Firmware updates from an external channel

Patent metadata

Field	Value
Publication number	US-9565207-B1
Application number	US-55469009-A
Country	US
Kind code	B1
Filing date	Sep 4, 2009
Priority date	Sep 4, 2009
Publication date	Feb 7, 2017
Grant date	Feb 7, 2017

Abstract

When providing a user with native access to at least a portion of device hardware, the user can be prevented from modifying firmware and other configuration information by controlling the mechanisms used to update that information. In some embodiments, an asymmetric keying approach can be used to encrypt or sign the firmware. In other cases access can be controlled by enabling firmware updates only through a channel or port that is not exposed to the customer, or by mapping only those portions of the hardware that are to be accessible to the user. In other embodiments, the user can be prevented from modifying firmware by only provisioning the user on a machine after an initial mutability period wherein firmware can be modified, such that the user never has access to a device when firmware can be updated. Combinations and variations of the above also can be used.

First claim

What is claimed is:

1. A computer-implemented method for securing access to firmware, comprising:
under control of one or more computer systems configured with executable instructions,
restricting access to firmware on a peripheral device by a central processing unit of a host machine through a peripheral bus, the peripheral bus being configured to prevent firmware from being updated by the central processing unit, wherein the peripheral device has at least one first port for communicating with the central processing unit, and at least one second port for receiving firmware update information independent of the at least one central processing unit;
providing the central processing unit of the host machine with access to a first port on the host machine;
receiving firmware update information on the second port on the peripheral device from a source external to the host machine, the second port inaccessible by the central processing unit of the host machine during updates to the firmware of the peripheral device; and
upon receiving the firmware update information through the second port, updating the firmware on the peripheral device,
wherein the firmware is unable to be updated by the central processing unit of the host machine even when the central processing unit is able to communicate with the peripheral device.

2. The computer-implemented method of claim 1 , wherein the peripheral device is a network interface card connected to the host machine.

3. A computer-implemented method for managing configuration information for a hardware component, comprising:
under control of one or more computer systems configured with executable instructions,
providing a hardware component in a host machine including at least one processing unit, the hardware component having at least a first interface for communicating with the at least one processing unit of the host machine through a peripheral bus, and a second interface for receiving information independent of the at least one processing unit;
restricting the at least one processing unit of the host machine from accessing the second interface of the hardware component during at least any updates to the configuration information for the hardware component;
restricting the peripheral bus to prevent configuration information for the hardware component from being updated through the first interface; and
enabling the configuration information for the hardware component to be updated by receiving an update to the configuration information through the second interface,
wherein the configuration information is unable to be updated via the at least one processing unit of the host machine even when the at least one processing unit is able to communicate with the hardware component.

4. The method of claim 3 , wherein the hardware component is a peripheral component of the host machine.

5. The method of claim 3 , wherein the second interface is a network port operable to receive configuration information from an external source.

6. The method of claim 3 , wherein the configuration information comprises firmware for the hardware component.

7. The method of claim 3 , further comprising:
providing at least one additional hardware component in the host machine, the additional hardware component operable to receive configuration information via the second interface.

8. The method of claim 7 , wherein the configuration for the at least one additional hardware component is unable to be updated via the at least one processing unit of the host machine.

9. The method of claim 7 , further comprising:
providing at least one data path routing component for routing the configuration information from the second interface to the at least one additional hardware component.

10. The method of claim 9 , wherein configuration information for the at least one data path routing component is capable of being updated through the second interface.

11. The computer-implemented method of claim 3 , wherein the hardware component is a video card or graphics processing unit (GPU) connected to the host machine.

12. The computer-implemented method of claim 3 , wherein the hardware component is a network interface card (NIC) that includes a processing component configured to write the configuration information into a location on the NIC.

13. A computer-implemented method for managing configuration information for a hardware component, comprising:
under control of one or more computer systems configured with executable instructions,
providing a hardware component in a host machine including at least one processing unit, the host machine having at least one network port and at least one console port, wherein the console port is not exposed to a guest operating system on the host machine;
configuring the host machine to only enable updating of the configuration information for the hardware component using information received over the at least one console port; and
restricting the at least one processing unit of the host machine from accessing the at least one console port during at least any updates to the configuration information for the hardware component,
wherein the configuration information is unable to be updated by the guest operating system on the host machine even when the guest operating system is able to communicate with the hardware component.

14. The computer-implemented method of claim 13 , further comprising:
granting a remote console exclusive access manage the configuration information of the hardware component via the at least one console port.

15. A system for managing configuration information for a hardware device, comprising:
a processor; and
a memory device including instructions that, when executed by the processor, cause the processor to:
enable a hardware component in a host machine including at least one processing unit, the hardware component having at least a first interface for communicating with the at least one processing unit of the host machine through a peripheral bus, and a second interface for receiving information independent of the at least one processing unit;
restrict the at least one processing unit of the host machine from accessing the second interface of the hardware component during at least any updates to the configuration information for the hardware component;
restrict the peripheral bus to prevent configuration information for the hardware component from being updated through the first interface; and
enable the configuration information for the hardware component to be updated by receiving an update to the configuration information through the second interface,
wherein the configuration information is unable to be updated via the at least one processing unit of the host machine even when the at least one processing unit is able to communicate with the hardware component.

16. The system of claim 15 , wherein the hardware component is a peripheral component of the host machine, and the second interface comprises a network port operable to receive configuration information from an external source.

17. The system of claim 15 , wherein the configuration information comprises firmware for the hardware component.

18. The system of claim 15 , wherein the host machine further includes:
at least one additional hardware component, the additional hardware component operable to receive configuration information via the second interface, the configuration for the at least one additional hardware component unable to be updated via the at least one processing unit of the host machine.

Assignees

• Marr Michael David
• Corddry Matthew T
• Hamilton James R
• Amazon Tech Inc

Inventors

• Marr Michael David
• Corddry Matthew T
• Hamilton James R

Classifications

• H04L63/145 Primary

  the attack involving the propagation of malware through the network, e.g. viruses, trojans or worms · CPC title

• H04L9/3247 Primary

  involving digital signatures · CPC title

• G06F2221/2107

  File encryption · CPC title

• G06F21/572

  Secure firmware programming, e.g. of basic input output system [BIOS] · CPC title

• H04L9/0894

  Escrow, recovery or storing of secret information, e.g. secret key escrow or cryptographic key storage · CPC title