CN109614799B

CN109614799B - Information authentication method

Info

Publication number: CN109614799B
Application number: CN201811435729.6A
Authority: CN
Inventors: 孙瑜; 杨秩; 王涛; 洪宇; 王强
Original assignee: BEIJING KEXIN HUATAI INFORMATION TECHNOLOGY CO LTD
Current assignee: BEIJING KEXIN HUATAI INFORMATION TECHNOLOGY CO LTD
Priority date: 2018-11-28
Filing date: 2018-11-28
Publication date: 2021-03-16
Anticipated expiration: 2038-11-28
Also published as: CN109614799A

Abstract

The invention relates to an information authentication method, which can complete user identity authentication at the starting stage of a trusted hard disk, thereby avoiding the behavior that computer equipment is stolen and information is falsified, and can utilize biological information to carry out security authentication on TPCM (trusted personal computer) and carry out security authentication at the starting stage of BIOS (basic input output system), thereby providing an all-round computer system security starting method for users, and greatly improving the security of a computer system.

Description

Information authentication method

Technical Field

The invention relates to the field of computer security, in particular to an information authentication method.

Background

With the rapid development of trusted computing technology, the trusted computing technology is popular with businesses, society, research institutions and individuals, but the information security faces more and more security threats. At present, the information security problem becomes a bottleneck of real implementation of a trusted computing platform, the information security technology guarantees the safe operation of a system by means of combining a robust cryptographic algorithm and a secret key, but the mechanism of pure software is not absolutely secure, and many users can cause the leakage, the stealing, the tampering and the damage of sensitive data due to improper operation in management and use. In addition, pure software cryptographic operations consume a large amount of computer resources and time, so that the pure software cryptographic operations cannot meet the requirements for information security.

The trusted 3.0 is used for improving the overall security of the system, and the main idea is to introduce a trusted Platform module tpm (trusted Platform module) on the existing device hardware Platform, and provide cryptographic operation through the trusted Platform module to realize the functions of trusted boot, identity certification, data protection and the like, so as to ensure the system security of the computer. The TPCM realizes the functions of safe starting, identity authentication, data encryption and the like on a computer, and can solve the safety problem of a computer system.

Disclosure of Invention

The invention provides an information authentication method, which is suitable for carrying out security authentication on a computer system and can greatly improve the security of the computer system compared with the security authentication method in the prior art.

The invention provides an information authentication method, which is characterized by comprising the following steps:

step 1: the system is powered on and started, the TPCM carries out active security measurement on the computer system, if the measurement is passed, the step 2 is carried out, otherwise, the step 3 is carried out;

step 2: a login dialog box is added in the OPROM, and the identity authentication of personnel is realized in the OPROM when the trusted hard disk is started;

and step 3: and reporting abnormal information and forbidding the computer system to start.

Preferably, the step 2 comprises:

adding an 'administeror password' field setting in a TPCM configuration item in an OPROM, so that a manager can realize user identity authentication in a trusted hard disk starting stage by configuring the configuration item.

Preferably, before the step 1, the method further comprises:

and identifying the identity of an operator through the biological identification equipment, if the identity passes the identification, performing active security measurement on the computer system by using the TPCM, and otherwise, reporting abnormal information and forbidding the operator to operate the TPCM.

Preferably, the recognizing the identity of the operator by the biometric device includes:

the system is connected with the TPCM through an external biological recognition device, and prompts an operator to input biological information for safety verification after the TPCM is electrified and started and before the active safety measurement function is formally started.

Preferably, the biological information comprises one or more of the following biological information in combination:

fingerprint information, sclera information, and face information.

Preferably, the method further comprises the following steps between the step 1 and the step 2:

and changing the TPCM configuration item in the BIOS to realize the user identity authentication in the BIOS starting stage, if the authentication is passed, normally starting the computer system, otherwise, reporting abnormal information.

Preferably, the change of the TPCM configuration item in the BIOS:

an "administeror password" is added to the TPCM configuration item included in the BIOS.

The invention also provides a trusted control method based on the trusted hard disk, which is characterized by comprising the following steps:

step 1, electrifying a trusted hard disk, measuring other hardware in a system where the trusted hard disk is located by using a TPCM (tire pressure monitor) module embedded in a hard disk chip in the trusted hard disk, entering step 2 if the measurement result of the other hardware is normal, and alarming if the measurement result of the other hardware is abnormal;

step 2, electrifying other hardware, measuring software in a system where the credible hard disk is located after the system where the credible hard disk is located is started, entering step 3 if the measurement result of the software is normal, and alarming if the measurement result of the software is abnormal;

and 3, the system where the trusted hard disk is located normally operates, when the system where the trusted hard disk is located performs read/write operation on the trusted hard disk, the TPCM embedded in a hard disk chip in the trusted hard disk is utilized to perform decoding/encryption on the data which is cached in the system where the trusted hard disk is located and needs to be read/written, and then the data which is cached in the system where the trusted hard disk is located and needs to be read/written is read/written to the trusted hard disk.

Preferably, the other hardware in the system where the trusted hard disk is located includes: a BMC chip and a BIOS chip;

the software in the system where the trusted hard disk is located comprises: MBR, OS LOADER, and OS KERNEL.

Preferably, the decrypting/encrypting the data which is cached in the system where the trusted hard disk is located and needs to be read/written by using the TPCM module embedded in the hard disk chip of the trusted hard disk includes:

and the system where the trusted hard disk is located calls a TCM module of a TPCM module embedded in a hard disk chip in the trusted hard disk to decrypt/encrypt data to be read/written by the trusted hard disk in the system where the trusted hard disk is located.

Preferably, the trusted hard disk is an IDE hard disk, a PIDE hard disk, an SCSI hard disk, an SATA hard disk, an SAS hard disk or an SSD hard disk.

Preferably, the trusted hard disk supports an m.2 interface, an SAS interface, an SATA interface, and/or an M.P interface.

Preferably, the alarm comprises: and lightening an indicator lamp, sounding an alarm, and prompting printing error information or shutdown by a printing interface.

The information authentication method can complete user identity authentication in the starting stage of the trusted hard disk, thereby avoiding the behavior that the computer equipment is stolen and information is tampered, and can utilize the biological information to carry out safety authentication on the TPCM and carry out safety authentication in the starting stage of the BIOS, thereby providing an all-round computer system safety starting method for users, and further greatly improving the safety of the computer system.

Drawings

The invention will be further described with reference to the accompanying drawings and examples, in which:

FIG. 1 is a flowchart illustrating an information authentication method according to an embodiment of the present invention;

FIG. 2 is a flowchart of an information authentication method according to a second embodiment of the present invention;

fig. 3 is a flowchart of an information authentication method according to a third embodiment of the present invention.

Detailed Description

The preferred embodiments of the present invention will now be described in detail with reference to the accompanying drawings.

The information authentication method is applied to a computer system, wherein the computer system has the function of active security measurement, and the function of active security measurement is realized by adding a TPCM security chip in the computer system.

The TPCM is used for carrying out active safety measurement on each main firmware and components of the computer system in the process of powering on and starting the computer system, wherein the main firmware and the components comprise BIOS firmware, BMC firmware, a designated hard disk partition and the like, if the active measurement result is normal, the computer system is allowed to be normally started, and otherwise, the computer system is forbidden to be normally started.

Example one

Based on the computer system, the present embodiment proposes an information authentication method, whose flowchart is shown in fig. 1, the method includes the following steps:

step 1: after the system is powered on and started, the identity of an operator is identified through the biological identification equipment, if the identity passes the step 2, otherwise, the step 3 is carried out.

Specifically, in order to realize the active security measurement of the computer system, the TPCM security chip needs to be powered on and started before the computer system is started.

Specifically, in order to avoid the TPCM being stolen and tampered by people, the TPCM is connected with a biological identification device such as an external USBKey and a fingerprint acquisition instrument, and after the TPCM is electrified and started and before an active security measurement function is formally started, an operator is prompted to enter biological information for security verification.

Preferably, the biological information includes fingerprint information, sclera information, face information, and the like.

Step 2: and the TPCM formally enters a working state and carries out active safety measurement on the computer system.

Specifically, the content of the active security metric includes integrity check of BIOS firmware, BMC firmware, a designated hard disk partition, and the like.

And step 3: and reporting abnormal information, and forbidding an operator to operate the TPCM.

Specifically, if the identity authentication of the operator fails, the computer system is proved to have risks of being stolen and information falsified, and in this case, the computer system automatically enables the TPCM to enter a locked state and controls the TPCM to be powered off.

According to the safety authentication method in the embodiment, when the computer system is started, the TPCM safety chip is authenticated by using the biological information of an operator, if the authentication is passed, the TPCM is used for carrying out active safety measurement on the computer system, otherwise, the operator is prohibited from operating the TPCM safety chip.

Example two

The present embodiment provides another information authentication method based on the first embodiment, and a flowchart thereof is shown in fig. 2, where the method includes:

step 1: and (3) electrifying and starting the system, carrying out active security measurement on the computer system by utilizing the TPCM, and entering the step 2 if the measurement is passed, or entering the step 3 if the measurement is not passed.

Specifically, the content of the active security metric is as described above, and is not described herein again.

Step 2: and (3) changing the TPCM configuration item in the BIOS to realize the user identity authentication in the BIOS starting stage, if the authentication is passed, normally starting the computer system, otherwise, entering the step 3.

Specifically, the changing of the TPCM configuration item in the BIOS includes adding an administeror password to the TPCM configuration item in the BIOS, so that an Administrator can configure the configuration item to realize user identity authentication at the BIOS startup stage.

Preferably, the method in this embodiment may be combined with the method in the first embodiment, so as to obtain a method capable of performing biometric authentication on the TPCM and performing user identity security authentication in the BIOS stage at the same time, where the process of performing user identity authentication in the BIOS stage is located after the process of performing biometric authentication on the TPCM.

The safety authentication method in the embodiment realizes the user identity authentication in the BIOS starting stage by adding the configuration items about the TPCM in the BIOS, and can avoid the computer system from being stolen and information tampering, thereby improving the safety of the computer system.

EXAMPLE III

In this embodiment, another information authentication method is proposed based on the security authentication method in the first embodiment and the second embodiment, preferably, the flow of the security authentication method in this embodiment may be implemented alone, or may be combined with the flow of the method in the first embodiment and the second embodiment, and the flow chart is shown in fig. 3, where the security authentication method in this embodiment includes:

step 1: and (3) electrifying and starting the system, carrying out active security measurement on the computer system by the TPCM, and entering the step (2) if the measurement is passed, or entering the step (3).

Step 2: and a login dialog box is added in the OPROM, and the personnel identity authentication is realized in the OPROM when the trusted hard disk is started.

Specifically, an "administeror password" field is added in a TPCM configuration item in the OPROM, so that a manager can configure the configuration item to realize user identity authentication at a trusted hard disk boot stage.

Preferably, before step 1, the TPCM may be authenticated by using the biometric information according to the method in the first embodiment, and between step 1 and step 2, the authentication of the user may be completed in the BIOS booting stage according to the method in the second embodiment.

The technical scheme of the embodiment can finish the user identity authentication at the starting stage of the trusted hard disk, so that the behaviors that the computer equipment is stolen and information is tampered are avoided, and the embodiment can be combined with the first embodiment and the second embodiment, so that an all-around computer system security authentication method is provided for a user, and the security of the computer system is greatly improved.

Example four

Preferably, the trusted hard disk can be an IDE hard disk, a PIDE hard disk, an SCSI hard disk, an SATA hard disk, an SAS hard disk and/or an SSD hard disk.

Through the technical scheme in the embodiment, other hardware in the system and software in the system where the trusted hard disk is located can be measured by using the TPCM embedded in the trusted hard disk, and in the normal operation process of the system where the trusted hard disk is located, the TPCM embedded in the trusted hard disk can be used for controlling the trusted reading and writing of data in the trusted hard disk.

In the embodiments provided in the present invention, it should be understood that the disclosed method and terminal can be implemented in other manners. For example, the above-described apparatus embodiments are merely illustrative, and for example, the division of the modules is only one logical functional division, and other divisions may be realized in practice.

In addition, the technical solutions in the above several embodiments can be combined and replaced with each other without contradiction.

The modules described as separate parts may or may not be physically separate, and parts displayed as modules may or may not be physical units, may be located in one place, or may be distributed on a plurality of network units. Some or all of the modules may be selected according to actual needs to achieve the purpose of the solution of the present embodiment.

In addition, functional modules in the embodiments of the present invention may be integrated into one processing unit, or each unit may exist alone physically, or two or more units are integrated into one unit. The integrated unit can be realized in a form of hardware, or in a form of hardware plus a software functional module.

It will be evident to those skilled in the art that the invention is not limited to the details of the foregoing illustrative embodiments, and that the present invention may be embodied in other specific forms without departing from the spirit or essential attributes thereof. The present embodiments are therefore to be considered in all respects as illustrative and not restrictive, the scope of the invention being indicated by the appended claims rather than by the foregoing description, and all changes which come within the meaning and range of equivalency of the claims are therefore intended to be embraced therein. Any reference signs in the claims shall not be construed as limiting the claim concerned. Furthermore, it is obvious that the word "comprising" does not exclude other elements or steps, and the singular does not exclude the plural. A plurality of modules or means recited in the system claims may also be implemented by one module or means in software or hardware. The terms first, second, etc. are used to denote names, but not any particular order.

Finally, it should be noted that the above embodiments are only for illustrating the technical solutions of the present invention and not for limiting, and although the present invention is described in detail with reference to the preferred embodiments, it should be understood by those skilled in the art that modifications or equivalent substitutions may be made on the technical solutions of the present invention without departing from the spirit and scope of the technical solutions of the present invention.

Claims

1. An information authentication method is applied to a computer system with the function of active security measurement, wherein the function of active security measurement is realized by adding a TPCM security chip in the computer system;

the TPCM is used for carrying out active security measurement on each main firmware and each component of the computer system in the process of power-on starting of the computer system;

the main firmware and components comprise BIOS firmware, BMC firmware and a designated hard disk partition; if the active measurement result is normal, allowing the computer system to be normally started, otherwise forbidding the computer system to be normally started;

the method comprises the following steps:

before starting the computer system, the TPCM security chip is powered on and started;

the system is connected with the TPCM through an external USBKey and a fingerprint acquisition instrument biological identification device, and prompts an operator to input biological information for safety verification after the TPCM is electrified and started and before an active safety measurement function is formally started;

the biological information comprises one or more of fingerprint information, sclera information or face information;

and step 3: reporting abnormal information, and forbidding the computer system to start; disabling the operator from operating the TPCM: and if the identity authentication of the operator fails, the computer system is proved to have the risks of being stolen and information falsification, and in the case, the computer system automatically enables the TPCM to enter a locking state and controls the TPCM to be powered off.

2. An information authentication method as claimed in claim 1, wherein said step 2 comprises: adding an 'administeror password' field setting in a TPCM configuration item in an OPROM, so that a manager can realize user identity authentication in a trusted hard disk starting stage by configuring the configuration item.

3. The method for authenticating information according to claim 1, further comprising, between the step 1 and the step 2:

4. The information authentication method of claim 3, wherein said changing the TPCM configuration in the BIOS:

5. A trusted control method based on a trusted hard disk is characterized by comprising the following steps:

step 3, the system where the trusted hard disk is located normally operates, when the system where the trusted hard disk is located performs read/write operation on the trusted hard disk, the TPCM module embedded in a hard disk chip in the trusted hard disk is used for performing decryption/encryption on the data which is cached in the system where the trusted hard disk is located and needs to be read/written, and then the data which needs to be read/written by the trusted hard disk is read/written to the trusted hard disk;

the method for decrypting/encrypting the data which is cached in the system where the trusted hard disk is located and needs to be read/written by using the TPCM embedded in the hard disk chip in the trusted hard disk comprises the following steps:

6. The method of claim 5, wherein the other hardware in the system where the trusted hard disk resides comprises: a BMC chip and a BIOS chip;

7. The method of claim 5, wherein the trusted hard disk is an IDE hard disk, a PIDE hard disk, a SCSI hard disk, a SATA hard disk, a SAS hard disk, or an SSD hard disk.

8. The method of claim 7, wherein the trusted hard disk supports an m.2 interface, a SAS interface, a SATA interface, and/or an M.P interface.

9. The method of claim 5, wherein the alerting comprises: and lightening an indicator lamp, sounding an alarm, and prompting printing error information or shutdown by a printing interface.