Firmware refreshing method and device, computer equipment, medium and product

Abstract

The invention relates to a firmware refreshing method and device, computer equipment, a medium and a product. The method comprises the steps of receiving a firmware signature file corresponding to firmware to be refreshed sent by a server side, calling first logical operation hardware in a user side, performing signature verification processing on the firmware signature file, and refreshing the firmware to be refreshed according to the firmware signature file under the condition that the signature verification of the firmware signature file is passed. By the adoption of the method, firmware refreshing can be achieved, the safety of the refreshed firmware can be guaranteed, the user side can call the internal first logic operation hardware to verify the signature of the firmware signature file sent by the server side, the signature verification process is achieved in the hardware, and the user side can conveniently and rapidly verify the signature of the firmware signature file. Therefore, the firmware signature file subjected to signature verification can be physically isolated from the outside, so that the security of the file signature verification process can be improved, the accuracy of the file signature verification result is further improved, an effective refresh file is provided for further firmware refresh, and the security of the refreshed firmware is higher.

Description

Technical Field

[0001] The present application relates to the field of computer technologies, and in particular, to a firmware refreshing method, apparatus, computer device, medium, and product. Background Art

[0002] As current computer devices become more complex and at the same time more vulnerable. If the security of the firmware in a computer device cannot be guaranteed, the stability and normal operation of the computer device are easily damaged. Therefore, the security of the firmware has an inestimable impact on the security of the computer device.

[0003] In related technologies, in order to make up for the vulnerabilities in the firmware of a computer device and improve the compatibility between the firmware and other hardware, the function of the firmware can be updated by refreshing the firmware.

[0004] However, how to securely refresh the firmware has become a technical problem that urgently needs to be solved. Summary of the Invention

[0005] Based on this, in view of the above technical problems, it is necessary to provide a firmware refreshing method, apparatus, computer device, medium, and product that can securely refresh the firmware.

[0006] In a first aspect, an embodiment of the present application provides a firmware refreshing method, which includes:

[0007] Receiving a firmware signature file corresponding to a firmware to be refreshed sent by a server;

[0008] Invoking a first logical operation hardware in a client to perform a signature verification process on the firmware signature file;

[0009] When the signature verification of the firmware signature file passes, refreshing the firmware to be refreshed according to the firmware signature file.

[0010] In the technical solution of the embodiment of the present application, a firmware signature file corresponding to the firmware to be refreshed sent by the server is received, and the first logical operation hardware in the client is called to perform signature verification processing on the firmware signature file. When the firmware signature file passes the signature verification, the firmware to be refreshed is refreshed according to the firmware signature file. The above method can not only implement firmware refreshing, but also ensure the security of the refreshed firmware. Specifically, the client can call the internal first logical operation hardware to perform signature verification on the firmware signature file sent by the server, so that the signature verification process is implemented in the hardware, which can physically isolate the signed firmware signature file from the outside world, thereby improving the security of the file signature verification process, further improving the accuracy of the file signature verification result, providing an effective refreshed file for further firmware refreshing, making the security of the refreshed firmware higher, and the signature verification speed can also be improved by the first logical operation hardware for signature verification. At the same time, the above method does not require manual participation in the signature verification process, which can reduce the error of manual participation, thereby greatly improving the accuracy of the firmware signature file signature verification, providing an effective refreshed file for further firmware refreshing, making the security of the refreshed firmware higher. In addition, the above method performs signature verification on the firmware signature file through the first logical operation hardware, so that all processing in the signature verification process is executed in the register of the first logical operation hardware, avoiding the process of moving back and forth between the memory and the buffer when implementing signature verification through the firmware, thereby greatly improving the speed and efficiency of the file signature verification. Moreover, before refreshing the firmware to be refreshed, the above method can also perform signature verification on the firmware signature file to avoid the firmware signature file received by the client being tampered with during the transmission process, ensuring the security of the firmware signature file and further improving the security of the refreshed firmware.

[0011] In one of the embodiments, the firmware signature file includes the target firmware and the firmware signature of the target firmware; calling the first logical operation hardware in the client to perform signature verification processing on the firmware signature file includes:

[0012] Calling the first logical operation hardware to perform information security processing on the target firmware to obtain the actual signature information;

[0013] Decrypting the firmware signature to obtain the signature information;

[0014] Comparing the signature information with the actual signature information to perform signature verification processing on the firmware signature file.

[0015] In the technical solution of the embodiment of the present application, the first logical operation hardware is called to perform information security processing on the target firmware to obtain the actual signature information, decrypt the firmware signature to obtain the signature information, and compare the signature information with the actual signature information to perform signature verification processing on the firmware signature file. In the above method, the client can call the internal first logical operation hardware to perform information security processing on the target firmware in the firmware signature file, so that the information security processing process is implemented in the hardware, which can physically isolate the target firmware of the information security processing from the outside world, thereby improving the security of the information security processing process and further providing the accuracy of the information security processing result. On this basis, the accurate signature verification processing result of the firmware signature file can be finally obtained to prepare for the firmware security refresh.

[0016] In one embodiment, decrypting the firmware signature to obtain the signature information includes:

[0017] Decrypt the firmware signature according to the public key to obtain the signature information; the public key is stored in the memory.

[0018] The technical solution in the embodiment of the present application can adopt the elliptic curve public key cryptography algorithm to decrypt the firmware signature through the public key to obtain the signature information, so as to provide effective information for further signature verification processing, thereby ensuring the authenticity and integrity of the firmware signature file to be verified, ensuring that the firmware signature file has not been tampered with, and ensuring that the firmware signature file is sent by the private key holder.

[0019] In one embodiment, the above method further includes:

[0020] Detect whether the first logical operation hardware supports the signature verification processing function;

[0021] If the first logical operation hardware supports the signature verification processing function, call the first logical operation hardware.

[0022] In the technical solution of the embodiment of the present application, detect whether the first logical operation hardware supports the signature verification processing function, and call the first logical operation hardware when the first logical operation hardware supports the signature verification processing function. The above method can first detect whether the first logical operation hardware supports the signature verification processing function, and on this basis, can improve the success rate of calling the first logical operation hardware inside the client to successfully implement the signature verification process of the firmware signature file.

[0023] In one embodiment, refreshing the firmware to be refreshed through the firmware signature file includes:

[0024] Obtain the target firmware in the firmware signature file;

[0025] Burn the target firmware into the storage device of the firmware to be refreshed to complete the refresh of the firmware to be refreshed.

[0026] The technical solution in the embodiment of the present application obtains the target firmware in the firmware signature file, and burns the target firmware to the storage device of the firmware to be refreshed to complete the refresh of the firmware to be refreshed; the above method can directly burn the target firmware to the storage device of the firmware to be refreshed, so as to complete the firmware refresh without performing other additional operations, thereby making the refresh process relatively simple and improving the speed and efficiency of the firmware refresh.

[0027] In one of the embodiments, the firmware signature file is generated by the server by performing signature processing on the target firmware based on the refresh instruction of the firmware to be refreshed.

[0028] According to the technical solution in the embodiment of the present application, the server performs signature processing on the target firmware based on the refresh instruction of the firmware to be refreshed to generate a firmware signature file; the above method can generate a firmware signature file only when the refresh instruction is triggered, thereby improving the security of the firmware signature file.

[0029] In one embodiment, the process of signing the target firmware based on the refresh instruction of the target firmware by the server includes:

[0030] The server responds to the refresh instruction, calls the second logic operation hardware that supports the signature processing function, performs information security processing on the target firmware to generate an information summary, and signs the information summary according to the private key; the private key is stored in the solidified area of ​​the processor in the server.

[0031] According to the technical solution in the embodiment of the present application, the server responds to the refresh instruction, calls the second logic operation hardware that supports the signature processing function, performs information security processing on the target firmware to generate an information summary, and signs the information summary according to the private key, wherein the private key is stored in the solidified area of ​​the processor in the server; in the above method, the server can call the internal second logic operation hardware to perform information security processing on the target firmware, so that the information security processing process is implemented in the hardware, which can physically isolate the target firmware of the information security processing from the outside world, thereby improving the security of the information security processing process, further improving the accuracy of the obtained information security processing results, and providing effective information for further obtaining accurate signature results, and realizing information security processing through the second logic operation hardware can also improve the speed of information security processing; at the same time, the above method does not require human participation in processing, can reduce human participation errors, and can greatly improve the accuracy of the information security processing results.

[0032] In a second aspect, an embodiment of the present application provides a firmware refresh device, the device comprising:

[0033] A file receiving module, configured to receive a firmware signature file corresponding to the firmware to be refreshed sent by the server;

[0034] A signature verification processing module, configured to call the first logical operation hardware in the user device to perform signature verification processing on the firmware signature file;

[0035] A refreshing module, configured to refresh the firmware to be refreshed according to the firmware signature file when the signature verification of the firmware signature file passes.

[0036] Thirdly, an embodiment of the present application further provides a computer device, which includes a memory and a processor. The memory stores a computer program, and when the processor executes the computer program, the steps of the method in any one of the above-mentioned first aspects are implemented.

[0037] Fourthly, an embodiment of the present application further provides a computer-readable storage medium, on which a computer program is stored. When the computer program is executed by a processor, the steps of the method in any one of the above-mentioned first aspects are implemented.

[0038] Fifthly, an embodiment of the present application further provides a computer program product, which includes a computer program. When the computer program is executed by a processor, the steps of the method in any one of the above-mentioned first aspects are implemented.

[0039] The above description is only an overview of the technical solution of the present application. In order to be able to understand the technical means of the present application more clearly, it can be implemented according to the content of the specification. And in order to make the above and other purposes, features and advantages of the present application more obvious and understandable, the specific implementation manners of the present application are specifically given below. BRIEF DESCRIPTION OF THE DRAWINGS

[0040] Figure 1 It is an application environment diagram of the firmware refreshing method in an embodiment;

[0041] Figure 2 It is a schematic flowchart of the firmware refreshing method in an embodiment;

[0042] Figure 3 It is a schematic flowchart of the firmware refreshing method in another embodiment;

[0043] Figure 4 It is a schematic flowchart of the firmware refreshing method in another embodiment;

[0044] Figure 5 It is a schematic flowchart of the firmware refreshing method in another embodiment;

[0045] Figure 6 It is a structural block diagram of the firmware refreshing device in an embodiment;

[0046] Figure 7 The internal structure diagram of a computer device in an embodiment. Detailed implementation manners

[0047] In order to make the objectives, technical solutions and advantages of the present application clearer, the present application will be further described in detail below with reference to the accompanying drawings and embodiments. It should be understood that the specific embodiments described herein are only used to explain the present application and are not used to limit the present application.

[0048] In the field of computers, different types of firmware are responsible for controlling and managing different operations and functions of computer devices, such as firmware like Basic Input Output System (BIOS), Baseboard Management Controller (BMC), Complementary Metal Oxide Semiconductor (CMOS), Operating System (OS), etc. As computer devices become more and more powerful, the functions of different types of firmware in computer devices need to be continuously updated to make up for the vulnerabilities of different types of firmware in computer devices and improve the compatibility of different types of firmware with other hardware such as memory, graphics cards, and hard disks, so that computer devices can provide more comprehensive services for users and meet the needs of users. In related technologies, in order to make up for the vulnerabilities of different types of firmware in hardware devices and improve the compatibility of different types of firmware with other hardware, the function update of firmware can be achieved through different types of refreshes. However, how to perform secure firmware refresh has become a technical problem that needs to be solved urgently. Based on this, the embodiments of the present application provide a firmware refresh method, which can improve the speed of firmware refresh.

[0049] The firmware refresh method provided by the embodiments of the present application can be applied to Figure 1 the application environment diagram shown. This application environment includes a client and a server. Optionally, there may be a communication connection between the client and the server, and this communication method may be Wi-Fi, a mobile network, or a Bluetooth connection, etc. Optionally, the client may be a computer device, and this computer device may be but is not limited to a personal computer, a tablet computer, a laptop computer, a smart phone, etc.; the above-mentioned server may be but is not limited to being implemented by a computer device, an independent server, or a server cluster composed of multiple servers; the specific forms of the client and the server in this embodiment are not limited, Figure 1 and the firmware refresh system is illustrated by taking the client as a personal computer and the server as a server as an example. The following embodiments will introduce the specific process of the firmware refresh method with the client as the execution subject of the firmware refresh method.

[0050] As Figure 2As shown in the figure, it is a schematic flowchart of the firmware update method provided by an embodiment of this application. This method is applied to the client side and can be implemented through the following steps:

[0051] S100. Receive the firmware signature file corresponding to the firmware to be updated sent by the server.

[0052] In practical applications, the client can send a firmware update request for the firmware to be updated to the server through the Baseboard Management Controller (BMC) according to the actual update requirements, so as to instruct the server to obtain the firmware signature file containing the target firmware corresponding to the firmware to be updated according to the update request and feedback the firmware signature file to itself. Correspondingly, the client can receive the firmware signature file of the target firmware sent by the server.

[0053] Here, it should be noted that the firmware to be updated can be understood as the program running in the client, which can be the firmware before being updated in the client and corresponds to the type of the target firmware; at the same time, the above-mentioned target firmware can be generated by the firmware to be updated, that is, the firmware after repairing the vulnerabilities of the firmware to be updated or the firmware after upgrading the firmware to be updated.

[0054] Among them, the above-mentioned target firmware can be various different types of firmware, such as BIOS, BMC, CMOS, OS and other firmware, and the embodiments of this application do not make any limitations on this. Optionally, the firmware signature file of the above-mentioned target firmware can be a compressed package file, and the target firmware can be included in the firmware signature file.

[0055] Optionally, the firmware identifier of the firmware to be updated can be carried in the above-mentioned update request. Specifically, the method of obtaining the firmware signature file of the target firmware according to the update request can be to find the new firmware corresponding to the firmware identifier in the firmware library according to the firmware identifier carried in the update request, and determine the found new firmware as the target firmware, and then generate the firmware signature file according to the target firmware. Optionally, the corresponding relationship between the firmware identifiers of different types of firmware and different new firmwares can be included in the above-mentioned firmware library.

[0056] In addition, the method of obtaining the firmware signature file of the target firmware according to the update request can also be to construct the target firmware corresponding to the firmware to be updated in real time according to the firmware identifier carried in the update request, and then generate the firmware signature file according to the target firmware.

[0057] In one embodiment, the server can directly package the target firmware in the form of a file to generate the firmware signature file. In another embodiment, the server can also perform encryption processing on the target firmware to generate the firmware signature file of the target firmware.

[0058] S200. Invoke the first logic operation hardware in the client to perform signature verification on the firmware signature file.

[0059] Among them, the above-mentioned first logic operation hardware can be a Complex Programmable Logic Device (CPLD), a Field Programmable Gate Array (FPGA) chip, a Baseboard Management Controller (BMC) chip, etc. The embodiments of the present application do not make any limitations in this regard. Optionally, the above-mentioned first logic operation hardware can be but is not limited to being located within the main board of the client. However, in the embodiments of the present application, the above-mentioned first logic operation hardware is located on the Central Processing Unit (CPU) of the client and can also be referred to as a logic operation unit.

[0060] In one implementation, the client can send the firmware signature file to the first logic operation hardware at a specific moment or under specific conditions to instruct the first logic operation hardware to perform signature verification on the firmware signature file using a hardware signature verification algorithm. Optionally, the above-mentioned hardware signature verification algorithm can be a Secure Hash Algorithm, a Cryptographic Hash Function method, etc. The embodiments of the present application do not make any limitations in this regard.

[0061] In this case, the above-mentioned specific conditions can be that the load of the first logic operation hardware is less than a preset load threshold, or that the first logic operation hardware is in a normal operating state. The embodiments of the present application do not make any limitations in this regard.

[0062] In the embodiments of the present application, the client can call the signature verification interface of the first logic operation hardware through assembly instructions to enable the signature verification interface to control the first logic operation hardware to perform signature verification on the firmware signature file using a hardware signature verification algorithm. This process realizes hardware signature verification processing at the instruction level, which can make the processing process more flexible and convenient, and can also reduce the signature verification cost. In practical applications, the signature verification of the firmware signature file can be understood as the authentication of the identity of the firmware signature file.

[0063] S300. When the signature verification of the firmware signature file passes, refresh the firmware to be refreshed according to the firmware signature file.

[0064] Based on the signature verification result of the firmware signature file obtained in the previous steps, when the signature verification result is that the signature verification of the firmware signature file passes, the firmware to be refreshed can be refreshed according to the firmware signature file.

[0065] In one embodiment, the method of refreshing the firmware to be refreshed through the firmware signature file may be to input the firmware signature file into the firmware refreshing tool, so that the firmware refreshing tool refreshes the firmware to be refreshed according to the firmware signature file.

[0066] In another embodiment, the method of refreshing the firmware to be refreshed through the firmware signature file may also be to delete the firmware to be refreshed and store the firmware signature file at the original storage location of the firmware to be refreshed to complete the refresh.

[0067] In the technical solution of the embodiment of the present application, the firmware signature file corresponding to the firmware to be refreshed sent by the server is received, and the first logical operation hardware in the client is called to perform signature verification processing on the firmware signature file. When the signature verification of the firmware signature file passes, the firmware to be refreshed is refreshed according to the firmware signature file; the above method can not only implement firmware refresh, but also ensure the security of the firmware after refresh. Specifically, the client can call the internal first logical operation hardware to perform signature verification on the firmware signature file sent by the server, so that the signature verification process is implemented in the hardware, which can physically isolate the signed firmware signature file from the outside world, thereby improving the security of the file signature verification process and further improving the accuracy of the file signature verification result, providing an effective refresh file for further firmware refresh, making the security of the firmware after refresh higher, and the signature verification speed can also be improved through the first logical operation hardware; at the same time, the above method does not require manual participation in the signature verification process, which can reduce the error of manual participation, thereby greatly improving the accuracy of the firmware signature file signature verification, providing an effective refresh file for further firmware refresh, making the security of the firmware after refresh higher; in addition, the above method performs signature verification on the firmware signature file through the first logical operation hardware, so that all processes in the signature verification process are executed in the registers of the first logical operation hardware, avoiding the process of moving back and forth between the memory and the buffer when implementing signature verification through the firmware, thereby greatly improving the speed and efficiency of the file signature verification; furthermore, before refreshing the firmware to be refreshed, the above method can also perform signature verification on the firmware signature file to avoid the firmware signature file received by the client being tampered with during transmission, ensuring the security of the firmware signature file and further improving the security of the firmware after refresh.

[0068] In some scenarios, during the process of the server sending the firmware signature file to the client, the firmware signature file may be tampered with. Therefore, signature verification is performed on the firmware signature file before firmware refresh to ensure the security of the firmware signature file used during firmware refresh. The process of signature verification of the firmware signature file is described below. In one embodiment, the above firmware signature file includes the target firmware and the firmware signature of the target firmware; as Figure 3As shown, the step of calling the first logical operation hardware in the user terminal in S200 to perform signature verification processing on the firmware signature file can be implemented in the following manner:

[0069] S210. Call the first logical operation hardware to perform information security processing on the target firmware to obtain the actual signature information.

[0070] In the embodiment of the present application, the firmware signature file includes the target firmware and the firmware signature of the target firmware. Specifically, the user terminal can call the first logical operation hardware to perform information security processing on the target firmware to obtain the actual signature information.

[0071] Optionally, the method of performing information security processing on the target firmware can be at least one of information conversion and arithmetic operations on the target firmware. Optionally, the above arithmetic operations can be at least one of addition operation, subtraction operation, logical operation, multiplication operation, division operation, logarithm operation, and exponentiation operation, etc., and the above logical operations can be at least one of AND operation, OR operation, XOR operation, NOT operation, etc.

[0072] In the embodiment of the present application, the user terminal can call the first logical operation hardware to perform information security processing on the target firmware by using a cryptographic hashing algorithm to obtain the actual signature information, where the information security processing can be understood as hashing processing.

[0073] S220. Decrypt the firmware signature to obtain the signature information.

[0074] Specifically, the user terminal can use a symmetric decryption algorithm to decrypt the firmware signature to obtain the signature information. Optionally, the above symmetric decryption algorithm can be the decryption algorithm corresponding to the symmetric encryption algorithm, and the symmetric encryption algorithm can be a block algorithm using a key for encryption, a symmetric block encryption algorithm, a symmetric key block encryption algorithm, etc., and the embodiments of the present application do not make any limitations in this regard.

[0075] In addition, the user terminal can also pre-train a decryption model in advance, and then input the firmware signature into the decryption model, and the decryption model outputs the signature information.

[0076] Optionally, the above decryption model can be composed of at least one combination of a convolutional neural network model, a fully connected neural network model, a graph convolutional neural network model, a recurrent neural network model, a long short-term memory neural network model, etc.

[0077] S230. Compare the signature information and the actual signature information to perform signature verification processing on the firmware signature file.

[0078] Specifically, the client can compare the signature information with the actual signature information. When the signature information is consistent with the actual signature information, it is determined that the verification of the firmware signature file passes. When the signature information is inconsistent with the actual signature information, it is determined that the verification of the firmware signature file fails.

[0079] In the technical solution of this application embodiment, the first logical operation hardware is called to perform information security processing on the target firmware to obtain the actual signature information, decrypt the firmware signature to obtain the signature information, and compare the signature information with the actual signature information to perform the verification processing on the firmware signature file. In the above method, the client can call the internal first logical operation hardware to perform information security processing on the target firmware in the firmware signature file, so that the information security processing process is implemented in the hardware, which can physically isolate the target firmware of the information security processing from the outside world, thereby improving the security of the information security processing process and further providing the accuracy of the information security processing result. On this basis, the accurate verification processing result of the firmware signature file can be finally obtained to prepare for the firmware security refresh.

[0080] In one embodiment, the step of decrypting the firmware signature to obtain the signature information in S220 above may include: decrypting the firmware signature according to the public key to obtain the signature information; the public key is stored in the memory.

[0081] In the embodiment of this application, the public key is located in the public key certificate, and the public key certificate can be stored in the memory. The memory can be a flash memory, a non-volatile memory, a disk, a hard disk, etc. The embodiment of this application does not make any limitation on this.

[0082] Optionally, the above public key certificate is issued by a special institution, and the public key certificate may include information such as the public key of the target firmware, the public key length, the signature algorithm, the hash algorithm, and the signature value.

[0083] In the embodiment of this application, the client can use an asymmetric decryption algorithm to decrypt the firmware signature according to the public key to obtain the signature information. Optionally,

[0084] Optionally, the above asymmetric decryption algorithm can be the decryption algorithm corresponding to the asymmetric encryption algorithm. The asymmetric encryption algorithm can be a public key encryption algorithm, a digital signature algorithm, etc. The embodiment of this application does not make any limitation on this.

[0085] The technical solution in the embodiment of this application can adopt the elliptic curve public key cryptography algorithm to decrypt the firmware signature through the public key to obtain the signature information, so as to provide effective information for further verification processing, thereby ensuring the authenticity and integrity of the verified firmware signature file, ensuring that the firmware signature file has not been tampered with, and ensuring that the firmware signature file is sent by the private key holder.

[0086] In some scenarios, it is necessary to perform some pre - judgment processing to ensure the successful invocation of the first logical operation hardware inside the client. The process of invoking the first logical operation hardware is described below. In one embodiment, before the steps in S200 above, as Figure 4 shown, the above - mentioned method can also include the following steps:

[0087] S400. Detect whether the first logical operation hardware supports the signature verification processing function.

[0088] It should be noted here that the above - mentioned signature verification processing function means that the first logical operation hardware can execute the signature verification processing process.

[0089] Among them, the client can receive the signature verification request sent by the server and respond to the signature verification request to execute the detection of whether the first logical operation hardware supports the signature verification processing function.

[0090] In addition, after receiving the firmware signature file, the client can automatically detect whether the first logical operation hardware supports the signature verification processing function.

[0091] In the embodiments of the present application, the attribute information of the first logical operation hardware can be read through the CPUID instruction, and then it is determined whether the first logical operation hardware supports the signature verification processing function according to the attribute information. Optionally, the attribute information of the above - mentioned first logical operation hardware can be the series model of the first logical operation hardware, the number of buffer areas, and the supported hardware functions, etc.

[0092] Specifically, it can be determined whether the first logical operation hardware supports the signature verification processing function according to the hardware function in the attribute information of the first logical operation hardware.

[0093] S500. If the first logical operation hardware supports the signature verification processing function, then invoke the first logical operation hardware.

[0094] In the case of determining that the first logical operation hardware supports the signature verification processing function, the first logical operation hardware can be invoked through assembly instructions.

[0095] The technical solution in the embodiments of the present application detects whether the first logical operation hardware supports the signature verification processing function, and invokes the first logical operation hardware when the first logical operation hardware supports the signature verification processing function; the above - mentioned method can first detect whether the first logical operation hardware supports the signature verification processing function, and on this basis, the success rate of invoking the first logical operation hardware inside the client can be improved to successfully implement the signature verification process of the firmware signature file.

[0096] The process of refreshing the firmware to be refreshed through the firmware signature file is described below. In one embodiment, as Figure 5As shown, the step of refreshing the firmware to be refreshed through the firmware signature file in S300 above can be implemented in the following manner:

[0097] S310. Obtain the target firmware in the firmware signature file.

[0098] Specifically, the client can directly extract the target firmware from the firmware signature file according to the storage location of the target firmware in the firmware signature file.

[0099] In addition, the client can also use algorithms such as keyword extraction or feature extraction to perform information extraction on the firmware signature file to obtain the target firmware in the firmware signature file.

[0100] S320. Burn the target firmware into the storage device of the firmware to be refreshed to complete the refresh of the firmware to be refreshed.

[0101] Furthermore, the client can directly burn the target firmware into the storage device of the firmware to be refreshed so that the target firmware overwrites the firmware to be refreshed, thereby completing the refresh of the firmware to be refreshed.

[0102] In the embodiments of the present application, the above target firmware can be a Basic Input Output System (BIOS) firmware, a Complex Programmable Logic Device (CPLD) firmware, a PCI Option ROM firmware, etc.

[0103] Among them, when the target firmware is BIOS firmware, the corresponding storage device can be a BIOS flash memory; when the target firmware is CPLD firmware, the corresponding storage device is a CPLD; when the target firmware is an extended read-only memory PCI Option ROM firmware, the corresponding storage device is a read-only memory on a Peripheral Component Interconnect (PCI) device or an Industrial Standard Architecture (ISA) device in the client.

[0104] In practical applications, when the target firmware is BIOS firmware, the client can burn the BIOS firmware into the BIOS flash memory through the Serial Peripheral Interface (SPI); when the target firmware is CPLD firmware, the client can burn the CPLD firmware onto the CPLD through the Peripheral Component Interconnect Express (PCIE) interface; when the target firmware is PCI Option ROM firmware, the client can burn the PCI Option ROM firmware into the read-only memory through the Inter-Integrated Circuit (IIC).

[0105] In the technical solution of the embodiment of the present application, the target firmware in the firmware signature file is obtained, and the target firmware is burned into the storage device of the firmware to be refreshed to complete the refresh of the firmware to be refreshed; the above method can directly burn the target firmware into the storage device of the firmware to be refreshed, and the firmware refresh can be completed without other additional operations, so that the refresh process is relatively simple, and the speed and efficiency of firmware refresh are improved.

[0106] In one embodiment, the above firmware signature file is generated by the server based on the refresh instruction of the firmware to be refreshed and performing signature processing on the target firmware.

[0107] In practical applications, the server can receive the refresh instruction of the target firmware input by the user. Optionally, the way for the user to input the refresh instruction can be voice, gesture, button, keyboard, etc. At the same time, the server can also receive the refresh instruction of the target firmware sent by the client in real time.

[0108] Further, the server can respond to the refresh instruction, analyze the refresh instruction to obtain the firmware to be refreshed identifier carried in the refresh instruction, determine the firmware to be refreshed identifier as the target firmware identifier, then determine the target firmware according to the target firmware identifier, read the target firmware from the target firmware storage location, and then perform signature processing on the target firmware to generate the firmware signature of the target firmware. Further, the firmware signature of the target firmware and the target firmware are packaged to generate a firmware signature file.

[0109] Optionally, the way to perform signature processing on the target firmware can be to use a digital signature algorithm to perform signature processing on the target firmware. Optionally, the above digital signature algorithm can be an asymmetric encryption signature algorithm, an elliptic curve digital signature algorithm, etc., and the embodiment of the present application does not make a limitation on this.

[0110] In addition, the method of signing the target firmware may also be to pre-train an algorithm model, and then input the target firmware into the algorithm model, and the algorithm model signs the target firmware.

[0111] According to the technical solution in the embodiment of the present application, the server performs signature processing on the target firmware based on the refresh instruction of the target firmware to generate a firmware signature file; the above method can generate a firmware signature file in real time when the refresh instruction is triggered, thereby improving the security of the firmware signature file.

[0112] In one embodiment, the process of the server performing signature processing on the target firmware based on the refresh instruction of the target firmware may include:

[0113] The server responds to the refresh instruction, calls the second logic operation hardware supporting the signature processing function, performs information security processing on the target firmware to generate an information summary, and signs the information summary according to the private key, wherein the private key is stored in the solidified area of ​​the processor in the server.

[0114] In practical applications, the second logic operation hardware may also be a complex programmable logic device, CPLD, a field programmable gate array (FPGA) chip, a baseboard management controller (BMC) chip, etc., which is not limited in the embodiments of the present application. Optionally, the second logic operation hardware may be, but is not limited to, located in the mainboard of the server, but in the embodiments of the present application, the second logic operation hardware is located on the central processing unit (CPU) of the server, which may also be referred to as a logic operation unit.

[0115] Specifically, the server can respond to the refresh instruction, call the second logic operation hardware that supports the signature processing function, and use the cryptographic hash algorithm to perform information security processing on the target firmware to generate an information summary.

[0116] In actual applications, before the server calls the second logic operation hardware, it can detect whether the second logic operation hardware supports the signature processing function. If it is determined that the second logic operation hardware supports the signature processing function, the second logic operation hardware is called, which can ensure the success rate of calling the second logic operation hardware.

[0117] It should be noted here that the above-mentioned signature processing function refers to the second logic operation hardware being able to execute the signature processing process.

[0118] After the server responds to the refresh instruction, it can automatically detect whether the second logic operation hardware supports the signature processing function.

[0119] In the embodiment of the present application, the attribute information of the second logic operation hardware can be read through the CPUID instruction, and then it is determined whether the second logic operation hardware supports the signature processing function according to the attribute information. Optionally, the attribute information of the second logic operation hardware can be the series model, the number of cache areas, and the supported hardware functions of the second logic operation hardware.

[0120] Specifically, whether the second logic operation hardware supports the signature processing function can be determined according to the hardware function in the attribute information of the second logic operation hardware. If it is determined that the second logic operation hardware supports the signature processing function, the second logic operation hardware can be called through assembly instructions.

[0121] Furthermore, the server may read the private key from the solidified area of ​​the processor in the server, and then sign the information digest according to the private key.

[0122] Among them, the solidified area of ​​the processor in the server side can be understood as a storage area in the server side processor that cannot be changed permanently after the information is written. The information in the solidified area is relatively safe, that is, after the information is written to the solidified area, the information is not easy to be tampered with or lost. Optionally, the information written to the solidified area may include a private key, the built-in code of the processor in the server side, and other related information of the hardware structure, etc., which is not limited in the embodiments of the present application.

[0123] In actual applications, in order to ensure the safe operation of the server and effectively prevent the firmware signature files with security risks from refreshing the firmware to be refreshed, the server can read the private key in the solidified area of ​​its own processor, and sign the information digest according to the private key to obtain the firmware signature.

[0124] According to the technical solution in the embodiment of the present application, the server responds to the refresh instruction, calls the second logic operation hardware that supports the signature processing function, performs information security processing on the target firmware to generate an information summary, and signs the information summary according to the private key, wherein the private key is stored in the solidified area of ​​the processor in the server; in the above method, the server can call the internal second logic operation hardware to perform information security processing on the target firmware, so that the information security processing process is implemented in the hardware, which can physically isolate the target firmware of the information security processing from the outside world, thereby improving the security of the information security processing process, further improving the accuracy of the obtained information security processing results, and providing effective information for further obtaining accurate signature results, and realizing information security processing through the second logic operation hardware can also improve the speed of information security processing; at the same time, the above method does not require human participation in processing, can reduce human participation errors, and can greatly improve the accuracy of the information security processing results.

[0125] In one embodiment, the present application also provides a firmware refresh method, which is applied to a user end and includes the following process:

[0126] (1) Receive the firmware signature file corresponding to the firmware to be refreshed sent by the server; the firmware signature file is the server's response to the refresh instruction, calling the second logic operation hardware that supports the signature processing function, performing information security processing on the target firmware to generate an information summary, and signing the information summary according to the private key; the private key is stored in the solidified area of ​​the processor in the server;

[0127] (2) Detecting whether the first logic operation hardware supports the signature verification processing function;

[0128] (3) If the first logic operation hardware supports the signature verification processing function, calling the first logic operation hardware;

[0129] (4) calling the first logic operation hardware to perform information security processing on the target firmware to obtain actual signature information;

[0130] (5) Decrypt the firmware signature according to the public key to obtain the signature information; the public key is stored in the memory;

[0131] (6) Compare the signature information with the actual signature information to verify the firmware signature file;

[0132] (7) If the firmware signature file is verified, the target firmware in the firmware signature file;

[0133] (8) Burn the target firmware to the storage device of the firmware to be refreshed to complete the refresh of the firmware to be refreshed.

[0134] The execution process of the above (1) to (8) can be specifically referred to the description of the above embodiment. The implementation principle and technical effect are similar and will not be repeated here.

[0135] It should be understood that, although the steps in the flowcharts involved in the above embodiments are displayed in sequence according to the indication of the arrows, these steps are not necessarily executed in sequence according to the order indicated by the arrows. Unless there is a clear explanation in this article, the execution of these steps is not strictly limited in order, and these steps can be executed in other orders. Moreover, at least a part of the steps in the flowcharts involved in the above embodiments may include multiple steps or multiple stages, and these steps or stages are not necessarily executed at the same time, but can be executed at different times, and the execution order of these steps or stages is not necessarily carried out in sequence, but can be executed in turn or alternately with other steps or at least a part of the steps or stages in other steps.

[0136] Based on the same inventive concept, the embodiment of the present application also provides a firmware refresh device for implementing the firmware refresh method involved above. The implementation scheme for solving the problem provided by the device is similar to the implementation scheme recorded in the above method, so the specific limitations in one or more firmware refresh device embodiments provided below can refer to the limitations on the firmware refresh method above, and will not be repeated here.

[0137] In one embodiment, Figure 6 This is a schematic diagram of the structure of a firmware refresh device in an embodiment of the present application. The firmware refresh device provided in the embodiment of the present application can be applied to a user end. Figure 6 As shown, the firmware refresh device of the embodiment of the present application may include: a file receiving module 11, a signature verification processing module 12 and a refresh module 13, wherein:

[0138] The file receiving module 11 is used to receive the firmware signature file corresponding to the firmware to be updated sent by the server;

[0139] The signature verification processing module 12 is used to call the first logic operation hardware in the user terminal to perform signature verification processing on the firmware signature file;

[0140] A refresh module 13 is used to refresh the firmware to be refreshed according to the firmware signature file when the firmware signature file is verified;

[0141] Optionally, the firmware signature file is generated by the server by signing the target firmware based on the refresh instruction of the firmware to be refreshed; wherein the server responds to the refresh instruction, calls the second logical operation hardware that supports the signature processing function, performs information security processing on the target firmware to generate an information summary, and signs the information summary according to the private key; the private key is stored in the solidified area of ​​the processor in the server.

[0142] The firmware refreshing device provided by the embodiment of the present application can be used to execute the technical solution in the above-mentioned firmware refreshing method embodiment of the present application. The implementation principle and technical effect are similar, and will not be elaborated here.

[0143] In one embodiment, the firmware signature file includes the target firmware and the firmware signature of the target firmware; the signature verification processing module 12 includes: a security processing unit, a decryption unit, and an information comparison unit, where:

[0144] The security processing unit is used to call the first logical operation hardware to perform information security processing on the target firmware to obtain the actual signature information;

[0145] The decryption unit is used to decrypt the firmware signature to obtain the signature information;

[0146] The information comparison unit is used to compare the signature information with the actual signature information to perform signature verification processing on the firmware signature file.

[0147] The firmware refreshing device provided by the embodiment of the present application can be used to execute the technical solution in the above-mentioned firmware refreshing method embodiment of the present application. The implementation principle and technical effect are similar, and will not be elaborated here.

[0148] In one embodiment, the decryption unit is specifically used for:

[0149] According to the public key, decrypt the firmware signature to obtain the signature information; the public key is stored in the memory.

[0150] The firmware refreshing device provided by the embodiment of the present application can be used to execute the technical solution in the above-mentioned firmware refreshing method embodiment of the present application. The implementation principle and technical effect are similar, and will not be elaborated here.

[0151] In one embodiment, the firmware refreshing device further includes: a detection module and a calling module, where:

[0152] The detection module is used to detect whether the first logical operation hardware supports the signature verification processing function;

[0153] The calling module is used to call the first logical operation hardware when the first logical operation hardware supports the signature verification processing function.

[0154] The firmware refreshing device provided by the embodiment of the present application can be used to execute the technical solution in the above-mentioned firmware refreshing method embodiment of the present application. The implementation principle and technical effect are similar, and will not be elaborated here.

[0155] In one embodiment, the refreshing module 13 is specifically used for:

[0156] Obtain the target firmware in the firmware signature file;

[0157] Burn the target firmware into the storage device of the firmware to be refreshed to complete the refresh of the firmware to be refreshed.

[0158] The firmware refreshing device provided by the embodiments of the present application can be used to execute the technical solutions in the above-mentioned firmware refreshing method embodiments of the present application. The implementation principles and technical effects are similar and will not be elaborated here.

[0159] For the specific limitations of the firmware refreshing device, reference can be made to the limitations on the firmware refreshing method in the above text, which will not be elaborated here. Each module in the above firmware refreshing device can be implemented in whole or in part by software, hardware, and their combinations. The above modules can be embedded in the processor of the computer device in hardware form or independent of it, or stored in the memory of the computer device in software form, so that the processor can call and execute the operations corresponding to the above modules.

[0160] In one embodiment, a computer device is provided. The computer device can be a server, and its internal structure diagram can be as Figure 7 shown. The computer device includes a processor, a memory, and a network interface connected through a system bus. Among them, the processor of the computer device is used to provide processing capabilities. The memory of the computer device includes a non-volatile storage medium and an internal memory. The non-volatile storage medium stores an operating system, a computer program, and a database. The internal memory provides an environment for the operation of the operating system and the computer program in the non-volatile storage medium. The database of the computer device is used to store firmware signature files. The network interface of the computer device is used to communicate with an external endpoint through a network connection. When the computer program is executed by the processor, it implements a firmware refreshing method.

[0161] Those skilled in the art can understand that Figure 7 the structure shown in

[0162] is only a block diagram of some structures related to the solution of the present application, and does not constitute a limitation on the computer device to which the solution of the present application is applied. The specific computer device may include more or fewer components than those shown in the figure, or combine some components, or have different component arrangements.

[0163] In one embodiment, a computer-readable storage medium is further provided, on which a computer program is stored. When the computer program is executed by a processor, the technical solution of the above firmware update method of the present application is implemented, and its implementation principle and technical effect are similar, which will not be elaborated here.

[0164] In one embodiment, a computer program product is further provided, including a computer program. When the computer program is executed by a processor, the technical solution of the above firmware update method of the present application is implemented, and its implementation principle and technical effect are similar, which will not be elaborated here.

[0165] Those of ordinary skill in the art can understand that all or part of the processes in the above embodiment methods can be completed by instructing relevant hardware through a computer program. The computer program can be stored in a non-volatile computer-readable storage medium. When the computer program is executed, it can include the processes of the above method embodiments. Among them, any reference to a memory, storage, database, or other medium used in the various embodiments provided by the present application can include at least one of non-volatile and volatile memories. Non-volatile memory can include read-only memory (ROM), magnetic tape, floppy disk, flash memory, or optical memory, etc. Volatile memory can include random access memory (RAM) or external cache memory. By way of illustration and not limitation, RAM can be in various forms, such as static random access memory (SRAM) or dynamic random access memory (DRAM), etc.

[0166] The technical features of the above embodiments can be combined arbitrarily. For the sake of brevity of description, not all possible combinations of the technical features in the above embodiments are described. However, as long as there is no contradiction in the combination of these technical features, it should be considered as the scope described in this specification.

[0167] The above-described embodiments merely represent several implementation manners of the present application. The description is relatively specific and detailed, but it should not be construed as a limitation on the scope of the invention patent. It should be noted that for those of ordinary skill in the art, without departing from the concept of the present application, several modifications and improvements can still be made, and these all belong to the protection scope of the present application. Therefore, the protection scope of the patent of the present application should be subject to the appended claims.

Claims

1. A firmware update method, characterized in that, Applied to a user terminal, the method includes: Receive the firmware signature file corresponding to the firmware to be flashed sent by the server; Invoking the first logic operation hardware in the user terminal to perform signature verification processing on the firmware signature file; When the firmware signature file passes the signature verification, the firmware to be refreshed is refreshed according to the firmware signature file.

2. The method according to claim 1, wherein The firmware signature file includes the target firmware and the firmware signature of the target firmware; the calling of the first logic operation hardware in the user terminal to perform signature verification processing on the firmware signature file includes: Calling the first logic operation hardware to perform information security processing on the target firmware to obtain actual signature information; Decrypting the firmware signature to obtain signature information; The signature information is compared with the actual signature information to verify the signature of the firmware signature file.

3. The method according to claim 2, wherein The decrypting the firmware signature to obtain signature information includes: The firmware signature is decrypted according to the public key to obtain the signature information; the public key is stored in the memory.

4. The method according to any one of claims 1-3, characterized in that, The method further comprises: Detecting whether the first logic operation hardware supports the signature verification processing function; If the first logic operation hardware supports the signature verification processing function, the first logic operation hardware is called.

5. The method according to any one of claims 1 to 3, characterized in that, The step of refreshing the firmware to be refreshed according to the firmware signature file includes: Obtain the target firmware in the firmware signature file; The target firmware is burned into the storage device of the firmware to be refreshed to complete the refreshing of the firmware to be refreshed.

6. The method according to any one of claims 1 to 3, characterized in that The firmware signature file is generated by the server performing signature processing on the target firmware based on the refresh instruction of the firmware to be refreshed.

7. The method according to claim 6, characterized in that, The process of the server performing signature processing on the target firmware based on the refresh instruction of the target firmware includes: The server responds to the refresh instruction, calls the second logic operation hardware that supports the signature processing function, performs information security processing on the target firmware to generate an information summary, and signs the information summary according to a private key; the private key is stored in a solidified area of ​​the processor in the server.

8. A firmware refreshing device, characterized in that, The device comprises: A file receiving module, used for receiving a firmware signature file corresponding to the firmware to be flashed sent by the server; A signature verification processing module, used to call the first logic operation hardware in the user terminal to perform signature verification processing on the firmware signature file; The refresh module is used to refresh the firmware to be refreshed according to the firmware signature file when the firmware signature file passes the signature verification.

9. A computer device, comprising a memory and a processor, the memory storing a computer program, characterized in that, When the processor executes the computer program, the steps of the method according to any one of claims 1 to 7 are implemented.

10. A computer-readable storage medium having a computer program stored thereon, characterized in that, When the computer program is executed by a processor, the steps of the method according to any one of claims 1 to 7 are implemented.

11. A computer program product, comprising a computer program, characterized in that, When the computer program is executed by a processor, the steps of the method according to any one of claims 1 to 7 are implemented.

Images