200910137 υ/υ^/υ.ι w ^4613twf.doc/n 九、發明說明： 【發明所屬之技術領域】 本發明是有關於一種電腦系統，且特別是有關於—種 利用安全卡開機（Power on)的電腦系統與安全開機 法。 【先前技術】 一般使用者為了保護電腦系統内部之資料不會被# 更動’都會使用微軟作業系統之使用者帳戶來設^悟稱、 碼，以保護電腦系統。但是此方法必須是在二二: 進入作業系統之後，才由作業系統保護電腦系統=、、死開機 然而’此時電腦系統已經進入開機（p〇wer〇n° 使用者還是可以在不進人作業系統之操作 ^ ’ 統做相關設定’或者是竊取電腦系軸 I…'腦系 保護電腦系統最好是能夠在—開機的時候，二二、因此， 之安全確認動作，以達到真正保護電腦二二仃相關 【發明内容】 卞、死的目的。 本發明提供-種電腦系統，利用安全 卡上之辨識資料與電_ ^卩錢。當安全 統才能被開機 系統安全性m统，只有①料有保護 料的安全卡才能開啟電腦系統來使用Γ電腦系統之辨職資 本發明提供一種應用於上 二。】以比對安全卡上之辨識資料盘本身:之安全開機方 同’達到保護電腦系統之安全性。 彳具有的是否相 200910137 070270.TW 24613twf,doc/n 局解決上述問柯，尽發明提出一種電 ，單元、開機單元、安全卡槽與基板管理：J括:: 卡，安八士…:而安全卡槽用以插入安全 η 疋否吻合，以判斷是否輸出第二開機信麥^八有的 應單元依據第二開機_泸、a 'u後由電源供 系統。頂u决疋是否將系統電源供應給電腦 r舆電腦系統上所具有之辨識資料;=以識資 腦系統。 心巧將祕轉供應給電 在本發明之一實施例中， 中比對安全卡上之辨識資 二=機之方法’其 料是否吻合。若安全卡^二1!；钱上所具有之辨識資 之辨識資料二者不吻合，則不以糸:上所具有 持續保持在_狀態。 、應糸統電源，使電腦系統 安全先因此可以保護電腦系統之 開啟此電腦系統來使用，二=識資料的安全卡才能 使用。可以讓此電腦系統疋去1，、，、法開啟此電腦系統來 允之使用者，具有更完整的使用權， 200910137 070270.TW 24613twf.doc/n 輕易更動，保障 並殘保電腦系統内部之資料不會被其他人 使用者之隱私。 為讓本發明之上述特徵和 舉較佳實施例，並配合所附圖 【實施方式】 優點能更明顯易懂，下文特 式，作詳細說明如下。 1 ΩΟ Ί緣不為依，本發明之—實施例的—種電腦系統 ，匕括電源供應單元11〇、南橋晶片12〇200910137 υ/υ^/υ.ι w ^4613twf.doc/n IX. Description of the invention: [Technical field of the invention] The present invention relates to a computer system, and in particular to a kind of use of a security card to boot (Power On) computer system and safe boot method. [Prior Art] In order to protect the internal data of the computer system, the general user will not use the user account of the Microsoft operating system to set the name and code to protect the computer system. However, this method must be in the second two: After entering the operating system, the operating system protects the computer system =, and the computer is powered on. However, the computer system has already been turned on (p〇wer〇n° users can still not enter the user). The operation of the operating system ^ 'Do the related settings' or steal the computer shaft I... 'Brain protection computer system is best to be able to - when booting, 22, therefore, the security confirmation action to achieve a true protection of the computer二二仃related [Summary of the invention] 目的, the purpose of death. The present invention provides a computer system, using the identification data on the security card and electricity _ ^ money. When the security system can be booted system security m system, only 1 The security card with the protective material can be turned on to open the computer system to use the computer system. The discriminative capital invention provides a method for applying the above two.] To compare the identification data disk on the security card itself: the safe booting party is the same as the protection computer The security of the system. 彳 Have the phase of 200910137 070270.TW 24613twf, doc / n Bureau to solve the above question Ke, do the invention to propose a power, unit, boot list , security card slot and substrate management: J bracket:: card, An Baoshi...: and the security card slot is used to insert security η 疋 no match, to determine whether to output the second boot letter _泸, a 'u after the power supply system. Top u decide whether to supply the system power to the computer r舆 computer system has the identification data; = to identify the brain system. In an embodiment of the invention, the method of comparing the identification on the security card to the machine's method is consistent with the material. If the security card is not included, the identification data of the identification information on the money does not match. Then it is not ambiguous: the above has a continuous _ state. The power supply should be used to make the computer system safe so that it can protect the computer system from opening the computer system. This computer system removes the 1,,, and method to open the computer system to allow users to have more complete use rights. 200910137 070270.TW 24613twf.doc/n Easy to change, to protect and protect the internal data of the computer system. Will be made by others User's Privacy In order to make the above features and preferred embodiments of the present invention, and the advantages of the accompanying drawings, the advantages of the embodiments can be more clearly understood, the following detailed description will be described in detail below: 1 ΩΟ Ί 不According to the computer system of the present invention, the power supply unit 11〇, the south bridge wafer 12〇
(Baseboard Manager Controller, BMC) 130 I4'安全卡I5。與開機單元W。。其中電源供應單元 /供應待機電源、vSB與系統電源Vsys給電腦系統1〇〇。 系.、先龟源VSYS可以供應電腦系統1⑻内部各個元件正 作所需之電能。 於本實施例中，電源供應單元110受控於南橋晶片 當南橋晶片12Q接收到由基板管理控制器所發出 ^二開f信號時，南橋W12G會輪出電關啟信號給 電源供應單元no’使電源供應單元11G能夠供應系統電 源VSYS給電腦系統1〇〇。 基板管理控制益13〇耦接至南橋晶片12〇、安全卡槽 140曰與開機單元副。_單元16()上具有開機按钮i6i: 以提供使用者啟動電腦系統刚之操作介面。當開機按紐 ⑹被使用者按壓時，開機單元16〇即會輸出第一開機信 ，給基板官理控制器13〇。安全卡槽14〇藉由系統管理匯 流排(System Management Bus，簡稱SM匯流排）132與基 板管理控制态130相連接。因此，當安全卡15〇插入安全 200910137 V / VJZ. / w. X vv 二 i613twf.doc/n 卡槽140後，基板管理控制器13〇可以經由SM匯流排i32 與女全卡槽140讀取安全卡15〇上之第一辨識資料。上述 安全卡150上具有儲存該第一辨識資料之記憶體151，具 =此領域通常知識者可以依據其需求而以各種方式實現記 fe體151，例如於本實施例中，記憶體151是以電子可抹 除了程式化唯。買 1己彳5^(Eiectricaiiy Erasabie pr〇grammabie(Baseboard Manager Controller, BMC) 130 I4' Security Card I5. With the boot unit W. . Among them, the power supply unit / supply standby power supply, vSB and system power supply Vsys to the computer system. The first turtle source VSYS can supply the electrical energy required by each component inside computer system 1 (8). In this embodiment, the power supply unit 110 is controlled by the south bridge chip. When the south bridge wafer 12Q receives the signal from the substrate management controller, the south bridge W12G turns the power off signal to the power supply unit no'. The power supply unit 11G is enabled to supply the system power supply VSYS to the computer system. The substrate management control is connected to the south bridge chip 12〇, the security card slot 140曰 and the boot unit pair. _ Unit 16 () has a power button i6i: to provide the user to start the operating interface of the computer system. When the power button (6) is pressed by the user, the power-on unit 16 outputs a first power-on letter to the substrate controller 13〇. The security card slot 14 is connected to the baseboard management control state 130 by a system management bus (System Management Bus, SM bus) 132. Therefore, when the security card 15 is inserted into the security 200910137 V / VJZ. / w. X vv II i613twf.doc / n card slot 140, the substrate management controller 13 can be read via the SM bus i32 and the female full card slot 140 The first identification data on the security card 15〇. The security card 150 has a memory 151 for storing the first identification data. The general knowledge in the field can be implemented in various ways according to the needs of the user. For example, in the embodiment, the memory 151 is Electronics can erase stylized only. Buy 1 彳5^(Eiectricaiiy Erasabie pr〇grammabie
Read-Only Memory,簡稱 EEPR〇M)來實現的。 基板官理控制器130藉由低接腳數匯流排(L〇wpin Count Bus ’簡稱lpc匯流排）13!與南橋晶片12〇相連接。 由於基板官理控制H 13G所需之操作電能是由待機電源 S1所提供^因此當電腦系統1〇〇關機時（也就是電源供 :單=11〇停止供應系統電源VSYS給電腦系統1〇〇時）， 土板官理控制器130依然為致能的狀態。 ，板g理控制器13〇本身紀錄有電腦系統1⑽之第二 =料。當使用者按壓開機按紐161時，開機單元16〇 P曰輸開機信號給基板管理控制器130。當基板管 =控制器13G收到第—開機信號後，基板管理控制哭 會比對本身所紀錄之第二賴㈣與安全卡15GJJ第一 =識貢料是否相符合，藉以決定是否輸出第二關信號。 统UG依據此第二職信號而歧是否供應系 、-'元電源VSYS給電腦系統1〇〇。 之機= 識資料是否相符」 辨巧次^ 方式只現之例如’弟—辨識資料與第二 1 日貝枓可以是相對應之加密金鑰對；由安全卡15〇使用 200910137 070270.TW 24613twf.doc/n 第一辨識資料（加密金鑰）對—預設資料（例如字串「丨2 3」） 進行-加密操作’然後將加密後之預設資料傳送給基板管 ，控制器no;基板管理控制器m使用第二辨識資料（解 禮金输）對加密後之預設資料進行—解密操作，若解密結 果為原先預設資料（字串「123」），則第二辨識資料與第 =辨識倾二者相符（mateh)。於本實補t，第一辨識 貪料與第二辨識資料均可以是電腦系統1〇〇中系統管理基 〇 本輪入輸出系統(System Management Basic Input 〇utputRead-Only Memory, referred to as EEPR〇M). The substrate management controller 130 is connected to the south bridge wafer 12 by a low pin count bus (abbreviated as lpc bus) 13! Since the operating power required for the substrate control H 13G is provided by the standby power supply S1, when the computer system 1 is turned off (that is, the power supply is: single = 11 〇 stop supplying the system power supply VSYS to the computer system 1 〇〇 At the time), the earthboard official controller 130 is still in an enabled state. The board g controller 13 itself records the second material of the computer system 1 (10). When the user presses the power button 161, the power-on unit 16 〇 P drives the power-on signal to the baseboard management controller 130. When the substrate tube=controller 13G receives the first-on signal, the substrate management control cry will be compared with the second (four) recorded by itself and the safety card 15GJJ first=identification material, thereby determining whether to output the second Off signal. According to this second job signal, the system UG is different from the supply system, and the 'yuan power supply VSYS gives the computer system 1〇〇. The machine = know whether the data is consistent or not. The method is only for the present time. For example, the brother-identification data and the second day of the day can be the corresponding encryption key pair; by the security card 15〇200910137 070270.TW 24613twf .doc/n first identification data (encryption key) pair - preset data (such as string "丨 2 3") - encryption operation 'and then transfer the encrypted default data to the substrate tube, controller no; The substrate management controller m performs the decryption operation on the encrypted preset data by using the second identification data (the gift output). If the decrypted result is the original preset data (the string "123"), the second identification data and the second identification data = Identify the opposite of the mater (mateh). In this case, the first identification of both the greedy material and the second identification data can be the system management basis of the computer system. System This round-in and output system (System Management Basic Input 〇utput
System，簡稱SMBIOS)之身份辨識資料师馈吻Unique Identifier ’簡稱UUID)。使用者可以事先將電腦系統1〇〇 中SMBI〇S tUUID儲存在安全卡150與基板管理控制器 13 0。當基板管理控制II丨3 Q &到第—開機信號後，基板管 理控制器130會從安全卡15〇讀取第一辨識資料（smbi〇s 之UUID ) ’然後比對本身所紀錄之第二辨識資料（ 之^JUID)與第-辨識資料是否相同，此為「比對第二辨 識貝料與第-辨識資料是否相符」機制之另一實施範例。 前述第一辨識資料與第二辨識資料亦可為加密後之 SMBIOS 之 UUID。 圖2繪不為依照本發明之一實施例的—種安全開機之 方法。請同時參照圖！與圖2，步驟S21〇為當開機單元 16(^發生職事件（例如使用者按制機按紐161)時，開 機單元160輪出第—開機信號給基板管理控制器130。於 步驟S22G中’基板管理控制器13()比對第—辨識資料與 第二辨識資料是否相符。若第—辨識資料與第二辨識資& 200910137 070270.TW 24613twf.doc/n 管理控制器130透過南橋晶請之控制， 使包源供應早元100將系統電源 ^ 100(步驟S230)。 、 SYS，、應、、，&廷腦系統 圖=示為依照本發明之—較佳實施例的一種安全開 。請同時參照圖1與圖3，步驟S3。1 ^生嶋件，例如使用者按下開機按鈕⑹ 用者按下開機按鈕161，由開棬罝 田使 號給基板管理控制器13〇。於步驟s3〇2中 機單元160所輪出之第-開機信 制 步驟S3G3中判斷其内是否有儲存第二 =:=SMBI0S，ID)，若有儲存第二辨識 貝枓則進订步驟S304;若無則表示電腦系統1〇〇可能 一次開機，因此基板管理控制器13G進行步驟㈣。 ^S304為由基板管理控制器、請判斷電腦系統_ 疋否處於安全模式下。此安全模式是由步驟咖〜s3i2 所決定（容後詳述）。由使用者預先設定電腦系統⑽之 ^模式是否要為卩姐閉，若安全模式為賴則進行 乂驟S305，若安全模式為開啟則進行步驟S3〇6。 於步驟S306中，由基板管理控制器13〇透過SM匯流 排132與安全卡槽14〇讀取安全卡15〇之記憶體⑸上所 儲存之第一辨識資料（例如SMBIOS之UUID)。接著進 行步驟S307,基板管理控制器130比對安全卡15〇上之第 二辨識資料與電腦系統100之第二辨識資料是否吻合，以 獲得比對結果。例如，基板管理控制器13〇判斷所讀取之System, referred to as SMBIOS), identifies the unique Identifier (UUID). The user can store the SMBI〇S tUUID in the computer system 1 in the security card 150 and the baseboard management controller 130 in advance. After the substrate management control II丨3 Q & to the first-on signal, the substrate management controller 130 reads the first identification data (UUID of smbi〇s) from the security card 15' and then compares the record of the first The second identification data (^JUID) is the same as the first-identification data, which is another embodiment of the mechanism of "Comparing whether the second identification material and the first identification data are consistent". The first identification data and the second identification data may also be the UUID of the encrypted SMBIOS. 2 depicts a method of safe booting in accordance with an embodiment of the present invention. Please refer to the map at the same time! 2, step S21 is when the booting unit 16 (e.g., the user presses the button 161), the booting unit 160 rotates the first-on signal to the baseboard management controller 130. In step S22G 'The substrate management controller 13() compares the first identification data with the second identification data. If the first identification data and the second identification information & 200910137 070270.TW 24613twf.doc/n management controller 130 passes through Nanqiaojing Please control, so that the packet source supply 100 will be the system power supply ^ 100 (step S230). SYS, YES, ,, & TEM system diagram = shown as a security according to the preferred embodiment of the present invention Referring to FIG. 1 and FIG. 3 simultaneously, step S3. 1 ^ raw parts, for example, the user presses the power on button (6), the user presses the power on button 161, and the switch is issued to the baseboard management controller 13A. In the first-start signal processing step S3G3 in which the machine unit 160 rotates in the step s3〇2, it is determined whether there is a second=:=SMBI0S, ID), and if the second identification is stored, the step S304 is performed. If it is not, it means that the computer system may be turned on once, so the base Step (iv) management controller 13G. ^S304 is the substrate management controller, please judge whether the computer system _ is in safe mode. This security mode is determined by the step coffee ~s3i2 (detailed later). It is pre-set by the user whether the mode of the computer system (10) is to be closed, if the security mode is on, then step S305 is performed, and if the security mode is on, step S3 is performed. In step S306, the substrate management controller 13 reads the first identification data (for example, the UUID of the SMBIOS) stored in the memory (5) of the security card 15 through the SM bus 132 and the security card slot 14 . Next, in step S307, the substrate management controller 130 compares the second identification data on the security card 15 with the second identification data of the computer system 100 to obtain a comparison result. For example, the substrate management controller 13 determines the read
200910137 070270.TW 24613tw£doc/n 本::儲存之第二辨識資料是否-樣。若 相同，或讀不到第一:：=識資料不吻合(或不 不會送出第二’基板管理控制器130將 (Powers 取之;判斷所讀 (或相同）¥ ’或於步驟S3〇3判斷基板管理控制〇 存第=識資料時，又或於步驟S3Q4判斷電腦系 統亚不疋處於安全模式下日夺，則進行步驟S305。於步 驟S305巾，基板管理控制器13()將送出第二開機信號至 南1晶片120。當南橋晶片12〇接收到該第二開機信號時， 此時南橋晶片120會輸出電源開啟信號至電源供應單元 110，以使電源供應單元110供應系統電源％”給電腦系 統100。因此，電腦系統1〇〇得以進行諸如基本輪入輪出 系統(Basic Input/Output System，簡稱BIOS)之開機自我測 試（Power On Self Test，簡稱POST)等開機程序。 因此’電腦系統100可以在BIOS之POST過程中， 沒由智慧平台管理介面（Intelligent Platform Management Interface,簡稱IPMI)之指令將第二辨識資料（例如 SMBIOS之UUID)傳送至基板管理控制器130，使其寫入 基板管理控制器130内（步驟S309)。 步驟S310提供使用者於BIOS之POST階段中進行安 全模式之設定。若使用者設定安全模式為開啟則進行步驟 11 200910137 070270.TW 24613twf.doc/n S311。於步驟S311中，BIOS傳送「安全模式為開啟」之 IPMI指令給基板管理控制器130。基板管理控制器13〇將 收到”啟動”安全模式之IPMI指令，並且代表當使用者按下 開機按鈕161(步驟S301)時，第一辨識資料與第二辨識資 料必須相符合(步驟S307)，基板管理控制器〖go才合送出 第二開機信號(步驟S305)。 曰、 反之，若使用者設定安全模式為關閉，則進行步驟 〇 S312。於步驟S312中，BI0S傳送「安全模式為關閉」之 IPMI指令給基板管理控制器13〇。基板管理控制哭將 收到，’關閉’’安全模式之指令，並且代表當使用者；下開機 按鈕161(步驟S301)時，基板管理控制器13〇將不進行比 對第一辨識資料與第二辨識資料(步驟S3〇7)，而基板管理 控制為130會直接送出第二開機信號（即直接進行步驟 S305)。而於設定完安全模式之後，電腦系統1〇〇繼續進行 POST之其他程序。當完成P0ST之後，接下來電腦系統 100開始載入作業系統，而由作業系統繼續進行其他開機 ( 程序（步驟S313)。 '、 /在另一實施例中，可以將SMBIOS之UUID事先加密 後才寫入安全卡150，以做為第一辨識資料。由於M〇s 之POST階段中（步驟S309)，會將未經過加密及加上檢 查碼的SMBIOS之UUID (第二辨識資料）寫入基板管理 控制器130中，故於比對第一辨識資料與第二辨識資料（步 驟S307)之前，還需要經由解密之步驟，才能進行比對之 流程。 12 200910137 υ/υ2/υ.ι w 246l3twf.d〇c/n 圖4為依照本發明之另一實施例之一種將第一辨識資 料解密之步驟流程圖。步驟S306為由安全卡150之記憶 體151上讀取第一辨識資料。步驟S402為由基板管理控 制器130將此第一辨識資料解密。於此實施例中，第一辨 識資料之加解密可以由任一演算法實施之，例如資料加密/ 解密標準(Data Encryption/Decryption Standard，簡稱 DES) 决异法、南級加後、/解密標準（Advanced ^、 Encryption/Decryption Standard，簡稱 AES)演算法等等。於 步驟S403中’基板管理控制器130將檢驗第一辨識資料 之檢查碼。確認無誤之後’即獲得未加密之第一辨識資料 (步驟S404)。上述之檢查碼可以是核對和(Checksum)。 在將第一辨識資料解密後，便可以進行步驟S307。 安全卡150之記憶體151上所儲存之第一辨識資料， 可以藉由下述之兩種方式將第一辨識資料寫入記憶體15 i 内。第一種方式請參照圖5 ’步驟S501將電腦系統1〇〇開 機至作業系統下。步驟S502由軟體取得電腦系統1〇〇之 ( 辨識資料（例如SMBI0S之UUID)。於步驟中，軟 體利用IPMI命令將SMBI0S之UUID傳送至基板管理控 制器130上。 於步驟S504中’由基板管理控制器13〇將SMBI〇s 之UUID加上檢查碼，例如是核對和（Checksum)之檢查 碼。步驟S505由基板管理控制器130將加上檢查碼之 UUID資料加密，並將此完成加密之UTJID資料做為第一 辨識資料。於此實施例中’可以任一演算法實現步驟 13 200910137 υ/uz/u. 1 w zhd 13twf.doc/n S5〇5 ’例如DES演算法、AES演算法等等。最後進行步 驟SS06,由基板管理控制器m將加密過並含有檢查瑪之 第-辨識資料寫人安全卡15Q之記憶體151内。 f 一種方式，則是於生產電腦系統100之主機板時， 將加岔過並含有檢查碼之第一辨識資料直接以200910137 070270.TW 24613tw£doc/n This:: Whether the second identification data stored is the same. If the same, or can not read the first::= knowledge does not match (or does not send the second 'baseboard management controller 130 will (Powers take it; judge read (or the same) ¥ ' or in step S3〇 3, when it is judged that the substrate management control caches the data, or if it is determined in step S3Q4 that the computer system is in the safe mode, step S305 is performed. In step S305, the substrate management controller 13() is sent out. The second power-on signal is sent to the south 1 chip 120. When the south bridge chip 12 receives the second power-on signal, the south bridge chip 120 outputs a power-on signal to the power supply unit 110 to enable the power supply unit 110 to supply the system power source. "To the computer system 100. Therefore, the computer system 1 can perform booting procedures such as the Basic On/Output System (BIOS) Power On Self Test (POST). 'The computer system 100 can be used in the POST process of the BIOS, and the second identification data (such as SMBIOS) is not used by the Intelligent Platform Management Interface (IPMI) instruction. The UUID is transmitted to the baseboard management controller 130 and written into the baseboard management controller 130 (step S309). Step S310 provides the user to perform the security mode setting in the POST phase of the BIOS. Then, proceed to step 11 200910137 070270.TW 24613twf.doc/n S311. In step S311, the BIOS transmits an IPMI command of "safe mode is on" to the baseboard management controller 130. The baseboard management controller 13 will receive "start". The IPMI command of the security mode, and means that when the user presses the power on button 161 (step S301), the first identification data and the second identification data must match (step S307), and the substrate management controller 〖go sends the second The power-on signal (step S305). Otherwise, if the user sets the security mode to off, the process proceeds to step S312. In step S312, the BI0S transmits the IPMI command "safe mode is off" to the baseboard management controller 13A. The substrate management control cry will receive, 'close' the 'safe mode command, and represents the user; when the power button 161 is pressed (step S301), the substrate management The controller 13 will not compare the first identification data with the second identification data (step S3〇7), and the substrate management control 130 will directly send out the second startup signal (ie, directly proceed to step S305). After the safe mode, the computer system continues to perform other procedures of POST. After the completion of the P0ST, the computer system 100 begins to load the operating system, and the operating system continues to perform other booting (program (step S313). ', / In another embodiment, the UBIOS of the SMBIOS can be encrypted beforehand. Write the security card 150 as the first identification data. Since the POST phase of M〇s (step S309), the UUID (second identification data) of the SMBIOS that has not been encrypted and added with the check code is written into the substrate. In the management controller 130, before the first identification data and the second identification data are compared (step S307), the decryption step is required to perform the comparison process. 12 200910137 υ/υ2/υ.ι w 246l3twf .d〇c/n Figure 4 is a flow chart showing the steps of decrypting the first identification data according to another embodiment of the present invention. Step S306 is to read the first identification data from the memory 151 of the security card 150. S402 is used to decrypt the first identification data by the substrate management controller 130. In this embodiment, the encryption and decryption of the first identification data can be implemented by any algorithm, such as data encryption/decryption standard (Data Encryption/Decryp Tion Standard (referred to as DES), the singularity method, the Southern Plus, and the decryption standard (Advanced En, Encryption/Decryption Standard, AES) algorithm, etc. In step S403, the 'substrate management controller 130 will check the first identification. The check code of the data. After the confirmation is correct, the unidentified first identification data is obtained (step S404). The above check code may be a checksum. After the first identification data is decrypted, step S307 may be performed. The first identification data stored in the memory 151 of the security card 150 can be written into the memory 15 i by the following two methods. The first method is as shown in FIG. 5 'Step S501 The computer system is booted to the operating system. Step S502 acquires the computer system 1 by the software (identification data (for example, UUID of SMBI0S). In the step, the software transmits the UUID of the SMBI0S to the baseboard management controller by using the IPMI command. 130. In step S504, the UMUID of the SMBI〇s is added with a check code, for example, a checksum checksum, by the substrate management controller 13. Step S505 is managed by the substrate. The controller 130 encrypts the UUID data with the check code, and uses the encrypted UTJID data as the first identification data. In this embodiment, 'any algorithm can be implemented as step 13 200910137 υ/uz/u. 1 w zhd 13twf.doc/n S5〇5 'eg DES algorithm, AES algorithm, etc. Finally, step SS06 is performed, and the substrate management controller m encrypts the memory 151 which is encrypted and contains the first identification data of the security card 15Q. f One way is to directly add the first identification data that has been added and contains the inspection code when the motherboard of the computer system 100 is produced.
EEPROM 燒錄器燒入安全卡15〇之記憶體 151 内。 综上=述，藉由本發明之安全卡開機方式，可以讓使 用^擁有完全之系統使用權。本發明可以於開機之時，即 驗°且使用者疋否具有開啟系統之權限，而不需等到電腦系 、充已L進人作業系統之後才去驗證使用者之系統使用權， 此方式反而會增加電腦系統被任意變更設定與竊取内部資 料之風險。而且，增加安全卡之硬體成本錢其他方式為 低’例如相於指紋辨識系統之錢減體成本，使用安 全卡之硬體成本會低很多。 —雖然本發明已以較佳實施例揭露如上，然其並非用以 限疋本發明，任何所屬技術領域中具有通常知識者，在不 脫離本I月之精神和範圍内，當可作些許之更動與潤飾， =此本發明之_範圍當視後附之申料織騎界 準。 【圖式簡單說明】 圖1繪:為依照本發明之一實施例的一種電腦系統。 、圖2繪不為依照本發明之一實施例的一種安全開機之 14 200910137 υ/υζ/υ.ι w ζ^613twf.doc/n 圖3繪示為依照本發明之一較佳實施例的一種安全開 機之操作步驟流程圖。 圖4繪示為依照本發明之另一實施例之一種將第一辨 識資料解密之步驟流程圖。 圖5繪示為將第一辨識資料寫入記憶體之步驟流程 圖。 【主要元件符號說明】 100 :電腦系統 110 :電源供應單元 120 :南橋晶片 130 :基板管理控制器 131 : LPC匯流排 132 : SM匯流排 140 :安全卡槽 150 :安全卡 151 :記憶體 G 160:開機單元 161 .開機按紐 S210〜S230 :安全開機方法之步驟 S301〜S313 :安全開機之操作步驟 S401〜S404 :辨識資料解密之步驟 S501〜S506 :辨識資料寫入記憶體之步驟 Vsb ·待機電源 VsYS ·糸統電源 15The EEPROM burner is burned into the memory 151 of the security card. In summary, the security card boot mode of the present invention allows the use of ^ to have full system usage rights. The invention can be used at the time of starting up, that is, whether the user has the right to open the system, and does not need to wait until the computer system and the charging system have been activated to verify the user's system usage right. It will increase the risk of the computer system being arbitrarily changed and stealing internal data. Moreover, the hardware cost of adding a security card is otherwise low. For example, the cost of using a security card is much lower than that of a fingerprint identification system. The present invention has been disclosed in the above preferred embodiments, but it is not intended to limit the invention, and any person having ordinary skill in the art can make some changes without departing from the spirit and scope of the present invention. Change and refinement, = the scope of this invention is considered to be attached to the application of the weaving industry. BRIEF DESCRIPTION OF THE DRAWINGS Figure 1 depicts a computer system in accordance with an embodiment of the present invention. 2 is a safe booting device according to an embodiment of the present invention. 200910137 υ/υζ/υ.ι w ζ^613 twf.doc/n FIG. 3 illustrates a preferred embodiment of the present invention. A flow chart of the steps of safe booting. 4 is a flow chart showing the steps of decrypting the first identification data in accordance with another embodiment of the present invention. FIG. 5 is a flow chart showing the steps of writing the first identification data into the memory. [Description of Main Component Symbols] 100: Computer System 110: Power Supply Unit 120: South Bridge Wafer 130: Substrate Management Controller 131: LPC Bus Bar 132: SM Bus Bar 140: Security Card Slot 150: Security Card 151: Memory G 160 : Power-on unit 161. Power-on button S210~S230: Steps S301 to S313 of the safe boot method: Operation steps S401 to S404 for secure booting: Steps S501 to S506 for decrypting the identification data: Step of writing the identification data to the memory Vsb · Standby Power supply VsYS · 糸 power supply 15