dynamic adjustment and optimization capabilities of the server firmware boot control system. Intelligent algorithms, through real-time evaluation, dynamic adjustment, and user interaction, provide a flexible and efficient security management solution, ensuring the system maintains high security and high performance under various environments.

[0147] Through the above embodiments, the server firmware boot control system provided by this invention can not only dynamically update encryption keys and security tokens, but also dynamically adjust them through intelligent algorithms, further improving the system's security, reliability, and operating efficiency. This system is suitable for various complex server environments and can effectively cope with constantly changing security threats and technical requirements.

[0148] The above description is only a preferred embodiment of the present invention. Therefore, all equivalent changes or modifications made to the structure, features and principles described in the claims of this patent application are included in the scope of this patent application.

Claims

1. A firmware boot control system for a server, characterized in that: The control system includes a storage module (101) containing a basic input / output system and a database (103) containing an initial encryption key (104) for authenticating an initial program executable by the basic input / output system by verifying the initial encryption identifier; The physical storage medium (102) includes a custom database (105) containing a secondary encryption key (106) for authenticating a secondary program executable by the basic input / output system by verifying the secondary encryption identifier; Data processing device (107), said data processing device (107) is used to load a basic input / output system add-on module into the basic input / output system through the following steps: Determine that the initial encryption key (104) does not contain a key for authenticating the Basic Input / Output System Add-on Module; determine that the secondary encryption key (106) contains a private key for authenticating the Basic Input / Output System Add-on Module; authenticate the Basic Input / Output System Add-on Module using the private key and a dynamically generated security token; after authentication, load and execute the Basic Input / Output System Add-on Module; Both the storage module (101) and the physical storage medium (102) include an update module for dynamically updating the encryption key. The update module is connected to the security module to receive the security token generated by the security module and trigger the dynamic update process based on the verification result of the security token. When a potential security threat is detected or a technology update requirement is received, the update module automatically generates a new encryption key and distributes it to the corresponding storage module (101) and physical storage medium (102) through a secure channel to replace the old encryption key. The loading and authentication process of the basic input / output system add-on module is dynamically adjusted according to changes in the system environment and security requirements. The data processing device (107) integrates intelligent algorithms to evaluate the current security status in real time and dynamically adjust the key and security token generation strategies in the authentication process. The intelligent algorithm analyzes the system's operational data in real time and dynamically adjusts the key update frequency, key strength, and security token generation strategy based on the evaluation results. The system uses a feedback mechanism to record detailed logs of each authentication and key update, and adjusts the parameters and strategies of the intelligent algorithm based on the analysis results.

2. The firmware boot control system for a server as described in claim 1, characterized in that: The security token is requested by the data processing device (107) through a recorded dedicated key to an independent security module. The independent security module uses the dedicated key to perform encryption operations and generates a unique identifier based on the current system timestamp and dynamic parameters of the hardware status. It then combines the encryption operation result and the unique identifier to generate a dynamic security token. The independent security module returns the generated dynamic security token to the data processing device (107).

3. A firmware boot control system for a server as described in claim 2 or 1, characterized in that: The security module is equipped with a timer, which is set to periodically trigger the security token generation process. When the timer is triggered, the security module collects the current system status information, obtains the current timestamp T and system status information S, generates a hash value H1=SHA-256(T||S), and uses a special key K to generate the final token L=HMAC(K,H1). The generated security token is sent to the update module and the data processing device (107) through a secure channel.

4. The firmware boot control system for a server as described in claim 1, characterized in that: The intelligent algorithm collects system operation data in real time, including CPU utilization, memory usage, network traffic, hardware status, and external threats.

5. The firmware boot control system for a server as described in claim 4, characterized in that: After collecting the operational data, the intelligent algorithm uses a smoothing algorithm to remove random fluctuations and noise from the data; it converts data from different sources to a unified standard range, extracts key features such as average CPU load, peak memory usage, and network traffic change rate from the raw data, analyzes the preprocessed data, and assesses the current security status.

6. The firmware boot control system for a server as described in claim 1, characterized in that: The intelligent algorithm determines the key update frequency based on the system's security status and threat assessment results; selects a stronger encryption algorithm and a longer key length according to the current threat level, and dynamically adjusts the security token generation parameters.

7. A firmware boot control system for a server as described in claim 1, 4, or 5, characterized in that: The data processing device (107) modifies the key update time interval and conditions according to the adjustment strategy provided by the intelligent algorithm, generates and distributes new keys, modifies the security token generation algorithm and parameters, and adjusts the system configuration parameters.

8. A firmware boot control system for a server as described in any one of claims 1-2, characterized in that: The firmware boot control system is applied to the server.

Images