Equipment starting method and device, management controller and storage medium
By using a hardware fingerprint module in the management controller to generate random numbers to scramble the startup data, the problem of the management controller startup program being easily accessed by malicious actors is solved, achieving higher startup security and data protection.
Patent Information
- Application Number
- CN202511076057.4
- Authority / Receiving Office
- CN · China
- Patent Type
- Applications(China)
- Current Assignee / Owner
- Filing Date
- 2025-07-31
- Publication Date
- 2025-11-04
AI Technical Summary
The management controller's startup program is vulnerable to malicious users who can obtain the encryption key by repeatedly accessing the memory, threatening startup security and posing a risk of encryption key leakage.
The system uses an internal hardware fingerprint module to generate random numbers to scramble the startup program data and then reverses the scrambling process upon power-on, thus improving data security.
By out-of-order processing, the security of startup data storage and the startup security of the management controller are improved, preventing the leakage of encryption keys.
Smart Images
Figure CN120893048A_ABST
Abstract
Description
TECHNICAL FIELD
[0001] The present application relates to the technical field of computer, and in particular, to a device starting method and device, a management controller and a storage medium. BACKGROUND
[0002] The management controller is an important component in the server, and guarantees the safe starting, which plays an important role in maintaining the normal operation of the server. In the related art, although the starting program in the management controller can be protected by encryption and the like, the encryption key is at risk of being leaked. In addition, the memory of the management controller is easily accessed by malicious external users, and then the malicious users can obtain the encrypted starting program by accessing the memory multiple times, and restore the encryption key, thereby threatening the starting security of the management controller. SUMMARY
[0003] The present application provides a device starting method and device, a management controller and a storage medium, which can use the random number generated by the internal hardware fingerprint module to perform the disorder processing on the starting program data in the memory, can improve the storage security of the starting program data, and can improve the starting security of the management controller.
[0004] To solve the above technical problems, the present application provides a device starting method, comprising:
[0005] When the starting program is saved, the starting program data is obtained;
[0006] The excitation signal is input to the hardware fingerprint module to obtain the random number corresponding to the excitation signal generated by the hardware fingerprint module according to the hardware physical characteristics thereof, the starting program data is processed in disorder according to the random number, and the starting program data after the disorder processing is saved to the memory;
[0007] When the power-on starting is performed, the excitation signal is input to the hardware fingerprint module to obtain the random number, the starting program data in the memory is processed in reverse disorder according to the random number, and the device is started according to the starting program data after the reverse disorder processing.
[0008] The present application also provides a device starting device, comprising:
[0009] The obtaining module is configured to obtain the starting program data when the starting program is saved;
[0010] The disorder module is configured to input the excitation signal to the hardware fingerprint module to obtain the random number corresponding to the excitation signal generated by the hardware fingerprint module according to the hardware physical characteristics thereof, process the starting program data in disorder according to the random number, and save the starting program data after the disorder processing to the memory;
[0011] The device startup method comprises the following steps: inputting an excitation signal to a hardware fingerprint module to obtain a random number; performing a disordering sequence processing on startup program data in a memory according to the random number; and performing device startup according to the startup program data after the disordering sequence processing.
[0012] The application further provides a management controller, comprising:
[0013] a memory for storing a computer program;
[0014] a processor for executing the computer program to implement the device startup method;
[0015] a hardware fingerprint module for receiving the excitation signal sent by the processor and generating a random number corresponding to the excitation signal according to the hardware physical characteristics of the hardware fingerprint module.
[0016] The application further provides a non-volatile computer readable storage medium, wherein the non-volatile computer readable storage medium stores computer executable instructions, and the computer executable instructions are loaded and executed by a processor to implement the device startup method.
[0017] The application has the following beneficial effects: when saving startup program data, the application can input an excitation signal to an internal hardware fingerprint module to generate a random number corresponding to the excitation signal according to the hardware physical characteristics of the hardware fingerprint module, perform disordering sequence processing on the startup program data according to the random number, and save the startup program data after the disordering sequence processing to a memory. It can be seen that the startup program data in the memory has been subjected to disordering sequence processing, and the random number used for the disordering sequence processing is generated by the internal hardware fingerprint module according to the hardware physical characteristics of the module itself and cannot be copied, so that the security of the startup program data can be improved. Furthermore, when performing power-on startup, the application can input an excitation signal to the hardware fingerprint module to obtain a random number, perform disordering sequence processing on the startup program data in the memory according to the random number, and perform device startup according to the startup program data after the disordering sequence processing, so that the startup security can be improved.
[0018] The application further provides a device startup device, a management controller and a non-volatile computer readable storage medium, which have the above beneficial effects. BRIEF DESCRIPTION OF DRAWINGS
[0019] In order to more clearly illustrate the embodiments of the application, the drawings needed in the embodiments will be briefly introduced as follows. Obviously, the drawings in the following description are only some embodiments of the application, and other drawings can be obtained by those skilled in the art without creative effort.
[0020] Figure 1A flow chart of a device starting method provided by the embodiment of the present application;
[0021] Figure 2 A flow chart of software and hardware matching starting provided by the embodiment of the present application;
[0022] Figure 3 A software work flow chart provided by the embodiment of the present application;
[0023] Figure 4 A schematic diagram of a hardware security starting flow provided by the embodiment of the present application;
[0024] Figure 5 A structure block diagram of a device starting apparatus provided by the embodiment of the present application;
[0025] Figure 6 A structure block diagram of a management controller provided by the embodiment of the present application. DETAILED DESCRIPTION
[0026] The technical solutions in the embodiments of the present application will be described clearly and completely below with reference to the drawings in the embodiments of the present application. Obviously, the described embodiments are only part of the embodiments of the present application, rather than all the embodiments of the present application. Based on the embodiments in the present application, all the other embodiments obtained by those skilled in the art without creative work fall within the protection scope of the present application.
[0027] It should be noted that, in the description of the present application, the terms "comprise", "contain" or any other variants thereof are intended to cover non-exclusive inclusion, so that the process, method, article or device comprising a series of elements not only includes those elements, but also includes other elements not explicitly listed or inherent to such process, method, article or device. The terms "first", "second" and the like in the present application are used to distinguish similar objects, and are not used to describe a specific order or sequence.
[0028] In order for those skilled in the art to better understand the technical solutions of the present application, the present application will be further described in detail below with reference to the drawings and specific embodiments.
[0029] The management controller is an important component in the server, guarantees the safe start, and plays an important role in maintaining the normal operation of the server. The common management controller can be a baseboard management controller (BMC), iLO (Integrated Lights-out), iDRAC (Integrated Dell Remote Access Controller) or other management controllers. In the related art, although the start program in the management controller can be protected by encryption and the like, the encryption key is at risk of being leaked; in addition, the memory of the management controller is easily accessed by malicious external users, and then the malicious user can obtain the encrypted start program by accessing the memory multiple times, and restore the encryption key, threatening the start security of the management controller.
[0030] Therefore, in order to solve the technical problem of how to effectively store and read the start program to guarantee the start security of the management controller, the present application provides a device start method, which can use the random number generated by the internal hardware fingerprint module to perform out-of-order processing on the start program data in the memory, improve the storage security of the start program data, and improve the start security of the management controller.
[0031] For the convenience of understanding, please refer to Figure 1 , Figure 1 The flow chart of the device start method provided by the embodiment of the present application. The method can be applied to the management controller. The method can include:
[0032] S101, when saving the start program, obtaining start program data.
[0033] In the embodiment, the start program data can include a start program image (Image) and a signature value (Signature) of the start program image. The start program image contains the start program required for the management controller to start. The signature value can be obtained by signing the digest value (Hash) of the start program image, and the digest value is used to verify whether the start program image has been tampered with.
[0034] In order to preliminarily guarantee the security of the start program image, the start program image in the embodiment can be encrypted, and the encryption key used for encryption can be stored in the management controller. In addition, the signature value can be obtained by signing the digest value using a signature private key, and the signature value can be restored by decrypting using a signature public key. The signature public key can also be stored in the management controller. In order to improve the security of the encryption key and the signature public key, the embodiment can use an OTP (One Time Programmable) to save the encryption key and the signature public key.
[0035] S102, input an excitation signal to the hardware fingerprint module, obtain a random number corresponding to the excitation signal generated by the hardware fingerprint module according to its hardware physical characteristics, perform out-of-order processing on the startup program data according to the random number, and save the startup program data after the out-of-order processing to the memory.
[0036] After obtaining the startup program data, the embodiment needs to perform out-of-order processing on it, and then save the startup program data after the out-of-order processing to the memory. The out-of-order processing refers to exchanging the positions of each data bit in the startup program data to confuse the original data bit order in the startup program data, so as to achieve the confusion purpose. It is worth pointing out that since the efficiency of data movement and transposition in the computer is relatively high, compared with using random numbers to confuse the startup program data in the form of addition, subtraction, multiplication and division, the efficiency of out-of-order processing is higher, and the confusion effect can be achieved more simply and quickly.
[0037] To improve the security of the out-of-order processing, the embodiment can set a hardware fingerprint module in the management controller. The management controller can input an excitation signal to the hardware fingerprint module, so that the latter generates a random number corresponding to the excitation signal according to its own hardware physical characteristics. The hardware physical characteristics here can be electrical characteristics such as path delay, power consumption, signal stability, etc. Influenced by the hardware production process deviation, each hardware module has subtle differences in electrical characteristics, and the hardware fingerprint module can amplify these subtle differences and generate a unique response based on these subtle differences. In other words, even if the same excitation signal is input to different hardware fingerprint modules, the outputs of the two are not the same. Considering that the production process deviation cannot be effectively copied, therefore each hardware fingerprint module has a non-reproducible characteristic. In addition, since the random number in the embodiment is generated by the hardware fingerprint module according to the excitation signal, it can ensure that the random number is dynamically generated on demand, which can avoid random number leakage, thereby effectively improving the security of the out-of-order processing.
[0038] It should be noted that the embodiment does not limit the specific hardware fingerprint module, as long as it can generate a random number according to its own hardware physical characteristics. For example, the hardware fingerprint module can be a PUF module (Physical Unclonable Functions), which can be an SRAM PUF module (Static Random-Access Memory Physical Unclonable Functions).
[0039] Further, after obtaining the random number, the embodiment can exchange data bits in the start program data according to each bit (Bit) of the random number. First, since the length of the random number is limited, it can only control data bit exchange in a data segment of limited length, so the start program data can be divided into a first data segment first, and the data length of the first data segment can be set according to the data length of the random number. Then, the embodiment can pre-set the correspondence between each bit of the random number and each pair of data bits in the first data segment. For example, data bit 0 in the random number corresponds to data bits 0, 1 in the first data segment, data bit 1 in the random number corresponds to data bits 2, 3 in the first data segment, and so on. Then, the embodiment can read each bit of the random number value in the random number according to the preset order, determine the corresponding pair of target data bits in the first data segment, and control the target data bits to exchange positions or remain positions in the first data segment according to the random number value, to obtain the start program data after the disorder processing. For example, each bit of the random number value is read in order from left to right, and the position of the corresponding pair of target data bits in the first data segment is exchanged or maintained according to each bit of the random number value. Then, after completing the processing of each first data segment, the start program data after the disorder processing can be obtained.
[0040] Based on this, the disorder processing of the start program data according to the random number can include:
[0041] Step 11: divide the start program data into a first data segment;
[0042] Step 12: for each first data segment, read each bit of the random number value in the random number according to the preset order, determine the corresponding pair of target data bits in the first data segment, and control the target data bits to exchange positions or remain positions in the first data segment according to the random number value, to obtain the start program data after the disorder processing.
[0043] In a specific embodiment, controlling the target data bits to exchange positions or remain positions in the first data segment according to the random number value can include:
[0044] Step 21: when the random number value is determined to be a first value, control the data bit exchange position;
[0045] Step 22: when the random number value is determined to be a second value, control the data bit to remain position.
[0046] It should be noted that the embodiment does not limit the specific values of the first value and the second value, which can be set according to actual application requirements. Since the value of each data bit is 0 or 1, the first value can be 1 and the second value can be 0. Further, if the value of the data bit 0 in the random number is 1, the data bits 0 and 1 in the first data segment are exchanged; if the value of the data bit 1 in the random number is 0, the positions of the data bits 2 and 3 in the first data segment remain unchanged.
[0047] It should be noted that the embodiment does not limit the correspondence between the random number bits in the random number and each pair of data bits in the first data segment, which can be set according to actual application requirements.
[0048] Further, considering that the size of the startup program data is large, the time consumed by the out-of-order processing of the complete startup program data is more, which is easy to affect the startup efficiency. Therefore, the embodiment also performs out-of-order processing on part of the startup program data. For example, considering that the signature value of the startup program image plays an important role in verifying the startup program image and needs to be protected first, the signature value can be processed out of order.
[0049] Based on this, the startup program data includes the startup program image and the signature value of the startup program image; the startup program data is equally divided into the first data segment, which can include:
[0050] Step 31: Extract the signature value in the startup program data, and equally divide the signature value into the first data segment.
[0051] In addition, the embodiment can perform out-of-order processing on the startup program image. For the sake of security and processing efficiency, the embodiment can perform out-of-order processing on the complete startup program image, or perform out-of-order processing on part of the startup program image. For example, only the data segment with a preset length located at the head of the startup program image is processed out of order.
[0052] Based on this, the startup program data is equally divided into the first data segment, which can include:
[0053] Step 41: Extract the startup program image in the startup program data, and equally divide the complete startup program image or part of the startup program image into the first data segment.
[0054] Of course, the embodiment can also exchange the positions of the out-of-order signature value and the out-of-order startup program image after performing out-of-order processing on part of the signature value and the startup program image to further improve the out-of-order effect.
[0055] S103, inputting the excitation signal to the hardware fingerprint module to obtain a random number, performing reverse out-of-order processing on the startup program data in the memory according to the random number, and performing device startup according to the startup program data after the reverse out-of-order processing.
[0056] In this step, since the startup program data in the memory has been processed in disorder, when power-on startup is performed, the startup program data in the memory needs to be processed in reverse order, that is, the original data bit order of the startup program data is restored, and then device startup is performed. Specifically, in this embodiment, the random number can be read according to the reverse order of the preset order used when the random number is read during the out-of-order processing, and each bit of the random number value in the random number can be read, and the position of each bit of the random number value in the first data segment can be restored, so as to obtain the startup program data after the reverse out-of-order processing.
[0057] Therefore, the reverse out-of-order processing of the startup program data in the memory according to the random number can include:
[0058] Step 51: for each first data segment, reading each bit of the random number value in the random number according to the reverse order of the preset order, determining a pair of target data bits corresponding to the random number value in the first data segment, and controlling the target data bits to exchange positions or remain positions in the first data segment according to the random number value, to obtain the startup program data after the reverse out-of-order processing.
[0059] Based on the above embodiment, when saving the startup program, an excitation signal can be input to the internal hardware fingerprint module, a random number corresponding to the excitation signal generated by the hardware fingerprint module according to its hardware physical characteristics can be obtained, and the startup program data can be processed in disorder according to the random number, and the startup program data after the out-of-order processing can be saved to the memory. It can be seen that the startup program data in the memory has been processed in disorder, and the random number used for the out-of-order processing is generated by the internal hardware fingerprint module according to the hardware physical characteristics of the module itself, and cannot be copied, so as to improve the security of the startup program data. Further, when power-on startup is performed, the excitation signal can be input to the hardware fingerprint module to obtain a random number, the startup program data in the memory can be processed in reverse order according to the random number, and device startup can be performed according to the startup program data after the reverse out-of-order processing, so as to improve the startup security.
[0060] Based on the above embodiment, in order to further improve the out-of-order effect, in addition to exchanging each pair of data bits in the first data segment according to each bit of the random number, the data sub-segment formed by multiple data bits can also be exchanged. Another out-of-order processing method will be introduced below. In a specific implementation, the method can further include:
[0061] S201, divide the first data segment into first data sub-segments, divide the random number into second data segments corresponding to the first data sub-segments, and divide the second data segments into first data blocks and second data blocks.
[0062] For example, for a first data segment of 128 bits, it can be divided into 16 first data sub-segments of 8 bits. Each first data sub-segment can be allocated a second data segment of 16 bits to determine the permutation mode, i.e. a total of 16x16=256 bits of random number is needed. In addition, the second data segment can be divided into a first data block composed of the first 12 bits and a second data block composed of the last 4 bits.
[0063] For each first data segment, read each random number value in the random number in a preset order, determine a pair of target data bits corresponding to the random number value in the first data segment, and control the target data bits to exchange positions or remain positions in the first data segment according to the random number value, to obtain the start program data after the disorder processing, including:
[0064] S202, for each first data sub-segment, read each random number value in the first data block corresponding to the first data sub-segment in a preset order, determine a pair of target data bits corresponding to the random number value in the first data sub-segment, and control the target data bits to exchange positions or remain positions in the first data sub-segment according to the random number value, to obtain the first data sub-segment after the disorder processing.
[0065] In this step, data bit exchange can be performed in each first data sub-segment. Specifically, the embodiment can read each random number value in the first data block corresponding to the first data sub-segment in a preset order, determine a pair of target data bits corresponding to the random number value in the first data sub-segment, and control the target data bits to exchange positions or remain positions in the first data sub-segment according to the random number value, to obtain the first data sub-segment after the disorder processing. For example, the following operations can be performed in the first data sub-segment:
[0066] 1. According to the first 4 bits of the first data block, determine whether the data bits 0 and 1, bits 2 and 3, bits 4 and 5, and bits 6 and 7 in the first data sub-segment are exchanged in turn.
[0067] 2. According to the next 4 bits of the first data block, determine whether the data bits 0 and 2, bits 1 and 3, bits 4 and 6, and bits 5 and 7 in the first data sub-segment are exchanged in turn.
[0068] 3. According to the last 4 bits of the first data block, determine whether the data bits 0 and 4, bits 1 and 5, bits 2 and 6, and bits 3 and 7 in the first data sub-segment are exchanged in turn.
[0069] S203, the second data block is composed into a third data segment, each bit of random number value in the third data segment is read according to a preset order, a pair of target first data sub-segments corresponding to the random number value is determined, and the target first data sub-segments completing the disorder processing are exchanged or kept in position in the first data segment according to the random number value, to obtain the first data segment completing the disorder processing.
[0070] In this step, the second data block can be sequentially composed into a third data segment, and each bit of random number value in the third data segment is read according to a preset order, a pair of target first data sub-segments corresponding to the random number value is determined, and the target first data sub-segments completing the disorder processing are exchanged or kept in position in the first data segment according to the random number value, to obtain the first data segment completing the disorder processing. For example, the following operations can be performed on each first data sub-segment:
[0071] 1, data sub-segment 0 and data sub-segment 1, data sub-segment 2 and data sub-segment 3, data sub-segment 4 and data sub-segment 5, data sub-segment 6 and data sub-segment 7… data sub-segment 14 and data sub-segment 15, whether to exchange is determined according to the first 8 bits of the 64-bit third data segment.
[0072] 2, data sub-segment 0 and data sub-segment 2, data sub-segment 1 and data sub-segment 3, data sub-segment 4 and data sub-segment 6, data sub-segment 5 and data sub-segment 7… data sub-segment 13 and data sub-segment 15, whether to exchange is determined according to the next 8 bits of the 64-bit third data segment.
[0073] …
[0074] 8, data sub-segment 0 and data sub-segment 8, data sub-segment 1 and data sub-segment 9, data sub-segment 2 and data sub-segment 10, data sub-segment 3 and data sub-segment 11… data sub-segment 7 and data sub-segment 15, whether to exchange is determined according to the last 8 bits of the 64-bit third data segment.
[0075] S204, the first data segment completing the disorder processing is used to compose the boot program data after the disorder processing.
[0076] After the disorder processing of each first data segment is completed, the first data segment completing the disorder processing can be used to compose the boot program data after the disorder processing, and the boot program data after the disorder processing is saved. It can be understood that the disorder processing is the reverse process of steps S201-S204.
[0077] Based on the above embodiments, after the out-of-order processing of the boot program data is completed, the boot program image can be verified by the signature value to ensure the security of the boot of the management controller. The verification method is described below. In a specific embodiment, the boot program data includes an encrypted boot program image and a signature value of the boot program image; and the device booting according to the boot program data after the out-of-order processing can include:
[0078] S301, reading the encryption key and the signature public key from the one-time programmable register.
[0079] In this embodiment, the encryption key and the signature public key can be stored in the one-time programmable register to improve the security of key storage. In addition, the one-time programmable register can also be set to a read-rejected state to prevent external acquisition of key information.
[0080] S302, decrypting the signature value by using the signature public key to obtain a first hash value.
[0081] In this step, the first hash value is the hash value obtained by performing hash processing on the correct boot program image. If the hash processing on the current boot program image cannot obtain the first hash value, it means that the current boot program image has been tampered with and the device cannot be booted.
[0082] It should be noted that this embodiment does not limit how to decrypt the signature value by using the signature public key, and reference can be made to related technologies of asymmetric encryption.
[0083] S303, performing hash processing on the boot program image to obtain a second hash value.
[0084] In this step, the first hash value is the hash value obtained by performing hash processing on the current boot program image. The second hash value needs to be compared and verified with the first hash value to determine whether the boot program image has been tampered with.
[0085] S304, determining whether the first hash value and the second hash value are the same.
[0086] S305, when it is determined that the first hash value and the second hash value are the same, decrypting the boot program image by using the encryption key, and booting the device by using the decrypted boot program image.
[0087] It should be noted that this embodiment does not limit how to decrypt the boot program image by using the encryption key, and reference can be made to related technologies of symmetric encryption.
[0088] S306, when it is determined that the first hash value and the second hash value are different, stopping the device booting.
[0089] It can be seen that the embodiment only starts the device when the program image is verified, and the safety of the device start can be ensured.
[0090] Based on the above embodiment, the above device starting method is completely introduced based on specific drawings. The application proposes an optimized BMC security starting system, which can generate a 256-bit seed sequence by using a PUF module built in the security starting system to generate a unique key, and further optimize the security performance of the security starting process by using a convenient and easy-to-implement algorithm.
[0091] The application proposes a matching software and hardware architecture, the software is responsible for encrypting the image and the signature value and communicating with the hardware, the hardware is built in with an OTP memory, a PUF module and an RSA algorithm module, and the SHA algorithm module is responsible for the security starting.
[0092] The user first uses the software system to perform AES encryption on the correct BMC starting program image, performs SHA algorithm operation on the encrypted image (the application uses SHA-256 algorithm), generates a corresponding 256-bit digest value, and the digest value is the identity proof of the starting program image. Then, the digest value is encrypted by using the RSA private key to generate a signature value. Then, the image and the signature are written into a storage unit (such as a FLASH or an EMMC). Since the image and the signature are stored in a non-secure storage space, the application can analyze the image and the signature by using the PUF module in the chip to perform a certain degree of out-of-order processing, thereby further improving the security performance and making up for the unsafe blind area caused by the non-secure storage space.
[0093] When the hardware starts, the RSA-encrypted digest value is first obtained from the Flash / EMMC, the signature is decoded by using the information obtained from the PUF module, and then the RSA public key stored in the OTP is used for decryption. Secondly, the encrypted image is subjected to SHA operation to calculate the digest value, and the two sets of digest values are compared. If they are consistent, it is considered that the starting program is correct and no error is found, and the device can be normally started. If they are inconsistent, the starting is immediately terminated to prevent risks.
[0094] The scheme proposes a way to generate random numbers by using the non-reproducibility and high security of the PUF module in the BMC chip to perform out-of-order scrambling processing on the image and the signature, so that the data stored in the Flash / EMMC can improve the security performance. Even if a third party steals the image and the signature, it is difficult to recover the effective data without obtaining the PUF random number.
[0095] The scheme is divided into two parts from the system structure: software part and hardware part
[0096] The hardware module is divided into the following modules from the function of the hardware module:
[0097] The OTP module is a memory for storing RSA public key and AES key, and a function module for protecting the key from being randomly obtained by the outside world.
[0098] The AES encryption / decryption module is a function module for continuing to encrypt the image with a positive random number.
[0099] The SHA algorithm module is a module for generating a digest value by performing a hash operation on the encrypted image using the sha-256 algorithm.
[0100] The RSA algorithm module is a function module for encrypting the digest value with a private key and decrypting the signature value with a public key.
[0101] The PUF module uses SRAM PUF to provide a secure and low-cost random data generation by using the inherent physical differences in chip manufacturing, and the same data cannot be obtained by copying the chip, the process deviation is uncontrollable, and the random number is dynamically generated each time the power is turned on, so that the possibility of leakage is eliminated.
[0102] The present application uses two sets of software and hardware systems, and the simple process is as shown in Figure 2 , Figure 2 The software and hardware matching start process provided by the embodiment of the present application is shown in the figure. Before the secure start, the software needs to write the used RSA public key (Rivest-Shamir-Adleman, asymmetric encryption algorithm) and AES private key (Advanced Encryption Standard, high-level encryption standard), the Image to be started and the Signature and other information into the hardware. The hardware uses the random number generated by the PUF to reorder the information, and stores it in the specified position. After the hardware is powered on and started, it is verified whether the internal Image and Signature are consistent, if they are consistent, the kernel program, the driver program and the like are further verified. If they are inconsistent, it is judged that the start fails.
[0103] The software system is mainly responsible for the process of AES encryption and signature generation of the Image to be started, and writing the necessary information into the hardware system.
[0104] The software first calls the AES algorithm to encrypt the image to be started, then uses the SHA algorithm to measure the hash of the encrypted image to obtain a set of digest values, and then the user encrypts the digest values with the RSA private key held by the user to generate a signature value Signature. The RSA private key encryption requires the user to properly maintain it, and if it is leaked, it will seriously affect the security performance of the secure boot. Finally, the software system transmits the encrypted image, the generated signature value Signature, the AES key, the RSA private key and other information to the hardware system. The software working process can be referred to Figure 3 , Figure 3 The software working process diagram provided for the embodiment of the application.
[0105] The AES key and the RSA public key are only configured to be written for the first time, and then when the image is updated, only the image and the signature Signature need to be updated.
[0106] When the software writes information, the hardware stores the information in the corresponding position, the AES key and the RSA public key are stored in the OTP, the OTP has a one-time programming function and cannot be changed after writing data, and the OTP can also be set to a read-rejected state to prevent external acquisition of the key information, so the security of the AES key and the RSA public key is relatively strong. The image and the signature are stored in a relatively public storage space such as Flash / EMMC, and the security performance is low, and a third party can easily obtain the image and the signature. If the third party obtains these information multiple times, there is a risk of reverse cracking and exposing the AES key and the RSA key. The application generates a 256-bit random number seed by using a PUF module matched in the hardware, uses an SRAM PUF structure, and provides a safe and low-cost random data generation by using the inherent physical differences in chip manufacturing. The same data cannot be obtained by copying the chip, and the chip process deviation is uncontrollable. Since the random number is dynamically generated when the chip is powered on, it does not need to be stored, and the hardware system directly obtains it from the PUF module after each power-on, thereby eliminating the possibility of leakage. The 256-bit random number is used to perform disorder processing on each 128-bit data, and the application proposes a simple and fast algorithm, and the algorithm is as follows:
[0107] The 128-bit data is divided into 16 groups of 8-bit data, and the 8-bit inside each group is permuted, and the permutation mode is defined by 16 bits in the seed (16 bits are used for each group). A total of 16*16=256 bits of seed are required, which matches exactly.
[0108] Stage 1: swap bit 0 and bit 1, bit 2 and bit 3, bit 4 and bit 5, bit 6 and bit 7, according to the first 4 bits of the 16-bit seed to determine whether to swap.
[0109] Stage 2: swap bit 0 and bit 2, bit 1 and bit 3, bit 4 and bit 6, bit 5 and bit 7, according to the next 4 bits of the 16-bit seed to determine whether to swap.
[0110] Stage 3: swap bit 0 and bit 4, bit 1 and bit 5, bit 2 and bit 6, bit 3 and bit 7, according to the next 4 bits of the 16-bit seed to determine whether to swap.
[0111] In the 16-bit seed, if the bit value is 1, it is defined as swapping, and if the bit value is 0, it is not swapped. After 3 rounds of swapping, there are still 4 bits left in the 16-bit seed, and the data is reserved for 4-bit data.
[0112] After the 16 groups of data are changed, there are still 4 bits of data left in each group of seeds, which are sequentially composed of 4*16=64-bit new seed sequences, and the 16 groups of data are also sequentially numbered as 0~15. 64-bit new seed sequence is used to replace 8-bit data to adjust the order of 16 groups of data, and the replacement method is:
[0113] Stage 1: swap bit 0 and bit 1, bit 2 and bit 3, bit 4 and bit 5, bit 6 and bit 7… bit 14 and 15, according to the first 8 bits of the 64-bit seed to determine whether to swap.
[0114] Stage 2: swap bit 0 and bit 2, bit 1 and bit 3, bit 4 and bit 6, bit 5 and bit 7… bit 13 and 15, according to the next 8 bits of the 64-bit seed to determine whether to swap.
[0115] …
[0116] Stage 8: swap bit 0 and bit 8, bit 1 and bit 9, bit 2 and bit 10, bit 3 and bit 11… bit 7 and 15, according to the last 8 bits of the 64-bit seed to determine whether to swap.
[0117] In this way, a new 128-bit data format is finally formed, and then stored in the corresponding place. At this point, all the preparation stages of secure boot are completed.
[0118] Please refer to Figure 4 , Figure 4The schematic diagram of the hardware security starting process provided by the embodiment of the present application is shown in the figure. When starting security, the hardware system is first powered on, and then obtains a 256-bit random number from the PUF module, and then uses the random number to decode the signature value Signature by inverse operation of the above algorithm, and after decoding, uses the RSA public key in the OTP to decrypt. Then read Image and use random number to decode, after decoding, use SHA algorithm to measure Image, get a group of digest values, compare the value with the decrypted signature value, if consistent, prove that the Image in the Flash / EMMC is the correct Image written by the user with the matching software system, and can be started with confidence. The control unit notifies the AES decryption module to use the AESkey in the OTP to decrypt the encrypted Image, and then notifies the starting unit to use the Image to start. Otherwise, abort the start and return the start failure notification.
[0119] The optimized BMC security starting method provided by the present application uses the unobtainable, no storage, dynamically generated random number generated by the characteristics of the PUF module to perform disorder scrambling processing on the Image and the Signature, so that when stored in the public storage space, the Image and the Signature can also have high security performance. Because even if a third party obtains the Image and the Signature, it is basically impossible to restore them to valid data without obtaining the random number generated by the PUF and without knowing the disorder scrambling processing algorithm. When starting hardware, the random number can be obtained from the PUF module to decode the Image and the Signature by using the decoding module, and then perform security starting verification. This disorder processing of the Image and the Signature greatly increases the difficulty of cracking the Image and the Signature, improves the security performance of the security starting, and solves the problem of low security of the public space storage.
[0120] Through the description of the above embodiments, those skilled in the art can clearly understand that the method according to the above embodiments can be realized by means of software on a general hardware platform as necessary, and of course can also be realized by hardware, but in many cases the former is a better embodiment.
[0121] Please refer to Figure 5 , Figure 5 The structural block diagram of a device starting apparatus provided by the embodiment of the present application is shown in the figure, and the apparatus can include:
[0122] The obtaining module 501 is used to obtain the starting program data when saving the starting program.
[0123] The disorder module 502 is configured to input an excitation signal to the hardware fingerprint module to obtain a random number corresponding to the excitation signal generated by the hardware fingerprint module according to the hardware physical characteristics, perform disorder processing on the startup program data according to the random number, and save the startup program data after the disorder processing to the memory.
[0124] The anti-disorder module 503 is configured to input an excitation signal to the hardware fingerprint module to obtain a random number when performing power-on startup, perform anti-disorder processing on the startup program data in the memory according to the random number, and perform device startup according to the startup program data after the anti-disorder processing.
[0125] Optionally, the disorder module 502 comprises:
[0126] The first segmentation sub-module is configured to divide the startup program data into first data segments.
[0127] The disorder sub-module is configured to read each random number value in the random number according to a preset order for each first data segment, determine a pair of target data bits corresponding to the random number value in the first data segment, and control the target data bits to exchange positions or keep positions in the first data segment according to the random number value, to obtain the startup program data after the disorder processing.
[0128] Optionally, the startup program data comprises a startup program image and a signature value of the startup program image.
[0129] The first segmentation sub-module can be configured to:
[0130] extract the signature value from the startup program data, and divide the signature value into the first data segments.
[0131] Optionally, the first segmentation sub-module can be further configured to:
[0132] extract the startup program image from the startup program data, and divide the complete startup program image or partial data in the startup program image into the first data segments.
[0133] Optionally, the disorder sub-module can be configured to:
[0134] when the random number value is determined to be a first value, control the data bits to exchange positions.
[0135] when the random number value is determined to be a second value, control the data bits to keep positions.
[0136] Optionally, the anti-disorder module 503 can be configured to:
[0137] For each first data segment, each random number value in the random number is read in a reverse order of the preset order, a pair of target data bits corresponding to the random number value in the first data segment is determined, and the target data bits are controlled to exchange positions or remain positions in the first data segment according to the random number value, to obtain the start program data after the reverse disorder processing.
[0138] Optionally, the disorder module 502 can further include:
[0139] The second segmentation sub-module is configured to divide the first data segment into first data sub-segments, divide the random number into second data segments corresponding to the first data sub-segments, and divide the second data segments into first data blocks and second data blocks.
[0140] The disorder sub-module can be configured to:
[0141] The first disorder unit is configured to, for each first data sub-segment, read each random number value in the first data block corresponding to the first data sub-segment in the preset order, determine a pair of target data bits corresponding to the random number value in the first data sub-segment, and control the target data bits to exchange positions or remain positions in the first data sub-segment according to the random number value, to obtain the first data sub-segment after the disorder processing.
[0142] The second disorder unit is configured to group the second data blocks into a third data segment, read each random number value in the third data segment in the preset order, determine a pair of target first data sub-segments corresponding to the random number value, and control the target first data sub-segments after the disorder processing to exchange positions or remain positions in the first data segment according to the random number value, to obtain the first data segment after the disorder processing.
[0143] The recombination unit is configured to group the first data segment after the disorder processing to obtain the start program data after the disorder processing.
[0144] Optionally, the start program data includes an encrypted start program image and a signature value of the start program image; the apparatus can further include:
[0145] The key reading module is configured to read an encryption key and a signature public key from a one-time programmable register.
[0146] The first decryption module is configured to decrypt the signature value by using the signature public key to obtain a first hash value.
[0147] The hash processing module is configured to perform hash processing on the start program image to obtain a second hash value.
[0148] The judgment module is configured to judge whether the first hash value is same as the second hash value.
[0149] The second decryption module is configured to decrypt the boot program image by using the encryption key when the first hash value is determined to be the same as the second hash value, and to perform device booting by using the decrypted boot program image.
[0150] The boot rejection module is configured to stop performing device booting when the first hash value is determined to be different from the second hash value.
[0151] The features of the embodiments of the device booting apparatus can be referred to the related descriptions of the embodiments of the device booting method, which will not be repeated here.
[0152] Please refer to Figure 6 , Figure 6 The structure block diagram of the management controller provided by the embodiments of the present application is shown in FIG. 1. The embodiments of the present application provide a management controller, which comprises a processor 11 and a memory 12, a hardware fingerprint module 13. The memory 12 is configured to save a computer program. The processor 11 is configured to execute the device booting method provided by the foregoing embodiments when executing the computer program. The hardware fingerprint module 13 is configured to receive an excitation signal sent by the processor 11 and generate a random number corresponding to the excitation signal according to the hardware physical characteristics of the hardware fingerprint module 13.
[0153] The specific process of the device booting method can be referred to the corresponding content provided by the foregoing embodiments, which will not be repeated here.
[0154] The embodiments of the present application further provide a computer readable storage medium, which stores a computer program. The computer program is configured to execute the steps of any one of the device booting method embodiments when running.
[0155] In an example embodiment, the computer readable storage medium can include, but is not limited to, a U disk, a read-only memory (ROM), a random access memory (RAM), a mobile hard disk, a magnetic disk or an optical disk, and various media that can store computer programs.
[0156] The embodiments of the present application further provide a computer program product, which comprises a computer program. The computer program is executed by a processor to implement the steps of any one of the device booting method embodiments.
[0157] The embodiments of the present application further provide another computer program product, which comprises a non-volatile computer readable storage medium. The non-volatile computer readable storage medium stores a computer program. The computer program is executed by a processor to implement the steps of any one of the device booting method embodiments.
[0158] Those skilled in the art will further realize that the mere concepts, teachings, and embodiments described herein are merely meant to provide an enabling description of the claimed invention and are not intended to limit the scope of the claimed invention to these embodiments. Therefore, embodiments described herein are not meant to be limiting, but merely representative. Further, the routines executed to implement the embodiments of the invention, individually or collectively, need not be limited to any specific combination of hardware and software. Various embodiments can also be implemented using more conventional components, as well as hardware and software that are not expressly identified herein. To clearly illustrate this interchangeability of hardware and software, various embodiments have been depicted in the form of specific examples. Those skilled in the art will appreciate that the concepts and teachings described herein are applicable to a variety of other platforms and applications. Accordingly, the present invention is not intended to be limited to the embodiments described herein, but is to be accorded the widest scope consistent with the claims, the principles and the practices described herein.
[0159] The above describes in detail the device starting method, device, management controller and storage medium provided by the present application. The principles and implementation modes of the present application are described by applying specific examples. The above description of the embodiments is only used to help understand the method of the present application and its core idea. It should be pointed out that, for those skilled in the art, without departing from the principles of the present application, the present application can be improved and modified in several ways. These improvements and modifications also fall within the scope of the present application.
Claims
1. A device startup method, characterized in that, include: When saving the startup program, retrieve the startup program data; An excitation signal is input to the hardware fingerprint module to obtain a random number generated by the hardware fingerprint module according to its hardware physical characteristics, which corresponds to the excitation signal. The startup program data is then scrambled according to the random number, and the scrambled startup program data is saved to the memory. During power-on startup, the excitation signal is input to the hardware fingerprint module to obtain the random number. The startup program data in the memory is de-ordered based on the random number, and the device is started based on the de-ordered startup program data.
2. The device startup method according to claim 1, characterized in that, The step of scrambling the startup program data according to the random number includes: The startup program data is divided into a first data segment; For each first data segment, each random value in the random number is read in a preset order, a pair of target data bits corresponding to the random value in the first data segment is determined, and the target data bits are controlled to exchange positions or maintain positions in the first data segment according to the random value, so as to obtain the startup program data with completed disorder processing.
3. The device startup method according to claim 2, characterized in that, The startup program data includes the startup program image and the signature value of the startup program image; The step of dividing the startup program data into equal segments includes: Extract the signature value from the startup program data and divide the signature value into the first data segment.
4. The device startup method according to claim 2, characterized in that, The step of controlling the target data bit to exchange or maintain its position in the first data segment according to the random value includes: When the random value is determined to be the first value, the data bit swapping position is controlled. When the random value is determined to be the second value, the position of the data bit is controlled to remain unchanged.
5. The device startup method according to claim 2, characterized in that, The step of reordering the boot program data in the memory based on the random number includes: For each first data segment, each random value in the random number is read in reverse order of the preset order. A pair of target data bits corresponding to the random value in the first data segment is determined. The target data bits are then controlled to exchange positions or maintain positions in the first data segment according to the random value, thereby obtaining the startup program data with completed de-order processing.
6. The device startup method according to claim 2, characterized in that, Also includes: The first data segment is divided into a first data sub-segment, the random number is divided into a second data segment corresponding to the first data sub-segment, and the second data segment is divided into a first data block and a second data block. For each first data segment, each random value in the random number is read in a preset order to determine a pair of target data bits corresponding to the random value in the first data segment. The target data bits are then controlled to swap or maintain their positions in the first data segment based on the random value, resulting in the completed out-of-order startup program data, including: For each first data segment, read each random value in the first data block corresponding to the first data segment in a preset order, determine a pair of target data bits corresponding to the random value in the first data segment, and control the target data bits to exchange positions or keep positions in the first data segment according to the random value, so as to obtain the first data segment after the disordered processing is completed. The second data block is combined into a third data segment. Each random value in the third data segment is read in a preset order. A pair of target first data segments corresponding to the random values are determined. The target first data segments that have completed the disordered processing are controlled to exchange positions or keep their positions in the first data segment according to the random values, so as to obtain the first data segment that has completed the disordered processing. The first data segment after the out-of-order processing is used to form the startup program data after the out-of-order processing is completed.
7. The device startup method according to claim 1, characterized in that, The launcher data includes an encrypted launcher image and a signature value of the launcher image; The step of starting the device based on the boot program data that has undergone de-out-of-order processing includes: Read the encryption key and signing public key from a one-time programmable register; The signature value is decrypted using the signature public key to obtain the first hash value; The startup program image is hashed to obtain a second hash value; Determine whether the first hash value and the second hash value are the same; When it is determined that the first hash value and the second hash value are the same, the boot program image is decrypted using the encryption key, and the device is booted using the decrypted boot program image; If it is determined that the first hash value is different from the second hash value, the device startup process is stopped.
8. A device starting device, characterized in that, include: The acquisition module is used to acquire startup program data when saving the startup program; The scrambling module is used to input an excitation signal to the hardware fingerprint module, obtain a random number generated by the hardware fingerprint module according to its hardware physical characteristics that corresponds to the excitation signal, scramble the startup program data according to the random number, and save the scrambled startup program data to the memory. The de-out-of-order module is used to input the excitation signal to the hardware fingerprint module to obtain the random number during power-on startup, perform de-out-of-order processing on the startup program data in the memory according to the random number, and start the device according to the startup program data after de-out-of-order processing.
9. A management controller, characterized in that, include: Memory, used to store computer programs; A processor, configured to implement the device startup method as described in any one of claims 1 to 7 when executing the computer program; The hardware fingerprint module is used to receive the excitation signal sent by the processor and generate a random number corresponding to the excitation signal based on its own hardware physical characteristics.
10. A non-volatile computer-readable storage medium, characterized in that, The non-volatile computer-readable storage medium stores computer-executable instructions, which, when loaded and executed by a processor, implement the device startup method as described in any one of claims 1 to 7.