Trusted Security Applications Based on openUBMC

Firmware Security Risks

In today's complex and evolving network security landscape, firmware has become a prime target for attackers, with security threats on the rise. As the foundational layer of a computing system, firmware plays a critical role in the overall security and resilience of the system. Given its position at the lowest layer and its high-level privileges, a compromised firmware can render upper-layer protections ineffective. Therefore, enhancing the security and resilience of firmware is of paramount importance in the current threat environment.

Computing systems exhibit the following characteristics:

• Privilege restriction: Lower layers can limit the privileges of upper layers, whereas upper layers cannot constrain lower layers. Consequently, attacks targeting the firmware layer have a significant impact on upper-level systems.
• Attack vulnerability: Upper layers cannot effectively defend against attacks originating from lower layers. If the firmware is compromised, the entire system becomes highly vulnerable.
• Privilege hierarchy: Lower layers possess greater privileges, with hardware holding the highest level. Since firmware operates close to the hardware, ensuring its security is especially critical.

According to the BMC CVE vulnerability statistics, the number of BMC firmware vulnerabilities has steadily increased from 2012 to 2021. In 2021, the count reached 39, significantly higher than in previous years. These vulnerabilities are predominantly high-risk, including types such as remote exploitation and arbitrary code execution. For instance, vulnerabilities like CVE-2013-1945 and CVE-2012-2959 enable remote attackers to execute arbitrary code, posing a serious threat to system security.

With the rapid advancement of AI infrastructure, hardware roots of trust (RoTs) vary in design. Some are built-in, while others are external, leading to differences in security capabilities across devices. This variation makes collaboration challenging and poses risks to data center security. Industry implementations include TPM, SGX, Arm TrustZone, and TPCM, some embedded within SoCs and others placed externally on the board.

Therefore, both built-in and external hardware RoTs form the basis of firmware trust. In a trusted computing system, the trust chain begins with the hardware RoT, which plays a key role in maintaining platform integrity. A hardware RoT generally includes components such as a cryptographic engine, hardware true random number generator, one-time programmable memory, secure SRAM, and corresponding secure firmware.

Common hardware RoTs include RTM, RTS, and RTR in TPM/TCM, BSBC boot code in secure boot, root public key hashes stored in eFuse, TPCM in Trusted Computing 3.0, and Microsoft's open-source Caliptra RoT, which includes a platform root of trust (pRoT).

Based on built-in or external hardware RoTs, trust chain technologies are used to implement security features such as tamper resistance, protection against supply chain replacement, and prevention of unauthorized channel distribution. Cloud providers leverage RoT chips to enable secure boot and hardware identity protection, and they use both internal and external RoTs to perform trusted measurements and identity authentication for intelligent data center components. Chinese CPU manufacturers typically adopt built-in TPCM solutions to achieve trusted computing 3.0 boot and runtime measurement control for server platforms.

Trusted Security Application Practices of openUBMC

The trusted security applications of openUBMC, based on the Hi171x series chips, have been thoroughly validated across various scenarios, including computing servers, storage devices, telecom computing platforms, and edge computing. This provides a comprehensive solution for both hardware and software security protection.

Building on the hardware RoT, hierarchical trust chain transfer is implemented to achieve system-level, full-stack, high-security protection. openUBMC establishes trusted and confidential computing capabilities through features such as firmware resilience, trusted boot, secure upgrade, secure boot, secure runtime, and data protection.

Its component-based architecture distributes BMC functions across different modules. It optimizes interactions between components through standardized interfaces, unified data storage, and permission management.

In addition, openUBMC defines different security levels according to the service attributes of data. Its data partitioning capabilities protect data of varying sensitivity to minimize the risk of data leakage.

openUBMC incorporates a sandbox mechanism that defines varying permission levels and minimal resilience scopes based on component services, establishing a multi-layered protection system.

Based on different trusted partitions, openUBMC designs dedicated data recovery and interface permission degradation processes to achieve chip-level RoT boot security and firmware resilience. This ensures the automatic firmware recovery from tampering.

openUBMC also offers comprehensive signature and identity authentication capabilities, including end-to-end firmware package signing, verification, decryption, and key management. These features maximize firmware integrity and help prevent tampering.

The openUBMC community has established a transparent R&D process that encompasses requirement acceptance, implementation design, coding, automated community building, and official releases. In addition, openUBMC has developed a comprehensive vulnerability management system based on the community's source code and third-party libraries. This system enables process-driven management of software vulnerabilities and risks to maximize software security.

Summary

The standardization of external RoTs, including hardware design and interfaces, and the open-sourcing of built-in RoTs are expected to be the future trend. In heterogeneous trusted computing systems, memory pooling increases the attack surface. Traditional TPM-based trusted boot technology, DICE environment protection, and RoT interconnection technologies will be integrated and unified. They will become essential security capabilities for smart components.

In China, trust chain transfer, secure signatures, and code cross-auditing are major gaps in the security ecosystem. The complexity of security technologies slows down adoption and implementation. Systems like Microsoft's logo certification and the OCP S.A.F.E firmware signing framework provide useful examples for China. The openUBMC community aims to work with upstream and downstream industry partners to build a strong firmware security ecosystem in China.

The openUBMC community invites industry peers to join in creating a new firmware ecosystem and establishing a first-class firmware security environment in China.