System and method for secure information handling system flash memory access
Firmware updates at an information handling system flash memory device, such as provisioning information stored on a USB device, are securely performed by using a buffer memory and a secured code. An application running on a CPU generates a firmware update and a security code, such as a ciphered hash code based on the firmware update, stores the firmware update and security code in a buffer, and informs a management processor of the update. The management processor analyzes the firmware update to authorize copying of the update from the buffer to the flash memory device. For instance, the management processor creates the security code from the firmware update and compares the created code with the security code stored in the buffer to validate the firmware update.
1. An information handling system comprising:
a central processing unit (CPU) having a firmware updater, the firmware updater configured to execute on the CPU;
a management processor (MP) having a firmware manager, the firmware manager configured to execute on the MP;
random access memory (RAM) operable to store information, the RAM interfaced with the CPU and the MP;
flash memory operable to store firmware; and
a management bus separate from a system bus, wherein the CPU, MP, RAM, and flash memory are interconnected at least in part by at least one of the management bus or the system bus;
wherein the firmware updater performs the following operations when executed:
prepares a firmware update, determines a security code for the firmware update, stores the firmware update and the security code in a configuration file in a buffer defined in the RAM by the MP, and sends a command over the management bus to execute a task list in the configuration file; and
wherein the firmware manager performs the following operations when executed:
in response to the command, finds a command in the task list to copy the firmware update to the flash memory after verification of the security code;
authorizes copying of the firmware update from the buffer to the flash memory by verifying the security code, and, performs the firmware update to be copied from the buffer to the flash memory over the system bus.
2. The information handling system of claim 1 wherein the system bus comprises a USB and the management bus comprises an IPMI.
3. The information handling system of claim 1 wherein:
the firmware updater comprises a first security module configured to generate a first security code from the firmware update for storage in the buffer with the firmware update;
the firmware manager comprises a second security module configured to retrieve the firmware update to generate a second security code; and
the firmware manager is further configured to compare the first and second security codes to authorize copying of the firmware update from the buffer to the flash memory.
4. The information handling system of claim 3 wherein the first and second security codes comprise a cryptographic hash algorithm.
5. The information handling system of claim 1 wherein the buffer is defined in hard disk drive memory.
6. The information handling system of claim 1 wherein the management processor comprises a baseboard management processor.
7. The information handling system of claim 1 wherein the firmware update comprises provisioning information.
8. A method for updating firmware, the method comprising:
generating a firmware update with an application stored in a random access memory (RAM) and running on a central processing unit (CPU),
determining with the application a security code for the firmware update, and storing the firmware update and the security code in a configuration file;
copying with the application the configuration file to a buffer memory defined in the RAM by a management processor (MP);
sending a command over a management bus with the application to the MP to execute a task list in the configuration file;
in response to the command, finding a command in the task list to copy the firmware update to the flash memory;
authorizing by the management processor copying of the firmware update from the buffer memory to the flash memory by verifying the security code; and
copying, in response to the authorizing, the firmware update from the buffer memory to the flash memory with the management processor through a system bus separate from the management bus.
9. The method of claim 8 wherein the system bus comprises USB and the management bus comprises IPMI.
10. The method of claim 8 wherein the referencing the firmware update to create a first security code further comprises generating a hash code with a cryptographic hash algorithm.
11. The method of claim 8 wherein the firmware comprises provisioning information.
12. The method of claim 8 wherein the firmware update comprises a destination and a copy mode.