Techniques of encrypting BMC and BIOS firmware and data in flash memory using co-processor
In an aspect of the disclosure, a method, a computer-readable medium, and an apparatus are provided. The apparatus is a BMC. The BMC obtains data to be written to a storage. A main processor of the BMC provides the data to a co-processor of the BMC. The co-processor encrypts the data into encrypted data. The co-processor stores the encrypted data to the storage.
1 . A method of operation of a baseboard management controller (BMC), the method comprising:
after power on of the BMC, executing, by a main processor of the BMC, unencrypted co-processor initialization code from a storage to initialize a co-processor of the BMC, wherein the storage further stores BMC firmware code and data and host initialization component code and data, and wherein the unencrypted co-processor initialization code is stored unencrypted in the storage while at least a portion of the BMC firmware code and data and at least a portion of the host initialization component code and data are stored encrypted in the storage;
obtaining data to be written to the storage;
writing, by the main processor of the BMC, the data to a shared memory area accessible by both the main processor and the co-processor of the BMC;
calling, by the main processor through an API, the co-processor to handle the data in the shared memory area;
reading, by the co-processor, the data from the shared memory area;
encrypting, by the co-processor, the data from the shared memory area into encrypted data via a stream encryption engine executed by the co-processor utilizing a unique key derived from a unique identifier stored in a one time programmable (OTP) memory of a hardware component of the BMC, wherein the encrypting is performed in a format-preserving manner such that a size of the data equals a size of the encrypted data; and
storing, by the co-processor, the encrypted data to the storage at a target location such that the encrypted data occupies a same set of storage addresses in the storage as the data.
2 . The method of claim 1 , further comprising:
obtaining encrypted data from the storage;
decrypting, by the co-processor, the encrypted data from the storage into decrypted data; and
providing, by the co-processor, the decrypted data to the main processor.
3 . The method of claim 2 , wherein decrypting the encrypted data comprises decrypting the encrypted data via a stream decryption engine executed by the co-processor.
4 . The method of claim 1 , wherein the storage comprises a flash memory storing firmware code and data for the BMC and a host computer.
5 . A baseboard management controller (BMC), comprising:
a main processor;
a co-processor; and
a storage;
wherein the main processor is configured to:
after power on of the BMC, execute unencrypted co-processor initialization code from the storage to initialize the co-processor, wherein the storage further stores BMC firmware code and data and host initialization component code and data, and wherein the unencrypted co-processor initialization code is stored unencrypted in the storage while at least a portion of the BMC firmware code and data and at least a portion of the host initialization component code and data are stored encrypted in the storage;
obtain data to be written to the storage;
write the data to a shared memory area accessible by both the main processor and the co-processor;
call, through an API, the co-processor to handle the data in the shared memory area;
wherein the co-processor is configured to:
read the data from the shared memory area;
encrypt the data from the shared memory area into encrypted data via a stream encryption engine executed by the co-processor utilizing a unique key derived from a unique identifier stored in a one time programmable (OTP) memory of a hardware component of the BMC, wherein the encrypting is performed in a format-preserving manner such that a size of the data equals a size of the encrypted data; and
store the encrypted data to the storage at a target location such that the encrypted data occupies a same set of storage addresses in the storage as the data.
6 . The BMC of claim 5 , wherein the co-processor is further configured to:
obtain encrypted data from the storage;
decrypt the encrypted data from the storage into decrypted data; and
provide the decrypted data to the main processor.
7 . The BMC of claim 6 , wherein the co-processor is configured to decrypt the encrypted data via a stream decryption engine executed by the co-processor.
8 . The BMC of claim 5 , wherein the storage comprises a flash memory storing firmware code and data for the BMC and a host computer.