TWI467485B - Verification of the basic input and output system update method, the computer can read the recording media and computer program products - Google Patents

Description

Method for verifying the update of the basic input/output system, computer readable recording medium and computer program product

The present invention relates to a method for verifying an update of a basic input/output system, a computer readable recording medium, and a computer program product, and more particularly to verifying an update of a basic input/output system in an environment of a universal extendable firmware interface. Method, computer readable recording medium and computer program product.

The computer has a commonly known basic input/output system (BIOS, Basic Input Output System), which is stored in read-only memory, such as Flash ROM (Flash Read-Only Memory). Since the development of the traditional basic input and output system (Legacy BIOS) has reached its limit, Intel Corporation has developed an Extensible Firmware Interface (EFI) specification that eliminates the traditional basic input and output system. Innate limitations.

This extensible firmware interface allows for the addition of new components using standard programming language tools, with better scalability, and is written in C, which is easy to maintain and read. Currently, the extendable firmware interface supports legacy systems, performs on traditional basic input and output systems, and properly takes over some control.

However, Intel's extended firmware interface can only be used for specific CPUs. In view of this, Intel has developed a universal extendable firmware interface with multiple CPU-making companies (UEFI, Universal). Extensible Firmware Interface) is suitable for CPUs manufactured by various companies.

FIG. 1 is a schematic diagram of a conventional firmware update in a UEFI environment. In FIG. 1, the user wants to update the BIOS firmware of the UEFI environment, and the application of the operating system 10 reads from the storage medium (such as a hard disk, a flash drive, a compact disc, or a non-volatile memory) 12 to be updated. The file of the BIOS firmware is stored in the memory 14.

At this point, the operating system 10 calls and enters the BIOS 16 of the UEFI environment. The BIOS 16 reads the file data of the BIOS firmware to be updated from the memory 14. When the BIOS 16 executes the update firmware driver, the BIOS 16 writes the file data of the BIOS firmware to be read into the Flash ROM 18. When the computer is rebooted, it is opened by the new BIOS firmware.

The conventional method can complete the update of the BIOS firmware, but it is easy to tamper with the BIOS firmware when the hacker wants to update the process. Because during the update process, the firmware update program or the firmware update of the update is not verified, if it is changed by the hacker, this may become the firmware update application of the hacker's BIOS, and the Flash ROM will be The BIOS firmware in 18 is easily tampering.

In order to prevent the above problems, it is proposed to use the "checksum" method to verify the firmware update application and to update the BIOS firmware. The so-called "checksum" is to add all the data of the BIOS firmware to be updated, and put the sum into a variable, which will be transmitted to the BIOS firmware to be updated. The computer also transmits the sum to the computer. When the computer receives the firmware to be updated and the sum, the computer uses the checksum method to add the data of the firmware to be updated again to generate the sum of the verification, and then judges whether the sum of the received and the sum of the verification are the same, Verify that the BIOS firmware is being updated to be tampered with. However, using the checksum method for verification purposes, it is still easy for the hacker to crack and easily tamper with the BIOS firmware to be updated.

The present invention provides a method for verifying an update of a basic input/output system, a computer readable recording medium, and a computer program product, which verify the UEFI BIOS update firmware (UEFI BIOS) by one of the verification results generated by an algorithm. Flash Utility) and the new BIOS firmware have not been tampered with before the update. The verification method using this algorithm is not easy to be cracked by hackers to prevent illegal and incomplete BIOS firmware from being written into the Flash ROM.

The present invention provides a method of verifying an update of a basic input/output system, the method being implemented in a computer, executing an executable file in an environment of a universal extendable firmware interface, the method comprising the steps of: The storage file is read by the storage medium and stored in a memory file. The executable file is a file format of the universal extendable firmware interface, and the executable file includes a firmware update program and is embedded in the firmware update. At least one file, one digital certificate and one signature of the program, the at least one file is for reference by the execution program; Calling from the operating system and entering a basic input/output system of the universal extendable firmware interface; calculating, by the public key and an algorithm, the firmware update program and the at least one file according to the digital certificate To generate a verification signature; when verifying that the signature of the execution file is the same as the verification signature, releasing a read-only memory write lock; and executing the firmware update program in the executable file to The data of the at least one file is written into a read-only memory.

According to the method of the present invention, the method further includes the steps of: inputting the name of the execution file from an input interface; and reading the execution file from the memory.

The method according to the present invention further includes the steps of: inputting, by the input interface, a name of the firmware update program, a name of the at least one file, and a name of the digital certificate; reading the firmware update program from the storage medium, The at least one file and the digital certificate referenced by the firmware update program are temporarily stored in a temporary storage area; the at least one file is embedded in the firmware update program; a private key and the algorithm are used Calculating the firmware update program and the embedded at least one file to generate the signature according to the digital certificate; embedding the digital certificate and the signature in the firmware update program to become the execution file, and temporarily storing the signature The staging area; The execution file in the temporary storage area is stored in the storage medium.

According to the method of the present invention, the input interface is one of a keyboard, a mouse and a touch panel.

According to the method of the present invention, the storage medium is one of a hard disk, a flash drive, a compact disc and a non-volatile memory.

According to the method of the present invention, the temporary storage area is a memory.

The present invention provides a computer readable recording medium storing a program. When a computer is loaded into the program by the recording medium and executed, the method for verifying the update of the basic input/output system can be completed.

The invention provides a computer program product for storing a program. When a computer is loaded into the program by a computer program product and executed, the method for verifying the update of the basic input/output system can be completed.

DETAILED DESCRIPTION OF THE PREFERRED EMBODIMENTS Referring to the following drawings, a preferred embodiment of the method of verifying an update of a basic input/output system of the present invention will be described.

2 is a schematic diagram of an executable file attached to the executable file of the present invention, and FIG. 3 is a flow chart of the executable file attached to the executable file of the present invention. In Figures 2 and 3, a computer executes a signing style, and an algorithm implements UEFI update firmware (ie, execution program), update firmware function setting, and calculation of new BIOS firmware according to a digital certificate. To generate a signature and embed firmware firmware settings, new BIOS firmware, digital credentials and signatures in the UEFI update firmware. Among them, executed in the UEFI environment UEFI updates the firmware program, and the file such as the updated firmware function and the new BIOS firmware used as the reference for the UEFI update firmware may not be the file format of UEFI. This embodiment is exemplified by attaching two files, but is not limited to the present invention. In other embodiments, only one file or two or more files may be attached.

Users can enter the UEFI update firmware, update firmware settings, new BIOS firmware and digital credentials in one of the computer's input interfaces (such as keyboard, mouse or touch panel) in the operating system environment. Name (step S20).

The computer reads the UEFI update firmware, updated firmware settings, new BIOS firmware and digital credentials from a storage medium (such as hard drive, flash drive, CD-ROM, etc.) and temporarily stores it in the temporary storage area (such as In the memory) (step S22).

The computer embeds the firmware firmware setting and the new BIOS firmware into the UEFI update firmware (step S24).

The computer utilizes the well-known RSA encryption algorithm and the public key (Public Key) encryption standard, in addition to encrypting files such as UEFI update firmware, updated firmware settings, and new BIOS firmware, and is based on the well-known X. The .509 digital certificate calculates a UEFI update firmware program, updates the firmware function settings, and a new BIOS firmware to generate a signature corresponding to the files (step S26).

Then, the computer embeds the digital certificate and signature in the UEFI update firmware (including the embedded new firmware function settings and new BIOS firmware files). A new execution file is generated, and the execution file is temporarily stored in the temporary storage area (step S28). The execution file is a file format of UEFI.

The computer stores the execution file in the temporary storage area in the storage medium (step S30). The method of implementing the above steps to complete the archiving of the file into the execution program becomes the execution file.

4 is a schematic diagram of performing firmware update in a UEFI environment according to the present invention, and FIG. 5 is a flowchart of performing firmware update in a UEFI environment according to the present invention. The elements of FIG. 4 are the same as those of FIG. 1 and are denoted by the same reference numerals.

The user can input the name of the execution file in the environment of the work system 10 via the input interface (not shown) of the computer (step S40). The computer operating system 10 reads the execution file from the storage medium 12 and stores the execution file in the memory 14 (step S42). The executable file includes the UEFI update firmware program and the updated firmware function settings, new BIOS firmware, digital certificate and signature embedded in the UEFI update firmware program.

When the firmware of the BIOS 16 is to be updated, the operating system 10 calls and enters the BIOS 16 of the UEFI environment (step S44). In the UEFI environment, the BIOS 16 reads the executable file from the memory 14 (ie, reads the UEFI update firmware program included in the executable file, updates the firmware function settings, the new BIOS firmware, the digital certificate, and the signature). (Step S46).

BIOS 16 utilizes the well-known RSA encryption algorithm and private key (Private Key) decryption standard, in addition to decrypting files such as UEFI update firmware, updated firmware settings, and new BIOS firmware, and is well known. The X.509 digital certificate calculates the UEFI update firmware, updates the firmware function settings, and the new BIOS firmware to generate a verification signature corresponding to the files (step S48).

The BIOS 16 verifies whether the signature in the execution file is the same as the signature for verification (step S50). If the signature in the verification execution file is different from the verification signature, indicating that the update firmware function setting and the new BIOS firmware to be written to the Flash ROM 18 are illegal or incomplete, the computer issues a warning message to inform the operation. To terminate the update of the BIOS firmware (step S52).

If the signature in the verification execution file is the same as the verification signature, the BIOS 16 releases a Flash ROM write lock (step S54), so that the BIOS firmware update data can be written into the Flash ROM 18.

The BIOS 16 executes the UEFI update firmware in the executable file, and the UEFI update firmware program writes information such as the updated firmware function setting and the new BIOS firmware to the Flash ROM 18 during execution (step S56).

In the above steps, before the BIOS 16 performs the update of the BIOS firmware, it must comply with the security verification consideration in the UEFI environment, and the transmission is performed by the well-known RSA encryption algorithm, the public key encryption standard, and the private key decryption standard. The UEFI update firmware program before and after the computer, the firmware update function settings and the new BIOS firmware are verified according to the signature generated by the X.509 digital certificate to ensure that the data to update the BIOS firmware has not been modified by the customer. change.

The above method for verifying the update of the basic input/output system of the present invention can be completed in a program state, and the program can be stored in a computer readable The recording medium, when the computer loads the program from the computer-readable recording medium and executes it, the method steps as shown in the above description and the drawings can be completed.

Similarly, the method for verifying the update of the basic input/output system of the present invention can be implemented by a computer program product. After the computer downloads the computer program product from the network, for example, the following description and drawings can be completed. Show method steps.

The advantage of the present invention is to provide a method for verifying the update of a basic input/output system, a computer readable recording medium and a computer program product, which are based on an RSA encryption algorithm, a public key encryption standard, and a private key decryption standard according to X.509. The signature generated by the digital certificate verifies that the UEFI BIOS update firmware and the new BIOS firmware have not been tampered with before the update. This verification method is not easily cracked by the hacker to prevent illegal and incomplete BIOS. The firmware is written to the Flash ROM.

The present invention has been described above with reference to the preferred embodiments and the accompanying drawings, and should not be considered as limiting. Various modifications, omissions and changes may be made without departing from the scope of the invention.

10‧‧‧Operating system

12‧‧‧ Storage media

14‧‧‧ memory

16‧‧‧BIOS

18‧‧‧Flash ROM

1 is a schematic diagram of firmware update in a UEFI environment; FIG. 2 is a schematic diagram of an executable file attached to an executable file of the present invention; FIG. 3 is a flowchart of an executable file attached to an executable file of the present invention. FIG. 4 is a schematic diagram of performing firmware update in a UEFI environment according to the present invention; FIG. 5 is a flowchart of performing firmware update in a UEFI environment according to the present invention.

Claims (8)

A method of verifying an update of a basic input/output system, the method being implemented in a computer, executing an executable file in an environment of a universal extendable firmware interface, the method comprising the steps of: from a storage system from a storage system Reading the executable file and storing it in a memory file, the executable file is a file format of the universal extendable firmware interface, the executable file includes a basic input and output system firmware update program and is embedded in the basic input Outputting at least one file, a digital certificate and a signature of the system firmware update program, wherein the at least one file is for reference by the execution program; the operating system calls and enters one of the basic input of the universal extendable firmware interface Outputting a system; calculating, by the public key and an algorithm, the basic input/output system firmware update program of the executable file and the at least one file to generate a verification signature; verifying the signature of the execution file When the chapter is the same as the verification signature, the read-only memory write lock is released; and the basic input/output system in the execution file is tough. To upgrade the program to the at least one file of data written to a read-only memory. The method of claim 1, further comprising the steps of: inputting the name of the execution file by an input interface; and reading the execution file from the memory. The method of claim 2, further comprising the steps of: inputting, by the input interface, a name of the basic input/output system firmware update program, a name of the at least one file, and a name of the digital certificate; from the storage medium Reading the basic input/output system firmware update program, the at least one file and the digital certificate referenced by the basic input/output system firmware update program, and temporarily storing the digital certificate in a temporary storage area; embedding the at least one file The basic input/output system firmware update program is configured to generate the signature by using a private key and the algorithm to calculate the basic input/output system firmware update program and the embedded at least one file according to the digital certificate; The digital certificate and the signature are embedded in the basic input/output system firmware update program to be the executable file and temporarily stored in the temporary storage area; and the execution file in the temporary storage area is stored in the storage medium . The method of claim 2, wherein the input interface is one of a keyboard, a mouse, and a touch panel. The method of claim 1 or 3, wherein the storage medium is one of a hard disk, a flash drive, a compact disc, and a non-volatile memory. The method of claim 3, wherein the temporary storage area is a memory. A computer readable recording medium storing a program, and when a computer is loaded into the program by the recording medium and executed, the method of any one of claims 1 to 6 can be completed. A computer program product that stores a program, and when a computer is loaded into the program by a computer program product and executed, the method of any one of claims 1 to 6 can be completed.