System and method for secure information handling system flash memory access
Firmware updates at an information handling system flash memory device, such as provisioning information stored on a USB device, are securely performed by using a buffer memory and a secured code. An application running on a CPU generates a firmware update and a security code, such as a ciphered hash code based on the firmware update, stores the firmware update and security code in a buffer, and informs a management processor of the update. The management processor analyzes the firmware update to authorize copying of the update from the buffer to the flash memory device. For instance, the management processor creates the security code from the firmware update and compares the created code with the security code stored in the buffer to validate the firmware update.
1. An information handling system comprising:
a central processing unit (CPU);
a management processor (MP) having a firmware manager, the firmware manager configured to execute on the MP;
random access memory (RAM) operable to store information, the RAM interfaced with the CPU and the MP;
flash memory operable to store firmware; and
a firmware updater stored in non-transitory memory and configured to execute on the CPU to prepare a firmware update, determine a security code for the firmware update, store the firmware update and the security code in a configuration file in a buffer defined in the RAM by the MP, and send a command over a management bus to execute a task list in the configuration file;
wherein the firmware manager in response to the command, finds a command in the task list to copy the firmware update to the flash memory after verification of the security code, authorizes copying of the firmware update from the buffer to the flash memory by verifying the security code, and performs the firmware update to be copied from the buffer to the flash memory over a system bus.
2. The information handling system of claim 1 wherein the system bus comprises a USB and the management bus comprises an IPMI.
3. The information handling system of claim 1 wherein:
the firmware updater comprises a first security module configured to generate a first security code from the firmware update for storage in the buffer with the firmware update;
the firmware manager comprises a second security module configured to retrieve the firmware update to generate a second security code; and
the firmware manager is further configured to compare the first and second security codes to authorize copying of the firmware update from the buffer to the flash memory.
4. The information handling system of claim 3 wherein the first and second security codes comprise a cryptographic hash algorithm.
5. The information handling system of claim 1 wherein the buffer is defined in hard disk drive memory.
6. The information handling system of claim 1 wherein the management processor comprises a baseboard management processor.
7. The information handling system of claim 1 wherein the firmware update comprises provisioning information.
8. A method for updating firmware, the method comprising:
generating a firmware update with an application stored in a random access memory (RAM) and running on a central processing unit (CPU), the firmware update having a security code, and storing the firmware update and the security code in a configuration file;
copying with the application the configuration file to a buffer memory defined in the RAM by a management processor (MP);
commanding the MP over a management bus to execute a task list in the configuration file;
in response to a command in the task list, authorizing by the MP copying of the firmware update from the buffer memory to the flash memory by verifying the security code; and
copying, in response to the authorizing, the firmware update from the buffer memory to the flash memory with the management processor through a system bus separate from the management bus.
9. The method of claim 8 wherein the system bus comprises USB and the management bus comprises IPMI.
10. The method of claim 9 wherein the generating a firmware update having a security code further comprises generating a hash code with a cryptographic hash algorithm.
11. The method of claim 8 wherein the firmware comprises provisioning information.
12. The method of claim 8 wherein the firmware update comprises a destination and a copy mode.
13. A system for updating firmware stored in flash memory of an information handling system, the system comprising:
a firmware updater stored in non-transitory memory and configured to execute on the CPU to prepare a firmware update, determine a security code for the firmware update, store the firmware update and the security code in a configuration file in a buffer defined in the RAM by the MP, and send a command over a management bus to execute a task list in the configuration file; and
a firmware manager operable to run on a management processor, the firmware manager in response to the command from the firmware updater, finds a command in the task list to copy the firmware update to the flash memory after verification of the security code, authorizes copying of the firmware update from the buffer to the flash memory by verifying the security code, and performs the firmware update to be copied from the buffer to the flash memory over a system bus.
14. The system of claim 13 wherein the security code comprises a hash code generated from the firmware update.
15. The system of claim 14 wherein the firmware manager authorizes copying of the firmware update by generating a hash code from the firmware update and comparing the generated hash code with the hash code stored in the buffer.
16. The system of claim 13 wherein the flash memory comprises a USB device.