Firmware validation from an external channel

Patent metadata

Field	Value
Publication number	US-9686078-B1
Application number	US-201514635923-A
Country	US
Kind code	B1
Filing date	Mar 2, 2015
Priority date	Sep 8, 2009
Publication date	Jun 20, 2017
Grant date	Jun 20, 2017

Abstract

The state of firmware for devices on a provisioned host machine can be validated independent of the host CPU(s) or other components exposed to the user. A port that is not fully exposed or accessible to the user can be used to perform a validation process on firmware without accessing a CPU of the host device. The firmware can be scanned and a hashing or similar algorithm can be used to determine validation information, such as hash values, for the firmware, which can be compared to validation information stored in a secure location. If the current and stored validation information do not match, one or more remedial actions can be taken to address the firmware being in an unknown or unintended state.

First claim

What is claimed is:

1. A computer-implemented method for updating firmware of a device of a host machine independent of user interaction, comprising:
sending, by a computing system, a request to validate firmware information on the host machine based at least in part on a firmware image, the host machine being hosted by a different computing system, the host machine running a guest operating system provisioned to a guest user, the host machine including at least one interface to the device for which the guest user has been granted hardware access, the request being sent to a dedicated network port of a network interface device of the host machine, the dedicated network port being inaccessible to the guest user and reserved for firmware updates;
executing, by the computing system, a hashing algorithm against at least a portion of the firmware image to generate an approved set of hash values;
receiving, by the computing system, a set of hash values that have been signed using public key cryptography;
determining, by the computing system, that the set of hash values does not match the approved set of hash values; and
in response to determining that the set of hash values does not match the approved set of hash values, performing, by the computing system, at least one remedial action with respect to the host machine.

2. The computer-implemented method of claim 1 , wherein the firmware image is associated with a peripheral device, a particular central processing unit, or a basic input-output system on the host machine.

3. The computer-implemented method of claim 1 , wherein the approved set of hash values is stored at a remote location with respect to the host machine.

4. The computer-implemented method of claim 1 , wherein the firmware information is associated with a device on the host machine other than the network interface device.

5. The computer-implemented method of claim 1 , wherein the remedial action includes at least one of notifying the guest user, isolating the host machine, copying the approved firmware image to the host machine, powering down the host machine, creating an audit log entry, or removing power to the host machine.

6. A system for updating firmware of a device under control of a host machine independent of user interaction, comprising:
a processor; and
a memory device including instructions that, when executed by the processor, cause the processor to:
send a request to validate firmware information on the host machine based at least in part on a firmware image, the host machine hosted by a different computing system, the host machine running a guest operating system provisioned to a guest user, the host machine including at least one interface to the device for which the guest user has been granted hardware access, the request being sent to a dedicated network port of a network interface device of the host machine, the dedicated network port being inaccessible to the guest user and reserved for firmware updates;
execute a hashing algorithm against at least a portion of the firmware image to generate an approved set of hash values;
receive a set of hash values that have been signed using public key cryptography;
determine that the set of hash values does not match the approved set of hash values; and
in response to determining that the set of hash values does not match the approved set of hash values, perform at least one remedial action with respect to the host machine.

7. The system of claim 6 , wherein the host machine includes multiple instances of firmware, at least one of the multiple instances of firmware being outside control of at least one central processing unit of the host machine.

8. The system of claim 6 , wherein the firmware information is contained on the network interface device, the network interface device being connected to a bus of the host machine.

9. The system of claim 6 , wherein
the approved set of hash values corresponds to an approved state of the firmware image.

10. The system of claim 9 , wherein the approved set of hash values is stored at a location that is inaccessible to at least one central processing unit of the host machine.

11. The system of claim 6 , wherein the firmware information is associated with a peripheral device of the host machine.

12. The system of claim 6 , wherein the dedicated network port is used solely for firmware updates.

13. A computer readable storage device for updating firmware of a device of a host machine independent of user interaction, the computer readable storage device storing instructions that, when executed by a processor, cause a computing system to, at least:
send, from the computing system, a request to validate current firmware information on the host machine based at least in part on a firmware image, the host machine being hosted by a different computing system from the computing system, the host machine running a guest operating system provisioned to a guest user, the host machine including at least one interface to a device for which the guest user has been granted hardware access, the request being sent to a dedicated port of a network interface device of the host machine, the network interface device functioning independent of at least one central processing unit of the host machine, the dedicated port being hidden and inaccessible to the guest user of the host machine and reserved for firmware updates;
execute a hashing algorithm against at least a portion of the firmware image to generate approved firmware information;
receive a set of hash values, wherein the set of hash values has been signed using public key cryptography;
validate the current firmware information by comparing the set of hash values to the approved firmware information stored at a secure location inaccessible to the at least one central processing unit of the host machine;
determine that the set of hash values does not match the approved firmware information; and
in response to determining the set of hash values does not match the approved firmware information, perform at least one remedial action with respect to the host machine.

14. The computer readable storage device of claim 13 , wherein the host machine is provisioned to the guest user by the component of the computing system different from the host machine.

15. The computer readable storage device of claim 13 , wherein the guest user has substantially full access to the hardware of the host machine.

16. The computer readable storage device of claim 13 , wherein the computing system is a provisioning system of the host machine.

17. The computer readable storage device of claim 13 , wherein the secure location inaccessible to the at least one central processing unit of the host machine is located on the host machine.

18. The computer readable storage device of claim 13 , wherein the dedicated port comprises an out-of-band firmware update port.

Assignees

• Amazon Tech Inc

Inventors

• Marr Michael David
• Vincent Pradeep
• Corddry Matthew T
• Hamilton James R

Classifications

• G06F8/65 Primary

  Updates (security arrangements therefor G06F21/57) · CPC title

• H04L67/34

  involving the movement of software or configuration parameters  (network booting or remote initial program loading [RIPL] G06F9/4416) · CPC title

• H04L9/30

  Public key, i.e. encryption algorithm being computationally infeasible to invert or user's encryption keys not requiring secrecy · CPC title

• H04L9/3236 Primary

  using cryptographic hash functions · CPC title

• H04L63/145

  the attack involving the propagation of malware through the network, e.g. viruses, trojans or worms · CPC title