BMC Firmware Secure Boot via Read-Only Verification
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
There is a need for a mechanism to establish the integrity and security of Baseboard Management Controller (BMC) firmware before booting, as existing technologies lack effective methods to ensure the trusted and secure operation of BMC firmware in server-class computer systems.
Innovation Solution
The method involves loading a first boot loader from a read-only section of a storage device, which then loads a public key and generates a verification code for static code and data, decrypts an encrypted signature using the public key to obtain a second verification code, and determines the integrity of the BMC firmware by comparing the two codes, aborting the booting process if integrity is compromised.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Adaptability or versatility
If firmware is stored in a reprogrammable read-only memory, then the firmware can be updated and adapted, but the integrity and security of the firmware cannot be guaranteed
Solution Approach 1:
The storage medium is divided into a first section for storing verification data (integrity check values, public keys) and a second section for storing the firmware image. This segmentation allows the verification data to be protected separately from the updatable firmware, ensuring that the criteria for verification remain secure while the firmware can be updated.
Solution Approach 2:
The integrity check values and public keys are stored in the read-only section before the firmware is executed or updated. This preliminary placement of verification data ensures that the security criteria are established before any firmware modifications can occur, allowing verification to happen before the firmware runs.
2Reliability
If firmware integrity verification is implemented, then security is improved, but the boot process complexity increases
Solution Approach 1:
The first boot loader is pre-configured with the ability to read and verify firmware images against stored integrity check values. This preliminary setup of verification capability in the boot loader means that the verification process is already in place and does not require additional complex components or steps during the actual boot process.
Solution Approach 2:
The first boot loader acts as an intermediary between the firmware image and the execution environment. It performs the integrity verification by comparing the firmware's hash value against the stored integrity check value, and only passes control to the firmware if verification succeeds. This intermediary role simplifies the overall system architecture by centralizing the verification logic in the boot loader.
Data Source
AI summary
In an aspect of the disclosure, a method, a computer-readable medium, and an apparatus are provided. The apparatus is an embedded-system device. The embedded-system device loads a first boot loader from a read only section of a storage device in an initialization process of the embedded-system device. The embedded-system device also loads, by the first boot loader, a public key from the read only section. The embedded-system device further generates a first verification code for static code and data stored in a first section of the storage device. The embedded-system device then decrypts, by the first boot loader, an encrypted signature stored in the first section by using the public key to obtain a second verification code. The embedded-system device determines integrity of the static code and data based on the first verification code and the second verification code.