CN118094503A

CN118094503A - Method, system, equipment and medium for controlling BIOS interface access

Info

Publication number: CN118094503A
Application number: CN202410368506.1A
Authority: CN
Inventors: 谭志龙; 唐斌
Original assignee: Shenzhen Tong Tai Yi Information Technology Co ltd
Current assignee: Shenzhen Tong Tai Yi Information Technology Co ltd
Priority date: 2024-03-26
Filing date: 2024-03-26
Publication date: 2024-05-28

Abstract

The invention discloses a method, a system, equipment and a medium for controlling BIOS interface access, wherein the method specifically comprises the following steps: starting BIOS, detecting whether the system needs to carry out password authentication, and entering the next step if the system needs to carry out password authentication; verifying whether the input password information is matched or not, and if the password information is verified to be matched, entering the next step; detecting whether the BIOS starts a physical key verification function, and entering the next step when the physical key verification function is started; and detecting whether a physical key device is installed on the corresponding USB interface of the main board, and entering the BIOS interface after the key is successfully verified. By adding an additional physical key device, password authentication and physical key verification are combined when a user uses the password, the user is required to have a specific physical key device besides inputting the password, the difficulty of illegal access is greatly improved, effective authentication of the user identity is realized, the system information security is fully ensured, and the password is less prone to being stolen compared with a simple software password.

Description

Method, system, equipment and medium for controlling BIOS interface access

Technical Field

The invention belongs to the technical field of computers, and relates to a method, a system, equipment and a medium for controlling BIOS interface access.

Background

Traditional BIOS permissions are classified into administrator permissions, user permissions, and no user permissions. The administrator authority is the highest level authority that controls the BIOS, the user authority is the general control authority, and the no user authority is the default authority when the administrator authority and the user authority are not set. The BIOS control page can be accessed by triggering a key according to the starting prompt information in the starting guide process, generally, the default factory BIOS of manufacturers is that no administrator password and no user password are set, so that the BIOS interface can be accessed directly, when the user sets the administrator password or the user password on the BIOS interface, the server needs to input a correct password when entering the BIOS page, and the password can be accessed correctly. The administrator authority is the highest authority level in the BIOS, allowing the user to make all possible settings and changes, including setting or changing user passwords, changing system configuration, etc., and the user possessing the administrator authority can fully control the functions and settings of the BIOS. The user permission level allows the user to access and modify certain settings in the BIOS, but typically does not allow administrator passwords or other critical system configuration changes to be made, and the user permissions are typically used to allow an average user to make some basic BIOS settings without compromising system security. When the BIOS does not set any password, the user defaults to this permission level, at which point the user can view basic information of the BIOS and can modify part of the basic BIOS settings.

The conventional BIOS password is typically stored in a memory or hard disk of a computer in the form of software, which means that it may be easily obtained by malware, hackers, or users with physical access rights through various means, such as memory reads, hard disk cloning, etc. Once the password is revealed, an attacker can easily enter the BIOS interface to perform malicious operation on the server. And typically rely solely on the password itself as the sole means of authentication. This single authentication mechanism makes the system vulnerable to various forms of attack, such as brute force, dictionary attacks, etc. And if the password is set too simple or easy to guess, security will be compromised. Although the traditional BIOS password authentication plays a certain safety management role, the software BIOS password is easy to leak, and the BIOS can be randomly accessed only by acquiring the server password, so that BIOS options are modified, and the safety of the server is disastrous.

Disclosure of Invention

The invention aims to solve the problem that the BIOS password authentication in the prior art cannot effectively protect the security of a server, and provides a method, a system, equipment and a medium for controlling BIOS interface access.

In order to achieve the purpose, the invention is realized by adopting the following technical scheme:

a method for controlling BIOS interface access specifically comprises the following steps:

s1, starting a BIOS, detecting whether the system needs to carry out password authentication, and entering S2 if the system needs to carry out password authentication;

s2, verifying whether the input password information is matched, and if so, entering S3;

s3, detecting whether the BIOS starts a physical key verification function, and entering S4 when the physical key verification function is started;

s4, detecting whether a physical key device is installed on the corresponding USB interface of the main board, and entering the BIOS interface after the key is verified successfully.

Before the step S1, the physical key and the server are bound, and the method specifically comprises the following steps:

Starting a physical key verification function;

Installing a physical key verification device on a corresponding interface of the main board;

calculating by combining the main board information, the BIOS information and the physical key device information to obtain a key result;

The key result is stored.

When the key result is changed, the physical key verification function is closed at first, then the physical key verification function is opened again, and the key is regenerated.

The calculation is performed by combining the motherboard information, the BIOS information and the physical key device information, specifically: and intercepting the serial number of the main board, the compiling date of the BIOS and the serial number of the physical key device, and calculating in a splicing or disordered mode to obtain a key result.

The key result is stored in the BIOS NVRAM and the physical key device, so that a double verification mechanism is realized.

When the BIOS detects that the USB interface is not provided with the physical key device, the BIOS displays prompt information of not provided with the physical key or the key error to a user.

The password authentication includes administrator password authentication and user password authentication.

A system for controlling BIOS interface access specifically comprises the following modules:

The BIOS authentication module is used for processing the password authentication process, when a user tries to enter a BIOS interface, the BIOS authentication module can require the user to input an administrator password or a user password and verify, and if the password verification is successful, the user is allowed to enter the BIOS interface; otherwise, access will be denied;

The physical key verification module is used for realizing a physical key verification function, detecting whether a physical key verification device is installed on a designated USB interface on the main board, and if the physical key device is detected, communicating with the physical key device to verify the validity of the physical key device;

The key generation and management module is used for generating and managing a key result, when the physical key verification device is correctly installed and verified, the key generation and management module can intercept the serial number of the main board, the compiling date of the BIOS and the serial number of the physical key device to generate the key result, and the key result is written into NVRAM of the BIOS and the physical key device to ensure the key matching between the two;

The configuration and monitoring module is used for configuring and monitoring the physical key verification function, and the physical key verification function is opened or closed through the configuration and monitoring module so as to adapt to different security requirements;

And the user interface module is responsible for interacting with a user, providing an operation interface and prompt information, and viewing the current security setting state by the user through the user interface module, modifying the password or configuring the physical key verification function.

An apparatus comprising a memory, a processor, and a computer program stored in the memory and executable on the processor, the processor implementing the steps of the method of any one of the preceding claims when the computer program is executed.

A computer readable storage medium storing a computer program which, when executed by a processor, implements the steps of the method of any one of the preceding claims.

Compared with the prior art, the invention has the following beneficial effects:

the invention provides a method for controlling BIOS interface access, which introduces a physical key verification function by adding an additional physical key device, combines password authentication and physical key verification when a user uses the BIOS interface, realizes effective authentication of user identity, fully ensures information security of a system, and is less prone to be stolen compared with a simple software password. Although the conventional password authentication method provides protection to a certain extent, the risk of password leakage or guessing still exists. The physical key verification mechanism requires that the user has a specific physical key device besides inputting the password, thereby greatly improving the difficulty of illegal access. This prevents an attacker from entering the BIOS interface with the password alone even if the password is compromised, thus effectively preventing unauthorized access.

Furthermore, the invention combines the hardware information such as the serial number of the main board, the compiling date of the BIOS, the serial number of the physical key device and the like to generate a unique key result, and writes the unique key result into the BIOS NVRAM and the physical key device, thereby realizing a double verification mechanism. The mechanism not only improves the accuracy and the reliability of verification, but also increases the difficulty of cracking. Even if an attacker acquires the password, the attacker needs to simultaneously possess the correct physical key device and matched hardware information to pass the verification, so that the security protection capability of the server is greatly improved.

Drawings

For a clearer description of the technical solutions of the embodiments of the present invention, the drawings that are needed in the embodiments will be briefly described below, it being understood that the following drawings only illustrate some embodiments of the present invention and should not be considered as limiting the scope, and other related drawings may be obtained according to these drawings without inventive effort for a person skilled in the art.

FIG. 1 is a flow chart of a method for controlling BIOS interface access according to the present invention;

FIG. 2 is a flow chart of binding physical keys to servers in the present invention;

Fig. 3 is a schematic diagram of a physical key device configuration space in the present invention.

Detailed Description

For the purpose of making the objects, technical solutions and advantages of the embodiments of the present invention more apparent, the technical solutions of the embodiments of the present invention will be clearly and completely described below with reference to the accompanying drawings in the embodiments of the present invention, and it is apparent that the described embodiments are some embodiments of the present invention, but not all embodiments of the present invention. The components of the embodiments of the present invention generally described and illustrated in the figures herein may be arranged and designed in a wide variety of different configurations.

Thus, the following detailed description of the embodiments of the invention, as presented in the figures, is not intended to limit the scope of the invention, as claimed, but is merely representative of selected embodiments of the invention. All other embodiments, which can be made by those skilled in the art based on the embodiments of the invention without making any inventive effort, are intended to be within the scope of the invention.

It should be noted that: like reference numerals and letters denote like items in the following figures, and thus once an item is defined in one figure, no further definition or explanation thereof is necessary in the following figures.

The invention is described in further detail below with reference to the attached drawing figures:

referring to fig. 1, a flowchart of a method for controlling BIOS interface access in the present invention specifically includes the following steps:

S1, starting a server. The user presses the start key and the server starts.

S2, entering a BIOS interface flow. In the starting process, according to the starting guide information of the BIOS, the user triggers corresponding keys, such as a Del key, an F2 key and the like, and starts a process of entering the BIOS interface.

S3, detecting password setting, wherein the BIOS automatically detects whether an administrator password or a user password is set, and if the administrator password or the user password is set, executing the step S4. The password is automatically distinguished by the BIOS from its home account. And if the administrator password or the user password is not set, executing S6.

S4, inputting a password, inputting an administrator password or a user password by a user, preparing for verification, and executing the step S5.

S5, verifying the password, and verifying the input password by the BIOS to judge whether the password is matched with a preset administrator password or a preset user password. If the verification is successful, executing the step S6; if the verification fails, prompting the user to re-input the password, and returning to the step S4. The number of password verifications should be limited to prevent malicious users from guessing the password through multiple attempts.

S6, checking whether the BIOS starts the physical key verification function, and if so, executing the step S7. If the physical key verification function is not turned on, step S9 is executed. Wherein the physical key verification function refers to the option provided by the BIOS to control the switching of the physical key verification function.

S7, checking whether a USB interface with screen printing is assigned to the main board, if so, attempting to acquire the key and verifying the key, if so, executing the step S9 to enter the BIOS interface, otherwise, executing the step S8.

S8, prompting an error, wherein the BIOS prompts the user that the physical key device or the key error is not installed, and preventing the user from entering the BIOS interface.

S9, entering a BIOS interface. In the case that the password authentication is successful and (e.g., the physical key authentication has been turned on) is also successful, the user may enter the BIOS interface to perform the corresponding settings.

By adding the additional physical key device, the invention combines password authentication and physical key authentication when a user uses the system, realizes effective authentication of the user identity, fully ensures the information security of the system, and is less likely to be stolen compared with a simple software password. By the method for controlling the BIOS interface access, the safety of the BIOS of the server is obviously improved. The combination of traditional password authentication and physical key verification makes it difficult for an unauthorized user to bypass the security mechanism through a single means, thereby effectively protecting the security of the server. Meanwhile, the method of the invention has flexibility and usability, and an administrator can select whether to start the physical key verification function according to actual requirements so as to adapt to different security requirement scenes.

When the physical key device is used for the first time, a user needs to enter a BIOS interface to bind a server, so that one machine and one code are realized. Referring to fig. 2, a flowchart for binding a physical key with a server in the present invention specifically includes the following steps:

s1, entering a BIOS interface. And triggering a key or operating in an operating system through the starting prompt information, and entering a BIOS setting interface.

S2, starting a physical key verification function at the BIOS interface. In the BIOS interface, the user opens a setting option related to physical key verification, and in order to ensure that in addition to password verification, physical key verification is required in the subsequent access process.

S3, detecting whether a physical key verification device is installed in a USB interface with screen printing on the main board, if so, executing the step S4, otherwise, executing the step S5.

S4, the serial number of the main board, the compiling date of the BIOS and the serial number of the physical key device are intercepted, the key result is calculated in a splicing or disordered mode, and then the key result is written into the BIOS NVRAM and the physical key device.

S5, prompting that the physical key device is not installed, and turning off the physical key verification function, in order to prevent the user from attempting erroneous operation or access without the physical key.

When the user needs to replace the key result, the physical key verification function is closed at first, then the physical key verification function is restarted, and the key result is regenerated.

The invention not only utilizes the complexity and randomness of the secret key, but also combines the uniqueness and the unclonability of the physical secret key, thereby providing double guarantee for the system. Through the steps, the security of the BIOS of the server is greatly enhanced. Even if the password is compromised or guessed, an attacker still needs to have the correct physical key verification device to access the BIOS interface, thereby greatly reducing the risk of unauthorized access. At the same time, the double verification mechanism also makes the management of the server more strict and secure.

Furthermore, the method of the invention has flexibility and usability, and an administrator can select whether to start the physical key verification function according to the actual security requirement. The function can be closed under the condition that the physical key verification is not needed, and the operation flow is simplified. Meanwhile, the design of the physical key device can be customized according to different application scenes so as to meet the requirements of different users.

The implementation of the invention can also improve the management efficiency and the security of the server, and can prevent unauthorized users from carrying out illegal operations or modifying the settings on the server by strictly controlling the access rights of the BIOS interface. This helps to maintain the stability and reliability of the server, reducing the potential risk due to mishandling or malicious attacks.

Referring to fig. 3, a schematic diagram of a physical key device configuration space in the present invention is shown, and the physical key device interface adopted in the present invention is a USB standard interface, and a NVRAM not less than 1MB is built in the USB standard interface, so that the present invention has a hot plug function.

The invention provides a system for controlling BIOS interface access, which comprises the following modules:

and the BIOS authentication module is used for processing the traditional password authentication process. When a user attempts to enter a BIOS interface, the BIOS authentication module may require the user to enter an administrator password or user password and perform authentication. If the password verification is successful, the user is allowed to enter the BIOS interface; otherwise, access will be denied.

And the physical key verification module is used for realizing a physical key verification function. And detecting whether the physical key verification device is installed on the designated USB interface on the main board. If the physical key device is detected, the physical key device is further communicated with a physical key verification device to verify the validity of the physical key device. The physical key verification module cooperates with the BIOS authentication module to ensure that the user not only needs the correct password, but also needs the correct physical key device to access the BIOS interface.

And the key generation and management module is used for generating and managing key results. When the physical key verification device is correctly installed and verified, the key generation and management module intercepts the hardware information such as the serial number of the main board, the compiling date of the BIOS and the serial number of the physical key device, and generates a key result through an algorithm. The key result is then written to the NVRAM of the BIOS and to the physical key device, ensuring a key match between the two.

And the configuration and monitoring module is used for configuration and monitoring of the physical key verification function. An administrator can start or stop the physical key verification function through the configuration and monitoring module so as to adapt to different security requirements. Meanwhile, the configuration and monitoring module can monitor the state of the physical key device in real time, and ensure the normal operation of the device. If it is detected that the physical key device is removed or damaged, the module may take timely action, such as turning off the physical key verification function or prompting the user to replace the device.

And the user interface module is used for interacting with a user and providing an operation interface and prompt information. The user can check the current security setting state of the system through the user interface module, modify the password or configure the physical key verification function. When the password verification or the physical key verification fails, the user interface module can provide corresponding error prompts to help the user to know the problem and take corresponding measures.

The system for controlling the access of the BIOS interface obviously improves the access security of the BIOS interface by introducing the physical key verification function. In contrast to conventional password authentication, physical key authentication requires not only that the user know the correct password, but also that a specific physical key device is owned. The dual verification mechanism greatly increases the difficulty of illegal access and effectively prevents unauthorized access and data leakage. Even if the password is compromised or guessed maliciously, an attacker still needs to have the correct physical key device to pass the verification. The dual guarantee greatly improves the safety of the system and reduces the potential safety risk.

An embodiment of the invention provides a terminal device. The terminal device of this embodiment includes: a processor, a memory, and a computer program stored in the memory and executable on the processor. The steps of the various method embodiments described above are implemented when the processor executes the computer program. Or the processor, when executing the computer program, performs the functions of the modules/units in the above-described device embodiments.

The computer program may be divided into one or more modules/units, which are stored in the memory and executed by the processor to accomplish the present invention.

The device/terminal equipment can be a desktop computer, a notebook computer, a palm computer, a cloud server and other computing equipment. The apparatus/terminal device may include, but is not limited to, a processor, a memory.

The Processor may be a central processing unit (Central Processing Unit, CPU), but may also be other general purpose processors, digital signal processors (DIGITAL SIGNAL Processor, DSP), application SPECIFIC INTEGRATED Circuit (ASIC), off-the-shelf Programmable gate array (Field-Programmable GATE ARRAY, FPGA) or other Programmable logic devices, discrete gate or transistor logic devices, discrete hardware components, or the like.

The memory may be used to store the computer program and/or module, and the processor may implement various functions of the apparatus/terminal device by running or executing the computer program and/or module stored in the memory, and invoking data stored in the memory.

The means/terminal device integrated modules/units may be stored in a computer readable storage medium if implemented in the form of software functional units and sold or used as separate products. Based on such understanding, the present invention may implement all or part of the flow of the method of the above embodiment, or may be implemented by a computer program to instruct related hardware, where the computer program may be stored in a computer readable storage medium, and when the computer program is executed by a processor, the computer program may implement the steps of each of the method embodiments described above. Wherein the computer program comprises computer program code which may be in source code form, object code form, executable file or some intermediate form etc. The computer readable medium may include: any entity or device capable of carrying the computer program code, a recording medium, a U disk, a removable hard disk, a magnetic disk, an optical disk, a computer Memory, a Read-Only Memory (ROM), a random access Memory (RAM, random Access Memory), an electrical carrier signal, a telecommunications signal, a software distribution medium, and so forth. It should be noted that the computer readable medium contains content that can be appropriately scaled according to the requirements of jurisdictions in which such content is subject to legislation and patent practice, such as in certain jurisdictions in which such content is subject to legislation and patent practice, the computer readable medium does not include electrical carrier signals and telecommunication signals.

The above is only a preferred embodiment of the present invention, and is not intended to limit the present invention, but various modifications and variations can be made to the present invention by those skilled in the art. Any modification, equivalent replacement, improvement, etc. made within the spirit and principle of the present invention should be included in the protection scope of the present invention.

Claims

1. A method for controlling BIOS interface access, comprising the steps of:

2. The method for controlling the BIOS interface access as recited in claim 1, wherein prior to S1, binding the physical key with the server is required, comprising the steps of:

Starting a physical key verification function;

The key result is stored.

3. A method of controlling BIOS interface access as recited in claim 2, wherein when the key result is being changed, the physical key verification function is first turned off, then the physical key verification function is turned back on, and the key is regenerated.

4. The method for controlling BIOS interface access as claimed in claim 2, wherein the calculating is performed by combining the motherboard information, the BIOS information, and the physical key device information, specifically: and intercepting the serial number of the main board, the compiling date of the BIOS and the serial number of the physical key device, and calculating in a splicing or disordered mode to obtain a key result.

5. The method of claim 2, wherein storing the key result is specifically storing the key result into the BIOS NVRAM and the physical key device, and implementing a dual authentication mechanism.

6. The method of claim 1, wherein when the BIOS detects that the USB interface is not equipped with a physical key device, the BIOS displays a notification to the user that the physical key is not installed or that the key is wrong.

7. A method of controlling BIOS interface access as recited in claim 1, wherein said password authentication comprises an administrator password authentication and a user password authentication.

8. A system for controlling BIOS interface access, comprising the following modules:

9. An apparatus comprising a memory, a processor and a computer program stored in the memory and executable on the processor, wherein the processor implements the steps of the method according to any one of claims 1-7 when the computer program is executed.

10. A computer readable storage medium storing a computer program, characterized in that the computer program when executed by a processor implements the steps of the method according to any one of claims 1-7.