Secure firmware integrity monitoring using rest over IPMI interface
Technologies are described herein for a representational state transfer (“REST” or “RESTful”) over Intelligent Platform Management Interface (“IPMI”) interface for firmware to BMC communication and applications thereof. These applications include, but are not limited to, remote firmware configuration, firmware updates, peripheral device firmware updates, provision of management information such as system inventory data, cloning and batch migration of firmware configuration settings, and firmware integrity monitoring. This functionality can be provided in a way that enables communication between BMCs and firmware to utilize modern manageability interfaces while maintaining backward compatibility with previous IPMI implementations.
1. A computer-implemented method for verifying integrity of a firmware of a computing system, comprising:
receiving, at a management client, a current hash value for a first portion of the firmware from a baseboard management controller (BMC), the current hash value being computed by a second portion of the firmware and provided from the second portion of the firmware to the BMC by way of a representational state transfer (REST) over Intelligent Platform Management Interface (IPMI) interface;
receiving, at the management client, a reference hash value for the firmware from a firmware release server;
determining, at the management client, whether the reference hash value for the firmware and the current hash value for the firmware are different; and
responsive to determining that the reference hash value for the firmware and the current hash value for the firmware are different, initiating, by way of the management client, an update of the firmware.
2. The computer-implemented method of claim 1 , wherein the second portion of the firmware comprises a portion of the firmware that cannot be modified.
3. The computer-implemented method of claim 1 , wherein the first portion of the firmware comprises a remainder of the firmware other than the second portion.
4. The computer-implemented method of claim 1 , wherein the BMC is configured to store the current hash value in a secure location.
5. The computer-implemented method of claim 1 , wherein the reference hash value for the firmware is computed at a build time of the firmware.
6. The computer-implemented method of claim 1 , wherein the current hash value for the firmware is computed at a boot time of the computing system.
7. The computer-implemented method of claim 1 , wherein the BMC performs the update of the firmware.
8. A computing system, comprising:
one or more processors; and
at least one non-transitory computer-readable storage medium having computer-executable instructions stored thereupon which, when executed by the one or more processors, cause the system to:
receive, at a management client, a current hash value for a first portion of firmware from a baseboard management controller (BMC), the current hash value being computed by a second portion of the firmware and provided from the second portion of the firmware to the BMC by way of a representational state transfer (REST) over Intelligent Platform Management Interface (IPMI) interface;
receive, at the management client, a reference hash value for the firmware from a firmware release server;
determine, at the management client, whether the reference hash value for the firmware and the current hash value for the firmware are different; and
responsive to determining that the reference hash value for the firmware and the current hash value for the firmware are different, initiate, by way of the management client, an update of the firmware.
9. The computing system of claim 8 , wherein the second portion of the firmware comprises a portion of the firmware that cannot be modified.
10. The computing system of claim 8 , wherein the first portion of the firmware comprises a remainder of the firmware other than the second portion.
11. The computing system of claim 8 , wherein the BMC is configured to store the current hash value in a secure location.
12. The computing system of claim 8 , wherein the reference hash value for the firmware is computed at a build time of the firmware.
13. The computing system of claim 8 , wherein the current hash value for the firmware is computed at a boot time of the computing system.
14. A non-transitory computer-readable storage medium having computer-executable instructions stored thereupon which, when executed by a computer, cause the computer to:
receive, at a management client, a current hash value for a first portion of firmware from a baseboard management controller (BMC), the current hash value being computed by a second portion of the firmware and provided from the second portion of the firmware to the BMC by way of a representational state transfer (REST) over Intelligent Platform Management Interface (IPMI) interface;
receive, at the management client, a reference hash value for the firmware from a firmware release server;
determine, by way of the management client, whether the reference hash value for the firmware and the current hash value for the firmware are different; and
responsive to determining that the reference hash value for the firmware and the current hash value for the firmware are different, initiate, by way of the management client, an update of the firmware.
15. The non-transitory computer-readable storage medium of claim 14 , wherein the second portion of the firmware comprises a portion of the firmware that cannot be modified.
16. The non-transitory computer-readable storage medium of claim 14 , wherein the first portion of the firmware comprises a remainder of the firmware other than the second portion.
17. The non-transitory computer-readable storage medium of claim 14 , wherein the BMC is configured to store the current hash value in a secure location.
18. The non-transitory computer-readable storage medium of claim 14 , wherein the reference hash value for the firmware is computed at a build time of the firmware.
19. The non-transitory computer-readable storage medium of claim 14 , wherein the current hash value for the firmware is computed at a boot time of the computing system.
20. The non-transitory computer-readable storage medium of claim 14 , wherein the BMC performs the update of the firmware.