Firmware protection using multi-chip storage of firmware image
Techniques are provided for firmware protection using multi-chip storage of firmware images. One method comprises obtaining a firmware image; encrypting the firmware image; splitting the encrypted firmware image into a plurality of encrypted firmware image portions; and storing the plurality of encrypted firmware image portions on a plurality of recovery chips, wherein a threshold number of the encrypted firmware image portions from at least two different recovery chips are needed to reconstruct the firmware image. The threshold number of the encrypted firmware image portions can be obtained from the at least two different recovery chips and a validation can be applied to the obtained encrypted firmware image portions. The threshold number of encrypted firmware image portions may be obtained in response to a chip that stores the firmware image being inactive.
1. A method, comprising:
obtaining a firmware image associated with a given processing device, wherein the given processing device comprises a plurality of distinct recovery chips, a firmware image chip that stores the firmware image and a processor coupled to a memory, and wherein at least two of the plurality of distinct recovery chips are physically within the given processing device;
encrypting, by the given processing device, the firmware image;
splitting, by the given processing device, the encrypted firmware image into a designated number of encrypted firmware image portions;
storing, by the given processing device, the designated number of encrypted firmware image portions on respective ones of the plurality of distinct recovery chips of the given processing device, wherein a threshold number of the encrypted firmware image portions from at least two different recovery chips of the given processing device are needed by the given processing device to reconstruct the firmware image; and
in response to determining that the firmware image chip is not responsive:
(i) initiating an obtaining of at least the threshold number of the encrypted firmware image portions from the plurality of distinct recovery chips physically within the given processing device;
(ii reconstructing the firmware image using a reconstruction process and the at least the threshold number of the encrypted firmware image portions obtained from the plurality of distinct recovery chips physically within the given processing device; and
(iii) restoring the reconstructed firmware image in the firmware image chip that stores the firmware image;
wherein, in response to the reconstruction process determining that one or more of the threshold number of the encrypted firmware image portions is one or more of corrupted and cannot be obtained from the plurality of distinct recovery chips physically within the given processing device, the reconstruction process obtains a different encrypted firmware image portion from a different distinct recovery chip physically within the given processing device.
2. The method of claim 1 , wherein the designated number of the encrypted firmware image portions is greater than the threshold number.
3. The method of claim 1 , wherein the threshold number of the encrypted firmware image portions is obtained from the at least two different recovery chips and a validation is applied to the obtained encrypted firmware image portions.
4. The method of claim 3 , wherein at least one additional encrypted firmware image portion is obtained from at least one of the at least two different recovery chips in response to at least one obtained encrypted firmware image portion failing the validation.
5. The method of claim 3 , further comprising merging the obtained encrypted firmware image portions to generate merged encrypted firmware image portions.
6. The method of claim 5 , wherein the firmware image is reconstructed by decrypting the merged encrypted firmware image portions.
7. The method of claim 1 , wherein the determining that the firmware image chip is not responsive comprises determining whether the firmware image chip (i) responds to a message communicated to the given processing device using a one-way network diode or (ii) sends a heartbeat message.
8. An apparatus comprising:
at least one processing device comprising a processor coupled to a memory;
the at least one processing device being configured to implement the following steps:
obtaining a firmware image associated with a given processing device, wherein the given processing device comprises a plurality of distinct recovery chips, a firmware image chip that stores the firmware image and a processor coupled to a memory, and wherein at least two of the plurality of distinct recovery chips are physically within the given processing device;
encrypting, by the given processing device, the firmware image;
splitting, by the given processing device, the encrypted firmware image into a designated number of encrypted firmware image portions;
storing, by the given processing device, the designated number of encrypted firmware image portions on respective ones of the plurality of distinct recovery chips of the given processing device, wherein a threshold number of the encrypted firmware image portions from at least two different recovery chips of the given processing device are needed by the given processing device to reconstruct the firmware image; and
in response to determining that the firmware image chip is not responsive:
(i) initiating an obtaining of at least the threshold number of the encrypted firmware image portions from the plurality of distinct recovery chips physically within the given processing device;
(ii) reconstructing the firmware image using a reconstruction process and the at least the threshold number of the encrypted firmware image portions obtained from the plurality of distinct recovery chips physically within the given processing device; and
(iii) restoring the reconstructed firmware image in the firmware image chip that stores the firmware image;
wherein, in response to the reconstruction process determining that one or more of the threshold number of the encrypted firmware image portions is one or more of corrupted and cannot be obtained from the plurality of distinct recovery chips physically within the given processing device, the reconstruction process obtains a different encrypted firmware image portion from a different distinct recovery chip physically within the given processing device.
9. The apparatus of claim 8 , wherein the designated number of the encrypted firmware image portions is greater than the threshold number.
10. The apparatus of claim 8 , wherein the threshold number of the encrypted firmware image portions is obtained from the at least two different recovery chips and a validation is applied to the obtained encrypted firmware image portions.
11. The apparatus of claim 10 , wherein at least one additional encrypted firmware image portion is obtained from at least one of the at least two different recovery chips in response to at least one obtained encrypted firmware image portion failing the validation.
12. The apparatus of claim 10 , further comprising merging the obtained encrypted firmware image portions to generate merged encrypted firmware image portions.
13. The apparatus of claim 12 , wherein the firmware image is reconstructed by decrypting the merged encrypted firmware image portions.
14. The apparatus of claim 8 , wherein the determining that the firmware image chip is not responsive comprises determining whether the firmware image chip (i) responds to a message communicated to the given processing device using a one-way network diode or (ii) sends a heartbeat message.
15. A non-transitory processor-readable storage medium having stored therein program code of one or more software programs, wherein the program code when executed by at least one processing device causes the at least one processing device to perform the following steps:
obtaining a firmware image associated with a given processing device, wherein the given processing device comprises a plurality of distinct recovery chips, a firmware image chip that stores the firmware image and a processor coupled to a memory, and wherein at least two of the plurality of distinct recovery chips are physically within the given processing device;
encrypting, by the given processing device, the firmware image;
splitting, by the given processing device, the encrypted firmware image into a designated number of encrypted firmware image portions;
storing, by the given processing device, the designated number of encrypted firmware image portions on respective ones of the plurality of distinct recovery chips of the given processing device, wherein a threshold number of the encrypted firmware image portions from at least two different recovery chips of the given processing device are needed by the given processing device to reconstruct the firmware image; and
in response to determining that the firmware image chip is not responsive:
(i) initiating an obtaining of at least the threshold number of the encrypted firmware image portions from the plurality of distinct recovery chips physically within the given processing device;
(ii reconstructing the firmware image using a reconstruction process and the at least the threshold number of the encrypted firmware image portions obtained from the plurality of distinct recovery chips physically within the given processing device; and
(ii restoring the reconstructed firmware image in the firmware image chip that stores the firmware image;
wherein, in response to the reconstruction process determining that one or more of the threshold number of the encrypted firmware image portions is one or more of corrupted and cannot be obtained from the plurality of distinct recovery chips physically within the given processing device, the reconstruction process obtains a different encrypted firmware image portion from a different distinct recovery chip physically within the given processing device.
16. The non-transitory processor-readable storage medium of claim 15 , wherein the threshold number of the encrypted firmware image portions is obtained from the at least two different recovery chips and a validation is applied to the obtained encrypted firmware image portions.
17. The non-transitory processor-readable storage medium of claim 16 , wherein at least one additional encrypted firmware image portion is obtained from at least one of the at least two different recovery chips in response to at least one obtained encrypted firmware image portion failing the validation.
18. The non-transitory processor-readable storage medium of claim 16 , further comprising merging the obtained encrypted firmware image portions to generate merged encrypted firmware image portions.
19. The non-transitory processor-readable storage medium of claim 18 , wherein the firmware image is reconstructed by decrypting the merged encrypted firmware image portions.
20. The non-transitory processor-readable storage medium of claim 15 , wherein the determining that the firmware image chip is not responsive comprises determining whether the firmware image chip (i) responds to a message communicated to the given processing device using a one-way network diode or (ii) sends a heartbeat message.