Component authentication method and apparatus

1 . A component authentication method comprising:

generating, by a baseboard management controller (BMC) of a computer, a first random number;

sending, by the BMC to a component of the computer after the computer is powered on, a first authentication request for initiating an access authentication on the component, wherein the first authentication request comprises the first random number;

signing, by the BMC using a first private key of the component, the first random number to obtain signature data;

sending, by the component to the BMC, a first access request comprising a first access authentication certificate of the component and the signature data;

sending, by the BMC to the component and in response to the first access request, a first access response for triggering the component to be booted when verification on the first access authentication certificate based on the signature data is succeeded; and

rejecting, by the BMC and in response to the first access request, access to the component when verification on the first access authentication certificate is failed.

2 . The component authentication method of claim 1 , wherein before sending the first access request, the method further comprises:

sending, by the BMC to a management system of the computer, a second access request and a second access authentication certificate of the BMC; and

sending, by the management system to the BMC, a second access response for triggering the BMC to perform access authentication on the component when verification on the second access authentication certificate succeeds.

3 . The component authentication method of claim 1 , wherein rejecting access to the component comprises

alarming, by the BMC, the component.

4 . The component authentication method of claim 1 , wherein the component comprises a computing system, a storage system, an input/output (I/O) system, an acceleration system, and a memory expansion system.

5 . The component authentication method of claim 4 , wherein after sending the first access response, the method further comprises:

loading and running, by the component, a basic input/output system (BIOS) file when the component is the computing system; and

loading and running, by the component, a firmware file when the component is one of the storage system, the I/O system, the acceleration system, or the memory expansion system.

6 . The component authentication method of claim 1 ,

wherein after sending the first access request, the component authentication method further comprises:

decrypting, by the BMC using a first public key of a certification authority (CA) and based on the first access request, the first access authentication certificate to obtain a second public key of the component;

decrypting, by the BMC based on the first access request and using the second public key, the signature data to obtain a second random number;

determining that verification on the first access authentication certificate succeeds when the second random number is consistent with the first random number; and

determining that verification on the first access authentication certificate fails when the second random number is inconsistent with the first random number.

7 . The component authentication method of claim 6 , wherein the first access authentication certificate is preset in the component, wherein the component authentication method further comprises signing, by the BMC using a second private key of the CA, information about the component to obtain the first access authentication certificate, wherein the information comprises the second public key and a component identifier of the component, and wherein the first public key is preset in the BMC.

8 . The component authentication method of claim 7 , wherein the second public key, the first private key, and the component identifier are preset in the component, and wherein the component authentication method further comprises:

obtaining, by the component from the CA, the component identifier; and

deriving, from the component identifier, the second public key and the first private key.

9 . A component authentication method implemented by a baseboard management controller (BMC) in a computer, wherein the component authentication method comprises:

generating a first random number;

sending, to a component in the computer after the computer is powered on, a first authentication request for initiating an access authentication on the component, wherein the first authentication request comprises the first random number;

signing, using a first private key of the component, the first random number to obtain signature data;

receiving, from the component and in response to the first authentication request, a first access request comprising a first access authentication certificate of the component and the signature data;

sending, to the component, a first access response for triggering the component to be booted when verification on the first access authentication certificate based on the signature data is succeeded; and

rejecting access to the component when verification on the first access authentication certificate is failed.

10 . The component authentication method of claim 9 , wherein before sending the first access request, the component authentication method further comprises:

sending, to a management system of the computer, a second access request and a second access authentication certificate of the BMC; and

receiving, from the management system after verification on the second access authentication certificate is succeeded, a second access response for triggering the BMC to perform access authentication on the component.

11 . The component authentication method of claim 9 , wherein rejecting the access to the component comprises

forbidding the component to be booted.

12 . The component authentication method of claim 9 ,

wherein after receiving the first access request, the component authentication method further comprises:

decrypting, using a first public key of a certification authority (CA) and based on the first access request, the first access authentication certificate to obtain a second public key of the component;

decrypting, based on the first access request and using the second public key, the signature data to obtain a second random number;

determining that verification on the first access authentication certificate succeeds when the second random number is consistent with the first random number; and

determining that verification on the first access authentication certificate fails when the second random number is inconsistent with the first random number.

13 . The component authentication method of claim 12 , wherein the first access authentication certificate is preset in the component, wherein the component authentication method further comprises signing, using a second private key of the CA, information about the component to obtain the first access authentication certificate wherein the information comprises the second public key and a component identifier of the component, and wherein the first public key is preset in the BMC.

14 . A component authentication method implemented by a component in a computer, wherein the component authentication method comprises:

receiving, from a baseboard management controller (BMC) in the computer after the computer is powered on, a first authentication request for initiating an access authentication on the component, wherein the first authentication request comprises a first random number;

sending, to the BMC, a first access request comprising a first access authentication certificate of the component based on the first authentication request and further comprising signature data based on the first random number;

receiving, from the BMC when verification on the first access authentication certificate based on the signature data is succeeded, a first access response for triggering the component to be booted; and

receiving, from the BMC when verification on the first access authentication certificate is failed, a rejection.

15 . The component authentication method of claim 14 , wherein the first access authentication certificate is preset in the component, wherein the first access authentication certificate is based on information about the component and a first private key of a certification authority (CA), and wherein the information about the component comprises a public key of the component and a component identifier of the component.

16 . The component authentication method of claim 15 , wherein the public key, a second private key of the component, and the component identifier are preset in the component, and wherein the component authentication method further comprises:

obtaining, from the CA, the component identifier; and

deriving, from the component identifier, the public key and the second private key.

17 . The component authentication method of claim 14 , wherein the component comprises a computing system, a storage system, an input/output (I/O) system, an acceleration system, and a memory expansion system.

18 . An electronic apparatus comprising:

a baseboard management controller (BMC) configured to:

generate a first random number; and

send, after the electronic apparatus is powered on, a first authentication request,

wherein the first authentication request comprises the first random number;

an electronic configured to send, to the BMC, a first access request comprising a first access authentication certificate of a component based on the first authentication request and further comprising signature data, and

wherein the BMC is further configured to:

sign, using a first private key of the component, the first random number to obtain the signature data;

send, to the component when verification on the first access authentication certificate based on the signature data is succeeded, a first access response for triggering the component to be booted; and

reject access to the component when verification on the first access authentication certificate is failed.

19 . The electronic apparatus of claim 18 , further comprising a management system coupled to the BMC, wherein before sending the first access request, the BMC is further configured to send, a second access request and a second access authentication certificate of the BMC to the management system, and wherein the management system is configured to send, to the BMC after verification on the second access authentication certificate is succeeded, a second access response for triggering the BMC to perform access authentication on the component.

20 . The electronic apparatus of claim 18 , wherein the BMC is further configured to

power off the component.