CN116305169A - Firmware security detection method and firmware verification method - Google Patents

Firmware security detection method and firmware verification method Download PDF

Info

Publication number
CN116305169A
CN116305169A CN202310530056.7A CN202310530056A CN116305169A CN 116305169 A CN116305169 A CN 116305169A CN 202310530056 A CN202310530056 A CN 202310530056A CN 116305169 A CN116305169 A CN 116305169A
Authority
CN
China
Prior art keywords
firmware
peripheral
peripheral firmware
reference value
information
Prior art date
Legal status (The legal status is an assumption and is not a legal conclusion. Google has not performed a legal analysis and makes no representation as to the accuracy of the status listed.)
Granted
Application number
CN202310530056.7A
Other languages
Chinese (zh)
Other versions
CN116305169B (en
Inventor
马佳静
李美霞
丁飒
张凯伦
李家兴
闫贵龙
张文博
丁亚争
Current Assignee (The listed assignees may be inaccurate. Google has not performed a legal analysis and makes no representation or warranty as to the accuracy of the list.)
Tianjin Zhonghuan Hengda Technology Co ltd
Original Assignee
Tianjin Zhonghuan Electronic Computer Co ltd
Priority date (The priority date is an assumption and is not a legal conclusion. Google has not performed a legal analysis and makes no representation as to the accuracy of the date listed.)
Filing date
Publication date
Application filed by Tianjin Zhonghuan Electronic Computer Co ltd filed Critical Tianjin Zhonghuan Electronic Computer Co ltd
Priority to CN202310530056.7A priority Critical patent/CN116305169B/en
Publication of CN116305169A publication Critical patent/CN116305169A/en
Application granted granted Critical
Publication of CN116305169B publication Critical patent/CN116305169B/en
Active legal-status Critical Current
Anticipated expiration legal-status Critical

Links

Images

Classifications

    • GPHYSICS
    • G06COMPUTING; CALCULATING OR COUNTING
    • G06FELECTRIC DIGITAL DATA PROCESSING
    • G06F21/00Security arrangements for protecting computers, components thereof, programs or data against unauthorised activity
    • G06F21/50Monitoring users, programs or devices to maintain the integrity of platforms, e.g. of processors, firmware or operating systems
    • G06F21/57Certifying or maintaining trusted computer platforms, e.g. secure boots or power-downs, version controls, system software checks, secure updates or assessing vulnerabilities
    • G06F21/572Secure firmware programming, e.g. of basic input output system [BIOS]
    • YGENERAL TAGGING OF NEW TECHNOLOGICAL DEVELOPMENTS; GENERAL TAGGING OF CROSS-SECTIONAL TECHNOLOGIES SPANNING OVER SEVERAL SECTIONS OF THE IPC; TECHNICAL SUBJECTS COVERED BY FORMER USPC CROSS-REFERENCE ART COLLECTIONS [XRACs] AND DIGESTS
    • Y02TECHNOLOGIES OR APPLICATIONS FOR MITIGATION OR ADAPTATION AGAINST CLIMATE CHANGE
    • Y02DCLIMATE CHANGE MITIGATION TECHNOLOGIES IN INFORMATION AND COMMUNICATION TECHNOLOGIES [ICT], I.E. INFORMATION AND COMMUNICATION TECHNOLOGIES AIMING AT THE REDUCTION OF THEIR OWN ENERGY USE
    • Y02D10/00Energy efficient computing, e.g. low power processors, power management or thermal management

Landscapes

  • Engineering & Computer Science (AREA)
  • Computer Hardware Design (AREA)
  • General Engineering & Computer Science (AREA)
  • Computer Security & Cryptography (AREA)
  • Software Systems (AREA)
  • Theoretical Computer Science (AREA)
  • Physics & Mathematics (AREA)
  • General Physics & Mathematics (AREA)
  • Storage Device Security (AREA)

Abstract

The invention provides a firmware security detection method and a firmware verification method, which comprise the steps of starting a BIOS to obtain feedback information of a south bridge to determine that external devices are electrified, classifying security cards in a main board to obtain device information of the external devices, and calculating a verification value corresponding to peripheral firmware according to the device information; and the security card stores a reference value corresponding to the check value, and the check value is compared with the reference value to determine the security of the peripheral firmware, and the secure peripheral firmware is determined to be accessed into the system. The invention can actively detect the safety of peripheral firmware according to the number of peripheral firmware, serial port information and peripheral firmware information, disconnect abnormal peripheral firmware in time, improve the safety of communication processing equipment, and quickly generate new reference values after configuring peripheral firmware in batch so as to detect the safety of peripheral firmware.

Description

Firmware security detection method and firmware verification method
Technical Field
The invention relates to the technical field of computer security, in particular to a firmware security detection method and a firmware verification method.
Background
Computers have been widely used in daily life, and in order to increase the diversity of information processing of the computer, the computer system is equipped with a plurality of interfaces connected with peripheral firmware, and the peripheral firmware includes a mouse, a keyboard, a display screen, a storage disk, a hard disk, and the like.
The BIOS is a basic input/output system, is a set of programs solidified on a ROM chip on a computer main board, and has the main functions of providing bottommost and most direct hardware setting and control for the computer.
The computer is also internally provided with a south bridge responsible for communication between I/O buses, the BIOS is electrified when the computer is started, and the BIOS is accessed into the system after the initialization is completed, and the safety detection is carried out on the equipment. However, the BIOS generally only detects the internal setting program and the internal firmware information, and determines whether the information processing apparatus is hacked to tamper with the internal information, thereby ensuring the security of the computer. The BIOS usually cannot actively detect the security of the external peripheral firmware, if the peripheral firmware is detected by using the program in the BIOS, the computer motherboard needs to be powered on, the BIOS performs security detection by using a manually configured security policy after the BIOS is completely accessed into the computer system, and the application software must enter the system to perform verification, so that the timeliness is poor, the security is low, and if the peripheral firmware is replaced or added, the measurement in the security policy needs to be manually modified, so that the operation is complicated.
Disclosure of Invention
In view of this, the problem to be solved by the present invention is to provide a firmware security detection method and a firmware verification method, which can actively detect the security of peripheral firmware according to the number of peripheral firmware, serial port information and peripheral firmware information, disconnect abnormal peripheral firmware in time, improve the security of communication processing equipment, and quickly generate a new reference value after reconfiguring the peripheral firmware.
In order to solve the technical problems, the invention adopts the following technical scheme:
a firmware security detection method and firmware verification method includes, after powering up, obtaining equipment information obtained based on peripheral interface protocol;
obtaining a check value based on equipment information operation;
and comparing the check value with the reference value and outputting comparison result information.
Further, the device information includes peripheral firmware IDs, number, and corresponding serial IDs.
Further, the method for obtaining the check value comprises the following steps: and generating classification information according to the peripheral interface protocol and the peripheral interface information, inputting the classification information and the quantity as SM3 algorithm, and supplementing peripheral firmware ID and corresponding serial port ID to generate a check value.
Further, the main board is powered on for the first time or a reset key is started, and the reference value is calculated by the same method as the check value is calculated.
Further, each peripheral firmware corresponds to a unique check value, and all the check values are set in the same bit.
Further, the BIOS is powered on to acquire south bridge feedback information to determine the state of peripheral firmware;
the security card classifies and acquires the equipment information of the peripheral firmware, and calculates the acquired equipment information to obtain a check value; and comparing the check value with the reference value, if the check value is consistent with the reference value, accessing the peripheral firmware into the main board, otherwise, not accessing the main board.
Furthermore, the comparison mode of the check value corresponding to the reference value comprises a global scanning mode, the security card sequentially acquires the check value of the peripheral firmware according to the set sequence, and the security card sequentially acquires the corresponding reference value for comparison.
Further, the comparison mode of the check value corresponding to the reference value comprises a random scanning mode, the security card randomly acquires the check value of the peripheral firmware, and according to the arrangement bit number and the reference value bit number of the peripheral firmware, the storage position of the reference value corresponding to the peripheral firmware is calculated, and the reference value is acquired and compared with the check value.
The invention has the advantages and positive effects that:
the security card is arranged in the main board, when the main board is started for the first time, the BIOS card in the main board is started and obtains feedback information of the external fixing piece through the south bridge, after the peripheral firmware is determined to be in a starting state, the security card classifies and obtains equipment information of the peripheral firmware, classification information and the number of the peripheral firmware are used as inputs of SM3 algorithm, the ID of the peripheral firmware and the ID of a corresponding serial port are used as supplements to generate a reference value of a fixed digit, when the main board is started again later, a check value is obtained by using the same method, and the security of the peripheral firmware is determined by judging whether the check value is consistent with the reference value or not.
Drawings
The accompanying drawings are included to provide a further understanding of the invention and are incorporated in and constitute a part of this specification, illustrate the invention and together with the embodiments of the invention, serve to explain the invention. In the drawings:
FIG. 1 is a system diagram of a security card in a firmware security detection method and a firmware verification method of the present invention;
fig. 2 is a flowchart of the calculation of a security card in a firmware security detection method and a firmware verification method according to the present invention.
Detailed Description
The following description of the embodiments of the present invention will be made clearly and completely with reference to the accompanying drawings, in which it is apparent that the embodiments described are only some embodiments of the present invention, but not all embodiments. All other embodiments, which can be made by those skilled in the art based on the embodiments of the invention without making any inventive effort, are intended to be within the scope of the invention.
Unless defined otherwise, all technical and scientific terms used herein have the same meaning as commonly understood by one of ordinary skill in the art to which this invention belongs. The terminology used herein in the description of the invention is for the purpose of describing particular embodiments only and is not intended to be limiting of the invention. The term "and/or" as used herein includes any and all combinations of one or more of the associated listed items.
The invention provides a firmware security detection method and a firmware verification method, as shown in figure 1, after a main board is powered on, a BIOS is powered on, the BIOS obtains feedback information of peripheral firmware through a south bridge in the main board, and the BIOS determines whether the peripheral firmware is powered on or not and is in a standby state according to the feedback information, wherein the feedback information comprises high and low level signals output by the peripheral firmware, the type of equipment and the memory size format.
The main board is provided with a safety card, the BIOS is electrified and started, after the BIOS determines that the peripheral firmware is in a standby state, the safety card actively verifies the safety of the peripheral firmware, and the verification process of the safety card is completed before the BIOS does not enter the initialization or the system.
The safety card comprises an information acquisition module, a safety verification module and an information storage module, wherein when the BIOS determines that peripheral firmware is in a standby state, the information acquisition module classifies and acquires equipment information of the peripheral firmware, and the equipment information comprises peripheral firmware IDs, quantity and corresponding serial port IDs of the peripheral firmware.
The main board is electrified for the first time, the security check module calculates a reference value according to the classification of peripheral firmware and equipment information, and each peripheral firmware corresponds to one reference value and is sequentially stored in the information storage module. When the mainboard is powered on for the second time and backwards, the security check module reclassifies to acquire equipment information and calculates a check value, compares the consistency of the reference value and the check value, and if the reference value is consistent with the check value, the peripheral firmware is safe, the peripheral firmware can be connected into the computer system, and if the peripheral firmware is inconsistent with the reference value, the peripheral firmware is abnormal, and the connection of the peripheral firmware is disconnected.
After the security card completes the detection of the security of the peripheral firmware, the BIOS starts to initialize, and is accessed into the main board system after the initialization is completed to detect the security of the firmware in the main board.
The safety card is provided with a reset key, when peripheral firmware is replaced or added, the reset key is pressed, the safety card acquires the equipment information of the peripheral firmware again, and the equipment information is stored in the safety card again after a reference value is calculated so as to detect the peripheral firmware later.
As shown in fig. 2, the peripheral firmware detection method based on the security chip includes: the security card obtains equipment information according to serial port information and communication protocol classification (classification information of peripheral components can be generated according to serial port information and communication protocol), takes the classification information and the number of the peripheral components as the input of SM3 algorithm, supplements peripheral firmware ID and corresponding serial port ID to generate check value with specific bit number, and ensures that the standard bit number and check value bit number of all peripheral firmware are the same.
The check value contains serial port type information, communication protocol type information, the number of devices connected by the serial port, serial port ID information and device ID information, when one of the information changes, the corresponding check value is changed, so that the check value is not matched with the reference value, and whether the peripheral firmware is safe or not can be judged through multiple types of data together.
The generation process of the reference value is the same as the generation process of the check value, and the reference value is the output result of the SM3 algorithm when the main board is powered on for the first time or the reset key is pressed.
The peripheral firmware detection method comprises two modes, namely global scanning and random scanning, wherein the global scanning mode is used for sequentially calculating the check values of all peripheral firmware according to a set sequence (fixed arrangement sequence of the peripheral firmware), sequentially reading corresponding reference values (storage sequence of the reference values is the same as that of the peripheral firmware), and comparing to determine whether all the peripheral firmware is safe or not. The random scanning mode is to randomly select peripheral firmware and calculate a check value, calculate the storage position of the reference value of the peripheral firmware according to the arrangement bit number of the peripheral firmware and the reference value bit number, obtain the reference value and compare with the calculated check value, and determine whether the peripheral equipment is safe or not.
When executing the random scanning mode, the corresponding reference value needs to be quickly and accurately read out from the security chip according to the selected peripheral firmware, so that the reference value of any peripheral firmware can be obtained at any time, and all the reference values are set in the same bit.
The SM3 password hash algorithm is a Chinese commercial password hash algorithm standard published by the Chinese national password administration 2010. The execution of the whole algorithm can be summarized into four steps: message filling, message expansion, iterative compression and output of results.
The SM3 algorithm takes as input a number of 512-bit data packets when performing the message expansion step. Thus, the input information needs to be initially padded with data lengths to multiples of 512 bits. The specific setting process is as follows: the classification information of the devices and the number information of the devices are used as the input of the SM3 algorithm, the input information is converted into binary system and then divided into a plurality of groups, and as each group correspondingly outputs a variable of 32 bits, the reference value is set as 32 bits for example, and only one group of input is needed to be generated.
After the input information is converted into binary, the input serial port ID and the peripheral firmware ID are supplemented to fill the bit number of the group until 512 bits are satisfied. The group of data is subjected to message expansion and iterative compression, and then a 32-bit result is output. So that each peripheral firmware has the same reference value and the number of check value bits calculated later.
The foregoing describes the embodiments of the present invention in detail, but the description is only a preferred embodiment of the present invention and should not be construed as limiting the scope of the invention. All equivalent changes and modifications within the scope of the present invention are intended to be covered by this patent.

Claims (8)

1. A firmware security detection method is characterized by comprising the steps of,
acquiring equipment information acquired based on a peripheral interface protocol after power-on;
obtaining a check value based on equipment information operation;
and comparing the check value with the reference value and outputting comparison result information.
2. The method of claim 1, wherein the device information includes a peripheral firmware ID, a number and a corresponding serial port ID.
3. The firmware security detection method of claim 1, wherein the method for obtaining the check value is: and generating classification information according to the peripheral interface protocol and the peripheral interface information, inputting the classification information and the quantity as SM3 algorithm, and supplementing peripheral firmware ID and corresponding serial port ID to generate a check value.
4. The firmware security check method of claim 1, wherein the motherboard is powered on or activates a reset key for the first time, and the reference value is calculated in the same way as the check value is calculated.
5. The method of claim 1, wherein each peripheral firmware corresponds to a unique check value, and all of the check values are set in the same number of bits.
6. A firmware verification method is characterized by comprising the following steps of,
the BIOS is powered on to acquire south bridge feedback information to determine the state of peripheral firmware;
the security card classifies and acquires the equipment information of the peripheral firmware, and calculates the acquired equipment information to obtain a check value; and comparing the check value with the reference value, if the check value is consistent with the reference value, accessing the peripheral firmware into the main board, otherwise, not accessing the main board.
7. The method for verifying firmware according to claim 6, wherein the comparison mode of the verification value corresponding to the reference value includes a global scan mode, the security card sequentially obtains the verification values of the peripheral firmware according to a set sequence, and the security card sequentially obtains the corresponding reference values for comparison.
8. The method of claim 6, wherein the comparison mode of the check value corresponding to the reference value includes a random scan mode, the security card randomly acquires the check value of the peripheral firmware, calculates the storage position of the peripheral firmware corresponding to the reference value according to the number of the arranged bits and the number of the reference value bits of the peripheral firmware, acquires the reference value and compares the reference value with the check value.
CN202310530056.7A 2023-05-12 2023-05-12 Firmware security detection method and firmware verification method Active CN116305169B (en)

Priority Applications (1)

Application Number Priority Date Filing Date Title
CN202310530056.7A CN116305169B (en) 2023-05-12 2023-05-12 Firmware security detection method and firmware verification method

Applications Claiming Priority (1)

Application Number Priority Date Filing Date Title
CN202310530056.7A CN116305169B (en) 2023-05-12 2023-05-12 Firmware security detection method and firmware verification method

Publications (2)

Publication Number Publication Date
CN116305169A true CN116305169A (en) 2023-06-23
CN116305169B CN116305169B (en) 2023-08-11

Family

ID=86796247

Family Applications (1)

Application Number Title Priority Date Filing Date
CN202310530056.7A Active CN116305169B (en) 2023-05-12 2023-05-12 Firmware security detection method and firmware verification method

Country Status (1)

Country Link
CN (1) CN116305169B (en)

Citations (17)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
US20080104701A1 (en) * 2006-05-22 2008-05-01 Eric Peacock System and method for secure operating system boot
CN103226505A (en) * 2013-04-22 2013-07-31 华为技术有限公司 Method and equipment for checking basic input output system (BIOS)
US20160188345A1 (en) * 2014-12-26 2016-06-30 American Megatrends Inc. Method of a UEFI firmware and Computer System thereof
CN107729069A (en) * 2017-10-12 2018-02-23 浪潮(北京)电子信息产业有限公司 A kind of method, apparatus of clean boot video card, computer-readable recording medium
CN108319473A (en) * 2017-01-16 2018-07-24 深圳兆日科技股份有限公司 Terminal system starts method and apparatus
CN108549551A (en) * 2018-04-13 2018-09-18 浪潮(北京)电子信息产业有限公司 A kind of the startup method, apparatus and equipment of server network interface card
CN109063489A (en) * 2018-08-28 2018-12-21 郑州云海信息技术有限公司 A kind of starting method and device
CN110659498A (en) * 2018-06-29 2020-01-07 国民技术股份有限公司 Trusted computing measurement method, system thereof and computer readable storage medium
CN111052118A (en) * 2017-09-01 2020-04-21 微软技术许可有限责任公司 Hardware-implemented firmware security
CN111399919A (en) * 2020-03-06 2020-07-10 苏州浪潮智能科技有限公司 Starting method and system of server, electronic equipment and storage medium
CN112231713A (en) * 2020-10-29 2021-01-15 山东超越数控电子股份有限公司 GRUB secure starting method, system and computing equipment
WO2021019270A1 (en) * 2019-07-31 2021-02-04 Seagate Technology Sas Updating firmware in a chipset of a peripheral device
CN112463061A (en) * 2020-12-02 2021-03-09 苏州浪潮智能科技有限公司 Safety management method, device, medium and equipment of disk array system
CN114741091A (en) * 2022-03-18 2022-07-12 武汉光迅信息技术有限公司 Firmware loading method and device, electronic equipment and computer readable storage medium
CN115858396A (en) * 2023-02-02 2023-03-28 北京紫光芯能科技有限公司 Method and device for chip verification, electronic equipment and storage medium
CN116048643A (en) * 2023-03-08 2023-05-02 苏州浪潮智能科技有限公司 Equipment operation method, system, device, storage medium and electronic equipment
CN116070289A (en) * 2022-12-23 2023-05-05 加弘科技咨询(上海)有限公司 Security chip applied to system firmware and electronic equipment

Patent Citations (17)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
US20080104701A1 (en) * 2006-05-22 2008-05-01 Eric Peacock System and method for secure operating system boot
CN103226505A (en) * 2013-04-22 2013-07-31 华为技术有限公司 Method and equipment for checking basic input output system (BIOS)
US20160188345A1 (en) * 2014-12-26 2016-06-30 American Megatrends Inc. Method of a UEFI firmware and Computer System thereof
CN108319473A (en) * 2017-01-16 2018-07-24 深圳兆日科技股份有限公司 Terminal system starts method and apparatus
CN111052118A (en) * 2017-09-01 2020-04-21 微软技术许可有限责任公司 Hardware-implemented firmware security
CN107729069A (en) * 2017-10-12 2018-02-23 浪潮(北京)电子信息产业有限公司 A kind of method, apparatus of clean boot video card, computer-readable recording medium
CN108549551A (en) * 2018-04-13 2018-09-18 浪潮(北京)电子信息产业有限公司 A kind of the startup method, apparatus and equipment of server network interface card
CN110659498A (en) * 2018-06-29 2020-01-07 国民技术股份有限公司 Trusted computing measurement method, system thereof and computer readable storage medium
CN109063489A (en) * 2018-08-28 2018-12-21 郑州云海信息技术有限公司 A kind of starting method and device
WO2021019270A1 (en) * 2019-07-31 2021-02-04 Seagate Technology Sas Updating firmware in a chipset of a peripheral device
CN111399919A (en) * 2020-03-06 2020-07-10 苏州浪潮智能科技有限公司 Starting method and system of server, electronic equipment and storage medium
CN112231713A (en) * 2020-10-29 2021-01-15 山东超越数控电子股份有限公司 GRUB secure starting method, system and computing equipment
CN112463061A (en) * 2020-12-02 2021-03-09 苏州浪潮智能科技有限公司 Safety management method, device, medium and equipment of disk array system
CN114741091A (en) * 2022-03-18 2022-07-12 武汉光迅信息技术有限公司 Firmware loading method and device, electronic equipment and computer readable storage medium
CN116070289A (en) * 2022-12-23 2023-05-05 加弘科技咨询(上海)有限公司 Security chip applied to system firmware and electronic equipment
CN115858396A (en) * 2023-02-02 2023-03-28 北京紫光芯能科技有限公司 Method and device for chip verification, electronic equipment and storage medium
CN116048643A (en) * 2023-03-08 2023-05-02 苏州浪潮智能科技有限公司 Equipment operation method, system, device, storage medium and electronic equipment

Also Published As

Publication number Publication date
CN116305169B (en) 2023-08-11

Similar Documents

Publication Publication Date Title
CN107025406B (en) Motherboard, computer-readable storage device, and firmware verification method
US11706199B2 (en) Electronic device and method for generating attestation certificate based on fused key
JP5270377B2 (en) Platform boot with bridge support
US20030110368A1 (en) Method and system for initializing a hardware device
CN102663301A (en) Trusted computer and credibility detection method
TW200414051A (en) Encapsulation of a TCPA trusted platform module functionality within a server management coprocessor subsystem
US20200202003A1 (en) Verifying basic input/output system (bios) boot block code
US11651077B2 (en) Systems and methods for providing secured boot and scan for devices with limited access
CN116305169B (en) Firmware security detection method and firmware verification method
CN111444515A (en) Credibility measurement method based on PCIE interface
US20220103350A1 (en) Electronic device for selecting key to be used for encryption on basis of amount of information of data to be encrypted, and operation method of electronic device
CN111831346A (en) Starting method and device of memory operating system for data acquisition
US20230394154A1 (en) Untrusted orchestrator function subsystem inventory and verification system
US8695068B1 (en) Device authentication using display device irregularity
CN114153280B (en) Computer main board
US20090144536A1 (en) Monitoring method and monitor apparatus
CN116244250A (en) Clock frequency ratio monitor
CN115827304A (en) System and method for checking on-chip high-speed bus data
US8423830B2 (en) Debug method for computer system
CN112700819B (en) Gene sequence processing method, computer storage medium and electronic device
CN113534691A (en) Control system and method of terminal equipment
TW202340994A (en) System-on-chip, a method for the same, and a computing device
US7543222B2 (en) System and method for checking BIOS ROM data
CN111428243A (en) Credibility measurement method based on M.2 interface
JP4291368B2 (en) Memory bus check procedure

Legal Events

Date Code Title Description
PB01 Publication
PB01 Publication
SE01 Entry into force of request for substantive examination
SE01 Entry into force of request for substantive examination
GR01 Patent grant
GR01 Patent grant
TR01 Transfer of patent right

Effective date of registration: 20240429

Address after: Building A, 2nd Floor, No. 214 Hongqi Road, Nankai District, Tianjin, 300000

Patentee after: Tianjin Zhonghuan Hengda Technology Co.,Ltd.

Country or region after: China

Address before: 300000 No. 214, Hongqi Road, Nankai District, Tianjin

Patentee before: TIANJIN ZHONGHUAN ELECTRONIC COMPUTER Co.,Ltd.

Country or region before: China

TR01 Transfer of patent right