Memory anti-counterfeiting authentication method, electronic device and storage medium

Abstract

The present application discloses a memory anti-counterfeiting authentication method, electronic device and storage medium, which relate to the field of information security technology. The method includes combining a random challenge code with a unique identifier of a target memory, signing and verifying the combination result. The unique identifier can ensure the legitimacy of the target memory, and the random challenge code can be used to detect hot-plug attacks launched by attackers through replay and other methods. Therefore, the technical problem in related technologies that hot-plug attacks on memory during runtime cannot be detected in real time can be solved, and the security and reliability of the target memory can be effectively ensured.

Description

Technical Field

[0001] The present application relates to the field of information security technology, and in particular to a memory anti-counterfeiting authentication method, electronic device, and storage medium. Background Art

[0002] As the scale of data centers and servers continues to expand, hardware security issues are becoming increasingly prominent, especially the authenticity identification of memory modules.

[0003] In related technologies, static parameters (such as the serial number) of the memory Serial Presence Detect (SPD) chip are read through the bus to perform periodic memory verification. However, this method relies on static parameters during initialization and cannot detect hot-plug attacks on memory in real time during runtime. Summary of the Invention

[0004] The present application provides a memory anti-counterfeiting authentication method, electronic device and storage medium to at least solve the problem in the related art that hot-plug attacks on memory during operation cannot be detected in real time.

[0005] This application provides a memory anti-counterfeiting authentication method, including:

[0006] Generate a random challenge code and send it to the target memory via the communication bus;

[0007] receiving a signature response returned by the target memory, where the signature response is generated by the target memory using a private key to calculate the challenge code and a unique identifier of a serial presence detection chip of the target memory;

[0008] The signature response is verified, and a security response mechanism is triggered when the verification fails.

[0009] This application also provides a memory anti-counterfeiting authentication device, comprising:

[0010] A processing module, configured to generate a random challenge code and send the code to a target memory via a communication bus;

[0011] a receiving module, configured to receive a signature response returned by the target memory, where the signature response is generated by the target memory using a private key to calculate the challenge code and a unique identifier of a serial presence detection chip of the target memory;

[0012] The verification module is used to verify the signature response and trigger a security response mechanism when the verification fails.

[0013] The present application also provides an electronic device, comprising: a memory for storing a computer program; and a processor for implementing the steps of any of the above-mentioned memory anti-counterfeiting authentication methods when executing the computer program.

[0014] The present application also provides a computer-readable storage medium, in which a computer program is stored. When the computer program is executed by a processor, the steps of any of the above-mentioned memory anti-counterfeiting authentication methods are implemented.

[0015] The present application also provides a computer program product, including a computer program, which implements the steps of any of the above-mentioned memory anti-counterfeiting authentication methods when executed by a processor.

[0016] Through this application, since a different random challenge code is generated each time the memory is authenticated, the random challenge code is combined with the SPD unique identifier of the target memory, and the combination result is signed and verified, the SPD unique identifier can ensure the legitimacy of the target memory, and the random challenge code can be used to detect hot-plug attacks launched by attackers through replay and other methods. Therefore, the technical problem in related technologies that hot-plug attacks on memory during runtime cannot be detected in real time can be solved, and the security and reliability of the target memory can be effectively ensured. BRIEF DESCRIPTION OF THE DRAWINGS

[0017] In order to more clearly illustrate the embodiments of the present application or the technical solutions in the prior art, the following briefly introduces the drawings required for use in the embodiments or the description of the prior art. Obviously, the drawings described below are only some embodiments of the embodiments of the present application. For ordinary technicians in this field, other drawings can be obtained based on these drawings without paying any creative labor.

[0018] Figure 1 A schematic diagram of the internal structure of a server provided in an embodiment of the present application;

[0019] Figure 2 A schematic diagram of a memory anti-counterfeiting authentication method provided in an embodiment of the present application Figure 1 ;

[0020] Figure 3 A schematic diagram of a memory anti-counterfeiting authentication method provided in an embodiment of the present application Figure 2 ;

[0021] Figure 4 A schematic diagram of data stream transmission provided in an embodiment of the present application;

[0022] Figure 5 A schematic structural diagram of a memory anti-counterfeiting authentication device provided in an embodiment of the present application;

[0023] Figure 6 A schematic diagram of the structure of an electronic device provided in an embodiment of the present application. DETAILED DESCRIPTION

[0024] The following will be combined with the accompanying drawings in the embodiments of this application to clearly and completely describe the technical solutions in the embodiments of this application. Obviously, the embodiments described are only part of the embodiments of this application, not all of them. Based on the embodiments in this application, all other embodiments obtained by ordinary technicians in this field without making creative efforts are within the scope of protection of this application.

[0025] It should be noted that, in the description of this application, the terms "comprises," "includes," or any other variations thereof are intended to cover non-exclusive inclusion, such that a process, method, article, or device comprising a series of elements includes not only those elements, but also other elements not explicitly listed, or elements inherent to such process, method, article, or device. The terms "first," "second," etc., in this application are used to distinguish similar objects, and are not used to describe a particular order or sequence.

[0026] As data centers and servers continue to expand, hardware security issues are becoming increasingly prominent, particularly the authenticity verification of memory modules. Counterfeit and substandard memory modules not only affect system performance and stability but can also lead to security risks such as data leaks.

[0027] In related technologies, static parameters (such as the serial number) of the memory Serial Presence Detect (SPD) chip are read through the I2C bus, and the baseboard management controller (BMC) performs periodic memory verification. However, this method relies on static parameters during initialization and cannot detect hot-plug attacks during runtime in real time. In addition, the baseboard management controller only supports the Inter-Integrated Circuit (I2C) bus, which has a low data transmission rate and cannot meet the requirements of real-time encrypted data transmission.

[0028] This application proposes a memory anti-counterfeiting authentication method, which combines a random challenge code and the SPD unique identifier of the target memory, and signs and verifies the combination result. The SPD unique identifier can ensure the legitimacy of the target memory, and the random challenge code can detect hot-plug attacks launched by attackers through replay and other methods, which can effectively resist hot-plug attacks on the memory during operation.

[0029] In order to enable those skilled in the art to better understand the present application, the present application is further described in detail below with reference to the accompanying drawings and specific implementation methods.

[0030] In combination with the specific application environment architecture or specific hardware architecture on which the execution of the memory anti-counterfeiting authentication method depends, the specific application environment architecture or specific hardware architecture is described here. Figure 1 , Figure 1 A structural diagram of the internal structure of a server provided in an embodiment of the present application includes a baseboard management controller 11 and a target memory 12, wherein the number of target memories 12 can be multiple, and the baseboard management controller 11 and each target memory 12 can be connected through a communication bus 13.

[0031] The baseboard management controller 11 can monitor the hardware status of the server and facilitate server management. The target memory 12 is hardware in the server that requires verification. Counterfeit or substandard memory not only affects the performance and stability of the server but also may lead to security risks such as data leakage. Furthermore, during server operation, the target memory may be at risk of being attacked. Therefore, the baseboard manager 11 is required to authenticate the target memory 12 to confirm whether the target memory has been tampered with or whether the target memory is operating normally. Data is transmitted between the baseboard management controller 11 and the target memory 12 via the communication bus 13, thereby completing the authentication of the target memory 12.

[0032] Figure 2 A schematic diagram of a memory anti-counterfeiting authentication method provided in an embodiment of the present application Figure 1 ,like Figure 2 As shown, the embodiment of the present application provides a memory anti-counterfeiting authentication method, which is described in detail as follows:

[0033] S201: Generate a random challenge code and send it to the target memory via the communication bus.

[0034] A random challenge code is randomly generated each time memory security authentication is performed. It is used to dynamically authenticate the target memory and prevent replay attacks. The random challenge code can be 128 bits in length. The random challenge code can be generated by the baseboard management controller in the server, which is used to authenticate the target memory.

[0035] The target memory is the memory that needs to be anti-counterfeit certified. The target memory includes an SPD chip. The SPD chip is the core component of the target memory. The SPD chip stores basic information of the target memory, such as type, capacity, manufacturer, etc.

[0036] The SPD chip has a unique identifier (Serial Number, SN). This unique identifier is a serial number that is stored in the SPD chip during the manufacture of the target memory. It is used to uniquely identify the target memory. The legitimacy of the target memory can be verified by verifying the SPD's unique identifier.

[0037] The communication bus is used to implement data transmission between the baseboard management controller and the target memory, as well as to encrypt the transmitted data. In an embodiment of the present application, the communication bus is an improved inter-integrated circuit (I3C) bus. I3C can implement AES-128 real-time data stream encryption based on the HDR-DDR mode, ensuring confidentiality during data transmission. I3C also has a higher transmission rate, with a latency of less than 10 milliseconds and a throughput of up to 5Mbps, which can meet the needs of high-performance computing. Furthermore, the I3C protocol supports simultaneous access by multiple devices and can be easily expanded to anti-counterfeiting authentication of multiple memory modules to meet the needs of complex systems.

[0038] S202: Receive the signature response returned by the target memory.

[0039] The signature response is used to authenticate the target memory. The target memory uses its private key to calculate the signature response based on the challenge code and the unique identifier of the target memory's serial presence detector chip. The signature response can be calculated using the Elliptic Curve Digital Signature Algorithm (ECDSA) and the Secure Hash Algorithm (SHA-256).

[0040] The specific process for generating a signature response includes: the target memory receives a random challenge code sent by the baseboard management controller, concatenates the random challenge code with the unique identifier to obtain a first concatenation result, calculates a hash value of the first concatenation result, and encrypts the hash value of the first concatenation result using a private key to obtain a signature response. The unique identifier is used to verify the legitimacy of the target memory, that is, whether the target memory has been replaced; the random challenge code is used to verify hot-plug attacks during server operation. By generating a different challenge code each time, it can prevent attackers from pre-copying the legitimate unique identifier and then replaying the legitimate unique identifier to conduct a hot-plug attack.

[0041] The baseboard management controller can further verify the signature response by receiving the signature response sent by the target memory to determine the status of the target memory.

[0042] S203: Verify the signature response, and trigger a security response mechanism when the verification fails.

[0043] After receiving the signature response, the baseboard management controller may decrypt the signature response and compare it with the unique identifier and random challenge code stored in the baseboard management controller to verify the signature response.

[0044] The process of verifying the signature response includes: the baseboard management controller obtains a random challenge code from the cache and a unique identifier from the fingerprint database, splices the challenge code and the unique identifier to obtain a second splicing result, calculates the hash value of the second splicing result, and uses the public key exchanged in advance to decrypt the signature response to obtain a decrypted result. The decrypted result corresponds to the hash value of the first splicing result. The hash value of the second splicing result is compared with the decrypted result. If they are the same, it indicates that the verification is successful. If they are different, it indicates that the verification failed.

[0045] The fingerprint database is pre-built, and the fingerprint data stores the unique identifier of the SPD and the public key used for data transmission between the baseboard management controller and the target memory. If the target memory has not been tampered with or replaced, the decryption result, the hash value of the first splicing result, and the hash value of the second splicing result should all be identical. Therefore, by comparing the hash value of the second splicing result with the decryption result, the target memory can be verified. If verification is successful, the server maintains normal operation and records a normal status log. If verification fails, the security response mechanism is triggered.

[0046] The security response mechanism may include: generating an alarm log to record the unique identifier of the target memory and the timestamp of verification failure; prohibiting data access to the target memory that has not passed the authentication; isolating the physical storage channel where the target memory is located, etc.

[0047] Optionally, the BMC can connect to a remote management system and send alarm information to the cloud or other management platform via the network to facilitate subsequent response and processing by operation and maintenance personnel. For example, the BMC can send alarm information via Redfish to notify the remote management system.

[0048] Alarm logs can be generated based on the standard logging protocol (Syslog). Syslog is a log processing tool that can collect, synchronize, and filter log messages. Log messages can come from various components of the server, including alarm logs generated by the baseboard management controller.

[0049] By reusing Redfish and Syslog in related technologies, the memory anti-counterfeiting authentication method provided in the embodiment of the present application can be smoothly integrated into the existing system architecture, while also supporting seamless transition with the existing infrastructure and having strong applicability.

[0050] Optionally, in the memory anti-counterfeiting authentication method provided in the embodiment of the present application, the target memory can also be managed in terms of status, including transmitting status data of the target memory through a bus, a baseboard management controller receiving the status data, and triggering a security response mechanism when the status data is abnormal.

[0051] Among them, the status data may include the temperature, voltage, access mode, etc. of the target memory. Abnormal status data may include the target memory's temperature being too high, the operating voltage being too high, the access mode being abnormal, etc. When the baseboard management controller detects abnormal status data, it can record the abnormality log and send abnormal information to facilitate processing by operation and maintenance personnel.

[0052] Furthermore, in the memory anti-counterfeiting authentication method provided in the embodiment of the present application, I3C can implement AES-128 real-time data stream encryption based on the HDR-DDR mode, that is, the I3C protocol can encrypt the data transmitted between the baseboard management controller and the target memory through the communication key, for example, the public key, unique identifier and other data transmitted during the authentication process, as well as the target status data, such as temperature, voltage, access mode, etc., which can ensure the integrity and confidentiality of the data during transmission.

[0053] The memory anti-counterfeiting authentication method provided in an embodiment of the present application includes generating a random challenge code and sending it to the target memory via a communication bus; receiving a signature response returned by the target memory, the signature response being generated by the target memory using a private key to calculate the challenge code and the unique identifier of the serial presence detection chip of the target memory; verifying the signature response, and triggering a security response mechanism when the verification fails. By combining the random challenge code and the SPD unique identifier of the target memory, and signing and verifying the combined result, the legitimacy of the target memory can be guaranteed by the SPD unique identifier, and hot-plug attacks launched by attackers through replay and other methods can be detected by the random challenge code, which can effectively resist hot-plug attacks on the memory during operation.

[0054] Figure 3 Schematic diagram of the process of the memory anti-counterfeiting authentication method provided in the embodiment of the present application Figure 2 ,like Figure 3 As shown, the embodiment of the present application provides a memory anti-counterfeiting authentication method, which is described in detail as follows:

[0055] S301: Expand the functionality of the bus protocol corresponding to the communication bus.

[0056] Functional extension is used to establish an underlying communication architecture that complies with anti-counterfeiting authentication. Functional extension may include: enabling the bus master mode of the baseboard management controller to enable the allocation of dynamic addresses to the serial presence detection chip of the target memory; module expansion of the bus protocol to enable the bus protocol to support hot-plug event capture; protocol expansion of the bus protocol to define anti-counterfeiting-specific instruction codes, which are used to trigger the authentication process.

[0057] Specifically, bus master mode is a core operating mode defined in the I3C protocol. In bus master mode, the baseboard management controller has the ability to actively manage the communication bus, enabling high-speed communication with the target memory and assigning addresses to the target memory's SPD, i.e., configuring dynamic address assignment (DAA) for the SPD. The baseboard management controller can simultaneously manage and authenticate multiple target memories, assigning dynamic addresses to SPDs to ensure accurate identification of each corresponding target device on the communication bus.

[0058] Extending the bus module can include developing a Linux kernel I3C slave device driver (i3c-slave-core module extension). The i3c-slave-core module is the core framework of the I3C slave device driver provided in the kernel. It is responsible for handling the underlying communication of the I3C bus. By extending the bus protocol, the communication bus can support hot-plug event capture. That is, when the target memory is inserted or removed, the baseboard management controller can detect this change through I3C and take corresponding measures.

[0059] Extending the bus protocol may include defining a special anti-counterfeiting instruction code (Common Command Code, CCC) in the I3C protocol to trigger the authentication process. In related technologies, the authentication of the target memory needs to be performed periodically. The embodiment of the present application can trigger the authentication process in real time through CCC.

[0060] S302: Perform security initialization on the baseboard management controller and the target memory.

[0061] Security initialization is used to establish an identity authentication system for the target memory. Security initialization may include: broadcasting a dynamic address allocation command through the communication bus when the baseboard management controller is started to allocate a dynamic address for the serial presence detection chip of the target memory; calling the key management service of the baseboard management controller to obtain the preset certificate of the memory. According to the preset certificate, the baseboard management controller and the target memory establish a secure communication channel based on the key exchange protocol and exchange public keys; establishing a fingerprint database in the storage area of ​​the baseboard management controller, and the fingerprint database is used to record the unique identifier and public key of the serial presence detection.

[0062] Specifically, when the baseboard management controller starts, the baseboard management controller enables the bus master mode, broadcasts the dynamic address allocation command through the I3C bus, triggers the slave device (i.e., the target memory) on the I3C bus to enter the dynamic address allocation mode, and coordinates the allocation of the unique address.

[0063] The baseboard management controller may include a key management service (Key Management-IP, KM-IP) that provides services such as local key generation, storage, and secure call for the baseboard management controller. The baseboard management controller can obtain the pre-set certificate of the target memory through the key management service. The pre-set certificate is a device identity certificate pre-generated by the memory manufacturer and is used to verify the legitimacy of the target memory. The pre-set certificate may include information such as the public key of the target memory and the manufacturer's digital signature. The baseboard management controller can establish a secure communication channel and exchange public keys with the target memory based on a key exchange protocol based on the pre-set certificate. The key exchange protocol may be based on elliptic curve cryptography (Elliptic Curve Diffie-Hellman, ECDH) and the like. The key exchange protocol allows the communicating parties to negotiate a shared key over an insecure communication channel, namely the public key in the embodiment of the present application. The public key is used in the subsequent signature response verification process. The embodiment of the present application does not impose any specific restrictions on the generation method of the public key. It can be generated based on a random code or a combination of a unique identifier of the target memory and a random code. Among them, the public key generated based on the key exchange protocol is temporary and will be regenerated each time it is started, so it can ensure the forward security of message transmission, that is, the leakage of the current public key will not affect historical messages.

[0064] When establishing a fingerprint database in the storage area of ​​the baseboard management controller, the storage area can be a storage medium in which data is not easily lost after power failure, such as a flash memory, an electrically erasable programmable read only memory (EEPROM), etc. The fingerprint database is used to record the unique identifier of the SPD and the public key exchanged through the password exchange protocol.

[0065] S303: The baseboard management controller receives an interruption signal sent by the communication bus, and obtains a unique identifier of the serial presence detection based on the interruption signal.

[0066] In this embodiment, I3C provides an in-band interrupt communication mechanism that triggers the authentication process by sending a CCC message. This in-band interrupt mechanism allows the slave device (target memory) to proactively send an interrupt signal to the master device (baseboard management controller) without requiring polling from the master device (baseboard management controller). This notifies the master device of a specific event, thereby triggering the authentication process. Actively triggering the authentication process via I3C improves authentication efficiency and timeliness.

[0067] Optionally, in addition to being actively triggered, the authentication process may also be triggered by periodic polling by the baseboard management controller to avoid a long period of time without authentication of the target memory.

[0068] S304: Verify the target memory.

[0069] The process of verifying the target memory is as follows: Figure 2 The embodiment will not be described in detail here. If the verification is successful, S305 is executed; if the verification fails, S306 is executed.

[0070] S305: Record the normal status.

[0071] When the target memory is successfully verified, it means that the target memory has not been replaced or tampered with. At this time, the target server maintains normal operation and records the normal status log, ending the authentication process.

[0072] S306: Triggering a security response mechanism.

[0073] When verification of the target memory fails, it means that the target memory has been replaced or tampered with. At this time, the security response mechanism is triggered, including generating an alarm log, prohibiting data access to the unauthenticated target memory, and isolating the physical storage channel where the target memory is located.

[0074] The memory anti-counterfeiting authentication method provided in the embodiment of the present application can provide a basis for memory anti-counterfeiting authentication by extending the I3C bus protocol and securely initializing the baseboard management controller and the target memory. By using the I3C bus to realize data transmission between the baseboard management controller and the target memory, a higher data transmission rate can be achieved to meet the needs of high-performance computing. The I3C protocol supports simultaneous access of multiple devices and can be easily expanded to the anti-counterfeiting authentication of multiple memory modules to meet the needs of complex systems. At the same time, the I3C bus can encrypt the transmitted data stream in real time, ensuring confidentiality during the data transmission process. The memory anti-counterfeiting authentication method provided in the embodiment of the present application is compatible with the existing SPD chip design, can enhance security performance without additional hardware investment, and reduces the overall deployment cost.

[0075] The pseudo code of the memory anti-counterfeiting authentication method provided in the embodiment of the present application is as follows:

[0076] def i3c_mem_auth():

[0077] while True:

[0078] event = wait_for_i3c_ibi(I3C_CCC_MEM_AUTH) #Trigger authentication through I3C in-band interrupt. I3C_CCC_MEM_AUTH indicates the CCC message that triggers the authentication process.

[0079] mem_id = event.addr # Record the dynamic address mem_id of the target memory

[0080] challenge = os.urandom(16) # Generate 128-bit random number challenge code challenge

[0081] i3c_transfer(mem_id, WRITE, challenge) #Send the random challenge code to the target memory via I3C

[0082] sig = i3c_transfer(mem_id, READ, 64) # Receive signature response sig, which is generated based on the ECDSA-SHA256 algorithm

[0083] if verify_signature(sig, challenge, mem_id): # Query the fingerprint database to verify the target memory

[0084] set_health_status(mem_id, "OK") # If verification succeeds, update the target memory status

[0085] else:

[0086] send_alert(REDFISH_EVENT, "MemoryAuthFail", mem_id) # If verification fails, trigger an alarm

[0087] execute_policy("ISO_MEM_BANK", mem_id) # Execute the preset isolation policy, such as closing the memory Bank

[0088] During the above memory authentication process, the data flow transmission process can be as follows: Figure 4 As shown, Figure 4 A data flow transmission diagram provided for an embodiment of the present application includes a baseboard management controller and a target memory, and data between the baseboard management controller and the target memory is transmitted via a communication bus.

[0089] The data flow transmission process during the memory anti-counterfeiting authentication process specifically includes: the target memory initiates an in-band interrupt through the communication bus and sends a CCC message to the baseboard management controller to trigger the authentication process; the baseboard management controller receives the CCC message, generates a random challenge code, and sends the random challenge code to the target memory; the target memory receives the random challenge code and generates a signature response based on the random challenge code, and sends the signature response to the baseboard management controller; the baseboard management controller receives the signature response and verifies the signature response based on the unique identifier obtained from the fingerprint database.

[0090] In the memory anti-counterfeiting authentication method provided in the embodiment of the present application, the data message transmitted between the baseboard management controller and the target memory may further include a message authentication code, which is used to prevent malicious tampering and ensure the legitimacy of the data.

[0091] In one possible implementation, each message transmitted during the signature response generation and authentication process may include a message authentication code (MAC). Specifically, the MAC value of the message can be calculated based on the session key generated by the key exchange protocol, and the MAC value is appended to the end of the message. The message containing the MAC value is then sent to the baseboard management controller or target memory. After receiving the message, the baseboard management controller or target memory separates the original message and the MAC value, calculates the MAC value of the original message using the same session key, and compares the received MAC value with the calculated MAC value. If they are identical, the verification process continues. If they are different, the security response mechanism is triggered and the tampering event is recorded.

[0092] By adding a message authentication code, the message can be prevented from being tampered with during transmission, providing a reliable data basis for subsequent memory anti-counterfeiting authentication.

[0093] The memory anti-counterfeiting detection method provided in the embodiments of this application can be applied not only to memory module management in data centers and servers, but can also be widely used in a variety of fields, including IoT device management, smart home and building automation, industrial automation and intelligent manufacturing, telecommunications infrastructure management, automotive electronics and autonomous driving systems, medical equipment and health monitoring, aerospace and defense systems, and renewable energy management systems. By monitoring and verifying the identity information of devices in real time, it can significantly improve the security and reliability of these fields, optimize energy utilization efficiency, reduce operating costs, and ensure the stability and efficient operation of the system.

[0094] Through the description of the above implementation methods, those skilled in the art can clearly understand that the method according to the above embodiment can be implemented by means of software plus the necessary general hardware platform, and of course it can also be implemented by hardware, but in many cases the former is a better implementation method.

[0095] Figure 5 This is a schematic diagram of the structure of a memory anti-counterfeiting authentication device provided in an embodiment of the present application. Figure 5 As shown, an embodiment of the present application further provides a memory anti-counterfeiting authentication device 50 , comprising: a processing module 51 , a receiving module 52 and a verification module 53 .

[0096] The processing module 51 is used to generate a random challenge code and send it to the target memory via the communication bus;

[0097] A receiving module 52 is configured to receive a signature response returned by the target memory, where the signature response is generated by the target memory using a private key to calculate the challenge code and a unique identifier of the serial presence detection chip of the target memory;

[0098] The verification module 53 is used to verify the signature response and trigger the security response mechanism when the verification fails.

[0099] In a possible implementation, the apparatus further includes an initialization module configured to:

[0100] The bus protocol corresponding to the communication bus is functionally expanded to establish an underlying communication architecture that complies with anti-counterfeiting authentication;

[0101] The baseboard management controller and the target memory are securely initialized. The baseboard management controller is used to authenticate the target memory, and the security initialization is used to establish an identity authentication system for the target memory.

[0102] In a possible implementation, the initialization module is further used to:

[0103] The baseboard management controller enables a bus master mode to enable dynamic address allocation to the serial presence detect chip of the target memory;

[0104] Expand the bus protocol module to support hot-swap event capture;

[0105] The bus protocol is extended to define a special anti-counterfeiting instruction code, which is used to trigger the authentication process.

[0106] In a possible implementation, the initialization module is further used to:

[0107] When the baseboard management controller is started, a dynamic address allocation command is broadcasted via the communication bus to allocate a dynamic address to the serial presence detection chip of the target memory;

[0108] Call the baseboard management controller's key management service to obtain the memory's pre-set certificate. Based on the pre-set certificate, the baseboard management controller and the target memory establish a secure communication channel and exchange public keys based on the key exchange protocol.

[0109] A fingerprint database is established in a storage area of ​​the baseboard management controller, and the fingerprint database is used to record a unique identifier and a public key of the serial presence detection.

[0110] In a possible implementation, the initialization module is further used to:

[0111] The baseboard management controller receives an interrupt signal sent by the communication bus and obtains a unique identifier of the serial presence detection based on the interrupt signal.

[0112] In a possible implementation, the receiving module 52 is configured to:

[0113] The target memory receives the challenge code sent by the baseboard management controller;

[0114] The target memory concatenates the challenge code and the unique identifier to obtain a first concatenation result;

[0115] The target memory calculates a hash value of the first concatenation result, encrypts the hash value of the first concatenation result using the private key of the target memory, and obtains a signed response.

[0116] In one possible implementation, the verification module 53 is configured to:

[0117] The baseboard management controller obtains the random challenge code from the cache and the unique identifier from the fingerprint database;

[0118] The baseboard management controller concatenates the challenge code and the unique identifier to obtain a second concatenation result;

[0119] The baseboard management controller calculates the hash value of the second splicing result and decrypts the signature response using the public key exchanged in advance to obtain a decrypted result, which corresponds to the hash value of the first splicing result;

[0120] Compare the hash value of the second concatenation result with the decryption result. If they are the same, the verification is successful. If they are different, the verification fails.

[0121] In a possible implementation, the communication bus is an I3C bus, and the bus protocol is an I3C protocol. The I3C protocol can encrypt data transmitted between the baseboard management controller and the target memory using a communication key.

[0122] In a possible implementation, the verification module 53 is further configured to:

[0123] Generate an alarm log, recording the unique identifier of the target memory and the timestamp of the verification failure;

[0124] Data access to unauthenticated target memory is prohibited;

[0125] Isolate the physical storage channel where the target memory is located.

[0126] In a possible implementation, the memory anti-counterfeiting authentication device 50 is further configured to:

[0127] transmitting state data of the target memory via the communication bus, the state data including at least one of the following: temperature, voltage, and access mode;

[0128] The baseboard management controller receives status data and triggers a safety response mechanism when the status data is abnormal.

[0129] For the description of the features in the embodiment corresponding to the memory anti-counterfeiting authentication device, please refer to the relevant description of the embodiment corresponding to the memory anti-counterfeiting authentication method, and no further details will be given here.

[0130] Figure 6 This is a schematic diagram of the structure of the electronic device provided in the embodiment of the present application. Figure 6 As shown, the electronic device 60 provided in this embodiment includes: at least one processor 601 and a memory 602. Optionally, the electronic device 60 further includes a communication component 603. The processor 601, the memory 602 and the communication component 603 are connected via a bus.

[0131] In a specific implementation process, at least one processor 601 executes the computer-executable instructions stored in the memory 602 , so that the at least one processor 601 executes the above-mentioned memory anti-counterfeiting authentication method embodiment.

[0132] The specific implementation process of the processor 601 can be found in the above method embodiment. Its implementation principle and technical effects are similar and will not be repeated here in this embodiment.

[0133] In the above embodiments, it should be understood that the processor may be a central processing unit (CPU), other general-purpose processors, digital signal processors (DSP), application-specific integrated circuits (ASIC), etc. A general-purpose processor may be a microprocessor or any conventional processor. The steps of the method disclosed in the application may be directly executed by a hardware processor or by a combination of hardware and software modules within the processor.

[0134] The memory may include random access memory (RAM) and may also include non-volatile memory (NVM), such as at least one disk storage.

[0135] A bus can be an Industry Standard Architecture (ISA) bus, a Peripheral Component Interconnect (PCI) bus, or an Extended Industry Standard Architecture (EISA) bus. Buses can be categorized as address buses, data buses, and control buses. For ease of illustration, the buses in the drawings of this application are not limited to just one bus or just one type of bus.

[0136] An embodiment of the present application further provides a computer-readable storage medium, in which a computer program is stored, wherein the computer program is configured to execute the steps of any of the above-mentioned memory anti-counterfeiting authentication method embodiments when running.

[0137] In an exemplary embodiment, the computer-readable storage medium may include, but is not limited to, various media that can store computer programs, such as a USB flash drive, a read-only memory (ROM), a random access memory (RAM), a mobile hard disk, a magnetic disk, or an optical disk.

[0138] An embodiment of the present application further provides a computer program product, which includes a computer program. When the computer program is executed by a processor, the steps of any of the above-mentioned memory anti-counterfeiting authentication method embodiments are implemented.

[0139] An embodiment of the present application also provides another computer program product, including a non-volatile computer-readable storage medium, which stores a computer program. When the computer program is executed by a processor, it implements the steps of any of the above-mentioned memory anti-counterfeiting authentication method embodiments.

[0140] Professionals may further appreciate that the units and algorithm steps of each example described in conjunction with the embodiments disclosed herein can be implemented in electronic hardware, computer software, or a combination of the two. In order to clearly illustrate the interchangeability of hardware and software, the above description has generally described the components and steps of each example according to their functions. Whether these functions are performed in hardware or software depends on the specific application and design constraints of the technical solution. Professionals and technicians may use different methods to implement the described functions for each specific application, but such implementation should not be considered beyond the scope of this application.

[0141] The above is a detailed introduction to a memory anti-counterfeiting authentication method, electronic device and storage medium provided by the present application. This article uses specific examples to illustrate the principles and implementation methods of the present application. The description of the above embodiments is only used to help understand the method of the present application and its core idea. It should be pointed out that for ordinary technicians in this technical field, without departing from the principles of the present application, several improvements and modifications can be made to the present application, and these improvements and modifications also fall within the scope of protection of the claims of the present application.

Claims

1. A memory anti-counterfeiting authentication method, applied to a baseboard management controller, characterized in that: include: Enabling a bus master mode to assign a dynamic address to a serial presence detection chip of a target memory, wherein the dynamic address is used to identify each corresponding target memory on a communication bus; Expanding the driver module in the bus protocol so that the bus protocol supports hot plug event capture; Extending the bus protocol to define a special anti-counterfeiting instruction code, wherein the special anti-counterfeiting instruction code is used to trigger the authentication process; Performing security initialization on the baseboard management controller and the target memory, wherein the baseboard management controller is used to perform identity authentication on the target memory, and the security initialization is used to establish an identity authentication system for the target memory; generating a random challenge code and sending it to the target memory via the communication bus; receiving a signature response returned by the target memory, where the signature response is generated by the target memory using a private key to calculate the challenge code and a unique identifier of a serial presence detection chip of the target memory; The signature response is verified, and a security response mechanism is triggered when the verification fails.

2. The memory anti-counterfeiting authentication method according to claim 1, characterized in that: The securely initializing the baseboard management controller and the target memory includes: When the baseboard management controller is started, a dynamic address allocation command is broadcasted via the communication bus to allocate a dynamic address to the serial presence detection chip of the target memory; Calling the key management service of the baseboard management controller to obtain the preset certificate of the target memory, and according to the preset certificate, the baseboard management controller and the target memory establish a secure communication channel based on a key exchange protocol and exchange public keys; A fingerprint database is established in a storage area of ​​the baseboard management controller, wherein the fingerprint database is used to record the unique identifier of the serial presence detection and the public key.

3. The memory anti-counterfeiting authentication method according to claim 1, characterized in that: Before generating the random challenge code, the method further includes: receiving an interrupt signal sent by the communication bus, and obtaining a unique identifier of the serial presence detection based on the interrupt signal.

4. The memory anti-counterfeiting authentication method according to claim 1, characterized in that: The signature response is generated by the target memory using a private key to calculate the challenge code and a unique identifier of the serial presence detection chip of the target memory, including: The target memory receives the challenge code; The target memory concatenates the challenge code and the unique identifier to obtain a first concatenation result; The target memory calculates a hash value of the first splicing result, and encrypts the hash value of the first splicing result using a private key of the target memory to obtain a signed response.

5. The memory anti-counterfeiting authentication method according to claim 1, characterized in that: The verifying the signed response includes: Obtaining the random challenge code and the unique identifier; Concatenating the challenge code and the unique identifier to obtain a second concatenation result; Calculating a hash value of the second concatenation result, and decrypting the signature response using the public key exchanged in advance to obtain a decrypted result, where the decrypted result corresponds to the hash value of the first concatenation result; The hash value of the second concatenation result is compared with the decryption result. If they are the same, it indicates that the verification is successful; if they are different, it indicates that the verification fails.

6. The memory anti-counterfeiting authentication method according to claim 1, characterized in that: The security response mechanism includes: Generate an alarm log, recording the unique identifier of the target memory and the verification failure timestamp; Data access to unauthenticated target memory is prohibited; Isolate the physical storage channel where the target memory is located.

7. An electronic device, characterized in that: include: Memory for storing computer programs; A processor, configured to implement the steps of the memory anti-counterfeiting authentication method according to any one of claims 1 to 6 when executing the computer program.

8. A computer-readable storage medium, characterized in that The computer-readable storage medium stores a computer program, wherein when the computer program is executed by a processor, the steps of the memory anti-counterfeiting authentication method according to any one of claims 1 to 6 are implemented.

Images