CN113761538A - Security boot file configuration method, boot method, device, equipment and medium - Google Patents
Security boot file configuration method, boot method, device, equipment and medium Download PDFInfo
- Publication number
- CN113761538A CN113761538A CN202110873686.5A CN202110873686A CN113761538A CN 113761538 A CN113761538 A CN 113761538A CN 202110873686 A CN202110873686 A CN 202110873686A CN 113761538 A CN113761538 A CN 113761538A
- Authority
- CN
- China
- Prior art keywords
- file
- content
- digital signature
- signed
- binary file
- Prior art date
- Legal status (The legal status is an assumption and is not a legal conclusion. Google has not performed a legal analysis and makes no representation as to the accuracy of the status listed.)
- Withdrawn
Links
- 238000000034 method Methods 0.000 title claims abstract description 60
- 238000004422 calculation algorithm Methods 0.000 claims abstract description 38
- 239000000758 substrate Substances 0.000 claims abstract description 16
- 238000004590 computer program Methods 0.000 claims description 15
- 230000010354 integration Effects 0.000 claims description 11
- 101100217298 Mus musculus Aspm gene Proteins 0.000 claims description 7
- 238000004891 communication Methods 0.000 description 6
- 238000012545 processing Methods 0.000 description 5
- 238000010586 diagram Methods 0.000 description 4
- 238000013461 design Methods 0.000 description 2
- 230000005540 biological transmission Effects 0.000 description 1
- 238000005516 engineering process Methods 0.000 description 1
- 238000000605 extraction Methods 0.000 description 1
- 230000003287 optical effect Effects 0.000 description 1
- 230000000750 progressive effect Effects 0.000 description 1
- 238000013515 script Methods 0.000 description 1
- 230000001052 transient effect Effects 0.000 description 1
- 238000012795 verification Methods 0.000 description 1
Images
Classifications
-
- G—PHYSICS
- G06—COMPUTING; CALCULATING OR COUNTING
- G06F—ELECTRIC DIGITAL DATA PROCESSING
- G06F21/00—Security arrangements for protecting computers, components thereof, programs or data against unauthorised activity
- G06F21/50—Monitoring users, programs or devices to maintain the integrity of platforms, e.g. of processors, firmware or operating systems
- G06F21/57—Certifying or maintaining trusted computer platforms, e.g. secure boots or power-downs, version controls, system software checks, secure updates or assessing vulnerabilities
- G06F21/575—Secure boot
-
- G—PHYSICS
- G06—COMPUTING; CALCULATING OR COUNTING
- G06F—ELECTRIC DIGITAL DATA PROCESSING
- G06F21/00—Security arrangements for protecting computers, components thereof, programs or data against unauthorised activity
- G06F21/60—Protecting data
- G06F21/602—Providing cryptographic facilities or services
-
- G—PHYSICS
- G06—COMPUTING; CALCULATING OR COUNTING
- G06F—ELECTRIC DIGITAL DATA PROCESSING
- G06F21/00—Security arrangements for protecting computers, components thereof, programs or data against unauthorised activity
- G06F21/60—Protecting data
- G06F21/64—Protecting data integrity, e.g. using checksums, certificates or signatures
-
- G—PHYSICS
- G06—COMPUTING; CALCULATING OR COUNTING
- G06F—ELECTRIC DIGITAL DATA PROCESSING
- G06F9/00—Arrangements for program control, e.g. control units
- G06F9/06—Arrangements for program control, e.g. control units using stored programs, i.e. using an internal store of processing equipment to receive or retain programs
- G06F9/44—Arrangements for executing specific programs
- G06F9/445—Program loading or initiating
- G06F9/44505—Configuring for program initiating, e.g. using registry, configuration files
Abstract
The application discloses a method, a device, equipment and a medium for configuring a secure boot file, which comprise the following steps: acquiring an original binary file for starting a hardware circuit of a server baseboard management system chip; determining the content of a file to be signed from an original binary file; carrying out digital signature on the file content to be signed by utilizing a preset digital signature algorithm to obtain a corresponding first digital signature; integrating the original binary file, the storage position information corresponding to the content of the file to be signed and the first digital signature to obtain a target binary file; burning a target binary file to a preset storage position of a chip so as to start the hardware circuit by using the target binary file read from the preset storage position when the hardware circuit needs to be started. By the technical scheme, the hardware circuit can be prevented from being started by adopting the tampered file content, so that the starting safety of the hardware circuit of the server substrate management system chip is improved.
Description
Technical Field
The present application relates to the field of computer technologies, and in particular, to a method, an apparatus, a device, and a medium for configuring a secure boot file.
Background
Currently, a server baseboard management system chip is a chip commonly used in a server. When the server baseboard management system chip runs, a hardware circuit in the server baseboard management system chip needs to be started first. In order to start a hardware circuit of a server baseboard management system chip, at present, a binary file for starting the hardware circuit is usually burned to a preset storage location of the server baseboard management system chip, and after a system is powered on, the binary file on the preset storage location can be directly operated, so that the hardware circuit of the server baseboard management system chip is started. However, since the binary file in the predetermined storage location is susceptible to illegal tampering, a problem of starting the hardware circuit using the illegally tampered binary file occurs, thereby causing a system security risk.
In summary, how to improve the starting security of the hardware circuit of the server baseboard management system chip is a problem to be solved at present.
Disclosure of Invention
In view of the above, an object of the present invention is to provide a secure boot file configuration method, a boot method, a device, an apparatus, and a medium, which can improve the boot security of a hardware circuit of a server baseboard management system chip. The scheme is as follows:
in a first aspect, the present application discloses a secure boot file configuration method, including:
acquiring an original binary file for starting a hardware circuit of a server baseboard management system chip;
determining the content of a file to be signed from the original binary file;
carrying out digital signature on the content of the file to be signed by utilizing a preset digital signature algorithm to obtain a corresponding first digital signature;
integrating the original binary file, the storage position information corresponding to the content of the file to be signed and the first digital signature to obtain a target binary file;
and burning the target binary file to a preset storage position of the server baseboard management system chip so as to start the hardware circuit by using the target binary file read from the preset storage position when the hardware circuit needs to be started.
Optionally, the determining the content of the file to be signed from the original binary file includes:
determining initial position information of file contents to be signed and file content length;
and selecting corresponding file contents from the original binary file based on the initial position information and the file content length to obtain the file contents to be signed.
Optionally, the determining the starting position information of the file content to be signed and the file content length includes:
acquiring initial position information of the file content to be signed defined by a user and the length of the file content through a preset parameter configuration interface;
or determining the initial position information of the file content to be signed and the length of the file content in a background random determination mode.
Optionally, the digitally signing the content of the file to be signed by using a preset digital signature algorithm to obtain a corresponding first digital signature includes:
and carrying out digital signature on the content of the file to be signed by using an SHA1 digest algorithm to obtain a corresponding first digital signature.
Optionally, the integrating the original binary file, the storage location information corresponding to the content of the file to be signed, and the first digital signature to obtain a target binary file includes:
encrypting the first digital signature by using an encryption key to obtain the encrypted first digital signature, and determining decryption key information corresponding to the encryption key;
and integrating the original binary file, the storage position information corresponding to the content of the file to be signed, the decryption key information and the encrypted first digital signature according to a preset information integration sequence to obtain a target binary file.
Optionally, the encrypting the first digital signature by using an encryption key includes:
determining a private key which is not used currently from a plurality of pre-created private keys as an encryption key according to the sequence of preset key serial numbers, and then asymmetrically encrypting the first digital signature by using the encryption key;
correspondingly, the determining decryption key information corresponding to the encryption key includes:
and determining the serial number of the public key corresponding to the encryption key from a plurality of public keys corresponding to the private keys, which are pre-stored in the server substrate management system chip, so as to obtain decryption key information corresponding to the encryption key.
In a second aspect, the present application discloses a method for safely starting a hardware circuit, including:
reading a target binary file from a preset storage position of a server substrate management system chip; the target binary file is configured by the secure boot file configuration method;
analyzing the target binary file to obtain an original binary file recorded in the target binary file, storage position information corresponding to the content of the file to be signed and a first digital signature;
determining the content of the file to be signed from the original binary file by using the storage position information, and signing the content of the file to be signed by using a preset digital signature algorithm to obtain a corresponding second digital signature;
and judging whether the first digital signature and the second digital signature are consistent, and if so, allowing the hardware circuit of the server baseboard management system chip to be started by using the original binary file.
In a third aspect, the present application discloses a secure boot file configuration apparatus, including:
the file acquisition module is used for acquiring an original binary file for starting a hardware circuit of a server baseboard management system chip;
the content determining module is used for determining the content of the file to be signed from the original binary file;
the digital signature module is used for digitally signing the content of the file to be signed by utilizing a preset digital signature algorithm to obtain a corresponding first digital signature;
the file integration module is used for integrating the original binary file, the storage position information corresponding to the content of the file to be signed and the first digital signature to obtain a target binary file;
and the file burning module is used for burning the target binary file to a preset storage position of the server substrate management system chip so as to start the hardware circuit by using the target binary file read from the preset storage position when the hardware circuit needs to be started.
In a fourth aspect, the present application discloses an electronic device comprising a processor and a memory; when the processor executes the computer program stored in the memory, the aforementioned secure boot file configuration method is implemented.
In a fifth aspect, the present application discloses a computer readable storage medium for storing a computer program; wherein the computer program, when executed by a processor, implements the aforementioned secure boot file configuration method.
It can be seen that, this application acquires the original binary file that is used for starting the hardware circuit of server base plate management system chip earlier, then follows it confirms in the original binary file to treat signature file content, utilizes and predetermines digital signature algorithm right treat signature file content carries out digital signature, obtains corresponding first digital signature, and right original binary file treat the storage location information that signature file content corresponds and first digital signature integrates, obtain target binary file, will target binary file burns record to server base plate management system chip's predetermined storage location to utilize when needs start to follow read in the predetermined storage location target binary file starts the hardware circuit. Therefore, the content of the file to be signed in the original binary file for starting the hardware circuit of the server baseboard management system chip is signed, and the signature result, the storage position information of the file content to be signed and the original binary file are integrated into a new binary file, namely a target binary file is obtained, and then writing the target binary file into a preset storage position of the server baseboard management system chip, so that, when the hardware circuit is started later, the signature information in the target binary file on the preset storage position can be used for verifying whether the content of the file to be signed in the original binary file is falsified, the method and the device avoid starting the hardware circuit by adopting the tampered file content, thereby improving the starting safety of the hardware circuit of the server substrate management system chip.
Drawings
In order to more clearly illustrate the embodiments of the present application or the technical solutions in the prior art, the drawings needed to be used in the description of the embodiments or the prior art will be briefly introduced below, it is obvious that the drawings in the following description are only embodiments of the present application, and for those skilled in the art, other drawings can be obtained according to the provided drawings without creative efforts.
FIG. 1 is a flow chart of a method for configuring a secure boot file as disclosed herein;
FIG. 2 is a flowchart of a specific secure boot file configuration method disclosed herein;
FIG. 3 is a flowchart of a specific secure boot file configuration method disclosed herein;
FIG. 4 is a flowchart of a hardware circuit secure boot method disclosed herein;
FIG. 5 is a schematic diagram of a secure boot file configuration apparatus according to the present disclosure;
fig. 6 is a block diagram of an electronic device disclosed in the present application.
Detailed Description
The technical solutions in the embodiments of the present application will be clearly and completely described below with reference to the drawings in the embodiments of the present application, and it is obvious that the described embodiments are only a part of the embodiments of the present application, and not all of the embodiments. All other embodiments, which can be derived by a person skilled in the art from the embodiments given herein without making any creative effort, shall fall within the protection scope of the present application.
The embodiment of the application discloses a method for configuring a secure boot file, which is shown in fig. 1 and comprises the following steps:
step S11: and acquiring an original binary file for starting a hardware circuit of the server baseboard management system chip.
In this embodiment, first, an original binary file of a secure boot hardware circuit on which the server baseboard management system chip is installed needs to be acquired. The server Baseboard Management system chip includes, but is not limited to, a BMC (Baseboard Management Controller) chip.
Step S12: and determining the content of the file to be signed from the original binary file.
In a specific embodiment, the present application may determine all file contents in the original binary file as file contents to be signed. In another specific embodiment, the present application may also determine a part of file contents in the original binary file as file contents to be signed. Specifically, after the original binary file is obtained, in order to perform signature authentication on a custom secure boot area corresponding to a hardware circuit of the server baseboard management system chip, content extraction needs to be performed on the original binary file according to the custom secure boot area, so as to obtain the content of the file to be signed. It can be understood that the above-mentioned custom secure boot area may be a file area screened from the original binary file and having a direct association with the secure boot of the hardware circuit, that is, the file content to be signed in this embodiment may be a file content in the original binary file and having a direct association with the secure boot of the hardware circuit.
Step S13: and carrying out digital signature on the content of the file to be signed by utilizing a preset digital signature algorithm to obtain a corresponding first digital signature.
In this embodiment, after the content of the file to be signed is determined from the original binary file, a preset digital signature algorithm may be used to perform digital signature operation on the content of the file to be signed, so as to obtain the first digital signature corresponding to the content of the file to be signed. The Digital Signature Algorithm includes, but is not limited to, an abstract Algorithm, ECDSA (Elliptic Curve Digital Signature Algorithm), and the like. The Digest Algorithm includes, but is not limited to, MD (Message Digest), SHA (Secure Hash Algorithm), MAC (Message Authentication Code), and the like.
Step S14: and integrating the original binary file, the storage position information corresponding to the content of the file to be signed and the first digital signature to obtain a target binary file.
Further, in this embodiment, after the original binary file, the storage location information corresponding to the content of the file to be signed, and the first digital signature are obtained, the original binary file, the storage location information corresponding to the content of the file to be signed, and the first digital signature need to be sorted, and the sorted files are merged into one target binary file, that is, the target binary file.
Step S15: and burning the target binary file to a preset storage position of the server baseboard management system chip so as to start the hardware circuit by using the target binary file read from the preset storage position when the hardware circuit needs to be started.
It should be noted that, under the condition that a secure boot circuit is not used, the binary file generated by the software may be directly burned into a preset storage location of the server baseboard management system chip, and may be directly booted when powered on. Therefore, it can be understood that, in this embodiment, after the original binary file, the storage location information corresponding to the content of the file to be signed, and the first digital signature are integrated to obtain the target binary file, the target binary file may be directly burned into a preset storage location of the server baseboard management system chip, when the hardware circuit is powered on and started, the target binary file in the preset storage location may be read, whether the original binary file is tampered with is verified by using the read information in the target binary file, and if the verification is passed, the hardware circuit is started.
As can be seen, the embodiment of the application signs the contents of the file to be signed in the original binary file for starting the hardware circuit of the server baseboard management system chip, and the signature result, the storage position information of the file content to be signed and the original binary file are integrated into a new binary file, namely a target binary file is obtained, and then writing the target binary file into a preset storage position of the server baseboard management system chip, so that, when the hardware circuit is started later, the signature information in the target binary file on the preset storage position can be used for verifying whether the content of the file to be signed in the original binary file is falsified, the method and the device avoid starting the hardware circuit by adopting the tampered file content, thereby improving the starting safety of the hardware circuit of the server substrate management system chip.
The embodiment of the application discloses a specific method for configuring a secure boot file, which is shown in fig. 2 and comprises the following steps:
step S21: and acquiring an original binary file for starting a hardware circuit of the server baseboard management system chip.
Step S22: and determining the initial position information of the file content to be signed and the length of the file content.
In this embodiment, after the original binary file is obtained, the start position information of the file content to be signed and the file content length may be determined according to the signature authentication area required by the hardware circuit.
In a first specific embodiment, the determining the start position information of the file content to be signed and the file content length may include: and acquiring the initial position information of the file content to be signed and the file content length defined by a user through a preset parameter configuration interface. It can be understood that after the original binary file is obtained, a corresponding instruction may be input through a preset parameter configuration interface, and start position information of the file content to be signed defined by the user and the file content length may be obtained by executing the corresponding instruction. For example, an s start address instruction is preset as the start position information of the content of the file to be signed in the original binary file, an l long instruction is the byte length of the content of the file to be signed in the original binary file, that is, the length of the content of the file, and when the s start address instruction and the l long instruction input by a user through a preset parameter configuration interface are obtained, the start position information of the content of the file to be signed and the length of the content of the file customized by the user can be obtained.
In another specific embodiment, the determining the start position information of the file content to be signed and the length of the file content may include: and determining the initial position information of the file content to be signed and the file content length in a background random determination mode. It can be understood that, after the original binary file is obtained, an address and a file content length in the original binary file specified by a background may be used as the start position information and the file content length of the file content to be signed. For example, the background may specify that an address corresponding to the 10 th bit in the original binary file is used as the start position information of the content of the file to be signed, and 100 bits after the 10 th bit are used as the length of the content of the file to be signed.
Step S23: and selecting corresponding file contents from the original binary file based on the initial position information and the file content length to obtain the file contents to be signed.
Further, it can be understood that, after the start position information and the file content length of the file content to be signed are determined, corresponding file content may be selected from the original binary file based on the start position information and the file content length, and the selected file content is used as the file content to be signed.
Step S24: and carrying out digital signature on the content of the file to be signed by utilizing a preset digital signature algorithm to obtain a corresponding first digital signature.
Step S25: and integrating the original binary file, the storage position information corresponding to the content of the file to be signed and the first digital signature to obtain a target binary file.
Step S26: and burning the target binary file to a preset storage position of the server baseboard management system chip so as to start the hardware circuit by using the target binary file read from the preset storage position when the hardware circuit needs to be started.
For more specific processing procedures of the steps S21, S24, S25, and S26, reference may be made to corresponding contents disclosed in the foregoing embodiments, and details are not repeated herein.
Therefore, when determining the initial position information and the file content length of the file content to be signed, the embodiment of the application can be obtained through a preset parameter configuration interface, and can also determine the initial position information and the file content length of the file content to be signed through a background random determination mode, and select corresponding file content from an original binary file based on the initial position information and the file content length, so as to obtain the file content to be signed. According to the embodiment of the application, the configuration management can be carried out in a parameter form through the preset parameter configuration interface, and the configuration management can be called in other scripts, so that the use management and the application are greatly facilitated.
The embodiment of the application discloses a specific method for configuring a secure boot file, which is shown in fig. 3 and comprises the following steps:
step S31: and acquiring an original binary file for starting a hardware circuit of the server baseboard management system chip.
Step S32: and determining the content of the file to be signed from the original binary file.
Step S33: and carrying out digital signature on the content of the file to be signed by using an SHA1 digest algorithm to obtain a corresponding first digital signature.
In this embodiment, after the content of the file to be signed is determined from the original binary file, a SHA1 digest algorithm may be used to perform a digital signature operation on the content of the file to be signed, so as to obtain a first digital signature corresponding to the content of the file to be signed. It should be noted that, because different digital signature algorithms supported by different server baseboard management system chips may be different, when the content of the file to be signed is digitally signed, the algorithm supported by the server baseboard management system chip needs to be selected.
Step S34: and encrypting the first digital signature by using an encryption key to obtain the encrypted first digital signature, and determining decryption key information corresponding to the encryption key.
In this embodiment, after the SHA1 digest algorithm is used to digitally sign the content of the file to be signed to obtain a corresponding first digital signature, an encryption key is used to encrypt the first digital signature to further verify the integrity of the first digital signature, so as to obtain the encrypted first digital signature, and the corresponding decryption key information is determined by using the encryption key.
Specifically, in this embodiment, the encrypting the first digital signature by using the encryption key may include: according to the sequence of the preset key serial numbers, one key which is not used at present is determined from a plurality of pre-created keys to be used as an encryption key, and then the first digital signature is asymmetrically encrypted by using the encryption key. It should be noted that, the hardware circuit of the server baseboard management system chip supports multiple sets of keys, only one set of keys is used in each use process, and the multiple sets of keys are used in sequence, once one set of keys is used, the keys used before cannot be used again, which is a rule established in the design of the hardware circuit, so that it is necessary to indicate the position information of the used private key corresponding to the public key in the hardware circuit, that is, the several sets of public keys. It can be understood that, before encrypting the first digital signature, it is necessary to determine, from a plurality of pre-created private keys, a private key that is not used currently as an encryption key in a sequence from a front to a back of a preset key sequence number, and then perform asymmetric encryption processing on the first digital signature by using the encryption key. The algorithm corresponding to the asymmetric encryption includes, but is not limited to, an RSA algorithm, an ecc (error Correcting code) algorithm, a DH (Diffie-Hellman) algorithm, and the like.
Further, the determining decryption key information corresponding to the encryption key may include: and determining the serial number of the public key corresponding to the encryption key from a plurality of public keys corresponding to the private keys, which are pre-stored in the server substrate management system chip, so as to obtain decryption key information corresponding to the encryption key. It can be understood that the decryption key is pre-stored in the server baseboard management system chip and corresponds to the plurality of private keys, a public key recorded in the server baseboard management system chip can be obtained from the encryption key through querying, and a serial number corresponding to the public key is used as the decryption key information.
Step S35: and integrating the original binary file, the storage position information corresponding to the content of the file to be signed, the decryption key information and the encrypted first digital signature according to a preset information integration sequence to obtain a target binary file.
In this embodiment, after obtaining the original binary file, the storage location information corresponding to the content of the file to be signed, the decryption key information, and the encrypted first digital signature, the original binary file, the storage location information corresponding to the content of the file to be signed, the decryption key information, and the encrypted first digital signature may be sorted and combined into one file, that is, the target binary file, according to a preset information integration sequence. For example, the original binary file, the storage location information corresponding to the content of the file to be signed, the decryption key information, and the encrypted first digital signature are integrated in sequence to obtain the target binary file.
Step S36: and burning the target binary file to a preset storage position of the server baseboard management system chip so as to start the hardware circuit by using the target binary file read from the preset storage position when the hardware circuit needs to be started.
For more specific processing procedures of the steps S31, S32, and S36, reference may be made to corresponding contents disclosed in the foregoing embodiments, and details are not repeated here.
It can be understood that, in this embodiment, when starting up, the target binary file is read from the preset storage location, then a corresponding decryption key is obtained by using decryption key information in the target binary file, then the encrypted first digital signature in the target binary file is decrypted by using the decryption key, so as to obtain the first digital signature by reduction, and based on the storage location information in the target binary file, the file content to be signed is determined from the original binary file in the target binary file, and the file content to be signed is signed by using a preset digital signature algorithm, so as to obtain a corresponding second digital signature; comparing the first digital signature with the second digital signature, if the first digital signature and the second digital signature are consistent, indicating that the content of the file to be signed in the original binary file is not changed before and after, starting the server on the basis of the original binary file, so that the hardware circuit of the server substrate management system chip can be safely started to a great extent; if the two binary files are inconsistent, the content of the file to be signed in the original binary file is changed, and starting by using the original binary file is prohibited for safety.
It can be seen that, in the embodiment of the present application, a SHA1 digest algorithm is used to digitally sign the content of the file to be signed, so as to obtain a corresponding first digital signature, then an encryption key is used to encrypt the first digital signature, so as to obtain an encrypted first digital signature, determine decryption key information corresponding to the encryption key, and then integrate the original binary file, the storage location information corresponding to the content of the file to be signed, the decryption key information, and the encrypted first digital signature according to a preset information integration sequence, so as to obtain a target binary file. According to the method and the device, the content of the file to be signed is subjected to digest operation, the file to be signed after the digest operation is subjected to encryption processing by using the encryption key, decryption key information corresponding to the encryption key is determined, so that the decryption key is determined by the acquired decryption key information when the file to be signed is started subsequently, and whether the content of the file to be signed in the original binary file is tampered or not is verified by using the decryption key and the encrypted first digital signature in the target binary file and the storage position information of the content of the file to be signed.
The embodiment of the application discloses a hardware circuit safe starting method, and as shown in fig. 4, the method comprises the following steps:
step S41: reading a target binary file from a preset storage position of a server substrate management system chip; the target binary file is configured by using the secure boot file configuration method.
In this embodiment, after the target binary file is configured by the secure boot file configuration method, the target binary file is automatically read from a preset storage location of the server baseboard management system chip during the power-on startup process of the hardware circuit.
Step S42: and analyzing the target binary file to obtain the original binary file recorded in the target binary file, the storage position information corresponding to the content of the file to be signed and the first digital signature.
In this embodiment, after the target binary file is read from a preset storage location of the server baseboard management system chip, the target binary file is analyzed, so as to obtain the original binary file recorded in the target binary file, the storage location information corresponding to the content of the file to be signed, and the first digital signature.
Step S43: and determining the content of the file to be signed from the original binary file by using the storage position information, and signing the content of the file to be signed by using a preset digital signature algorithm to obtain a corresponding second digital signature.
In this embodiment, after the original binary file recorded in the target binary file, the storage location information corresponding to the content of the file to be signed, and the first digital signature are obtained, the content of the file to be signed may be further determined from the original binary file according to the storage location information, and a preset digital signature algorithm is used to perform digital signature operation on the content of the file to be signed, so as to obtain the corresponding second digital signature.
Step S44: and judging whether the first digital signature and the second digital signature are consistent, and if so, allowing the hardware circuit of the server baseboard management system chip to be started by using the original binary file.
In this embodiment, after the second digital signature is obtained, the second digital signature may be compared with a first digital signature recorded in the target binary file, and if the first digital signature is consistent with the second digital signature, it is indicated that the content of the file to be signed in the original binary file is not tampered, and the original binary file is allowed to start a hardware circuit of the server baseboard management system chip.
For more specific processing procedures of the above steps, reference may be made to corresponding contents disclosed in the foregoing embodiments, and details are not repeated here.
As can be seen, in the embodiment of the present application, a target binary file is read from a preset storage location of a server baseboard management system chip; the target binary file is configured by the secure boot file configuration method, then the target binary file is analyzed to obtain an original binary file recorded in the target binary file, storage location information corresponding to the content of the file to be signed and a first digital signature, the content of the file to be signed is determined from the original binary file by using the storage location information, the content of the file to be signed is signed by using a preset digital signature algorithm to obtain a corresponding second digital signature, whether the first digital signature and the second digital signature are consistent or not is judged, and if so, the hardware circuit of the server substrate management system chip is allowed to be started by using the original binary file. It can be seen that, in the embodiment of the present application, when a hardware circuit is started, a target binary file is read from a preset storage location of a server substrate management system chip, and an original binary file, storage location information corresponding to a content of a file to be signed, and a first digital signature are obtained by parsing the target binary file, the content of the file to be signed is determined according to the storage location information corresponding to the content of the file to be signed, and the content of the file to be signed is signed to obtain a second digital signature, and whether the content of the file to be signed in the original binary file is tampered is verified by comparing whether the second digital signature and the first digital signature are consistent, so that the hardware circuit is prevented from being started by using the tampered file content, and the starting security of the hardware circuit of the server substrate management system chip is improved.
Correspondingly, an embodiment of the present application further discloses a secure boot file configuration apparatus, as shown in fig. 5, the apparatus includes:
the file acquisition module 11 is configured to acquire an original binary file used for starting a hardware circuit of a server baseboard management system chip;
a content determining module 12, configured to determine content of a file to be signed from the original binary file;
the digital signature module 13 is configured to perform digital signature on the content of the file to be signed by using a preset digital signature algorithm to obtain a corresponding first digital signature;
the file integration module 14 is configured to integrate the original binary file, the storage location information corresponding to the content of the file to be signed, and the first digital signature to obtain a target binary file;
and the file burning module 15 is configured to burn the target binary file to a preset storage location of the server baseboard management system chip, so that the hardware circuit is started by using the target binary file read from the preset storage location when the hardware circuit needs to be started.
For the specific work flow of each module, reference may be made to corresponding content disclosed in the foregoing embodiments, and details are not repeated here.
In addition, the secure boot file configuration apparatus in this embodiment may be specifically an apparatus implemented by software. It is understood that, the above-mentioned secure boot file configuration apparatus as a software tool may be executed in the form of instructions. For example, the instructions involved may specifically be: tool _ security _ start-i input, bin-o output, bin-k key, pem-h h _ id-s start _ address-l long. Wherein, the tool _ security _ start is the name of the software tool; bin is the original binary file of the input; bin is the target binary file of the processed output; pem is a file containing a private key; -h h _ id is the location information of the private key corresponding to the public key in the hardware circuit; -s start address is the start location information of the file part to be authenticated in the original binary file input. L long is the file content length of the file part of the original binary file input.
As can be seen, the embodiment of the application signs the contents of the file to be signed in the original binary file for starting the hardware circuit of the server baseboard management system chip, and the signature result, the storage position information of the file content to be signed and the original binary file are integrated into a new binary file, namely a target binary file is obtained, and then writing the target binary file into a preset storage position of the server baseboard management system chip, so that, when the hardware circuit is started later, the signature information in the target binary file on the preset storage position can be used for verifying whether the content of the file to be signed in the original binary file is falsified, the method and the device avoid starting the hardware circuit by adopting the tampered file content, thereby improving the starting safety of the hardware circuit of the server substrate management system chip.
In some specific embodiments, the content determining module 12 may specifically include:
the first determining unit is used for determining the initial position information of the file content to be signed and the file content length;
and the first selecting unit is used for selecting corresponding file contents from the original binary file based on the initial position information and the file content length so as to obtain the file contents to be signed.
In some specific embodiments, the first determining unit may specifically include:
the second determining unit is used for acquiring the initial position information of the file content to be signed defined by a user and the file content length through a preset parameter configuration interface;
or, the third determining unit is configured to determine, in a background random determination manner, start position information of the file content to be signed and a file content length.
In some specific embodiments, the digital signature module 13 may specifically include:
and the first digital signature unit is used for digitally signing the content of the file to be signed by using an SHA1 digest algorithm to obtain a corresponding first digital signature.
In some specific embodiments, the file integration module 14 may specifically include:
a fourth determining unit, configured to encrypt the first digital signature by using an encryption key, obtain the encrypted first digital signature, and determine decryption key information corresponding to the encryption key;
and the first file integration unit is used for integrating the original binary file, the storage position information corresponding to the content of the file to be signed, the decryption key information and the encrypted first digital signature according to a preset information integration sequence to obtain a target binary file.
In some specific embodiments, the encrypting the first digital signature by using the encryption key may specifically include:
a fifth determining unit, configured to determine, according to a preset key sequence order, one private key that is not currently used as an encryption key from the plurality of private keys that are created in advance;
an encryption unit configured to asymmetrically encrypt the first digital signature using the encryption key;
correspondingly, the determining decryption key information corresponding to the encryption key includes:
a sixth determining unit, configured to determine, from a plurality of public keys corresponding to the plurality of private keys and pre-stored in the server baseboard management system chip, a number of a public key corresponding to the encryption key, and obtain decryption key information corresponding to the encryption key.
Further, an electronic device is disclosed in the embodiments of the present application, and fig. 6 is a block diagram of an electronic device 20 according to an exemplary embodiment, which should not be construed as limiting the scope of the application.
Fig. 6 is a schematic structural diagram of an electronic device 20 according to an embodiment of the present disclosure. The electronic device 20 may specifically include: at least one processor 21, at least one memory 22, a power supply 23, a communication interface 24, an input output interface 25, and a communication bus 26. Wherein, the memory 22 is used for storing a computer program, and the computer program is loaded and executed by the processor 21 to implement the relevant steps in the secure boot file configuration method disclosed in any of the foregoing embodiments. In addition, the electronic device 20 in the present embodiment may be specifically an electronic computer.
In this embodiment, the power supply 23 is configured to provide a working voltage for each hardware device on the electronic device 20; the communication interface 24 can create a data transmission channel between the electronic device 20 and an external device, and a communication protocol followed by the communication interface is any communication protocol applicable to the technical solution of the present application, and is not specifically limited herein; the input/output interface 25 is configured to obtain external input data or output data to the outside, and a specific interface type thereof may be selected according to specific application requirements, which is not specifically limited herein.
In addition, the storage 22 is used as a carrier for resource storage, and may be a read-only memory, a random access memory, a magnetic disk or an optical disk, etc., and the resources stored thereon may include an operating system 221, a computer program 222, etc., and the storage manner may be a transient storage or a permanent storage.
The operating system 221 is used for managing and controlling each hardware device on the electronic device 20 and the computer program 222, and may be Windows Server, Netware, Unix, Linux, or the like. The computer program 222 may further include a computer program that can be used to perform other specific tasks in addition to the computer program that can be used to perform the secure boot file configuration method performed by the electronic device 20 disclosed in any of the foregoing embodiments.
Further, the present application also discloses a computer-readable storage medium for storing a computer program; wherein the computer program when executed by a processor implements the secure boot file configuration method disclosed above. For the specific steps of the method, reference may be made to the corresponding contents disclosed in the foregoing embodiments, which are not described herein again.
The embodiments are described in a progressive manner, each embodiment focuses on differences from other embodiments, and the same or similar parts among the embodiments are referred to each other. The device disclosed by the embodiment corresponds to the method disclosed by the embodiment, so that the description is simple, and the relevant points can be referred to the method part for description.
Those of skill would further appreciate that the various illustrative elements and algorithm steps described in connection with the embodiments disclosed herein may be implemented as electronic hardware, computer software, or combinations of both, and that the various illustrative components and steps have been described above generally in terms of their functionality in order to clearly illustrate this interchangeability of hardware and software. Whether such functionality is implemented as hardware or software depends upon the particular application and design constraints imposed on the implementation. Skilled artisans may implement the described functionality in varying ways for each particular application, but such implementation decisions should not be interpreted as causing a departure from the scope of the present application.
The steps of a method or algorithm described in connection with the embodiments disclosed herein may be embodied directly in hardware, in a software module executed by a processor, or in a combination of the two. A software module may reside in Random Access Memory (RAM), memory, Read Only Memory (ROM), electrically programmable ROM, electrically erasable programmable ROM, registers, hard disk, a removable disk, a CD-ROM, or any other form of storage medium known in the art.
Finally, it should also be noted that, herein, relational terms such as first and second, and the like may be used solely to distinguish one entity or action from another entity or action without necessarily requiring or implying any actual such relationship or order between such entities or actions. Also, the terms "comprises," "comprising," or any other variation thereof, are intended to cover a non-exclusive inclusion, such that a process, method, article, or apparatus that comprises a list of elements does not include only those elements but may include other elements not expressly listed or inherent to such process, method, article, or apparatus. Without further limitation, an element defined by the phrase "comprising an … …" does not exclude the presence of other identical elements in a process, method, article, or apparatus that comprises the element.
The foregoing describes in detail a secure boot file configuration method, a boot method, a device, an apparatus, and a medium provided by the present application, and a specific example is applied in the present application to explain the principle and the implementation of the present application, and the description of the foregoing embodiment is only used to help understand the method and the core idea of the present application; meanwhile, for a person skilled in the art, according to the idea of the present application, there may be variations in the specific embodiments and the application scope, and in summary, the content of the present specification should not be construed as a limitation to the present application.
Claims (10)
1. A method for configuring a secure boot file, comprising:
acquiring an original binary file for starting a hardware circuit of a server baseboard management system chip;
determining the content of a file to be signed from the original binary file;
carrying out digital signature on the content of the file to be signed by utilizing a preset digital signature algorithm to obtain a corresponding first digital signature;
integrating the original binary file, the storage position information corresponding to the content of the file to be signed and the first digital signature to obtain a target binary file;
and burning the target binary file to a preset storage position of the server baseboard management system chip so as to start the hardware circuit by using the target binary file read from the preset storage position when the hardware circuit needs to be started.
2. The method for configuring a secure boot file according to claim 1, wherein the determining the content of the file to be signed from the original binary file comprises:
determining initial position information of file contents to be signed and file content length;
and selecting corresponding file contents from the original binary file based on the initial position information and the file content length to obtain the file contents to be signed.
3. The method for configuring secure boot files according to claim 2, wherein the determining the start position information of the file content to be signed and the length of the file content comprises:
acquiring initial position information of the file content to be signed defined by a user and the length of the file content through a preset parameter configuration interface;
or determining the initial position information of the file content to be signed and the length of the file content in a background random determination mode.
4. The method for configuring a secure boot file according to claim 1, wherein the digitally signing the content of the file to be signed by using a preset digital signature algorithm to obtain a corresponding first digital signature comprises:
and carrying out digital signature on the content of the file to be signed by using an SHA1 digest algorithm to obtain a corresponding first digital signature.
5. The method for configuring a secure boot file according to any one of claims 1 to 4, wherein the integrating the storage location information corresponding to the original binary file, the content of the file to be signed, and the first digital signature to obtain a target binary file comprises:
encrypting the first digital signature by using an encryption key to obtain the encrypted first digital signature, and determining decryption key information corresponding to the encryption key;
and integrating the original binary file, the storage position information corresponding to the content of the file to be signed, the decryption key information and the encrypted first digital signature according to a preset information integration sequence to obtain a target binary file.
6. The secure boot file configuration method of claim 5, wherein said encrypting the first digital signature with an encryption key comprises:
determining a private key which is not used currently from a plurality of pre-created private keys as an encryption key according to the sequence of preset key serial numbers, and then asymmetrically encrypting the first digital signature by using the encryption key;
correspondingly, the determining decryption key information corresponding to the encryption key includes:
and determining the serial number of the public key corresponding to the encryption key from a plurality of public keys corresponding to the private keys, which are pre-stored in the server substrate management system chip, so as to obtain decryption key information corresponding to the encryption key.
7. A method for safely starting a hardware circuit is characterized by comprising the following steps:
reading a target binary file from a preset storage position of a server substrate management system chip; the target binary file is configured by the secure boot file configuration method according to any one of claims 1 to 6;
analyzing the target binary file to obtain an original binary file recorded in the target binary file, storage position information corresponding to the content of the file to be signed and a first digital signature;
determining the content of the file to be signed from the original binary file by using the storage position information, and signing the content of the file to be signed by using a preset digital signature algorithm to obtain a corresponding second digital signature;
and judging whether the first digital signature and the second digital signature are consistent, and if so, allowing the hardware circuit of the server baseboard management system chip to be started by using the original binary file.
8. A secure boot file configuration apparatus, comprising:
the file acquisition module is used for acquiring an original binary file for starting a hardware circuit of a server baseboard management system chip;
the content determining module is used for determining the content of the file to be signed from the original binary file;
the digital signature module is used for digitally signing the content of the file to be signed by utilizing a preset digital signature algorithm to obtain a corresponding first digital signature;
the file integration module is used for integrating the original binary file, the storage position information corresponding to the content of the file to be signed and the first digital signature to obtain a target binary file;
and the file burning module is used for burning the target binary file to a preset storage position of the server substrate management system chip so as to start the hardware circuit by using the target binary file read from the preset storage position when the hardware circuit needs to be started.
9. An electronic device comprising a processor and a memory; wherein the processor, when executing the computer program stored in the memory, implements the secure boot file configuration method of any of claims 1 to 6.
10. A computer-readable storage medium for storing a computer program; wherein the computer program when executed by a processor implements the secure boot file configuration method of any of claims 1 to 6.
Priority Applications (1)
| Application Number | Priority Date | Filing Date | Title |
|---|---|---|---|
| CN202110873686.5A CN113761538A (en) | 2021-07-30 | 2021-07-30 | Security boot file configuration method, boot method, device, equipment and medium |
Applications Claiming Priority (1)
| Application Number | Priority Date | Filing Date | Title |
|---|---|---|---|
| CN202110873686.5A CN113761538A (en) | 2021-07-30 | 2021-07-30 | Security boot file configuration method, boot method, device, equipment and medium |
Publications (1)
| Publication Number | Publication Date |
|---|---|
| CN113761538A true CN113761538A (en) | 2021-12-07 |
Family
ID=78788270
Family Applications (1)
| Application Number | Title | Priority Date | Filing Date |
|---|---|---|---|
| CN202110873686.5A Withdrawn CN113761538A (en) | 2021-07-30 | 2021-07-30 | Security boot file configuration method, boot method, device, equipment and medium |
Country Status (1)
| Country | Link |
|---|---|
| CN (1) | CN113761538A (en) |
Cited By (1)
| Publication number | Priority date | Publication date | Assignee | Title |
|---|---|---|---|---|
| CN114416432A (en) * | 2022-03-29 | 2022-04-29 | 山东云海国创云计算装备产业创新中心有限公司 | Chip safe start detection method, device, equipment and medium |
-
2021
- 2021-07-30 CN CN202110873686.5A patent/CN113761538A/en not_active Withdrawn
Cited By (2)
| Publication number | Priority date | Publication date | Assignee | Title |
|---|---|---|---|---|
| CN114416432A (en) * | 2022-03-29 | 2022-04-29 | 山东云海国创云计算装备产业创新中心有限公司 | Chip safe start detection method, device, equipment and medium |
| CN114416432B (en) * | 2022-03-29 | 2022-07-08 | 山东云海国创云计算装备产业创新中心有限公司 | Chip safe start detection method, device, equipment and medium |
Similar Documents
| Publication | Publication Date | Title |
|---|---|---|
| CN109313690B (en) | Self-contained encrypted boot policy verification | |
| FI114416B (en) | Method for securing the electronic device, the backup system and the electronic device | |
| JP4912879B2 (en) | Security protection method for access to protected resources of processor | |
| TWI667586B (en) | System and method for verifying changes to uefi authenticated variables | |
| JP4501349B2 (en) | System module execution device | |
| US20070074031A1 (en) | System and method for providing code signing services | |
| CN110688660B (en) | Method and device for safely starting terminal and storage medium | |
| JP4093723B2 (en) | Electronic signature method and apparatus for structured document | |
| EP2051181A1 (en) | Information terminal, security device, data protection method, and data protection program | |
| CN110795126A (en) | Firmware safety upgrading system | |
| CN108199827B (en) | Client code integrity checking method, storage medium, electronic device and system | |
| US20070074032A1 (en) | Remote hash generation in a system and method for providing code signing services | |
| CN113722720B (en) | System starting method and related device | |
| CN113434853A (en) | Method for burning firmware to storage device and controller | |
| KR20170089352A (en) | Firmware integrity verification for performing the virtualization system | |
| CN115129332A (en) | Firmware burning method, computer equipment and readable storage medium | |
| EP1770588A1 (en) | System and method for providing code signing services | |
| CN112699343A (en) | Software integrity protection and verification method and device | |
| CN113761538A (en) | Security boot file configuration method, boot method, device, equipment and medium | |
| CN106372523B (en) | Modem file security protection method and system | |
| CN115509587B (en) | Firmware upgrading method and device, electronic equipment and computer readable storage medium | |
| CN111709033A (en) | Method, system, device and medium for safely starting server based on PUF | |
| CN116561734A (en) | Verification method, verification device, computer and computer configuration system | |
| CN110674525A (en) | Electronic equipment and file processing method thereof | |
| CN114995918A (en) | Starting method and configuration method and device of baseboard management controller and electronic equipment |
Legal Events
| Date | Code | Title | Description |
|---|---|---|---|
| PB01 | Publication | ||
| PB01 | Publication | ||
| SE01 | Entry into force of request for substantive examination | ||
| SE01 | Entry into force of request for substantive examination | ||
| WW01 | Invention patent application withdrawn after publication |
Application publication date: 20211207 |
|
| WW01 | Invention patent application withdrawn after publication |