CN107451463A - A kind of method of checking secure boot functions - Google Patents

A kind of method of checking secure boot functions Download PDF

Info

Publication number
CN107451463A
CN107451463A CN201710712348.7A CN201710712348A CN107451463A CN 107451463 A CN107451463 A CN 107451463A CN 201710712348 A CN201710712348 A CN 201710712348A CN 107451463 A CN107451463 A CN 107451463A
Authority
CN
China
Prior art keywords
secure boot
checking
boot
secure
normally
Prior art date
Legal status (The legal status is an assumption and is not a legal conclusion. Google has not performed a legal analysis and makes no representation as to the accuracy of the status listed.)
Granted
Application number
CN201710712348.7A
Other languages
Chinese (zh)
Other versions
CN107451463B (en
Inventor
张晓涛
Current Assignee (The listed assignees may be inaccurate. Google has not performed a legal analysis and makes no representation or warranty as to the accuracy of the list.)
Suzhou Inspur Intelligent Technology Co Ltd
Original Assignee
Zhengzhou Yunhai Information Technology Co Ltd
Priority date (The priority date is an assumption and is not a legal conclusion. Google has not performed a legal analysis and makes no representation as to the accuracy of the date listed.)
Filing date
Publication date
Application filed by Zhengzhou Yunhai Information Technology Co Ltd filed Critical Zhengzhou Yunhai Information Technology Co Ltd
Priority to CN201710712348.7A priority Critical patent/CN107451463B/en
Publication of CN107451463A publication Critical patent/CN107451463A/en
Application granted granted Critical
Publication of CN107451463B publication Critical patent/CN107451463B/en
Active legal-status Critical Current
Anticipated expiration legal-status Critical

Links

Classifications

    • GPHYSICS
    • G06COMPUTING; CALCULATING OR COUNTING
    • G06FELECTRIC DIGITAL DATA PROCESSING
    • G06F21/00Security arrangements for protecting computers, components thereof, programs or data against unauthorised activity
    • G06F21/30Authentication, i.e. establishing the identity or authorisation of security principals
    • G06F21/44Program or device authentication

Landscapes

  • Engineering & Computer Science (AREA)
  • Computer Security & Cryptography (AREA)
  • Theoretical Computer Science (AREA)
  • Computer Hardware Design (AREA)
  • Software Systems (AREA)
  • Physics & Mathematics (AREA)
  • General Engineering & Computer Science (AREA)
  • General Physics & Mathematics (AREA)
  • Stored Programmes (AREA)

Abstract

The invention discloses a kind of method of checking secure boot functions, its implementation process is:In computer systems, secure boot are opened;Whether checking secure boot influence the stability of system, and when the system reports an error, the stability of system is affected;When the system is without reporting an error, the stability of system is unaffected;Verify secure boot whether can normal use, the secure boot can normal use refer to that secure boot meet following function:Normal identification drive software, normal support UEFI patterns, normal switching-off;When verify secure boot do not influence system stability and can normal use when, secure boot functions are normally realized.A kind of method of checking secure boot functions of the present invention is compared with prior art, by way of reversely verifying, realize the checking to secure boot functions, ensure the normal realization of its function, so as to effectively prevent Malware from invading, effectively improve the security of server product, improve product quality, it is practical, it is applied widely, it is easy to spread.

Description

A kind of method of checking secure boot functions
Technical field
The present invention relates to computer server technical field, specifically a kind of side of checking secure boot functions Method.
Background technology
Secure boot are a UEFI bios sub-rules, under tradition (Legacy) bios BOOT options, Microsoft provides that the manufacturer (i.e. OEM vendor) of all prepackage Win8 operating systems is all switched on secure boot (in mainboard The public key of Win8 built in face).The mainboard option in part is secure boot Contrl, under Security options.Prepackage Win8 is system computerized, once closing this function (being set to " Disabled "), will lead to not enter system.
That is, Microsoft secure boot make that the operating system or hardware by authenticating can only be loaded on mainboard Driver, so as to prevent Malware from invading, Product Safety can be effectively improved, but need third company to go to set in fact It is existing.So OEM vendor is needed to go design bios to realize its function.
In the prior art, by taking server as an example, it is obtained for and is widely applied in every field, such as internet, gold Melt ...;Security requirement of the client to server also more and more higher.The support for increasing secure boot under bios can be very big Degree improves illegal rogue program invasion, but needs bios manufacturers and OEM vendor to ensure that its function is normally realized.
In summary, how to ensure that secure boot functions are normally realized, complete verification process, turn into crucial, be based on This, the present invention provides a kind of method of checking secure boot functions.
The content of the invention
The technical assignment of the present invention is to be directed to above weak point, there is provided a kind of method of checking secure boot functions.
A kind of method of checking secure boot functions, its implementation process are:
In computer systems, secure boot are opened;
Whether checking secure boot influence the stability of system, and when the system reports an error, the stability of system is by shadow Ring, now secure boot functions can not be realized normally, terminate verification process;When the system is without reporting an error, the stabilization of system Property is unaffected, continues following checkings;
Verify secure boot whether can normal use, the secure boot can normal use refer to secure Boot meets following function:Normal identification drive software, normal support UEFI patterns, normal switching-off, when secure boot can During normal use, secure boot functions normally realize that otherwise secure boot functions can not be realized normally, terminate authenticated Journey.
Open secure boot the step of be:
It is first turned on clean boot function;
Then by secure boot key factory resets;
Secure boot are configured to user model;
Confirm that secure boot functions can be opened normally, secure boot are opened after the completion of confirmation.
Configuration secure boot are completed under bios interfaces, are specially:
Clean boot function is opened, into bios setup security settings interface, secure boot are arranged to Enable;
Restore Factory Keys are selected, YES is selected in prompting interface, preservation, which is exited, restarts, and completes factory reset;
Into bios setup, confirm that secure boot are Enable, secure boot are user mode, i.e. user model.
Confirm that secure boot functions can be opened normally to refer to confirm secure boot work(under computer operating system Whether can normally open, by installation operation system, into system after powershell, operation run with administrator mode Order as confirm-SecureBootUEFI, at this moment Secure boot functions normally then show True, are otherwise shown as FALSE。
PowerShell is a kind of command-line shell program and script environment, makes order line user and script edit person can To utilize .NET Framework power.
Checking secure boot function does not influence the stability of a system and referred to after secure boot steps are opened, and passes through Journal file under inspection system and BMC, any error information is checked whether, when without any error information, the secure Boot function does not influence the stability of a system.
After checking secure boot do not influence the stability of system, whether checking secure boot being capable of normal uses Before, in addition to by computer shutdown, the step of plugging TPM safety chips and PCIe card, the step is used to ensure the computer System starts normally, and secure boot opening does not influence the TPM safety chips and PCIe card of insertion.
Can checking secure boot normally identify is the step of drive software:By chip group, i.e. chipset, Check whether to check whether to restart after the completion of normal mounting normally with normal mounting, when restarting normal, the secure Boot normally identifies drive software.
Can checking secure boot normally support UEFI patterns to refer to by external mobile equipment, in the mobile device In be pre-configured with the system of UEFI patterns and the system of non-UEFI patterns, when only start UEFI patterns system, other systems without Method is entered fashionable, and the secure boot normally support UEFI patterns.
Can checking secure boot normally support concretely comprising the following steps for UEFI patterns:Main frame is shut down first, Then USB flash disk can be started by connecting, and this can start in USB flash disk the UEFI systems that are pre-configured with, non-UEFI systems;Start in the user mode, I.e. in bios, when secure boot Enable and secure boot status are under user mode patterns, if UEFI systems can only be started to, other systems cannot be introduced into, then the system that the secure boot only support UEFI patterns, Other modular systems think violated system.
Checking secure boot whether can normal switching-off refer to operating system by starting to other patterns, it was demonstrated that Whether secure boot can be normally closed, and be specially:Secure boot are arranged to disable states, or boot Status is arranged to setup mode, then starts to other mode operating systems, when other operating systems can be started to, Prove that secure boot can be normally closed.
Compared to the prior art a kind of method of checking secure boot functions of the present invention, has the advantages that:
A kind of method of checking secure boot functions of the present invention, by way of reversely verifying, is realized to secure The checking of boot functions, ensure the normal realization of its function, so as to effectively prevent Malware from invading, effectively improve server production The security of product, product quality is improved, it is practical, it is applied widely, it is easy to spread.
Embodiment
In order that those skilled in the art more fully understand the solution of the present invention, with reference to embodiment to this Invention is described in further detail.Obviously, described embodiment is only part of the embodiment of the present invention, rather than all Embodiment.Based on the embodiment in the present invention, those of ordinary skill in the art institute under the premise of creative work is not made The every other embodiment obtained, belongs to the scope of protection of the invention.
A kind of method of checking secure boot functions, its implementation process are:
In computer systems, secure boot are opened;
Whether checking secure boot influence the stability of system, and when the system reports an error, the stability of system is by shadow Ring, now secure boot functions can not be realized normally, terminate verification process;When the system is without reporting an error, the stabilization of system Property is unaffected, continues following checkings;
Verify secure boot whether can normal use, the secure boot can normal use refer to secure Boot meets following function:Normal identification drive software, normal support UEFI patterns, normal switching-off, when secure boot can During normal use, secure boot functions normally realize that otherwise secure boot functions can not be realized normally, terminate authenticated Journey.
Open secure boot the step of be:
It is first turned on clean boot function;
Then by secure boot key factory resets;
Secure boot are configured to user model;
Confirm that secure boot functions can be opened normally, secure boot are opened after the completion of confirmation.
Configuration secure boot are completed under bios interfaces, are specially:
Clean boot function is opened, into bios setup security settings interface, secure boot are arranged to Enable;
Restore Factory Keys are selected, YES is selected in prompting interface, preservation, which is exited, restarts, and completes factory reset;
Into bios setup, confirm that secure boot are Enable, secure boot are user mode, i.e. user model.
Confirm that secure boot functions can be opened normally to refer to confirm secure boot work(under computer operating system Whether can normally open, by installation operation system, into system after powershell, operation run with administrator mode Order as confirm-SecureBootUEFI, at this moment Secure boot functions normally then show True, are otherwise shown as FALSE。
Checking secure boot function does not influence the stability of a system and referred to after secure boot steps are opened, and passes through Journal file under inspection system and BMC, any error information is checked whether, when without any error information, the secure Boot function does not influence the stability of a system.
After checking secure boot do not influence the stability of system, whether checking secure boot being capable of normal uses Before, in addition to by computer shutdown, the step of plugging TPM safety chips and PCIe card, the step is used to ensure the computer System starts normally, and secure boot opening does not influence the TPM safety chips and PCIe card of insertion.
Can checking secure boot normally identify is the step of drive software:By chip group, i.e. chipset, Check whether to check whether to restart after the completion of normal mounting normally with normal mounting, when restarting normal, the secure Boot normally identifies drive software.
Can checking secure boot normally support UEFI patterns to refer to by external mobile equipment, in the mobile device In be pre-configured with the system of UEFI patterns and the system of non-UEFI patterns, when only start UEFI patterns system, other systems without Method is entered fashionable, and the secure boot normally support UEFI patterns.
Can checking secure boot normally support concretely comprising the following steps for UEFI patterns:Main frame is shut down first, Then USB flash disk can be started by connecting, and this can start in USB flash disk the UEFI systems that are pre-configured with, non-UEFI systems;Start in the user mode, I.e. when secure boot Enable and secure boot status are under user mode patterns, if can only start to UEFI systems, other systems cannot be introduced into, then the system that the secure boot only support UEFI patterns, other pattern systems System thinks violated system.
Checking secure boot whether can normal switching-off refer to operating system by starting to other patterns, it was demonstrated that Whether secure boot can be normally closed, and be specially:Secure boot are arranged to disable states, or boot Status is arranged to setup mode, then starts to other mode operating systems, when other operating systems can be started to, Prove that secure boot can be normally closed.
Instantiation:
Go to verify whether to pass through using the OS and USB flash disk of the UEFI Windows 2012 Jing Guo certification and non-UEFI patterns Power shell under secure boot, and system, implementation step are as described below.
Into bios SETUP security settings interface, secure boot are arranged to Enable.
" Restore Factory Keys ", prompting interface select YES, and preservation, which is exited, restarts for selection.
Confirm that secure boot are Enable into bios setup, secure boot are user mode.
Windows 2012 is installed, into system with administrator mode operation powershell operation orders “confirm-SecureBootUEFI”。
If Secure boot functions can normally show True, FALSE otherwise can be shown.
There is no any report an error under inspection system and BMC.
It is normal that cycle power ensures that system starts.
Official chipset is installed, checking whether can be with normal mounting.
Shutdown, USB flash disk can be started by connecting, and install win7 systems, Redhat6.x, UEFI windows2012 in USB flash disk in advance.
When secure boot Enable and secure boot status are user mode, and UEFI can only be started to The systems of Windows 2012, when other systems cannot be introduced into, illustrate the system that secure boot only support UEFI patterns, Legacy modular systems think violated system.
Secure boot are configured to disable states, or boot status are configured to setup, checking whether can To start to other pattern OS.
By embodiment above, the those skilled in the art can readily realize the present invention.But should Work as understanding, the present invention is not limited to above-mentioned embodiment.On the basis of disclosed embodiment, the technical field Technical staff can be combined different technical characteristics, so as to realize different operator's cases.
It is the known technology of those skilled in the art in addition to the technical characteristic described in specification.

Claims (10)

  1. A kind of 1. method of checking secure boot functions, it is characterised in that its implementation process is:
    In computer systems, secure boot are opened;
    Whether checking secure boot influence the stability of system, and when the system reports an error, the stability of system is by shadow Ring, now secure boot functions can not be realized normally, terminate verification process;When the system is without reporting an error, the stabilization of system Property is unaffected, continues following checkings;
    Verify secure boot whether can normal use, the secure boot can normal use refer to secure Boot meets following function:Normal identification drive software, normal support UEFI patterns, normal switching-off, when secure boot can During normal use, secure boot functions normally realize that otherwise secure boot functions can not be realized normally, terminate authenticated Journey.
  2. 2. the method for a kind of checking secure boot functions according to claim 1, it is characterised in that open secure The step of boot is:
    The safe mode of computer operating system is initially entered, opens clean boot function;
    Then factory reset, secure boot are configured to user model;
    Confirm that secure boot functions can be opened normally, secure boot are opened after the completion of confirmation.
  3. A kind of 3. method of checking secure boot functions according to claim 2, it is characterised in that configuration secure Boot is completed under bios interfaces, is specially:
    Clean boot function is opened, into bios setup security settings interface, secure boot are positioned to allow for, i.e., Enable;
    Restore Factory Keys are selected, YES is selected in prompting interface, preservation, which is exited, restarts, and completes factory reset;
    Into bios setup, confirm that secure boot are Enable, secure boot are user mode, i.e. user model.
  4. 4. the method for a kind of checking secure boot functions according to claim 2, it is characterised in that confirm secure Boot functions, which can be opened normally, to be referred to confirm whether secure boot functions can normally be opened under computer operating system, By installation operation system, into system after powershell run with administrator mode, operation order is confirm- SecureBootUEFI, at this moment Secure boot functions normally then show True, be otherwise shown as FALSE.
  5. A kind of 5. method of checking secure boot functions according to claim 2,3 or 4, it is characterised in that checking The stability whether secure boot influence system refers to after secure boot steps are opened, and passes through inspection system and BMC Under journal file, checked whether any error information, when without any error information, the function of the secure boot Opening does not influence the stability of a system.
  6. 6. the method for a kind of checking secure boot functions according to claim 5, it is characterised in that verifying After secure boot do not influence the stability of system, whether checking secure boot can include counting before normal use Machine-operated machine is calculated, the step of plugging TPM safety chips and PCIe card, the step is used to ensure that the computer system starting is normal, And secure boot opening does not influence the TPM safety chips and PCIe card of insertion.
  7. A kind of 7. method of checking secure boot functions according to claim 5, it is characterised in that checking secure Can boot normally identify is the step of drive software:By chip group, i.e. chipset, check whether normally to pacify Dress, check whether to restart after the completion of normal mounting normally, when restarting normal, the secure boot normally identify that driving is soft Part.
  8. A kind of 8. method of checking secure boot functions according to claim 5, it is characterised in that checking secure Can boot normally support UEFI patterns to refer to, by external mobile equipment, UEFI patterns are pre-configured with the mobile device The system of system and non-UEFI patterns, when the system for only starting UEFI patterns, when other systems cannot be introduced into, the secure Boot normally supports UEFI patterns.
  9. A kind of 9. method of checking secure boot functions according to claim 5, it is characterised in that checking secure Can boot normally support concretely comprising the following steps for UEFI patterns:Main frame is shut down first, USB flash disk can be started by then connecting, This can start in USB flash disk the UEFI systems that are pre-configured with, non-UEFI systems;Start in the user mode, i.e., as the secure in bios When boot Enable and secure boot status are under user mode patterns, if UEFI systems can only be started to, its He cannot be introduced into system, then the system that the secure boot only support UEFI patterns, other modular systems think the non-genealogy of law System.
  10. A kind of 10. method of checking secure boot functions according to claim 5, it is characterised in that checking secure Boot whether can normal switching-off refer to operating system by starting to other patterns, it was demonstrated that whether secure boot can be by Normal switching-off, it is specially:Secure boot are arranged to disable, i.e. disable states, or boot status are arranged to Setup mode, other mode operating systems are then started to, when other operating systems can be started to, it was demonstrated that secure Boot can be normally closed.
CN201710712348.7A 2017-08-18 2017-08-18 Method for verifying secure boot function Active CN107451463B (en)

Priority Applications (1)

Application Number Priority Date Filing Date Title
CN201710712348.7A CN107451463B (en) 2017-08-18 2017-08-18 Method for verifying secure boot function

Applications Claiming Priority (1)

Application Number Priority Date Filing Date Title
CN201710712348.7A CN107451463B (en) 2017-08-18 2017-08-18 Method for verifying secure boot function

Publications (2)

Publication Number Publication Date
CN107451463A true CN107451463A (en) 2017-12-08
CN107451463B CN107451463B (en) 2020-06-16

Family

ID=60492538

Family Applications (1)

Application Number Title Priority Date Filing Date
CN201710712348.7A Active CN107451463B (en) 2017-08-18 2017-08-18 Method for verifying secure boot function

Country Status (1)

Country Link
CN (1) CN107451463B (en)

Cited By (3)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN108804325A (en) * 2018-06-08 2018-11-13 郑州云海信息技术有限公司 A kind of test method to Secure Boot
CN109683972A (en) * 2018-12-25 2019-04-26 联想(北京)有限公司 Information control method and device
CN110287686A (en) * 2019-06-24 2019-09-27 深圳市同泰怡信息技术有限公司 A kind of the clean boot right management method and equipment of basic input output system

Citations (6)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN101833493A (en) * 2010-03-24 2010-09-15 浪潮电子信息产业股份有限公司 Method for testing stability and reliability of server based on linux system
CN103353929A (en) * 2013-07-31 2013-10-16 山东超越数控电子有限公司 Method for adding and checking ID card information in basic input/output system (BIOS) initiating process
CN103514411A (en) * 2012-06-25 2014-01-15 联想(北京)有限公司 Method for starting electronic equipment and electronic equipment safety system
CN105825131A (en) * 2016-03-16 2016-08-03 广东工业大学 Computer security startup protection method on basis of UEFI (Unified Extensible Firmware Interface)
CN106250725A (en) * 2016-08-02 2016-12-21 浪潮电子信息产业股份有限公司 A kind of ARM platform prevents the method that UEFI program is illegally transplanted
US9639700B2 (en) * 2015-03-20 2017-05-02 Lenovo Enterprise Solutions (Singapore) Pte. Ltd. Unified extensible firmware interface (UEFI) database for secure bootstrap of a computer

Patent Citations (6)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN101833493A (en) * 2010-03-24 2010-09-15 浪潮电子信息产业股份有限公司 Method for testing stability and reliability of server based on linux system
CN103514411A (en) * 2012-06-25 2014-01-15 联想(北京)有限公司 Method for starting electronic equipment and electronic equipment safety system
CN103353929A (en) * 2013-07-31 2013-10-16 山东超越数控电子有限公司 Method for adding and checking ID card information in basic input/output system (BIOS) initiating process
US9639700B2 (en) * 2015-03-20 2017-05-02 Lenovo Enterprise Solutions (Singapore) Pte. Ltd. Unified extensible firmware interface (UEFI) database for secure bootstrap of a computer
CN105825131A (en) * 2016-03-16 2016-08-03 广东工业大学 Computer security startup protection method on basis of UEFI (Unified Extensible Firmware Interface)
CN106250725A (en) * 2016-08-02 2016-12-21 浪潮电子信息产业股份有限公司 A kind of ARM platform prevents the method that UEFI program is illegally transplanted

Cited By (5)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN108804325A (en) * 2018-06-08 2018-11-13 郑州云海信息技术有限公司 A kind of test method to Secure Boot
CN109683972A (en) * 2018-12-25 2019-04-26 联想(北京)有限公司 Information control method and device
CN109683972B (en) * 2018-12-25 2021-07-16 联想(北京)有限公司 Information control method and device
CN110287686A (en) * 2019-06-24 2019-09-27 深圳市同泰怡信息技术有限公司 A kind of the clean boot right management method and equipment of basic input output system
CN110287686B (en) * 2019-06-24 2021-06-15 深圳市同泰怡信息技术有限公司 Safe starting authority management method and equipment for basic input output system

Also Published As

Publication number Publication date
CN107451463B (en) 2020-06-16

Similar Documents

Publication Publication Date Title
US8341393B2 (en) Security to extend trust
CN101980235B (en) Safe computing platform
US8868898B1 (en) Bootable covert communications module
CN107506663A (en) Server security based on credible BMC starts method
EP3676742A1 (en) Hardware-enforced firmware security
US20090288161A1 (en) Method for establishing a trusted running environment in the computer
US8387133B2 (en) Power on certification method for personal computer and power on certification system thereof
CN107451463A (en) A kind of method of checking secure boot functions
US8539246B2 (en) Secure resume for encrypted drives
CN105825131B (en) A kind of computer safety start means of defence based on UEFI
CN106909848A (en) A kind of computer security strengthening system and its method based on BIOS extensions
US10853474B2 (en) System shipment lock
WO2022028057A1 (en) Tpm-based apparatus and method for multi-layer protection of server asset information
CN106612178A (en) Method and device for protecting security of Android adb data transmission
US9448888B2 (en) Preventing a rollback attack in a computing system that includes a primary memory bank and a backup memory bank
CN106919845B (en) System security trust chain construction device and method
US8473747B2 (en) Secure boot with minimum number of re-boots
US10684904B2 (en) Information handling systems and methods to selectively control ownership of a hardware based watchdog timer (WDT)
US11861011B2 (en) Secure boot process
CN102594815B (en) Before register system, user right is set and performs method, the device of corresponding operating
CN114510751A (en) Hardware replacement prevention device and method based on processor security kernel
CN107315962A (en) A kind of trusted processing module of embedded platform
US10929827B2 (en) Basic input/output system (BIOS) and unified extensible firmware interface (UEFI) one-time boot
TWI758038B (en) Method for generating bios setup menu
CN109992933A (en) The firmware of PIN-based code authorization starts method

Legal Events

Date Code Title Description
PB01 Publication
PB01 Publication
SE01 Entry into force of request for substantive examination
SE01 Entry into force of request for substantive examination
TA01 Transfer of patent application right
TA01 Transfer of patent application right

Effective date of registration: 20200518

Address after: 215100 No. 1 Guanpu Road, Guoxiang Street, Wuzhong Economic Development Zone, Suzhou City, Jiangsu Province

Applicant after: SUZHOU LANGCHAO INTELLIGENT TECHNOLOGY Co.,Ltd.

Address before: 450000 Henan province Zheng Dong New District of Zhengzhou City Xinyi Road No. 278 16 floor room 1601

Applicant before: ZHENGZHOU YUNHAI INFORMATION TECHNOLOGY Co.,Ltd.

GR01 Patent grant
GR01 Patent grant