TW201935358A - Application or driver verification method - Google Patents

Abstract

An Application or driver verification method, implemented by a computer device, including: (A) Executing a firmware to generate a command interpretation environment; (B) In the command interpretation environment, after receiving an execution instruction related to a target program, obtaining a decryption method corresponding to a time interval comprising a system time and an encrypted authorization data corresponding to the target program and corresponding to an encryption method corresponding to the decryption method based on the system time of a system management data and a lookup table related to decryption methods and time intervals; (C) According to the decryption method, the encrypted authorization data is decrypted to generate the decryption authorization data; and (D) Generating an authorization message indicating whether the target program is valid or not according to a first metadata of the system management data corresponding to the target program and the decryption authorization data.

Description

Program verification method

The invention relates to a method for verifying the integrity of data, in particular to a program verification method for an extensible firmware interface.

In order to eliminate the inherent limitations of the Basic Input / Output system (BIOS), Intel Corporation has developed an Extensible Firmware Interface (EFI) specification. EFI is a personal computer system Specifications, you can use standard programming language tools to add new components, which has better expandability. Because EFI is based on the modular structure of C language, it is more flexible than the combined language BIOS, and the program is easier to maintain and read.

EFI is used to contact the operating system (OS) and provide an interface to connect the operating system and hardware. When all components of EFI are loaded, a command interpretation environment similar to the shell of the operating system is started. (EFI Shell). In EFI Shell, users can mount and execute any EFI application or EFI driver. These programs can be hardware detection and debugging software, boot management software, configuration software, and startup programs for the operating system. and many more. However, these programs may be malicious programs implanted by hackers with malicious software. Therefore, the existing computer device stores the authorization data corresponding to these programs in advance, so that the computer device verifies whether the corresponding programs are legitimate through the authorization data.

However, the existing authorization data does not have a proper protection mechanism. The authorization data may be outflowed, and the content may be parsed, and hackers may forge illegal authorization data.

Therefore, an object of the present invention is to provide a program verification method with a protection mechanism.

Therefore, the program verification method of the present invention is implemented by a computer device, which is electrically connected to a storage device, and stores a firmware, a plurality of programs, a lookup table of a time interval pair decryption method, and system management data. The system management data includes a system time related to the current time of the computer device and a plurality of first interpretation data corresponding to the programs. The storage device stores a plurality of encrypted authorization data corresponding to each program. The encryption authorization data corresponding to each program corresponds to multiple encryption methods. The lookup table includes multiple time intervals and multiple decryption methods corresponding to the time intervals and corresponding encryption methods. The program verification method includes One step (A), one step (B), one step (C), and one step (D).

In step (A), the computer device executes the firmware to generate a command interpretation environment.

In step (B), the computer device, under the command interpretation environment, receives an execution instruction related to a target program, and obtains the information covering the system according to the system time and the lookup table of the system management data. The decryption method corresponding to the time interval of the system time, and the encryption authorization data corresponding to the target program and the encryption method corresponding to the decryption method, wherein the target program is one of the programs.

In step (C), the computer device decrypts the encrypted authorization data obtained in step (B) according to the decryption method obtained in step (B) to generate decryption authorization data.

In step (D), the computer device generates an authorization message indicating whether the target program is legal according to the first interpretation data corresponding to the target program in the system management data and the decryption authorization data.

The effect of the present invention is that the decryption method and the encryption authorization data are obtained by the processing unit according to the system time and the lookup table, and the encryption authorization data is decrypted according to the decryption method to generate the decryption authorization data. The first interpretation data of the system management data and the decryption authorization data generate the authorization message indicating whether the target program is legitimate, improving the security of the authorization data, and avoiding the situation where the authorization data is forged.

Referring to FIG. 1, a computer device 100 for implementing an embodiment of the program verification method of the present invention is described. The computer device 100 includes a storage unit 11 and a processing unit 12 electrically connected to the storage unit 11. The computer device 100 Electrically connected to a storage device 200. In this embodiment, the storage unit 11 is, for example, a flash memory, and the storage device 200 is, for example, an external hard drive. In other embodiments, the storage unit 11 may be an electronic storage device. Erase Programmable Read-Only Memory (EEPROM), not limited to this.

The storage unit 11 stores a firmware, a plurality of programs, a lookup table of a decryption method in a time interval, a plurality of decryption keys corresponding to a plurality of different encryption algorithms, and system management data. The lookup table includes a plurality of time intervals, and a plurality of decryption modes corresponding to the time intervals and a plurality of encryption methods, each encryption method corresponding to at least two of the plurality of encryption keys corresponding to the encryption algorithms, An encryption sequence related to the encryption key corresponding to the encryption method is indicated, and each decryption method corresponds to a decryption key corresponding to the encryption algorithm corresponding to at least two encryption keys, and an instruction related to the decryption is indicated. The decryption order of the decryption key corresponding to the method. Table 1 illustrates the lookup table. It is worth noting that, in other embodiments, each decryption method corresponds to a counterpart of the decryption keys, and is not limited thereto. The system management data includes a system time related to the current time of the computer device 100, and a plurality of first interpretation data corresponding to the programs, each first interpretation data having a first product name and a first customer name. At least one of them. In this embodiment, the firmware is, for example, a BIOS, the programs are, for example, an EFI application program or an EFI driver, and the encryption algorithms are, for example, an RSA encryption algorithm or an Advanced Encryption Standard (AES) encryption. Algorithms, Data Encryption Standard (DES) encryption algorithms, and Triple Data Encryption Standard (3DES) encryption algorithms. The system management data is, for example, a system management basic input / output system (System Management BIOS, SMBIOS) information. Table 1

The storage device 200 stores a plurality of encrypted authorization data corresponding to each program, the encrypted authorization data corresponding to each program corresponds to the encryption methods, and each encrypted authorization data includes a second interpretation data and a During the authorization period, each second interpretation data has at least one of a second product name and a second customer name.

Referring to FIG. 1 and FIG. 2, how the computer device 100 executes the embodiment of the program verification method of the present invention is described. The steps included in this embodiment are described in detail below.

In step 301, the processing unit 12 executes the firmware stored by the storage unit 11 to generate a command interpretation environment. In an embodiment, the command interpretation environment is, for example, an EFI Shell.

In step 302, in the command interpretation environment, after receiving an execution instruction related to a target program, the processing unit 12 obtains coverage according to the system time and the lookup table of the system management data. There is a decryption method corresponding to the time interval of the system time, and encryption authorization data corresponding to the target program and corresponding to the encryption method corresponding to the decryption method in the storage device 200, wherein the target program is one of the programs By. For example, if the system time is 2018/1/1, the processing unit 12 can obtain the decryption order indicated by the decryption method according to Table 1 as RSA, AES, 3DES, DES, and then obtain the corresponding decryption method according to the decryption method. The encryption authorization data that should be encrypted by the target program and encrypted by DES, 3DES, AES, RSA.

In step 303, the processing unit 12 obtains the decryption key and the decryption order corresponding to the decryption method obtained in step 302, and decrypts the encryption authorization data obtained in step 302 according to the decryption key and the decryption order. To generate decryption authorization data. It is worth noting that, in the implementation of each of the other decryption methods corresponding to one of the decryption keys, the processing unit 12 only decrypts the encryption authorization data according to the decryption key corresponding to the decryption method, and the The decryption authorization data is the decrypted encrypted authorization data, so the decryption authorization data also includes the decrypted second interpretation data and an authorization period.

In step 304, the processing unit 12 determines whether the first interpretation data corresponding to the target program matches the second interpretation data, that is, determines at least one of the first product name and the first customer name of the first interpretation data. Whether this is the same as at least one of the second product name and the second customer name of the second interpretation information. When the processing unit 12 determines that the first interpretation data matches the second interpretation data, proceed to step 305; and when the processing unit 12 determines that the first interpretation data does not match the second interpretation data, proceed to step 305 307.

In step 305, the processing unit 12 determines whether the system time of the system management data is within the authorization period of the decryption authorization data. When the processing unit 12 determines that the system time is within the authorization period, step 306 is performed; and when the processing unit 12 determines that the system time is not within the authorization period, step 307 is performed. For example, if the system time is 2018/1/1 and the authorization period is 2016/1/1 ~ 2018/12/31, the system time is within the authorization period, and if the authorization time is 2016/1 / 1 ~ 2017/12/31, the system time is not within the authorization period.

In step 306, the processing unit 12 generates an authorization message indicating that the target program is legal.

In step 307, the processing unit 12 generates an authorization message indicating that the target program is illegal, and removes the target program.

It should be particularly noted that, in this embodiment, after the processing unit 12 executes step 302, if no authorization message is generated within a preset time, the processing unit 12 directly performs step 307.

In summary, in the program verification method of the present invention, the processing unit 12 obtains the decryption method and the encryption authorization data according to the system time and the lookup table, and decrypts the encryption authorization data according to the decryption method to generate the encryption authorization data. Decrypt authorization data. Finally, according to the system time, the first interpretation data of the system management data, and the second interpretation data of the decryption authorization data, the authorization message indicating whether the target program is legitimate is generated to improve the security of the authorization data to avoid counterfeiting. The situation of authorizing the data happened, so it could indeed achieve the purpose of the invention.

However, the above are only examples of the present invention. When the scope of implementation of the present invention cannot be limited by this, any simple equivalent changes and modifications made according to the scope of the patent application and the contents of the patent specification of the present invention are still Within the scope of the invention patent.

100‧‧‧Computer device

11‧‧‧Storage Unit

12‧‧‧ processing unit

200‧‧‧Storage device

301 ~ 307‧‧‧ steps

Other features and effects of the present invention will be clearly presented in the embodiment with reference to the drawings, in which: FIG. 1 is a block diagram illustrating, by way of example, a computer for implementing an embodiment of the program verification method of the present invention Device; and FIG. 2 is a flowchart illustrating the embodiment of the program verification method of the present invention.

Claims (7)

A program verification method is implemented by a computer device that is electrically connected to a storage device and stores a firmware, a plurality of programs, a look-up table of a time interval decryption method, and system management data. The system management data Including a system time related to the current time of the computer device, and a plurality of first interpretation data corresponding to the programs, the storage device stores a plurality of encrypted authorization data corresponding to each program, and each program independently The corresponding encryption authorization data corresponds to multiple encryption methods. The lookup table includes multiple time intervals and multiple decryption methods corresponding to the time intervals and the encryption methods. The program verification method includes the following steps: (A) execute the firmware to generate a command interpretation environment; (B) under the command interpretation environment, after receiving an execution instruction related to a target program, according to the system time and the search of the system management data Table to obtain the decryption method corresponding to the time interval covering the system time, and the corresponding target program and The encryption authorization data corresponding to the encryption method corresponding to the decryption method, wherein the target program is one of the programs; (C) According to the decryption method obtained in step (B), decrypt the data obtained in step (B). Encrypting the authorization data to generate decryption authorization data; and (D) generating an authorization message indicating whether the target program is legitimate according to the first interpretation data corresponding to the target program in the system management data and the decryption authorization data. According to the program verification method described in claim 1, the computer device further stores a plurality of decryption keys corresponding to a plurality of different encryption algorithms, and each decryption method corresponds to one of the decryption keys. In the step, (C) decrypts the encrypted authorization data according to the decryption key corresponding to the decryption method. According to the program verification method described in claim 1, the computer device further stores a plurality of decryption keys corresponding to a plurality of different encryption algorithms, and each decryption method corresponds to at least two of the decryption keys, and indicates a Related to the decryption order of the decryption key corresponding to the decryption method, in step (C), the encrypted authorization data is decrypted according to the decryption key corresponding to the decryption method and the decryption order. According to the program verification method described in claim 1, each encrypted authorization data includes a second interpretation data, wherein step (D) includes the following sub-steps: (D-1) determining the first interpretation data corresponding to the target program and the first interpretation data Whether the second interpretation data matches; (D-2) when it is determined that the first interpretation data matches the second interpretation data, an authorization message indicating that the target program is legal is generated; and (D-3) when it is determined that the When the first interpretation data does not match the second interpretation data, an authorization message indicating that the target program is illegal is generated. The program verification method according to claim 4, wherein in step (D-1), the first interpretation data has at least one of a first product name and a first customer name, and the second interpretation data has At least one of a second product name and a second customer name. According to the program verification method described in claim 4, each encrypted authorization data further includes an authorization period, wherein step (D) between sub-steps (D-1) and (D-2) further includes the following sub-steps: ( D-4) determine whether the system time of the system management data is within the authorization period of the decryption authorization data; in sub-step (D-2), it is determined that the first interpretation data matches the second interpretation data and When the system time is within the authorization period, the authorization message indicating that the target program is legal is generated, and after step (D-4), step (D) further includes the following substeps: (D-5) When it is determined When the system time is not within the authorization period, the authorization message indicating that the target program is illegal is generated. The program verification method according to claim 1, wherein in step (A), the command interprets the environment as an extensible firmware interface instruction shell.