Firmware upgrade system, method, electronic device, storage medium and program product

Abstract

The application discloses a firmware upgrading system and method, an electronic device, a storage medium and a program product, relates to the technical field of server hardware management, and the system comprises a firmware publishing end, which is used for carrying out block encryption processing on a target upgrading firmware to generate a hash tree, signing a root hash value of the hash tree based on a root layer private key to generate first signature data, and storing the root layer private key; a firmware supervision end, which is used for generating second signature data by using an intermediate layer private key and storing the intermediate layer private key; and a firmware using end, which is used for generating third signature data by using a leaf layer private key and storing the leaf layer private key; the firmware publishing end writes a data packet composed of the first signature data, the second signature data, the third signature data and the root hash value into a block chain; and the firmware using end checks the data packet, and if the checking is passed, firmware upgrading is carried out. The technical problem of low safety of a firmware upgrading mode in the related art is solved, and the technical effect of improving the safety of firmware upgrading is achieved.

Description

TECHNICAL FIELD

[0001] The present application relates to the technical field of server hardware management, and particularly relates to a firmware upgrading system and method, an electronic device, a storage medium and a program product. BACKGROUND

[0002] A board management controller (BMC) is an embedded system located on a server motherboard for monitoring and managing server hardware and system resources. The security and integrity of BMC firmware directly determine the overall stability and data security of the server. By upgrading the BMC firmware to fix vulnerabilities and adapt to new hardware, the stable operation of the system is ensured.

[0003] The BMC firmware upgrading method in the related art is that a BMC firmware publisher encrypts the BMC upgrading firmware by using an RSA (Rivest-Shamir-Adleman) algorithm or an ECC (Elliptic Curve Cryptography) algorithm and then publishes the encrypted BMC upgrading firmware, and a BMC firmware user obtains the encrypted BMC upgrading firmware, decrypts the encrypted BMC upgrading firmware, and then upgrades the BMC firmware. In a quantum computer environment, Shor algorithm can break the RSA algorithm or the ECC algorithm in a few hours, and the BMC firmware upgrading method in the related art relies on a centralized server to store a private key, so the risk of private key leakage is high, and the security of the BMC firmware upgrading is low. SUMMARY

[0004] The present application provides a firmware upgrading system, method, electronic device, storage medium and program product to at least solve the problem of low firmware security in the firmware upgrading process in the related art.

[0005] The present application provides a firmware upgrading system, comprising a firmware publishing end, a firmware using end and a firmware supervision end.

[0006] The firmware publishing end is configured to obtain target upgrading firmware of a controller, perform block encryption processing on the target upgrading firmware to obtain a plurality of encrypted target upgrading firmware blocks, generate a hash tree based on the plurality of encrypted target upgrading firmware blocks, sign a root hash value of the hash tree based on a root layer private key of the hash tree to generate first signature data, and store the root layer private key.

[0007] The firmware supervision end is configured to sign the first signature data by using an intermediate layer private key of the hash tree to generate second signature data, and store the intermediate layer private key.

[0008] The firmware usage end is configured to sign the second signature data using a leaf layer private key of the hash tree to generate third signature data, and store the leaf layer private key;

[0009] The firmware publishing end is further configured to write a data packet composed of the first signature data, the second signature data, the third signature data, and the root hash value into a blockchain.

[0010] The firmware usage end is further configured to obtain the data packet from the blockchain, verify the data packet, and if the verification is passed, obtain the plurality of encrypted target upgrade firmware blocks from the firmware publishing end, and perform firmware upgrade of the controller based on the plurality of encrypted target upgrade firmware blocks.

[0011] The application further provides a firmware upgrade method, comprising:

[0012] Based on the firmware publishing end, the target upgrade firmware of the controller is obtained, the target upgrade firmware is subjected to block encryption processing to obtain a plurality of encrypted target upgrade firmware blocks, a hash tree is generated based on the plurality of encrypted target upgrade firmware blocks, the root hash value of the hash tree is signed based on a root layer private key of the hash tree to generate first signature data, and the root layer private key is stored.

[0013] Based on the firmware monitoring end, the first signature data is signed using an intermediate layer private key of the hash tree to generate second signature data, and the intermediate layer private key is stored.

[0014] Based on the firmware usage end, the second signature data is signed using a leaf layer private key of the hash tree to generate third signature data, and the leaf layer private key is stored.

[0015] Based on the firmware publishing end, a data packet composed of the first signature data, the second signature data, the third signature data, and the root hash value is written into a blockchain.

[0016] Based on the firmware usage end, the data packet is obtained from the blockchain, the data packet is verified, and if the verification is passed, the plurality of encrypted target upgrade firmware blocks are obtained from the firmware publishing end, and firmware upgrade of the controller is performed based on the plurality of encrypted target upgrade firmware blocks.

[0017] The application further provides an electronic device, comprising a memory configured to store a computer program, and a processor configured to execute the computer program to implement the steps of the firmware upgrade method.

[0018] The application further provides a computer readable storage medium, wherein the computer readable storage medium stores a computer program, and the computer program is executed by a processor to implement the steps of the firmware upgrade method.

[0019] The application further provides a computer program product comprising a computer program which, when executed by a processor, implements the steps of the above firmware upgrading method.

[0020] According to the application, the firmware publishing end is configured to obtain target upgrading firmware of the controller, perform block encryption processing on the target upgrading firmware to obtain a plurality of encrypted target upgrading firmware blocks, generate a hash tree based on the plurality of encrypted target upgrading firmware blocks, sign a root hash value of the hash tree based on a root layer private key of the hash tree to generate first signature data, and store the root layer private key; the firmware supervision end is configured to sign the first signature data based on an intermediate layer private key of the hash tree to generate second signature data, and store the intermediate layer private key; the firmware using end is configured to sign the second signature data based on a leaf layer private key of the hash tree to generate third signature data, and store the leaf layer private key; the firmware publishing end is further configured to write a data packet composed of the first signature data, the second signature data, the third signature data, and the root hash value into a blockchain; and the firmware using end is further configured to obtain the data packet from the blockchain, verify the data packet, and if the verification is passed, obtain the plurality of encrypted target upgrading firmware blocks from the firmware publishing end and perform firmware upgrading of the controller based on the plurality of encrypted target upgrading firmware blocks. By performing block encryption processing on the target upgrading firmware, the ability to resist quantum computing attacks can be improved. By storing the root layer private key, the intermediate layer private key, and the leaf layer private key to the firmware publishing end, the firmware supervision end, and the firmware using end respectively, decentralized storage of the private keys is achieved, and the risk of private key leakage is reduced. Therefore, the technical problem of low security of the BMC firmware upgrading method in the related art can be solved, and the technical effect of improving the security of firmware upgrading is achieved. BRIEF DESCRIPTION OF DRAWINGS

[0021] In order to more clearly illustrate the embodiments of the present application, the drawings required in the embodiments will be briefly introduced. Obviously, the drawings in the following description are only some embodiments of the present application, and other drawings can be obtained by those skilled in the art without creative labor.

[0022] Figure 1 A structural schematic diagram of a firmware upgrading system provided by an embodiment of the present application;

[0023] Figure 2 A generation flowchart of a multi-level signature chain provided by an embodiment of the present application;

[0024] Figure 3 A flowchart of a smart contract verifying a data packet provided by an embodiment of the present application;

[0025] Figure 4 A flowchart of a firmware upgrading method provided by an embodiment of the present application;

[0026] Figure 5 A flowchart of another firmware upgrade method provided by an embodiment of the present application is shown in FIG. 3.

[0027] Figure 6 A structural diagram of an electronic device provided by an embodiment of the present application is shown in FIG. 4. DETAILED DESCRIPTION

[0028] The technical solutions in the embodiments of the present application will be described clearly and completely below with reference to the drawings in the embodiments of the present application. Obviously, the described embodiments are only some of the embodiments of the present application, but not all the embodiments of the present application. Based on the embodiments in the present application, all other embodiments obtained by those skilled in the art without creative work fall within the protection scope of the present application.

[0029] It should be noted that, in the description of the present application, the terms “comprise”, “contain” or any other variant thereof are intended to cover non-exclusive inclusion, so that the process, method, article or device comprising a series of elements not only includes those elements, but also includes other elements not explicitly listed, or includes elements inherent to such process, method, article or device. The terms “first”, “second” and the like in the present application are used to distinguish similar objects, and are not used to describe a specific order or sequence.

[0030] In order for those skilled in the art to better understand the present application, the present application will be further described in detail below with reference to the drawings and specific embodiments.

[0031] BMC is a controller that provides intelligent management for the motherboard based on the Intelligent Platform Management Interface (IPMI) technical design specification. The security and integrity of BMC firmware directly determine the overall stability and data security of the server. By upgrading the BMC firmware to repair vulnerabilities and adapt to new hardware, the stable operation of the system is ensured.

[0032] A firmware upgrading manner in the related art is as follows: a BMC firmware publisher encrypts a BMC upgrading firmware by using an RSA algorithm or an ECC algorithm and then publishes the BMC upgrading firmware, a BMC firmware user obtains the encrypted BMC upgrading firmware, decrypts the encrypted BMC upgrading firmware, and performs BMC firmware upgrading based on the decrypted BMC upgrading firmware. In a quantum computer environment, Shor algorithm can break the RSA algorithm or the ECC algorithm in several hours. For example, RSA-2048 can be broken in several hours in a 4000 quantum bit environment. The BMC firmware upgrading manner in the related art relies on a centralized server to store a private key. Once the server is intruded or a single point fault occurs, the private key will be leaked or the service terminal will be terminated. It can be seen that the risk of private key leakage is high in this manner, and the security of BMC firmware upgrading is low. The RSA algorithm is an asymmetric encryption algorithm, which is based on the mathematical difficulty of large integer factorization and is widely used in data encryption, digital signature, and key exchange. The ECC algorithm is an asymmetric encryption algorithm based on elliptic curve mathematics, which uses shorter keys than RSA at the same security strength, and provides efficient computing and storage advantages. Shor algorithm is a quantum computing algorithm, which is mainly used for efficiently decomposing large integers and solving discrete logarithm problems. The algorithm uses the parallel computing power of quantum computers to reduce the problem that traditional computers need exponential time to solve (such as large integer factorization relied on by RSA encryption) to polynomial time through quantum Fourier transform and other operations, thereby posing a potential threat to existing public key cryptography.

[0033] Further, the firmware upgrading manner in the related art only relies on simple hash verification of the whole BMC upgrading firmware, lacks block-level verification positioning capability, and cannot accurately identify the case that part of the firmware is tampered.

[0034] In a multi-agency cooperation scenario (such as supply chain management), firmware upgrading needs to be authorized by multiple parties, but the firmware upgrading manner in the related art lacks a decentralized verification mechanism, resulting in a cumbersome and inefficient process.

[0035] To solve the above technical problems, the embodiment of the present application provides a firmware upgrade system, method, electronic device, storage medium and program product, which comprises a firmware publishing end, a firmware using end and a firmware supervision end; the firmware publishing end is used for obtaining target upgrade firmware of a controller; the target upgrade firmware is subjected to block encryption processing to obtain a plurality of encrypted target upgrade firmware blocks; a hash tree is generated based on the plurality of encrypted target upgrade firmware blocks; a root hash value of the hash tree is signed based on a root layer private key of the hash tree to generate first signature data, and the root layer private key is stored; the firmware supervision end is used for signing the first signature data by using an intermediate layer private key of the hash tree to generate second signature data, and the intermediate layer private key is stored; the firmware using end is used for signing the second signature data by using a leaf layer private key of the hash tree to generate third signature data, and the leaf layer private key is stored; the firmware publishing end is further used for writing a data packet composed of the first signature data, the second signature data, the third signature data and the root hash value into a blockchain; the firmware using end is further used for obtaining the data packet from the blockchain, verifying the data packet, and if the verification is passed, obtaining the plurality of encrypted target upgrade firmware blocks from the firmware publishing end and performing firmware upgrade of the controller based on the plurality of encrypted target upgrade firmware blocks. The system provided by the above scheme can improve the ability to resist quantum computing attacks by performing block encryption processing on the target upgrade firmware, provide block-level verification and positioning capabilities, and accurately identify the case that part of the firmware is tampered with. The three-level signature is realized by using the root layer private key, the intermediate layer private key and the leaf layer private key, and the root layer private key, the intermediate layer private key and the leaf layer private key are respectively stored in the firmware publishing end, the firmware supervision end and the firmware using end, which realizes decentralized storage of the private key, reduces the risk of private key leakage, and improves the firmware upgrade security and firmware upgrade efficiency.

[0036] The embodiment of the present application provides a firmware upgrade system, Figure 1 The structure diagram of the firmware upgrade system provided by the embodiment of the present application is shown in the figure, Figure 1 As shown in the figure, the firmware upgrade system comprises a firmware publishing end, a firmware using end and a firmware supervision end. Among them, the firmware publishing end is a carrier for firmware publishing by a firmware publishing party, the firmware using end is a carrier for firmware using by a firmware using party, and the firmware supervision end is a carrier for firmware supervision by a firmware supervision party. The firmware using party can be an enterprise administrator.

[0037] The firmware publishing end is used for obtaining target upgrade firmware of a controller; the target upgrade firmware is subjected to block encryption processing to obtain a plurality of encrypted target upgrade firmware blocks; a hash tree is generated based on the plurality of encrypted target upgrade firmware blocks; a root hash value of the hash tree is signed based on a root layer private key of the hash tree to generate first signature data, and the root layer private key is stored.

[0038] The controller is a BMC. The hash tree is a Merkle tree, which is a tree-shaped data structure based on a cryptographic hash algorithm. The Merkle tree combines the hash values of data blocks recursively layer by layer to generate a root hash value, which is used to efficiently verify the integrity and consistency of large-scale data.

[0039] The root layer private key is generated based on a quantum-resistant digital signature algorithm, which serves as the root trust anchor of the signature chain composed of the first signature data, the second signature data, and the third signature data. The quantum-resistant digital signature algorithm can be an eXtended Merkle Signature Scheme (XMSS). XMSS is a quantum-resistant digital signature algorithm based on a hash function, which realizes efficient expansion and verification of one-time signatures using a Merkle tree structure.

[0040] The firmware supervision end is configured to sign the first signature data using the intermediate layer private key of the hash tree, generate the second signature data, and store the intermediate layer private key.

[0041] The intermediate layer private key is derived based on the root layer private key, i.e., generated by key derivation from the root layer key, ensuring the inheritance of the authority.

[0042] The firmware usage end is configured to sign the second signature data using the leaf layer private key of the hash tree, generate the third signature data, and store the leaf layer private key.

[0043] The leaf layer private key is derived based on the intermediate layer private key and is used for final signature authorization.

[0044] It should be noted that the generation process of the hash tree is completed before the firmware is released. The signature operations, i.e., the processes of signing the root hash value, signing the first signature data, and signing the second signature data, are performed in a physically isolated signature server. The network interface and external storage devices are disabled to prevent private key leakage and ensure the offline security of the signature chain.

[0045] The XMSS signature engine adopts the XMSS algorithm and a three-level hierarchical key structure to generate independent public-private key pairs for the root layer, the intermediate layer, and the leaf layer of the hash tree, respectively, corresponding to the firmware publisher, the firmware supervisor, and the enterprise administrator, respectively, to ensure authority separation and quantum security. It can be understood that quantum-resistant digital signature algorithms such as XMSS require high computing resources. If the signature is generated locally in real time in the BMC, the BMC firmware upgrade time will be prolonged, affecting the continuity of server availability. The embodiments of the present application shorten the BMC firmware upgrade time by performing the signature operation in a physically isolated signature server, ensuring the continuity of server availability.

[0046] The firmware publishing end is also configured to write a data packet composed of the first signature data, the second signature data, the third signature data, and the root hash value into a blockchain.

[0047] The blockchain is a decentralized distributed ledger technology that packages transaction data into blocks connected in chronological order through cryptographic methods, forming a chain structure that cannot be tampered with. It uses a consensus mechanism to allow all nodes to jointly maintain the ledger, ensuring data authenticity and security without a central authority. The blockchain has characteristics such as decentralization, transparency, and tamper resistance, and is widely used in smart contracts, supply chain management, and other fields, providing innovative solutions for digital information.

[0048] The blockchain of the embodiments of the present application adopts a consortium chain architecture. The consortium chain architecture refers to a distributed ledger system jointly maintained by a plurality of authoritative nodes selected in advance, which is between a public chain (completely open) and a private chain (single control). The core feature is the node access mechanism: nodes participating in accounting need to be authorized and authenticated by consortium members (such as firmware publishing parties, firmware using parties, and enterprise administrators), rather than being completely open or single controlled. The consortium chain architecture is governed by multi-centralization, specifically, the consortium members jointly decide on-chain transactions (such as upgrade rules and access standards) through democratic voting or agreement rules.

[0049] The firmware using end is also configured to obtain the data packet from the blockchain, verify the data packet, and if the verification is passed, obtain a plurality of encrypted target upgrade firmware blocks from the firmware publishing end, and perform firmware upgrade of the controller based on the plurality of encrypted target upgrade firmware blocks.

[0050] The firmware upgrade system provided by the embodiments of the present application can improve the ability to resist quantum computing attacks by performing block encryption processing on the target upgrade firmware. By storing the root layer private key, the intermediate layer private key, and the leaf layer private key into the firmware publishing end, the firmware supervision end, and the firmware using end respectively, the decentralized storage of the private key is realized, and the risk of private key leakage is reduced. Therefore, the technical problem of low security of the BMC firmware upgrade method in the related art can be solved, and the technical effect of improving the security of firmware upgrade is achieved.

[0051] In some optional embodiments, the firmware publishing end is specifically configured to:

[0052] perform block processing on the target upgrade firmware to obtain a plurality of target upgrade firmware blocks.

[0053] The target upgrade firmware of the BMC is divided into blocks according to 1MB units according to the flash memory page size (usually 4KB) of the BMC, to ensure that each target upgrade firmware block occupies 256 continuous memory pages, to avoid performance loss caused by cross-page writing, and to ensure that each target upgrade firmware block can be independently written.

[0054] A plurality of target keys are generated by using a hash-based message authentication code-deterministic random bit generator.

[0055] The plurality of 256-bit advanced encryption standard (AES) keys are generated by using a hash-based message authentication code-deterministic random bit generator (HMAC-DRBG). That is, the target keys are 256-bit AES keys. It should be noted that the AES is a symmetric encryption algorithm, which adopts a block encryption technology, supports three key lengths of 128, 192 and 256 bits, and has the characteristics of fast encryption speed, high security and low resource occupation.

[0056] The plurality of target keys are used to encrypt the plurality of target upgrade firmware blocks, and a plurality of encrypted first upgrade firmware blocks are obtained, wherein one target key is used to encrypt one target upgrade firmware block.

[0057] It can be understood that the use of one target key to encrypt one target upgrade firmware block ensures the unpredictability and uniqueness of the key. Each target upgrade firmware block is encrypted using an independent key, preventing a single key leak from exposing global data.

[0058] An initialization vector and an authentication tag corresponding to the first upgrade firmware block are obtained, the initialization vector is attached to the head of the first upgrade firmware block, and the authentication tag is attached to the tail of the first upgrade firmware block, to obtain an encrypted target upgrade firmware block. The initialization vectors corresponding to the plurality of first upgrade firmware blocks are different.

[0059] In the embodiment, the AES-Galois / Counter Mode (GCM)-256 encryption mode is used to encrypt the target upgrade firmware block, and an encrypted target upgrade firmware block is obtained, and the encryption and authentication integration operation is supported. First, the 256-bit AES key is used to encrypt the target upgrade firmware block, and the first encrypted upgrade firmware block, i.e., the ciphertext, is obtained. At the same time, the GCM mode generates the initialization vector and the authentication tag of the first upgrade firmware block. The initialization vector ensures that the same target upgrade firmware block generates different encrypted target upgrade firmware blocks, and the authentication tag is used to check the data integrity during decryption.

[0060] It should be noted that each first upgrade firmware block corresponds to a unique 12-byte initialization vector and a 16-byte authentication tag.

[0061] It should be further noted that the hardware acceleration engine can be used to encrypt multiple target upgrade firmware blocks in parallel to improve the processing speed. The hardware acceleration engine can be Quick Assist Technology (QAT), which offloads the computationally intensive tasks from the central processor to the dedicated hardware, significantly improving the encryption, decryption and data compression performance.

[0062] The firmware upgrade system provided in the embodiment uses an independently generated target key to encrypt each target upgrade firmware block, so that even if a certain key is cracked, the security of other target upgrade firmware blocks will not be affected, and the firmware security is improved. The target key is generated based on the HMAC-DRBG, and the anti-attack ability of the key itself is enhanced. The independent initialization vector and the authentication tag are attached to each first upgrade firmware block, the encryption and authentication integration protection is realized, and the data integrity and security are enhanced. The hardware acceleration engine is used to encrypt multiple target upgrade firmware blocks in parallel, and the encryption efficiency is improved.

[0063] In some optional embodiments, the firmware publishing end is specifically configured to:

[0064] The secure hash algorithm is used to determine a plurality of target hash values corresponding to the plurality of encrypted target upgrade firmware blocks.

[0065] The secure hash algorithm can be Secure Hash Algorithm (SHA)-256, which converts data of any length into a 256-bit (32-byte) unique hash value through complex bit operations, and has anti-collision property and irreversibility.

[0066] Multiple target hash values ​​are used as leaf nodes of the hash tree. This can be understood as follows: the target hash values ​​corresponding to the target upgrade firmware blocks are arranged from left to right according to their order, thus forming the leaf nodes of the hash tree.

[0067] Following the binary tree structure, the hash values ​​corresponding to two adjacent nodes are merged layer by layer until the root hash value is generated, thus obtaining the hash tree.

[0068] Understandably, following the binary tree structure, the target hash values ​​corresponding to two adjacent leaf nodes are merged from left to right to generate the hash value of the corresponding parent node. After obtaining the hash values ​​of multiple parent nodes, the process continues to merge the hash values ​​of two adjacent nodes layer by layer upwards until the root hash value is generated, thus obtaining the hash tree.

[0069] To make the generation process of a multi-level signature chain clearer, combined with Figure 2 The process of generating a multi-level signature chain is described. Figure 2 This is a schematic diagram of the multi-level signature chain generation process provided in the embodiments of this application, such as... Figure 2 As shown, the process includes: dividing the target upgrade firmware into 1MB blocks; encrypting multiple target upgrade firmware blocks using different target keys; using the multiple target hash values ​​corresponding to the encrypted target upgrade firmware blocks as leaf nodes of a hash tree; merging the hash values ​​corresponding to adjacent nodes layer by layer according to a binary tree structure until a root hash value is generated; the firmware publisher signing the root hash value using the root private key to generate the first signature data; the firmware supervisor signing the first signature data using the intermediate private key to generate the second signature data; the firmware user signing the second signature data using the leaf private key to generate the third signature data; and uploading the multi-level signature chain composed of the first, second, and third signature data with additional data to the blockchain. The additional data includes the root hash value, the storage address of the root public key, the storage address of the intermediate public key, and the storage address of the leaf public key.

[0070] The firmware upgrade system provided in this application embodiment supports block-level integrity verification by introducing a hash tree structure, making the location of tampering more accurate.

[0071] In some alternative implementations, the firmware release client is specifically used for:

[0072] The root private key is split into multiple root private key fragments, where the root private key is generated based on a digital signature algorithm resistant to quantum computing attacks.

[0073] The splitting can use a Shamir secret sharing algorithm. For example, the root layer private key is split into 5 root layer private key fragments, and the recovery threshold is 3 / 5, that is, at least 3 root layer private key fragments are required to jointly recover the root layer private key.

[0074] The first number of the plurality of root layer private key fragments are respectively stored in a plurality of hardware security modules of the firmware publishing end.

[0075] For example, the first number can be 3, that is, the root layer private key fragment 1, the root layer private key fragment 2, and the root layer private key fragment 3 are respectively stored in 3 different hardware security modules (Hardware Security Module, referred to as HSM) of the firmware publishing end, that is, the root layer private key fragment 1 is stored in one hardware security module, the root layer private key fragment 2 is stored in one hardware security module, and the root layer private key fragment 3 is stored in one hardware security module. The hardware security module is a special hardware device that protects sensitive data such as keys through physical isolation and encryption technology, and its core function is to provide a high-security execution environment for encryption operations.

[0076] The remaining root layer private key fragments except the first number of root layer private key fragments in the plurality of root layer private key fragments are stored in the blockchain node after being encrypted.

[0077] For example, the root layer private key fragment 4 and the root layer private key fragment 5 are stored in the blockchain node after being encrypted. It should be noted that the blockchain node is a high-security level blockchain node. The encryption algorithm for the root layer private key fragment 4 and the root layer private key fragment 5 can be an AES-GCM-256 encryption algorithm. The key of the AES-GCM-256 encryption algorithm is stored in a trusted execution environment to prevent remote theft or tampering.

[0078] The firmware upgrade system provided by the embodiments of the present application generates a root layer private key based on an XMSS algorithm, ensures that the root layer private key can resist quantum computing attacks, and protects the security of the root layer private key. By splitting the root layer private key into a plurality of root layer private key fragments and storing the plurality of root layer private key fragments in the hardware security module and the blockchain node of the firmware publishing end, respectively, the risk of single-point leakage of the root layer private key fragments is avoided, and the security of the root layer private key is further improved.

[0079] In some optional embodiments, the firmware monitoring end is specifically used for:

[0080] The intermediate layer private key is split into a plurality of intermediate layer private key fragments, wherein the intermediate layer private key is derived based on the root layer private key.

[0081] As described above, the splitting can use a Shamir secret sharing algorithm. For example, the intermediate layer private key is split into 5 intermediate layer private key fragments, and the recovery threshold is 3 / 5.

[0082] The second number of the plurality of intermediate layer private key shards are respectively stored into a plurality of hardware security modules of the firmware supervision end.

[0083] Exemplarily, the second number can be 2, i.e., the intermediate layer private key shard 1 and the intermediate layer private key shard 2 are respectively stored into 2 different hardware security modules of the firmware supervision end.

[0084] The remaining intermediate layer private key shards except the second number of the plurality of intermediate layer private key shards are encrypted and stored into the cross-region blockchain node.

[0085] Exemplarily, the intermediate layer private key shard 3, the intermediate layer private key shard 4 and the intermediate layer private key shard 5 are encrypted and stored into the cross-region blockchain node to achieve geographic redundancy. The algorithm for encrypting the intermediate layer private key shard 3, the intermediate layer private key shard 4 and the intermediate layer private key shard 5 can be an AES-GCM-256 encryption algorithm. The key of the AES-GCM-256 encryption algorithm is stored in a trusted execution environment to prevent remote theft or tampering.

[0086] In some optional embodiments, the firmware usage end is specifically used for:

[0087] The leaf layer private key is split into a plurality of leaf layer private key shards, wherein the leaf layer private key is derived based on the intermediate layer private key.

[0088] As described above, the splitting can adopt a Shamir secret sharing algorithm. Exemplarily, the leaf layer private key is split into 5 leaf layer private key shards, and the recovery threshold is 3 / 5.

[0089] The third number of the plurality of leaf layer private key shards are respectively stored into a plurality of hardware security modules of the firmware usage end.

[0090] Exemplarily, the third number can be 3, i.e., the leaf layer private key shard 1, the leaf layer private key shard 2 and the leaf layer private key shard 3 are respectively stored into 3 different hardware security modules of the firmware usage end.

[0091] The remaining leaf layer private key shards except the third number of the plurality of leaf layer private key shards are encrypted and stored into the blockchain node.

[0092] Exemplarily, the leaf layer private key shard 4 and the leaf layer private key shard 5 are encrypted and stored into the blockchain node. It should be noted that the blockchain node is a high-security level blockchain node. The algorithm for encrypting the leaf layer private key shard 4 and the leaf layer private key shard 5 can be an AES-GCM-256 encryption algorithm. The key of the AES-GCM-256 encryption algorithm is stored in a trusted execution environment to prevent remote theft or tampering.

[0093] In some optional embodiments, the firmware publishing end is further configured to obtain a root layer public key corresponding to the root layer private key, and store the root layer public key in a smart contract of a block chain.

[0094] It can be understood that the root layer public key is paired with the root layer private key to generate, and is used to verify the first signature data, and is stored in the smart contract of the block chain in plaintext. The smart contract is an automatic execution and tamper-proof digital protocol, and its essence is a program code deployed on the block chain. When the preset condition is met, the contract will automatically trigger the corresponding operation without manual intervention.

[0095] The firmware monitoring end is further configured to obtain an intermediate layer public key corresponding to the intermediate layer private key, and store the intermediate layer public key in a hardware security module of the firmware monitoring end after encryption.

[0096] It can be understood that the intermediate layer public key is paired with the intermediate layer private key to generate.

[0097] The firmware using end is further configured to obtain a leaf layer public key corresponding to the leaf layer private key, and store the leaf layer public key in a smart contract of a block chain.

[0098] It can be understood that the leaf layer public key is paired with the leaf layer private key to generate, and is stored in the smart contract of the block chain in plaintext for global verification and calling.

[0099] The firmware upgrade system provided by the embodiments of the present application stores the root layer public key and the leaf layer public key in the smart contract of the block chain, and stores the intermediate layer public key in the hardware security module of the firmware monitoring end, thereby improving the overall attack resistance of the system.

[0100] In some optional embodiments, the firmware publishing end is further configured to, after generating the first signature data, verify the first signature data by using the root layer public key to obtain a first verification result.

[0101] The firmware monitoring end is further configured to, after generating the second signature data, verify the second signature data by using the intermediate layer public key to obtain a second verification result.

[0102] The firmware using end is further configured to, after generating the third signature data, verify the third signature data by using the leaf layer public key to obtain a third verification result.

[0103] It can be understood that after each level of signature operation is completed, the validity is verified by using the corresponding public key to prevent incorrect signature data from being uploaded. It should be noted that the integrity of the public key chain composed of the root layer public key, the intermediate layer public key and the leaf layer public key is recorded in the block chain, and any modification needs to obtain more than 50% of the node consensus, and has tamper-proof protection.

[0104] The firmware publishing end is specifically configured to write, in a case where the first verification result, the second verification result, and the third verification result are all passed, a data packet composed of the first signature data, the second signature data, the third signature data, the root hash value, the storage address of the root layer public key, the storage address of the intermediate layer public key, and the storage address of the leaf layer public key into the blockchain.

[0105] Specifically, the first signature data, the second signature data, and the third signature data are encapsulated into a signature chain, and the root hash value is encapsulated into a JSON object, and a version number, a timestamp, firmware description, and a public key index are added to the data packet, so that subsequent tracing and verification are facilitated. It should be noted that the public key index includes the storage address of the root layer public key, the storage address of the intermediate layer public key, and the storage address of the leaf layer public key.

[0106] The data packet is written into the blockchain through the smart contract, and the blockchain consensus mechanism is triggered to ensure that the data is tamper-proof.

[0107] The firmware upgrade system provided in the embodiments of the present application ensures the accuracy of the firmware upgrade process by verifying the validity of the signature data using the corresponding public key immediately after each level of signature is completed, thereby preventing incorrect signature data from being uploaded to the chain and ensuring the accuracy of the uploaded data.

[0108] In some optional embodiments, the firmware using end includes a controller agent module, i.e., a BMC agent module, which is configured to:

[0109] The data packet is obtained from the blockchain, and the root layer public key is obtained based on the storage address of the root layer public key in the data packet by using the smart contract, and the first signature data in the data packet is verified based on the root layer public key to obtain a fourth verification result.

[0110] The BMC agent module integrates a lightweight blockchain client and supports functions such as firmware download, signature verification, and on-chain interaction. The BMC agent module submits the data packet to a smart contract verification interface, and the smart contract verification interface triggers the smart contract to automatically complete the verification of the multi-level signature chain, i.e., the verification of the data packet.

[0111] Specifically, the root layer public key is read from the blockchain, the root layer public key is parsed into an XMSS public key structure, an XMSS verification function is called, and the signature validity of the root layer private key on the root hash value in the data packet is verified, i.e., the first signature data in the data packet is verified based on the root layer public key to obtain a fourth verification result. If the fourth verification result is not passed, the process is terminated and an alarm is triggered.

[0112] The intermediate layer public key is obtained based on the storage address of the intermediate layer public key in the data packet, and the second signature data in the data packet is verified based on the intermediate layer public key to obtain a fifth verification result.

[0113] Specifically, the intermediate layer public key decryption permission is dynamically requested from the hardware security module of the firmware supervision end to obtain the intermediate layer public key, an XMSS verification function is called to verify the validity of the signature of the first signature data in the data packet by the intermediate layer private key, that is, the second signature data in the data packet is verified based on the intermediate layer public key to obtain a fifth verification result. If the fifth verification result is verification failure, the process is terminated and an alarm is triggered.

[0114] Based on the storage address of the leaf layer public key in the data packet, the leaf layer public key is obtained, and the third signature data in the data packet is verified based on the leaf layer public key to obtain a sixth verification result.

[0115] Specifically, the leaf layer public key is read from the blockchain, an XMSS verification function is called to verify the validity of the signature of the second signature data in the data packet by the leaf layer private key, that is, the third signature data in the data packet is verified based on the leaf layer public key to obtain a sixth verification result. If the sixth verification result is verification failure, the process is terminated and an alarm is triggered.

[0116] If the fourth verification result, the fifth verification result and the sixth verification result are all verification success, it is determined that the data packet passes the check.

[0117] It should be noted that after the data packet passes the check, a smart contract event is triggered and recorded to the blockchain. The smart contract event includes Coordinated Universal Time (UTC) timestamp, BMC unique identifier, upgrade operator identity and other key information.

[0118] In the related art, firmware upgrade is performed depending on static rules (such as fixed time window upgrade), which cannot dynamically adjust firmware upgrade strategy (such as key rotation or permission recovery) according to real-time threats (such as quantum attack warning), resulting in low firmware upgrade security. In the case where the data packet check fails, the firmware supervision party is notified and the process is terminated.

[0119] To make the process of automatically checking the data packet by the smart contract clearer, the process of automatically checking the data packet by the smart contract is described in combination with Figure 3 The process of automatically checking the data packet by the smart contract is described, Figure 3 The process of automatically checking the data packet by the smart contract provided in the embodiments of the present application is shown in the flowchart of the smart contract checking the data packet, as shown in Figure 3As shown, the flow includes: the controller agent module submits the data packet to the smart contract verification interface. The smart contract automatically starts the verification of the multi-level signature chain. The root layer public key is read from the blockchain, and the signature validity of the root layer private key to the root hash value is verified. If the signature validity verification of the root layer private key to the root hash value fails, the flow is terminated and an alarm is triggered. If the signature validity verification of the root layer private key to the root hash value passes, the intermediate layer public key is read from the hardware security module of the firmware supervision end, and the signature validity of the intermediate layer private key to the first signature data is verified. If the signature validity verification of the intermediate layer private key to the first signature data passes, the leaf layer public key is read from the blockchain, and the signature validity of the leaf layer private key to the second signature data is verified. If the signature validity verification of the intermediate layer private key to the first signature data fails, the flow is terminated and an alarm is triggered. If the signature validity verification of the leaf layer private key to the second signature data fails, the flow is terminated and an alarm is triggered.

[0120] The firmware upgrade system provided by the embodiments of the present application automatically performs signature data verification, alarm and strategy adjustment through a smart contract, and realizes decentralized collaborative management.

[0121] In some optional embodiments, the firmware use end includes a controller agent module and a host end.

[0122] The controller agent module is configured to, in a case where the data packet verification passes, acquire, from the firmware publishing end, a plurality of encrypted target upgrade firmware blocks, a plurality of target keys corresponding to the plurality of encrypted target upgrade firmware blocks, a plurality of initialization vectors and a plurality of authentication tags, and send the plurality of encrypted target upgrade firmware blocks, the plurality of target keys corresponding to the plurality of encrypted target upgrade firmware blocks, the plurality of initialization vectors and the plurality of authentication tags to the host end.

[0123] The controller agent module acquires the plurality of encrypted target upgrade firmware blocks, the plurality of target keys corresponding to the plurality of encrypted target upgrade firmware blocks, the plurality of initialization vectors and the plurality of authentication tags from the firmware publishing end through a secure encryption channel. The controller agent module sends the plurality of encrypted target upgrade firmware blocks, the plurality of target keys corresponding to the plurality of encrypted target upgrade firmware blocks, the plurality of initialization vectors and the plurality of authentication tags to the host end through a host-to-BMC (Host-to-BMC, referred to as: H2B) channel. The H2B channel is a core technology for efficient communication between the BMC and the host in a server, and is mainly used to realize functions such as out-of-band management, firmware upgrade, hardware state monitoring and the like.

[0124] The host end is configured to receive the plurality of encrypted target upgrade firmware blocks, the plurality of target keys corresponding to the plurality of encrypted target upgrade firmware blocks, the plurality of initialization vectors, and the plurality of authentication tags sent by the controller agent module, reconstruct a target hash tree based on the plurality of encrypted target upgrade firmware blocks, and obtain a target root hash value in the target hash tree; decrypt the plurality of encrypted target upgrade firmware blocks based on the plurality of target keys corresponding to the plurality of encrypted target upgrade firmware blocks, the plurality of initialization vectors, and the plurality of authentication tags, and obtain a plurality of decrypted target upgrade firmware blocks; and send the target root hash value and the plurality of decrypted target upgrade firmware blocks to the controller agent module.

[0125] It should be noted that the host end can use a hardware acceleration engine to decrypt the plurality of encrypted target upgrade firmware blocks in parallel. It can be understood that, based on the plurality of encrypted target upgrade firmware blocks, a plurality of first hash values corresponding to the plurality of encrypted target upgrade firmware blocks are determined using an SHA-256 algorithm, and a target hash tree is reconstructed based on the plurality of first hash values.

[0126] The controller agent module is further configured to receive the target root hash value and the plurality of decrypted target upgrade firmware blocks, compare the target root hash value with a root hash value in the data packet, and if the comparison is passed, perform firmware upgrade of the controller based on the plurality of decrypted target upgrade firmware blocks.

[0127] It should be noted that if the comparison is passed, the plurality of decrypted target upgrade firmware blocks are written into a BMC flash memory using a Quad Serial Peripheral Interface (QSPI), the BMC is restarted after being written completely, and firmware upgrade of the BMC is completed. The QSPI is a high-speed serial communication interface, mainly used for connecting flash memories or peripherals, and it transmits data in parallel through 4 data lines. Compared with a standard SPI, it has higher bandwidth and is suitable for scenarios requiring fast reading / writing of data.

[0128] In some optional embodiments, the controller agent module is further configured to:

[0129] If the comparison of the target root hash value and the root hash value in the data packet is not passed, the firmware upgrade is stopped and an alarm is given.

[0130] It can be understood that if the comparison of the target root hash value and the root hash value in the data packet is not passed, it indicates that the target upgrade firmware is tampered with, and then the firmware upgrade is immediately stopped and an alarm is given.

[0131] In some optional embodiments, the controller agent module is specifically configured to:

[0132] In the process of writing the plurality of decrypted target upgrade firmware blocks into the controller flash memory, after each preset amount of data is written, target verification is performed on the preset amount of data currently written, if the target verification passes, the step of writing the plurality of decrypted target upgrade firmware blocks into the controller flash memory is continued to be executed.

[0133] The target verification is a 32-bit cyclic redundancy check (CRC). The preset amount of data is set by a technician and is not specifically limited herein.

[0134] If the target verification does not pass, the step of performing target verification on the preset amount of data currently written is returned to be executed.

[0135] If the number of times of returning to execute the step of performing target verification on the preset amount of data currently written reaches a preset number threshold, and the target verification still does not pass, the firmware upgrade is stopped and an alarm is given. The preset number threshold is set by a technician and is not specifically limited herein.

[0136] The firmware upgrade system provided by the embodiments of the present application can find writing errors in time and improve the reliability of firmware writing by performing target verification immediately after each preset amount of data is written. The system fault tolerance is enhanced by setting an automatic retry mechanism. The system controllability is ensured by setting a preset number threshold to prevent infinite loops.

[0137] In some optional embodiments, the controller agent module is further configured to:

[0138] If the firmware upgrade of the controller based on the plurality of encrypted target upgrade firmware blocks fails, the step of performing the firmware upgrade of the controller based on the plurality of encrypted target upgrade firmware blocks is re-executed.

[0139] If the number of times of re-executing the step of performing the firmware upgrade of the controller based on the plurality of encrypted target upgrade firmware blocks reaches a preset number threshold, and the firmware upgrade of the controller still fails, a firmware upgrade failure alarm is given.

[0140] The firmware upgrade system provided by the embodiments of the present application enhances the system fault tolerance by setting an automatic retry mechanism. The system controllability is ensured by setting a preset number threshold to prevent infinite loops.

[0141] Embodiments of the present application provide a firmware upgrade method applied to the firmware upgrade system provided by any of the above embodiments, Figure 4 A flowchart of the firmware upgrade method provided by the embodiments of the present application is shown in Figure 4 The firmware upgrade method includes the following processes:

[0142] At step S401, the target upgrade firmware of the controller is acquired based on the firmware publishing end; the target upgrade firmware is subjected to block encryption processing to obtain a plurality of encrypted target upgrade firmware blocks; a hash tree is generated based on the plurality of encrypted target upgrade firmware blocks; a root hash value of the hash tree is signed based on a root layer private key of the hash tree to generate first signature data, and the root layer private key is stored.

[0143] At step S402, the first signature data is signed based on an intermediate layer private key of the hash tree by the firmware supervision end to generate second signature data, and the intermediate layer private key is stored.

[0144] At step S403, the second signature data is signed based on a leaf layer private key of the hash tree by the firmware using end to generate third signature data, and the leaf layer private key is stored.

[0145] At step S404, the firmware publishing end writes a data packet composed of the first signature data, the second signature data, the third signature data and the root hash value into a blockchain.

[0146] At step S405, the firmware using end acquires the data packet from the blockchain, verifies the data packet, and if the verification is passed, acquires the plurality of encrypted target upgrade firmware blocks from the firmware publishing end and performs firmware upgrade of the controller based on the plurality of encrypted target upgrade firmware blocks.

[0147] For details, refer to the corresponding description of the foregoing firmware upgrade system, which will not be repeated here.

[0148] The firmware upgrade method provided by the embodiments of the present application can improve the ability to resist quantum computing attacks by block encryption processing of the target upgrade firmware. By storing the root layer private key, the intermediate layer private key and the leaf layer private key to the firmware publishing end, the firmware supervision end and the firmware using end respectively, the private key is stored in a decentralized manner, and the risk of private key leakage is reduced, so that the technical problem of low security of the BMC firmware upgrade method in the related art can be solved, and the technical effect of improving the security of firmware upgrade is achieved.

[0149] The embodiments of the present application provide a firmware upgrade method, Figure 5 For the flowchart of the firmware upgrade method provided by the embodiments of the present application, as Figure 5 shown, the flowchart includes:

[0150] Block encryption of firmware. For details, refer to the foregoing description of acquiring the target upgrade firmware of the controller based on the firmware publishing end; the target upgrade firmware is subjected to block encryption processing to obtain a plurality of encrypted target upgrade firmware blocks, which will not be repeated here.

[0151] The hash tree is constructed. For details, refer to the foregoing description of generating the hash tree based on the plurality of encrypted target upgrade firmware blocks, which will not be repeated here.

[0152] The multi-level signature chain is generated. For details, refer to the foregoing description of signing the root hash value of the hash tree based on the root layer private key of the hash tree to generate first signature data, and storing the root layer private key; based on the firmware supervision end, signing the first signature data based on the intermediate layer private key of the hash tree to generate second signature data, and storing the intermediate layer private key; and based on the firmware use end, signing the second signature data based on the leaf layer private key of the hash tree to generate third signature data, and storing the leaf layer private key, which will not be repeated here.

[0153] The blockchain collaborative verification is performed. For details, refer to the foregoing description of obtaining the data packet from the blockchain based on the firmware use end, and verifying the data packet, which will not be repeated here.

[0154] The firmware upgrade and rollback are performed. For details, refer to the foregoing description of performing the firmware upgrade of the controller based on the plurality of encrypted target upgrade firmware blocks, which will not be repeated here.

[0155] The firmware upgrade method provided by the embodiment of the present application realizes the full life cycle security management of the BMC firmware upgrade through the deep integration of the block encryption, the multi-level signature chain, the blockchain collaborative verification, and the hardware acceleration. Each step from the firmware preprocessing to the abnormal rollback is embedded with the anti-quantum, tamper-proof, and automatic strategies, so as to ensure the reliability of the scheme in the high security requirement scene.

[0156] Through the description of the foregoing embodiments, those skilled in the art can clearly understand that the method according to the foregoing embodiments can be realized by means of software necessary for a general hardware platform, and of course, can also be realized by hardware, but in many cases, the former is a better embodiment.

[0157] The embodiment of the present application further provides an electronic device, as shown in the accompanying drawings, comprising a processor 601 and a memory 602, the memory 602 storing a computer program, and the processor 601 is configured to run the computer program to perform the steps in any of the foregoing firmware upgrade method embodiments. Figure 6

[0158] The embodiment of the present application further provides a computer readable storage medium, which stores a computer program, wherein the computer program is configured to perform the steps in any of the foregoing firmware upgrade method embodiments when running.

[0159] ​In an example embodiment, the computer readable storage medium described above can include, but is not limited to, a U disk, a Read-Only Memory (ROM), a Random Access Memory (RAM), a mobile hard disk, a magnetic disk or an optical disk, and various media that can store computer programs.

[0160] Embodiments of the present application also provide a computer program product, which comprises a computer program, and the computer program, when executed by a processor, implements the steps in any of the above-described firmware upgrade method embodiments.

[0161] Embodiments of the present application also provide another computer program product, which comprises a non-volatile computer readable storage medium, and the non-volatile computer readable storage medium stores a computer program, and the computer program, when executed by a processor, implements the steps in any of the above-described firmware upgrade method embodiments.

[0162] The skilled in the art can further realize that the units and algorithm steps of the examples described in conjunction with the embodiments disclosed herein can be realized in electronic hardware, computer software or a combination of both. In order to clearly illustrate the interchangeability of hardware and software, the components and steps of the examples have been described in the above description in a general manner. Whether the functions are performed in hardware or software depends on the specific application and design constraints of the technical solution. The skilled in the art can use different methods to implement the described functions for each specific application, but such implementation should not be considered beyond the scope of the present application.

[0163] The above describes in detail a firmware upgrade system, method, electronic device, storage medium and program product provided by the present application. The principles and implementation modes of the present application are described by applying specific examples in this paper, and the above description of the examples is only applicable to help understand the method and core idea of the present application. It should be noted that for those skilled in the art, without departing from the principles of the present application, some improvements and modifications can be made to the present application, and these improvements and modifications also fall within the protection scope of the claims of the present application.

Claims

1. A firmware upgrade system, characterized in that, This includes firmware release, firmware usage, and firmware monitoring. The firmware publishing terminal is used to obtain the target upgrade firmware for the controller; The target upgrade firmware is subjected to block encryption processing to obtain multiple encrypted target upgrade firmware blocks; A hash tree is generated based on multiple encrypted target upgrade firmware blocks; The root hash value of the hash tree is signed based on the root private key of the hash tree to generate first signature data, and the root private key is stored. The firmware monitoring terminal is used to sign the first signature data using the intermediate layer private key of the hash tree, generate the second signature data, and store the intermediate layer private key. The firmware client is used to sign the second signature data using the leaf layer private key of the hash tree, generate the third signature data, and store the leaf layer private key. The firmware publishing terminal is also used to write the data packet consisting of the first signature data, the second signature data, the third signature data, and the root hash value into the blockchain; The firmware user terminal is also used to obtain the data packet from the blockchain, verify the data packet, and if the verification is successful, obtain multiple encrypted target upgrade firmware blocks from the firmware publishing terminal, and perform firmware upgrade of the controller based on the multiple encrypted target upgrade firmware blocks.

2. The system according to claim 1, characterized in that, The firmware publishing client is specifically used for: The target upgrade firmware is divided into blocks to obtain multiple target upgrade firmware blocks; Multiple target keys are generated using a hash-based message authentication code deterministic random bit generator. Multiple target upgrade firmware blocks are encrypted using multiple sets of target keys to obtain multiple encrypted first upgrade firmware blocks, wherein one set of target keys is used to encrypt one target upgrade firmware block. Obtain the initialization vector and authentication tag corresponding to the first upgrade firmware block, append the initialization vector to the head of the first upgrade firmware block, and append the authentication tag to the tail of the first upgrade firmware block to obtain the encrypted target upgrade firmware block. Among them, the initialization vectors corresponding to multiple first upgrade firmware blocks are different.

3. The system according to claim 1, characterized in that, The firmware publishing client is specifically used for: Using a secure hash algorithm, multiple target hash values ​​corresponding to the multiple encrypted target upgrade firmware blocks are determined; The plurality of target hash values ​​are used as leaf nodes of the hash tree; Following the binary tree structure, the hash values ​​corresponding to two adjacent nodes are merged layer by layer until the root hash value is generated, thus obtaining the hash tree.

4. The system according to claim 1, characterized in that, The firmware publishing client is specifically used for: The root private key is split into multiple root private key fragments, wherein the root private key is generated based on a digital signature algorithm resistant to quantum computing attacks; The first number of root layer private key fragments from the multiple root layer private key fragments are stored in multiple hardware security modules of the firmware release terminal respectively; The remaining root private key fragments, excluding the first number of root private key fragments, are encrypted and stored in the blockchain node.

5. The system according to claim 1, characterized in that, The firmware monitoring terminal is specifically used for: The intermediate layer private key is split into multiple intermediate layer private key fragments, wherein the intermediate layer private key is derived from the root layer private key; The second number of intermediate layer private key fragments are stored in multiple hardware security modules of the firmware monitoring terminal. The remaining intermediate layer private key fragments, excluding the second number of intermediate layer private key fragments, are encrypted and stored in a cross-regional blockchain node.

6. The system according to claim 1, characterized in that, The firmware user terminal is specifically used for: The leaf layer private key is split into multiple leaf layer private key fragments, wherein the leaf layer private key is derived from the intermediate layer private key; The third number of leaf layer private key fragments from the multiple leaf layer private key fragments are stored in multiple hardware security modules of the firmware user terminal respectively; The remaining leaf layer private key fragments, excluding the third number of leaf layer private key fragments, are encrypted and stored in the blockchain node.

7. The system according to claim 1, characterized in that, The firmware publishing terminal is also used to obtain the root public key corresponding to the root private key and store the root public key in the smart contract of the blockchain; The firmware monitoring terminal is also used to obtain the intermediate layer public key corresponding to the intermediate layer private key, encrypt the intermediate layer public key and store it in the hardware security module of the firmware monitoring terminal; The firmware client is also used to obtain the leaf layer public key corresponding to the leaf layer private key and store the leaf layer public key in the smart contract of the blockchain.

8. The system according to claim 7, characterized in that, The firmware publishing terminal is also used to verify the first signature data using the root public key after generating the first signature data, and obtain a first verification result; The firmware monitoring terminal is also used to verify the second signature data using the intermediate layer public key after the second signature data is generated, and to obtain a second verification result; The firmware user terminal is also used to verify the third signature data using the leaf layer public key after the third signature data is generated, and to obtain a third verification result; Specifically, the firmware publishing terminal is used to write a data packet consisting of the first signature data, the second signature data, the third signature data, the root hash value, the storage address of the root public key, the storage address of the intermediate public key, and the storage address of the leaf public key into the blockchain when the first verification result, the second verification result, and the third verification result are all verified.

9. The system according to claim 8, characterized in that, The firmware user includes a controller proxy module, which is used for: The data packet is obtained from the blockchain. Using a smart contract, the root public key is obtained based on the storage address of the root public key in the data packet. The first signature data in the data packet is verified based on the root public key to obtain a fourth verification result. Based on the storage address of the intermediate layer public key in the data packet, the intermediate layer public key is obtained, and the second signature data in the data packet is verified based on the intermediate layer public key to obtain the fifth verification result; Based on the storage address of the leaf layer public key in the data packet, the leaf layer public key is obtained, and the third signature data in the data packet is verified based on the leaf layer public key to obtain the sixth verification result; If the fourth verification result, the fifth verification result, and the sixth verification result are all verified as passed, then the data packet verification is determined to be successful.

10. The system according to claim 1, characterized in that, The firmware user end includes a controller agent module and a host end; The controller proxy module is used to obtain multiple encrypted target upgrade firmware blocks, multiple target keys, multiple initialization vectors and multiple authentication tags corresponding to the multiple encrypted target upgrade firmware blocks from the firmware publishing end when the data packet verification is successful, and send the multiple encrypted target upgrade firmware blocks, multiple target keys, multiple initialization vectors and multiple authentication tags to the host end. The host terminal is used to receive the multiple encrypted target upgrade firmware blocks, multiple target keys corresponding to the multiple encrypted target upgrade firmware blocks, multiple initialization vectors and multiple authentication tags sent by the controller agent module, and reconstruct the target hash tree based on the multiple encrypted target upgrade firmware blocks to obtain the target root hash value in the target hash tree. Based on the multiple target keys, multiple initialization vectors and multiple authentication tags corresponding to the multiple encrypted target upgrade firmware blocks, the multiple encrypted target upgrade firmware blocks are decrypted to obtain multiple decrypted target upgrade firmware blocks; the target root hash value and the multiple decrypted target upgrade firmware blocks are sent to the controller agent module; The controller agent module is also used to receive the target root hash value and the decrypted multiple target upgrade firmware blocks, compare the target root hash value with the root hash value in the data packet, and if the comparison is successful, perform a firmware upgrade of the controller based on the decrypted multiple target upgrade firmware blocks.

11. The system according to claim 10, characterized in that, The controller agent module is also used for: If the target root hash value and the root hash value in the data packet fail to match, the firmware upgrade will be stopped and an alarm will be issued.

12. A firmware upgrade method, characterized in that, The method includes: Based on the firmware release terminal, the target upgrade firmware of the controller is obtained; the target upgrade firmware is divided into blocks for encryption to obtain multiple encrypted target upgrade firmware blocks; a hash tree is generated based on the multiple encrypted target upgrade firmware blocks; the root hash value of the hash tree is signed based on the root private key of the hash tree to generate first signature data, and the root private key is stored. Based on the firmware monitoring terminal, the first signature data is signed using the intermediate layer private key of the hash tree to generate the second signature data, and the intermediate layer private key is stored. Based on the firmware user end, the second signature data is signed using the leaf layer private key of the hash tree to generate the third signature data, and the leaf layer private key is stored. Based on the firmware release terminal, the data packet consisting of the first signature data, the second signature data, the third signature data, and the root hash value is written into the blockchain; Based on the firmware user end, the data packet is obtained from the blockchain and verified. If the verification passes, multiple encrypted target upgrade firmware blocks are obtained from the firmware publishing end, and the controller firmware is upgraded based on the multiple encrypted target upgrade firmware blocks.

13. An electronic device, characterized in that, include: Memory, used to store computer programs; A processor, configured to implement the steps of the firmware upgrade method as described in claim 12 when executing the computer program.

14. A computer-readable storage medium, characterized in that, The computer-readable storage medium stores a computer program, wherein the computer program, when executed by a processor, implements the steps of the firmware upgrade method as described in claim 12.

15. A computer program product, comprising a computer program, characterized in that, When the computer program is executed by the processor, it implements the steps of the firmware upgrade method as described in claim 12.

Images