RU2789614C1 - Device for protection of uefi bios from unauthorized changes - Google Patents

Abstract

FIELD: computer technology.

SUBSTANCE: invention relates to the field of computer technology; it is intended for protection of UEFI BIOS code placed on SPI Flash microcircuit from unauthorized changes. A device for protection of UEFI BIOS from unauthorized changes contains a microcontroller placed on the motherboard of a computing device between a central processor and SPI FLASH microcircuit of a computer system, wherein the protection device is connected to a power supply unit of the computer system, the microcontroller operates independently of the central processor and contains own RAM, long-term memory with a loaded database of user access rights, as well as program control modules with implementation of all commands of SPI FLASH protocol operation and content of SPI FLASH microcircuit for its emulation, as well as for processing and analysis of input data and commands before their entering SPI Flash microcircuit and the computer system for controllable access.

EFFECT: increase in protection of UEFI BIOS from unauthorized changes.

3 cl, 1 dwg

Description

The invention relates to the field of computer technology and is designed to protect the UEFI BIOS code located on the SPI Flash chip from unauthorized changes as a result of the user's unlawful actions, the operation of the malicious code at the operating system (OS), and the not declared capabilities of the southern bridge of the central processor or its firmware .

BACKGROUND OF THE INVENTION

The closest technical solution is RU119910U1, dated 08/27/2012, which describes a method of protection against unauthorized access to a computer. In this method, it is proposed to configure the BIOS so that immediately after completing the Power On Self-Test (POST) procedure, it launches the plug-in security module. At the same time, the security module contains a means for blocking access to the BIOS settings to all, except for authorized administrators of the security module, a means for authenticating the user/administrator of the security module, and the user/administrator is authenticated using an identifying device (ID) connected to the PC system bus, a means to transfer BIOS control for further computer boot after user/administrator authentication. However, these protections are not effective enough to protect your computer from malware.

The technical result of the proposed technical solution is an increase in UEFI BIOS protection from unauthorized changes, through the use of a microcontroller (QMS).

DISCLOSURE OF THE INVENTION

The technical result is achieved by the fact that the UEFI BIOS protection device is proposed from unauthorized changes containing a microcontroller (QMS) located on the motherboard of the computing device - between the central processor and the SPI Flash microcircuit, the protection device is connected to the power supply unit,

In this case, the QMS device additionally contains a power control unit of a computer system, as well as an independent power source that allows you to protect the QMS from power outages;

The QMS is loaded before the main computer system is loaded for the primary control of user access to the computer system and the central processor, and

The QMS works regardless of the central processor and contains its own RAM, long -term memory with the loaded database of user access rights, as well as the control modules with the implementation of all SPI FLASH workshop commands and the SPI Flash chip for the purpose of its emulation, as well as for processing and processing and Analysis of incoming data and commands before they enter the SPI Flash chip and computers for the implementation of controlled access, and the QMS is implemented for:

- registration of each user in the QMS device with the definition of access rights for reading and writing information to the central processor of the computer device, carrying out the identification and authentication procedure;

- locking the computer in case of trying to enter the system of an unregistered user by software blocking access to the central processor and to the computer system and/or by turning off the power system;

- registration of events in the system log;

- monitoring the integrity of important user and system files, including the operating system;

- prohibition of unauthorized booting of the OS from external removable media;

The QMS additionally contains a communication unit unprofitable of the motherboard of the hardware platform for loading data to send anxiety signal to the responsible person and/or the administrator that unauthorized access to the computer system has occurred;

The QMS additionally contains a block of sound and/or visual signals.

In addition, in particular cases of implementation of the invention:

- QMS is connected to the central processor bridge via the SPI bus through a standard expansion card connector;

- The QMS is connected to the central processor bridge over the SPI bus by steaming on the motherboard.

Consider the operation of the proposed method for protecting the UEFI BIOS from unauthorized changes, using the example of a computer with UEFI BIOS protection from unauthorized changes with a microcontroller. To implement the invention, a computer motherboard is used, on which the microcontroller is located. The remaining elements of the computer represent its standard elements: a processor with a cooling system, RAM, a video card, hard drives (SSD or HDD), a monitor, a case with a power supply, a keyboard and a mouse.

The QMS is connected to the CPU bridge via the SPI bus (via a standard expansion card connector or by soldering to the motherboard) and is an SPI Slave device connected between the CPU and the SPI FLASH chip (Fig.1). Thus, when the computer system is turned on, the QMS is loaded first, i.e. before loading the main computer system, for the primary control of user access to the computer system.

With the help of software control modules of the QMS, a typical SPI Flash chip is fully emulated with the implementation of all commands of the SPI Flash operation protocol in such a way as to process and analyze incoming data and commands before they enter the SPI Flash chip and the computer system for controlled access and detection of malicious software. software (software). However, it also does:

- registration of each user in the QMS device with the definition of access rights for reading and writing information to the central processor of the computer device, carrying out the identification and authentication procedure;

- locking the computer in case of trying to enter the system of an unregistered user or if malicious software is detected;

- registration of events in the system log;

- monitoring the integrity of important user and system files, including the operating system (OS);

- prohibition of unauthorized booting of the OS from external removable media.

At the same time, the contents of the emulated SPI Flash chip are stored in the long -term memory of the QMS, the access to which is controlled by the software code of the QMS and is provided only to users who have the necessary access rights. In addition, it is possible to implement the invention in which the user has a specialized access key implemented on USB technology and storing program instructions, as well as an encrypted record of access rights to the computer system, the use of which in the USB port of the computer allows the QMS to learn about the user's access rights and protect the computer system and SPI Flash chips from unauthorized changes.

The QMS device is powered from the computer system by connecting to the power supply unit of the system, and the QMS device contains a power supply control unit of the computer system. At the same time, the device is implemented in such a way that it also has an independent power source, which allows protecting the QMS from power outages for accessing the computer system and the SPI Flash chip. Thus, an independent power source, namely a rechargeable battery or other independent power sources, can additionally protect against unauthorized access to the computer system, as well as the SPI Flash chip.

At the same time, the QMS may additionally contain a source of audio and visual signals, such as a speaker and/or a sound transmitting device and/or LEDs and/or indicator lights, which are configured in such a way that, in the event of detection of unauthorized access and/or malware, notify with an audible and / or visual signal of an access violation. Moreover, the QMS is implemented in such a way that, in the case of generating sound and / or visual signals, the QMS completely blocks access to the computer system, as well as to the SPI Flash chip by blocking access to the computer system and / or turning off the power supply to the computer system.

The QMS device may additionally contain a communication unit implemented using technologies such as WIFI, Bluetooth, ZigBee, etc., to send an alarm to the responsible person and / or administrator that an unauthorized access to the computer system has occurred. The information may include time, date, location, identification key number, user name, access rights, and other information. In addition, by means of the communication block, the administrator and/or the person in charge can supplement, modify, correct and update the database of user access rights.

The QMS device can additionally contain an access control unit to open the computer system, as well as blocking access to a computer body for users who do not have the necessary access rights.

The use of this approach allows independent of the central processor, as well as the entire computing platform, to control the access to the SPI Flash chip in order to read or write information located on it. Keeping a log of operations of calls to the SPI Flash chip allows you to control its operation during the entire cycle of its operation.

Claims (13)

1. A UEFI BIOS protection device against unauthorized changes, containing a microcontroller (MCC) located on the motherboard of the computer system - between the central processor and the SPI FLASH chip of the computer system, and the protection device is connected to the power supply of the computer system, In this case, the QMS device additionally contains a power control unit of a computer system, as well as an independent power source that allows you to protect the QMS from power outages; The QMS is loaded before the main computer system is loaded for the primary control of user access to the computer system and the central processor, and The QMS operates independently of the central processor and contains its own RAM, long-term memory with a loaded database of user access rights, as well as software control modules with the implementation of all commands of the SPI FLASH protocol and the contents of the SPI FLASH chip for the purpose of its emulation, as well as for processing and analysis of incoming data and commands before they enter the SPI Flash chip and the computer system for controlled access, and the QMS is implemented for: - registration of each user in the QMS device with determining the rights of access and information access to the central processor of the computer system, conducting the identification and authentication procedure; - blocking the computer in the event of an attempt to log in to the system by an unregistered user by programmatically blocking access to the central processor and to the computer system and / or by turning off the power of the computer system; - registration of events in the system log; - monitoring the integrity of user and system files, including the operating system; - prohibition of unauthorized booting of the OS from external removable media; The QMS additionally contains a communication unit independent of the circuits of the motherboard of the hardware platform for downloading data and for sending an alarm signal to the responsible person and/or administrator that an unauthorized access to the computer system has occurred; The QMS additionally contains a block of sound and/or visual signals. 2. The device according to claim 1, characterized in that the QMS is connected to the central processor bridge over the SPI bus through the extension card connector. 3. The device according to claim 1, characterized in that the QMS is connected to the CPU bridge via the SPI bus by soldering to the motherboard.

Images