RU2762519C1 - Device for monitoring and controlling accesses to bios from the cpu - Google Patents

Abstract

FIELD: computer technology.

SUBSTANCE: invention relates to the field of computer technology. The device for monitoring and controlling accesses to the BIOS from the central processor (CPU) includes an independent access control module, an independent storage module of the boot BIOS, a security microprocessor, non-volatile flash memory, a power monitoring device, a device power supply, an alert module. In this case, the device is installed via the SPI interface between the central processor and the BIOS storage of the monitored device. The operation of the independent access control module is controlled by a security microprocessor, which sets the parameters of the operation of the independent access control module. The device stores information about each CPU access to the BIOS in a log in the non-volatile flash memory of the independent access control module. The security microprocessor determines the data in the BIOS storage that is critical for the safe operation of the system, which cannot be changed.

EFFECT: increase in system security, monitoring and control of BIOS modification.

1 cl, 1 dwg

Description

FIELD OF TECHNOLOGY

The invention relates to the field of computing and is intended to monitor the loading and control of BIOS modifications, protected from unauthorized changes as a result of illegal actions of the user, the operation of malware at the operating system (OS) level, or undeclared capabilities of the central processing unit (CPU) of the motherboard (system) or by the internal microcode of the CPU.

LEVEL OF TECHNOLOGY

From the prior art (CN 106776399 A 05/31/2017) there is known a system for reading and writing BIOS flash memory data and a method based on a main board control controller. The system contains an ARM processor, a BIOS manager, the ARM processor is connected to a first and first stack module, and a first and first stack module is connected to a BIOS manager, and a BIOS manager is connected to a BIOS flash memory. In accordance with the technical scheme, the BIOS flash memory (BIOS Flash) is performed, the scheme is based on reading and writing data from the BIOS control device of the BMC SPI interface, the SPI interface control device is used in the BMC to interact with the BIOS, and a full check is then carried out through the BMC. By reading the BIOS, the completeness of the BIOS is guaranteed, and the malicious ones, of course, are not installed, and the reliability of the system platform runtime is thus guaranteed.

The prior art (US 8661237 In 25.02.2014) also known a computer system and a method for loading the operating system. The computer system includes a general purpose serial bus (USB) storage device that stores a boot image, servers, and a boot image separator containing USB ports, memory, a first USB host controller, and a microprocessor. The microprocessor drives the first USB host controller to emulate each USB port on the USB stick and stores the boot image in memory so that the boot image is split into USB ports. The servers are suitably connected to USB ports, with each server containing a second USB host controller and a basic input / output system (BIOS). A second USB host controller is connected to one of the USB ports. The BIOS reads a boot image from an emulated USB storage device and loads the operating system according to the boot image.

The closest analogue of the claimed invention is a device for creating a trusted environment and protecting information from unauthorized access for computers of information and computing systems (RU 2538329 C1 10.01.2015), which includes a drive based on a flash memory chip with an SPI interface, which is connected to the bus SPI of the computer motherboard chipset and contains in its write-protected area of the computer BIOS with additional built-in commands that ensure interaction with the control microcontroller and check the integrity of the loaded software, and a controlled high-speed electronic key installed on the motherboard SPI bus between the computer chipset and the drive, at the same time, the microcontroller is equipped with an electronic key control channel connecting the control output of the microcontroller input-output port with the control input of the electronic key, as well as an SPI interface controller, which provides connection of the microcontroller troller to the SPI bus and its operation in the mode of direct access to the memory of the drive and in the mode of command control from the chipset to the drive via the SPI bus.

The disadvantages of the known devices are insufficient security, as well as insufficient control of access to the system.

SUMMARY OF THE INVENTION

The technical objective of the claimed invention is to monitor the loading and control of the BIOS modification, protected from unauthorized changes as a result of illegal actions of the user, the operation of malware at the operating system (OS) level, or undeclared capabilities of the central processing unit (CPU) of the motherboard (system) or the internal microcode of the CPU. ...

The technical result consists in increasing the security of the system, monitoring and control of BIOS modifications.

The result is achieved by using an intermediate independent BIOS storage access control module, which is built into the boot line (SPI interface) between the central processor and storage. An independent access control module is implemented using a programmable logic integrated circuit (FPGA), to which a memory chip is connected to store the bootable BIOS. The operation of the controller is controlled by a microprocessor (safety microprocessor), which ensures the safety of the system. The security microprocessor, using control registers in the FPGA, sets the operating parameters of the independent access control module, namely: the size of the log for storing information about calls to the BIOS, the conditions for generating an interrupt request for the security microprocessor, as well as the conditions for blocking access to BIOS storage memory from the CPU ...

Information about each CPU access to the BIOS is saved as a log entry in the RAM of an independent FPGA access control module. Each entry contains its own sequence number, the address of the data in the BIOS storage memory, the amount of data in bytes and the code of the operation performed with the data. When the log is full, an interrupt request is generated for the safety microprocessor, then the microprocessor takes information from the controller log and analyzes it.

Also, the security microprocessor detects data in the BIOS storage that are critical for the safe operation of the system, the change of which is unacceptable, and the independent access control module blocks requests to change this data located at certain addresses specified in the control registers.

Loading the BIOS master copy into the storage and filling the control registers (parameters of the operation of the independent access control module) is carried out by the security microprocessor before starting the CPU via the dedicated interface.

The technical result is also achieved due to the fact that the proposed 1. device for monitoring and controlling requests to the BIOS from the central processing unit (CPU), including:

an independent module for controlling requests,

independent storage module for bootable BIOS,

safety microprocessor,

non-volatile flash memory,

device power control device,

device power supply,

notification module,

the device is configured to be installed via the SPI interface between the central processor and the BIOS storage of the controlled device,

in this case, the device is configured to control the power supply of the controlled device based on the response from an independent access control module,

in this case, the device is made with the possibility, in the absence of connection of the SPI interface, to issue an alert by means of the alert module,

in this case, the device for monitoring the power supply of the device is made with the ability to control the power supply of the device regardless of the presence of power supply of the monitored device,

in this case, the independent access control module is implemented using a logic integrated circuit, the first output of which is connected to the first input of the independent storage module of the bootable BIOS, and the second output of the independent access control module is connected to the first input of the security microprocessor,

at the same time, the operation of the independent access control module is controlled by the safety microprocessor, which ensures the safety of the system,

at the same time, the security microprocessor, using control registers in the independent access control module, sets the operating parameters of the independent access control module, namely: the size of the log for storing information about BIOS calls, the conditions for generating an interrupt request for the security microprocessor, as well as the conditions for blocking access to memory storing BIOS from the CPU side of the controlled device,

in this case, the device is configured to save information about each CPU access to the BIOS stored in an independent storage module of the boot BIOS, which is saved as a log entry in the non-volatile flash memory of the independent access control module, with each entry containing its own sequence number, address data, the amount of data in bytes and the code of the operation performed with the data, while filling the log, an interrupt request is generated for the security microprocessor, then the microprocessor analyzes the log, while the security microprocessor determines the data in the BIOS storage that are critical for the safe operation of the system, change which is unacceptable, and the independent access control module blocks requests to change these data located at certain addresses specified in the control registers,

in this case, loading the reference BIOS copy in an independent storage module of the bootable BIOS and filling the control registers is carried out by the security microprocessor via a dedicated interface before starting the CPU of the controlled device,

in this case, the device is made with the possibility, in case of detection of a security violation in the system, to issue an alert by means of the notification module. In particular cases of implementation of the invention, the notification device contains one or more of:

sound notification,

light warning,

vibration alert.

In particular cases of implementation of the invention, the device power control device is implemented in the form of a mechanical switch for turning on or off the device power.

In particular cases of the implementation of the invention, the power control device is a battery.

DESCRIPTION OF DRAWINGS

The implementation of the invention will be described in the following in accordance with the accompanying drawings, which are presented to explain the essence of the invention and in no way limit the scope of the invention. The following drawings are attached to the application:

Rice. 1 is a schematic representation of the claimed device.

DETAILED DESCRIPTION OF THE INVENTION

In the following detailed description of an implementation of the invention, numerous implementation details are set forth in order to provide a thorough understanding of the present invention. However, it will be obvious to those skilled in the art how the present invention can be used, with or without these implementation details. In other instances, well-known techniques, procedures, and components have not been described in detail so as not to obscure the details of the present invention.

In addition, it will be clear from the above description that the invention is not limited to the above implementation. Numerous possible modifications, changes, variations and substitutions, while retaining the spirit and form of the present invention, will be apparent to those skilled in the art.

In fig. 1 shows a schematic diagram of the claimed device, according to which the device contains an independent access control module, an independent boot BIOS storage module (BIOS storage), a security microprocessor, which are separate, independent logic integrated circuits and / or microcontrollers. In this case, the first output of the independent access control module is connected to the first input of the independent storage module of the bootable BIOS, and the second output of the independent access control module is connected to the first input of the security microprocessor.

Moreover, the device is also implemented in such a way that it includes:

- nonvolatile flash memory designed to store information about each access by the central processing unit of the controlled device (CPU) to the BIOS. The information is stored in the form of a record in an electronic journal in the non-volatile flash memory of an independent access control module in such a way that each record contains its own sequence number, data address, amount of data in bytes and the code of the operation performed with the data.

- device power control device designed to ensure the safety of the device in the event of an attack on the controlled device through a power failure of the controlled device, i.e. the power monitor provides power monitoring of the monitored device in response to an independent access control module and / or user input. The device for monitoring the power supply of the device also serves to ensure security, for example, by means of one of the variants of the device, which implements a mechanical switch, for example a button or relay, which allows turning off the device and / or the power supply of the monitored system manually in case of suspicion of unauthorized access.

- device power supply intended for independent power supply of the device. The power supply of the device serves to provide power to the device even if the controlled device is attacked by interrupting the power supply of the controlled device. The power source of the device can be implemented in the form of a battery, battery, or other energy storage element. Thus, the safety of the device is also increased, as well as the security of the system, and the protection against unauthorized access to the system of the monitored device is improved.

- notification module, designed to notify the user or proxy about the lack of connection via the SPI channel. The notification module can be implemented as visual signals such as LEDs or audible signals such as a speaker. Additionally, the notification module can be implemented as a vibration device. Thus, the safety of the device is also increased, as well as the security of the system, and the protection against unauthorized access to the system of the monitored device is improved.

The principle of operation of the claimed device is as follows.

The device is embedded in the boot line (SPI interface) between the central processor of the controlled device and the BIOS storage of the controlled device. In this case, the device is implemented in such a way as to control the power supply of the monitored device, i.e. the device is built in in such a way that, when the controlled device is turned on, the declared device is loaded first and monitored. Thus, the claimed device will monitor the integrity of the BIOS before starting the PC and, in case of violation of the integrity of the BIOS, restore it from a backup copy. During operation, the device monitors BIOS calls and, when an incorrect or invalid access occurs, blocks its entry into the SPI-Flash by blocking the SPI bus.

Further, it should be noted that an independent access control module is implemented using a logical integrated circuit (LIS), to which a memory chip is connected to store the bootable BIOS. Thus, in case of damage or failure of any of the microcircuits, it is possible, for example, a modular replacement of the defective part, for example, an easy and quick replacement of an independent access control module, a bootable BIOS storage module and / or a security microprocessor and / or other parts. the declared device. This increases the safety of the monitored system.

Further, the operation of the controller is controlled by a safety microprocessor, which ensures the safety of the system. The security microprocessor, using control registers in the LIS, sets the operating parameters of the independent access control module, namely: the size of the log for storing information about calls to the BIOS, the conditions for generating an interrupt request for the security microprocessor, as well as the conditions for blocking access to BIOS storage memory from the CPU ...

Information about each CPU access to the BIOS is saved as a log entry in the RAM of the independent access control module on the LIS. Each entry contains its own sequence number, the address of the data in the BIOS storage memory, the amount of data in bytes and the code of the operation performed with the data. When the log is full, an interrupt request is generated for the safety microprocessor, then the microprocessor takes information from the controller log and analyzes it.

Also, the security microprocessor detects data in the BIOS storage that are critical for the safe operation of the system, the change of which is unacceptable, and the independent access control module blocks requests to change this data located at certain addresses specified in the control registers.

Loading the BIOS master copy into the storage and filling the control registers (parameters of the operation of the independent access control module) is carried out by the security microprocessor before starting the CPU via the dedicated interface.

Claims (18)

A device for monitoring and controlling access to BIOS from the central processing unit (CPU), including: an independent module for controlling requests, independent storage module for bootable BIOS, safety microprocessor, non-volatile flash memory, device power control device, device power supply, notification module, the device is configured to be installed via the SPI interface between the central processor and the BIOS storage of the controlled device, in this case, the device is configured to control the power supply of the controlled device based on the response from an independent access control module, in this case, the device is made with the possibility, in the absence of connection of the SPI interface, to issue an alert by means of the alert module, in this case, the device for monitoring the power supply of the device is made with the ability to control the power supply of the device regardless of the presence of power supply of the monitored device, in this case, the independent access control module is implemented using a logic integrated circuit, the first output of which is connected to the first input of the independent storage module of the bootable BIOS, and the second output of the independent access control module is connected to the first input of the security microprocessor, at the same time, the operation of the independent access control module is controlled by the safety microprocessor, which ensures the safety of the system, in this case, the security microprocessor, using control registers in the independent access control module, sets the operating parameters of the independent access control module, namely: the size of the log for storing information about BIOS calls, the conditions for generating an interrupt request for the security microprocessor, as well as the conditions for blocking access to memory storing BIOS from the CPU side of the controlled device, in this case, the device is made with the ability to save information about each CPU access to the BIOS, stored in an independent storage module of the boot BIOS, which is saved as a log entry in the non-volatile flash memory of the independent access control module, while each entry contains its own sequence number, address data, the amount of data in bytes and the code of the operation performed with the data, while filling the log, an interrupt request is generated for the security microprocessor, then the microprocessor analyzes the log, while the security microprocessor determines the data in the BIOS storage that are critical for the safe operation of the system, change which is unacceptable, and the independent access control module blocks requests for changing these data located at certain addresses specified in the control registers, in this case, loading the reference BIOS copy in an independent storage module of the bootable BIOS and filling the control registers is carried out by the security microprocessor via a dedicated interface before starting the CPU of the controlled device, in this case, the device is made with the possibility, in case of detection of a security violation in the system, to issue an alert by means of the notification module.

Images