Validating an image using an embedded hash in an information handling system
A method, an information handling system (IHS) and a validation system for validating an image using an embedded hash. The method includes retrieving, via a controller, a first image from a first memory device and extracting a first hash from a first location within the first image. The first hash was previously generated using an original set of data that includes a first data string, and the first image includes the first hash inserted into the first location to replace the first data string. The method includes retrieving a copy of the first data string. The method further includes generating a second image by inserting the first data string into the first location from which the first hash was extracted such that the second image contains the original set of data. The method further includes validating the first image using the first hash and the second image.
1. A method for validating an image within an information handling system, the method comprising:
retrieving, via a controller, a first image from a first memory device, the first image including a first hash in a first reserved address location, the first hash being previously calculated using an original set of data that included a first data string in the first reserve address location, wherein the first image is generated by inserting the calculated first hash into the first reserve address location;
extracting the first hash from the first reserve address location within the first image;
retrieving, from a remote access controller (RAC) memory, a stored copy of the first data string;
generating a second image by inserting the copy of the first data string into the first reserve address location from which the first hash was extracted such that the second image contains the original set of data; and
validating the first image using the first hash and the second image.
2. The method of claim 1 , wherein validating the first image comprises:
calculating a second hash of the second image;
determining if the first hash and the second hash match; and
in response to the first hash and the second hash not matching:
generating a first type error message that indicates detection of tampering with the first image; and
storing the first type error message to an error log that contains error messages generated by a controller when problems or errors occur during initializing or booting of the controller.
3. The method of claim 2 , further comprising:
in response to the first hash and the second hash matching, identifying the first image as a valid image and loading the first image during a subsequent reboot of the information handling system as a valid image.
4. The method of claim 2 , further comprising:
notifying a system administrator that tampering of the first image has been detected and preventing boot up using the first image.
5. The method of claim 1 , further comprising:
determining if a new image has been received;
in response to the new image being received, removing an appended hash from the new image;
calculating a fourth hash of the new image; determining if the fourth hash and the appended hash match; and
in response to the fourth hash and the appended hash not matching:
generating a second type error message that indicates detection of tampering with the new image; and
storing the second type error message to an error log.
6. The method of claim 5 , further comprising:
in response to the fourth hash and the appended hash matching:
storing the remaining new image to the first memory device.
7. An information handling system (IHS) comprising:
a controller communicatively coupled to a first memory device, the controller having firmware executing thereon for validating an image using an embedded hash, wherein the firmware configures the controller to:
retrieve a first image from a first memory device, the first image including a first hash in a first reserved address location, the first hash being previously calculated using an original set of data that included a first data string in the first reserve address location, wherein the first image is generated by inserting the calculated first hash into the first reserve address location;
extract the first hash from the first reserve address location within the first image;
retrieve, from a remote access controller (RAC) memory, a stored copy of the first data string;
generate a second image by inserting the copy of the first data string into the first reserve address location from which the first hash was extracted such that the second image contains the original set of data; and
validate the first image using the first hash and the second image.
8. The information handling system of claim 7 , wherein validating the first image comprises the firmware further configuring the controller to:
calculate a second hash of the second image;
determine if the first hash and the second hash match; and
in response to the first hash and the second hash not matching:
generate a first type error message that indicates detection of tampering with the first image; and
store the first type error message to an error log that contains error messages generated by a controller when problems or errors occur during initializing or booting of the controller.
9. The information handling system of claim 8 , wherein the firmware further configures the controller to:
in response to the first hash and the second hash matching, identify the first image as a valid image and load the first image during a subsequent reboot of the IHS as a valid image.
10. The information handling system of claim 8 , wherein the firmware further configures the controller to:
notify a system administrator that tampering of the first image has been detected and preventing boot up using the first image.
11. The information handling system of claim 7 , wherein the firmware further configures the controller to:
determine if a new image has been received;
in response to the new image being received,
remove an appended hash from the new image;
calculate a fourth hash of the new image;
determine if the fourth hash and the appended hash match; and
in response to the fourth hash and the appended hash not matching:
generate a second type error message that indicates detection of tampering with the new image; and
store the second type error message to an error log.
12. The information handling system of claim 11 , wherein the firmware further configures the controller to:
in response to the update hash and the appended hash matching:
store the remaining new image to the first memory device.
13. A validation system comprising:
a controller communicatively coupled to a first memory device, the controller having firmware executing thereon for validating an image using an embedded hash, wherein the firmware configures the controller to:
retrieve a first image from a first memory device, the first image including a first hash in a first reserved address location, the first hash being previously calculated using an original set of data that included a first data string in the first reserve address location, wherein the first image is generated by inserting the calculated first hash into the first reserve address location;
extract the first hash from the first reserve address location within the first image;
retrieve, from a remote access controller (RAC) memory, a stored copy of the first data string;
generate a second image by inserting the copy of the first data string into the first reserve address location from which the first hash was extracted such that the second image contains the original set of data; and
validate the first image using the first hash and the second image.
14. The validation system of claim 13 , wherein validating the first image comprises the firmware further configuring the controller to:
calculate a second hash of the second image;
determine if the first hash and the second hash match; and
in response to the first hash and the second hash not matching:
generate a first type error message that indicates detection of tampering with the first image; and
store the first type error message to an error log that contains error messages generated by a controller when problems or errors occur during initializing or booting of the controller.
15. The validation system of claim 14 , wherein the firmware further configures the controller to:
in response to the first hash and the second hash matching, identify the first image as a valid image and load the first image during a subsequent reboot of the IHS as a valid image.
16. The validation system of claim 14 , wherein the firmware further configures the controller to:
notify a system administrator that tampering of the first image has been detected and preventing boot up using the first image.
17. The validation system of claim 13 , wherein the firmware further configures the controller to:
determine if a new image has been received;
in response to the new image being received, remove an appended hash from the new image;
calculate a fourth hash of the new image;
determine if the fourth hash and the appended hash match; and
in response to the fourth hash and the appended hash not matching:
generate a second type error message that indicates detection of tampering with the new image; and
store the second type error message to an error log.
18. The validation system of claim 17 , wherein the firmware further configures the controller to:
in response to the update hash and the appended hash matching:
store the remaining new image to the first memory device.
19. A method for provisioning a new image of an information handling system (IHS), the method comprising:
receiving a third image that comprises an original set of data including a first data string of pre-determined data located at a reserved address of the third image corresponding to a first location, the third image further comprising at least one other data string;
calculating a third hash of the third image;
generating a fourth image by replacing the first data string of pre-determined data within the third image with the third hash inserted into a location of the reserve address, such that the third hash is embedded in the fourth image;
calculating an appended hash of the fourth image;
appending the appended hash to the fourth image to generate a modified fourth image; and
storing, to the first memory device as a new image, the modified fourth image containing the embedded third hash and the appended hash appended thereto, wherein the new image is authenticated at the information handling system utilizing the appended hash.
20. The method of claim 19 , wherein the method is performed by a factory IHS.