Firmware updates from an external channel

摘要

When providing a user with native access to at least a portion of device hardware, the user can be prevented from modifying firmware and other configuration information by controlling the mechanisms used to update that information. In some embodiments, an asymmetric keying approach can be used to encrypt or sign the firmware. In other cases access can be controlled by enabling firmware updates only through a channel or port that is not exposed to the customer, or by mapping only those portions of the hardware that are to be accessible to the user. In other embodiments, the user can be prevented from modifying firmware by only provisioning the user on a machine after an initial mutability period wherein firmware can be modified, such that the user never has access to a device when firmware can be updated. Combinations and variations of the above also can be used.

主权项

1. A computer-implemented method for securing access to firmware, comprising:
under control of one or more computer systems configured with executable instructions, restricting access to firmware on a peripheral device by a central processing unit of a host machine through a peripheral bus, the peripheral bus being configured to prevent firmware from being updated by the central processing unit, wherein the peripheral device has at least one first port for communicating with the central processing unit, and at least one second port for receiving firmware update information independent of the at least one central processing unit; providing the central processing unit of the host machine with access to a first port on the host machine; receiving firmware update information on the second port on the peripheral device from a source external to the host machine, the second port inaccessible by the central processing unit of the host machine during updates to the firmware of the peripheral device; and upon receiving the firmware update information through the second port, updating the firmware on the peripheral device, wherein the firmware is unable to be updated by the central processing unit of the host machine even when the central processing unit is able to communicate with the peripheral device.