FPGA-based baseboard management controller firmware encryption system

Abstract

This application discloses a firmware encryption system for a baseboard management controller based on an FPGA, belonging to the field of circuit encryption technology. The application includes an FPGA that is communicatively connected to the baseboard management controller. The FPGA includes an encryption module, a decryption module, and a firmware storage module, wherein: the encryption module is used to read firmware data and encrypt the firmware data using a preset encryption algorithm combined with the FPGA's serial number; the firmware storage module is used to store the encrypted firmware data; and the decryption module is used to decrypt the encrypted firmware data using a preset decryption algorithm. This application's solution solves the technical problem of vulnerability to attacks in existing software-level encryption methods through hardware-isolated encryption.

Description

Technical Field

[0001] This application belongs to the field of circuit encryption technology, and more specifically, relates to an FPGA-based baseboard management controller firmware encryption system. Background Technology

[0002] In modern computer systems, baseboard management controllers (BMCs) are widely used for server status monitoring. A BMC typically contains firmware used to handle server system management tasks, read real-time sensor data such as temperature, and perform remote control functions. Therefore, the security and integrity of the BMC firmware are crucial for the stable and secure operation of the server system.

[0003] Traditionally, the security of baseboard management controller firmware is mainly achieved through software-level encryption and signature technologies. However, these methods are vulnerable to malicious attacks and tampering, thus requiring a higher level of security protection to prevent unauthorized access and modification of the baseboard management controller firmware. Summary of the Invention

[0004] In view of the above-mentioned defects or improvement needs of the existing technology, this application provides an FPGA-based baseboard management controller firmware encryption system, which aims to solve the technical problem that the existing baseboard management controller firmware encryption method is vulnerable to attack.

[0005] To achieve the above objectives, in a first aspect, this application provides an FPGA-based baseboard management controller firmware encryption system, including an FPGA communicatively connected to the baseboard management controller; the FPGA includes an encryption module, a decryption module, and a firmware storage module, wherein:

[0006] The encryption module is used to encrypt firmware data using a preset encryption algorithm combined with the FPGA's serial number;

[0007] Firmware storage module, used to store encrypted firmware data;

[0008] The decryption module is used to read encrypted firmware data from the firmware storage module and decrypt the encrypted firmware data using a preset decryption algorithm.

[0009] Preferably, in the encryption module, a preset encryption algorithm is used in conjunction with the FPGA serial number to encrypt the firmware data. Specifically, a key for the encryption algorithm is generated based on the serial number, and the firmware data is encrypted using the key and the preset encryption algorithm.

[0010] Preferably, in the encryption module, a preset encryption algorithm is used in conjunction with the FPGA serial number to encrypt the firmware data. Specifically, the preset encryption algorithm parameters or initial vector are generated based on the serial number, and the preset encryption algorithm is used to encrypt the firmware data.

[0011] Preferably, in the encryption module, a preset encryption algorithm is used in conjunction with the FPGA serial number to encrypt the firmware data. Specifically, the preset encryption algorithm is used to encrypt the firmware data, and the serial number is appended to the encrypted firmware data.

[0012] Preferably, in the encryption module, symmetric encryption technology is used to encrypt firmware data, and asymmetric encryption technology is used to encrypt the key in the symmetric encryption technology.

[0013] Preferably, the encryption module includes an encryption algorithm unit and a key management unit; the key management unit is used to generate and manage keys; the encryption algorithm unit is used to obtain keys from the key management unit and encrypt firmware data using a preset encryption algorithm.

[0014] Preferably, the system also includes an integrity verification module, which is used to perform integrity verification on the firmware data before encryption and after decryption. If the integrity verification fails, the system's security response mechanism is triggered.

[0015] Preferably, the integrity verification module is specifically used to: generate a first verification value by combining the firmware data before encryption and the serial number, generate a second verification value by combining the decrypted firmware data and the serial number, compare the first verification value and the second verification value, and trigger the system's security response mechanism if they are not equal.

[0016] Preferably, it also includes a status monitoring module, which is used to monitor the upload encryption and decryption operations in real time.

[0017] Secondly, this application provides a firmware encryption method for a baseboard management controller based on an FPGA. The method is applied to any of the systems described in the first aspect and specifically includes the following steps:

[0018] The serial number generated by the FPGA is used to generate two symmetric keys for a symmetric encryption algorithm, and one of the symmetric keys is encrypted using the public key of an asymmetric encryption algorithm.

[0019] Upon receiving the firmware update command, the FPGA reads the firmware data from the baseboard management controller, generates a first verification value by applying integrity verification technology to the firmware data, and encrypts the firmware data using an unencrypted symmetric key.

[0020] Before the baseboard management controller starts, the FPGA uses the private key of the asymmetric encryption algorithm to decrypt the encrypted symmetric key, and then uses the decrypted symmetric key to decrypt the encrypted firmware data; the decrypted firmware data is used to generate a second verification value using integrity verification technology; the first verification value and the second verification value are compared. If they are the same, the decrypted firmware data is written to the baseboard management controller and started; if they are different, the system's security response mechanism is triggered.

[0021] Overall, the technical solutions conceived in this application have the following beneficial effects compared with the prior art:

[0022] (1) In traditional methods, the security protection of the baseboard management controller firmware is mainly achieved through software-level encryption and signature technologies. In this application, the baseboard management controller firmware is encrypted using an FPGA, which isolates the firmware data that needs protection at the physical level. Therefore, the encryption scheme of this application is more difficult to crack and attack. At the same time, the programmability and high-speed processing capability of the FPGA ensure the efficiency and flexibility of firmware upgrades.

[0023] (2) This application integrates the unique serial number of the FPGA into the encryption algorithm, thereby further reducing the impact of software on encryption, increasing the difficulty of cracking the encryption algorithm, and improving the security of firmware encryption.

[0024] (3) This application integrates encryption algorithms and integrity verification to further ensure that firmware data will not be maliciously tampered with. Attached Figure Description

[0025] Figure 1 This is a schematic diagram of the structure of an FPGA-based baseboard management controller firmware encryption system provided in an embodiment of this application.

[0026] Figure 2 This is a flowchart of a firmware encryption method for a baseboard management controller based on an FPGA, provided in an embodiment of this application. Detailed Implementation

[0027] To make the objectives, technical solutions, and advantages of this application clearer, the following detailed description is provided in conjunction with the accompanying drawings and embodiments. It should be understood that the specific embodiments described herein are merely illustrative and not intended to limit the scope of this application.

[0028] The terms "first" and "second," etc., used in the specification and claims herein are used to distinguish different objects, not to describe a specific order of objects. For example, "first check value" and "second check value," etc., are used to distinguish different check values, not to describe a specific order of check values.

[0029] In the embodiments of this application, the terms "exemplary" or "for example" are used to indicate that something is an example, illustration, or description. Any embodiment or design that is described as "exemplary" or "for example" in the embodiments of this application should not be construed as being more preferred or advantageous than other embodiments or design. Specifically, the use of the terms "exemplary" or "for example" is intended to present the relevant concepts in a specific manner.

[0030] In the description of the embodiments of this application, unless otherwise stated, "multiple" means two or more, for example, multiple processing units means two or more processing units, multiple elements means two or more elements, etc.

[0031] like Figure 1 As shown, an FPGA-based firmware encryption system for a baseboard management controller is provided in an embodiment of this application. The baseboard management controller firmware encryption system includes an FPGA that is communicatively connected to the baseboard management controller.

[0032] The FPGA serves as the core of the firmware data encryption system for the baseboard management controller. The encryption and decryption of firmware data are all performed within the FPGA, thereby isolating the firmware data that needs protection at the physical level, making the firmware data difficult to crack and attack.

[0033] The FPGA includes an encryption module, a decryption module, a firmware storage module, an integrity verification module, and a status monitoring module. In this embodiment, the FPGA is an FPGA.

[0034] Upon receiving the firmware update command, the integrity verification module is activated, directly reading firmware data from the firmware memory of the baseboard management controller, and generating the first verification value by combining the firmware data and the FPGA serial number.

[0035] The encryption module is then activated, using a preset encryption algorithm combined with the FPGA's serial number to encrypt the firmware data.

[0036] In this embodiment, a combination of symmetric and asymmetric encryption algorithms is selected as the preset encryption algorithm. Specifically, a symmetric encryption algorithm is selected to encrypt the firmware data, while an asymmetric encryption algorithm is selected to encrypt the key of the symmetric encryption algorithm.

[0037] Alternatively, one or more combinations of hash algorithms, message authentication code algorithms, and digital signature algorithms can be used as preset encryption algorithms to encrypt firmware data.

[0038] In this embodiment, the firmware data is encrypted using the FPGA's unique serial number combined with an encryption algorithm. Specifically, a key for the encryption algorithm is generated based on the FPGA's unique serial number, and then the firmware data is encrypted using this key. This integrates the hardware serial number into the encryption algorithm, thereby further reducing the influence of software on encryption, increasing the difficulty of cracking the encryption algorithm, and improving the security of firmware encryption.

[0039] In this embodiment, a key is first randomly generated, then the serial number is embedded into the key to generate a new key, and then the new key is used to encrypt the firmware data.

[0040] Optionally, in this embodiment, the serial number can be input into a key derivation function to generate a key.

[0041] Optionally, in this embodiment, parameters for a preset encryption algorithm are generated based on the serial number, and the preset encryption algorithm is used to encrypt the firmware data.

[0042] Optionally, in this embodiment, the firmware data can be encrypted using a preset encryption algorithm, and the serial number can be appended to the encrypted firmware data. The appending method can be in the form of splicing or insertion, thus forming new encrypted firmware data.

[0043] In this application, the generated new key is used as the symmetric key for a symmetric encryption algorithm to encrypt the firmware data. Simultaneously, the public key of an asymmetric encryption algorithm is used to encrypt the symmetric key.

[0044] The encryption module includes an encryption algorithm unit and a key management unit. The key management unit is used to generate and manage keys; in this embodiment, it is used to generate and manage the symmetric key for the symmetric encryption algorithm, and the public and private keys for the asymmetric encryption algorithm. All keys are stored in the non-volatile storage area of ​​the FPGA to ensure that the keys are not lost after the FPGA is powered off. The symmetric key before encryption is distributed to the encryption algorithm unit, and the symmetric key and the private key of the asymmetric key after encryption are distributed to the decryption module.

[0045] The encryption algorithm unit is used to obtain a symmetric key from the key management unit and encrypt the firmware data using a preset encryption algorithm.

[0046] The encrypted firmware data is stored in the firmware storage module, which is located in the memory of the FPGA, specifically NAND Flash or NOR Flash.

[0047] The decryption module is used to retrieve encrypted firmware data from the firmware storage module and decrypt the encrypted firmware data using a preset decryption algorithm.

[0048] In this embodiment, the decryption module obtains the private key and the encrypted symmetric key from the key management unit in the asymmetric encryption algorithm. It first uses the private key to decrypt the symmetric key, and then uses the decrypted symmetric key to decrypt the encrypted firmware data, finally obtaining the decrypted firmware data.

[0049] The integrity verification module combines the decrypted firmware data and serial number to generate a second verification value. This value is then compared to the first verification value. If they are not equal, the system's security response mechanism is triggered. Otherwise, the decrypted firmware data is written to the baseboard management controller.

[0050] Upon receiving the firmware update instruction, the integrity verification module, encryption module, and firmware storage module are invoked to encrypt the firmware data in the baseboard management controller's memory.

[0051] Each time the baseboard management controller starts up, it calls the firmware storage module, decryption module, and integrity verification module to decrypt the encrypted firmware data. After decryption, the firmware data is sent to the baseboard management controller for execution. This ensures that the firmware data sent to the baseboard management controller each time it runs is tamper-proof and can be used normally.

[0052] like Figure 2 As shown in the figure, this application embodiment also implements a firmware encryption method for a baseboard management controller based on FPGA, including the following steps:

[0053] Before encrypting or decrypting firmware data, the FPGA will generate two symmetric keys based on the FPGA's serial number and encrypt one of the symmetric keys using the public key of an asymmetric encryption algorithm.

[0054] Upon receiving the firmware update command, the FPGA reads the firmware data from the baseboard management controller, generates a first verification value by using integrity verification technology on the firmware data, and encrypts the firmware data using an unencrypted symmetric key.

[0055] Before the baseboard management controller is started, the FPGA uses the private key of the asymmetric encryption algorithm to decrypt the encrypted symmetric key, and then uses the decrypted symmetric key to decrypt the encrypted firmware data; the decrypted firmware data is used to generate a second verification value using integrity verification technology; the first verification value and the second verification value are compared. If they are the same, the decrypted firmware data is written to the baseboard management controller and the baseboard management controller is started; otherwise, the system's security response mechanism is triggered.

[0056] It is understood that the various numerical designations used in the embodiments of this application are merely for descriptive convenience and are not intended to limit the scope of the embodiments of this application.

[0057] The above content is readily understood by those skilled in the art. The above description is merely a preferred embodiment of this application and is not intended to limit this application. Any modifications, equivalent substitutions, and improvements made within the spirit and principles of this application should be included within the protection scope of this application.

Claims

1. A firmware encryption system for a baseboard management controller based on an FPGA, characterized in that, This includes an FPGA that communicates with the baseboard management controller; the FPGA includes an encryption module, a decryption module, and a firmware storage module, wherein: An encryption module is used to read the firmware data in the baseboard management controller after receiving a firmware update instruction, and encrypt the firmware data using a preset encryption algorithm combined with the FPGA serial number. Firmware storage module, used to store encrypted firmware data; The decryption module is used to read the encrypted firmware data from the firmware storage module before the baseboard management controller starts, and decrypt the encrypted firmware data using a preset decryption algorithm. The integrity verification module is used to generate a first verification value by combining the firmware data before encryption and the serial number, and to generate a second verification value by combining the decrypted firmware data and the serial number. The first verification value and the second verification value are compared. If they are not equal, the system's security response mechanism is triggered; otherwise, the decrypted firmware data is written to the baseboard management controller.

2. The firmware encryption system for the baseboard management controller according to claim 1, characterized in that, In the encryption module, a preset encryption algorithm is used in conjunction with the FPGA's serial number to encrypt the firmware data. Specifically, a key for the encryption algorithm is generated based on the serial number, and the firmware data is encrypted using the key and the preset encryption algorithm.

3. The firmware encryption system for the baseboard management controller according to claim 1, characterized in that, In the encryption module, a preset encryption algorithm is used in conjunction with the FPGA serial number to encrypt the firmware data. Specifically, the preset encryption algorithm parameters or initial vector are generated based on the serial number, and the preset encryption algorithm is used to encrypt the firmware data.

4. The firmware encryption system for the baseboard management controller according to claim 1, characterized in that, In the encryption module, a preset encryption algorithm is used in conjunction with the FPGA serial number to encrypt the firmware data. Specifically, the preset encryption algorithm is used to encrypt the firmware data, and the serial number is appended to the encrypted firmware data.

5. The firmware encryption system for the baseboard management controller according to claim 1, characterized in that, In the encryption module, symmetric encryption technology is used to encrypt firmware data, while asymmetric encryption technology is used to encrypt the key in the symmetric encryption technology.

6. The firmware encryption system for the baseboard management controller according to claim 1, characterized in that, The encryption module includes an encryption algorithm unit and a key management unit; the key management unit is used to generate and manage keys; the encryption algorithm unit is used to obtain keys from the key management unit and encrypt firmware data using a preset encryption algorithm.

7. The firmware encryption system for the baseboard management controller according to claim 1, characterized in that, It also includes a status monitoring module, which is used to monitor the upload encryption and decryption operations in real time.

8. A firmware encryption method for a baseboard management controller based on FPGA, characterized in that, The method, when applied to the system according to any one of claims 1-7, specifically includes the following steps: The serial number generated by the FPGA is used to generate two symmetric keys for a symmetric encryption algorithm, and one of the symmetric keys is encrypted using the public key of an asymmetric encryption algorithm. Upon receiving the firmware update command, the FPGA reads the firmware data from the baseboard management controller, generates a first verification value by applying integrity verification technology to the firmware data, and encrypts the firmware data using an unencrypted symmetric key. Before the baseboard management controller starts, the FPGA uses the private key of the asymmetric encryption algorithm to decrypt the encrypted symmetric key, and then uses the decrypted symmetric key to decrypt the encrypted firmware data; the decrypted firmware data is used to generate a second verification value using integrity verification technology; the first verification value and the second verification value are compared. If they are the same, the decrypted firmware data is written to the baseboard management controller and started; if they are different, the system's security response mechanism is triggered.

Images