WO2016018390A1 - Secure bios password method in server computer - Google Patents

Secure bios password method in server computer Download PDF

Info

Publication number
WO2016018390A1
WO2016018390A1 PCT/US2014/049232 US2014049232W WO2016018390A1 WO 2016018390 A1 WO2016018390 A1 WO 2016018390A1 US 2014049232 W US2014049232 W US 2014049232W WO 2016018390 A1 WO2016018390 A1 WO 2016018390A1
Authority
WO
WIPO (PCT)
Prior art keywords
bios
bmc
passwords
password
user
Prior art date
Legal status (The legal status is an assumption and is not a legal conclusion. Google has not performed a legal analysis and makes no representation as to the accuracy of the status listed.)
Ceased
Application number
PCT/US2014/049232
Other languages
French (fr)
Inventor
Liang-Chin KAO
Shang-Ching Hung
Hao Lun CHIN
Current Assignee (The listed assignees may be inaccurate. Google has not performed a legal analysis and makes no representation or warranty as to the accuracy of the list.)
Hewlett Packard Development Co LP
Original Assignee
Hewlett Packard Development Co LP
Priority date (The priority date is an assumption and is not a legal conclusion. Google has not performed a legal analysis and makes no representation as to the accuracy of the date listed.)
Filing date
Publication date
Application filed by Hewlett Packard Development Co LP filed Critical Hewlett Packard Development Co LP
Priority to US15/325,299 priority Critical patent/US10216937B2/en
Priority to PCT/US2014/049232 priority patent/WO2016018390A1/en
Publication of WO2016018390A1 publication Critical patent/WO2016018390A1/en
Anticipated expiration legal-status Critical
Ceased legal-status Critical Current

Links

Classifications

    • G—PHYSICS
    • G06—COMPUTING OR CALCULATING; COUNTING
    • G06F—ELECTRIC DIGITAL DATA PROCESSING
    • G06F21/00—Security arrangements for protecting computers, components thereof, programs or data against unauthorised activity
    • G06F21/50—Monitoring users, programs or devices to maintain the integrity of platforms, e.g. of processors, firmware or operating systems
    • G06F21/57—Certifying or maintaining trusted computer platforms, e.g. secure boots or power-downs, version controls, system software checks, secure updates or assessing vulnerabilities
    • G06F21/572—Secure firmware programming, e.g. of basic input output system [BIOS]
    • G—PHYSICS
    • G06—COMPUTING OR CALCULATING; COUNTING
    • G06F—ELECTRIC DIGITAL DATA PROCESSING
    • G06F21/00—Security arrangements for protecting computers, components thereof, programs or data against unauthorised activity
    • G06F21/30—Authentication, i.e. establishing the identity or authorisation of security principals
    • G06F21/45—Structures or tools for the administration of authentication
    • G06F21/46—Structures or tools for the administration of authentication by designing passwords or checking the strength of passwords
    • G—PHYSICS
    • G06—COMPUTING OR CALCULATING; COUNTING
    • G06F—ELECTRIC DIGITAL DATA PROCESSING
    • G06F21/00—Security arrangements for protecting computers, components thereof, programs or data against unauthorised activity
    • G06F21/50—Monitoring users, programs or devices to maintain the integrity of platforms, e.g. of processors, firmware or operating systems
    • G06F21/57—Certifying or maintaining trusted computer platforms, e.g. secure boots or power-downs, version controls, system software checks, secure updates or assessing vulnerabilities
    • G06F21/575—Secure boot
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L63/00—Network architectures or network communication protocols for network security
    • H04L63/08—Network architectures or network communication protocols for network security for authentication of entities
    • H04L63/083—Network architectures or network communication protocols for network security for authentication of entities using passwords
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L63/00—Network architectures or network communication protocols for network security
    • H04L63/10—Network architectures or network communication protocols for network security for controlling access to devices or network resources
    • H04L63/102—Entity profiles
    • G—PHYSICS
    • G06—COMPUTING OR CALCULATING; COUNTING
    • G06F—ELECTRIC DIGITAL DATA PROCESSING
    • G06F2221/00—Indexing scheme relating to security arrangements for protecting computers, components thereof, programs or data against unauthorised activity
    • G06F2221/03—Indexing scheme relating to G06F21/50, monitoring users, programs or devices to maintain the integrity of platforms
    • G06F2221/034—Test or assess a computer or a system

Definitions

  • BIOS Basic Input/Output System
  • BIOS User Privilege Control runs on a system processor, which uses BIOS to perform user authentications.
  • BIOS User Privilege Control comprises User Privilege and User Authentication.
  • User privilege can be read from Non-volatile random- access memory (NVRAM) or written to NVRAM by BIOS.
  • User Authentication depends on saved User Privilege.
  • BIOS reads the valid passwords from an NVRAM and the user inputs the passwords from a keyboard.
  • the passwords may be a single string of a password or a list of passwords.
  • the BIOS compares the inputted passwords with the valid passwords.
  • the BIOS saves the new passwords and sets the user privilege on the BIOS NVRAM.
  • Such traditional methods handle the user privilege in an unsecured way due to the lack of anti-spy mechanism or encryption over the network. Any spy software may crack the BIOS passwords and then get power on or administration privileges, such that the hacker may obtain the control privilege of a server computer.
  • FIG. 1 A and 1B illustrate a block diagram of the firmware components for user privilege authentication in a server computer.
  • Figures 2A to 2C illustrate a flow chart of user privilege
  • FIG. 3 illustrates a flow chart of user privilege authentication handled by a Baseboard Management Controller (BMC).
  • BMC Baseboard Management Controller
  • Figure 4 illustrates a flow chart of three types of user privilege operation.
  • Figure 5 illustrates a flow chart for the BIOS keyboard driver under user privilege operation mode. DETAILED DESCRIPTION
  • the traditional BIOS User Privilege Control operation applies an unsecured method to handle the user privilege for the password authentication, such that a hacker may easily obtain the control privilege of server computers.
  • the present invention aims to solve the aforesaid issue and provides a different structure over the traditional methods in order to avoid that the BIOS passwords and the control privilege of the server computers being hacked.
  • the present application proposes methods and systems for securing BIOS passwords in a server computer under user privilege control operations.
  • the BIOS, system processor and system memory cannot access the actual passwords, so the spy software has no chance to discover the BIOS passwords.
  • the hacker cannot steal the passwords with any cracking methods, such as applying unauthorized applications or unauthorized option ROM (Read-Only Memory), to read the passwords from the BIOS NVRAM storage.
  • the proposed invention handles the BIOS User Privilege Control operation by a BMC firmware running in a baseboard management controller (BMC) instead of a BIOS firmware running in a system processor of a server computer.
  • BMC baseboard management controller
  • the proposed invention comprises a server computer system with a BMC.
  • the proposed invention comprises BIOS, BMC firmware and option ROM, which supports the Human Interface Infrastructure (HII) Configuration.
  • the passwords are stored by the BMC, so the BIOS does not need to keep, save or compare them.
  • Figure 1 illustrates a block diagram (100) of software components of BIOS, BMC firmware (150) and option ROM under user privilege operation mode (password mode).
  • the BIOS loads an HII configuration driver (120) embedded in the BIOS or the option ROM.
  • the HII configuration driver (120) provides an interface between the BIOS and the input devices controlled by a user, and communicates activities initiated by the user.
  • the HII configuration driver (120) initiates an HII setup browser (110), which provides the user with a visual browser including system setup options, and enables a keyboard driver (130) for the user to input instructions in order to check whether the user requests a BIOS user privilege control operation.
  • the BIOS firmware runs on a system processor (170).
  • the BIOS first loads a password mode driver (140) and requests the BMC firmware (150) to enter a password authentication mode for user privilege authentication.
  • the BMC firmware (150) runs on a BMC (180) instead of the system processor (170).
  • the BMC (180) is a specialized microcontroller embedded on a motherboard of a computer, generally a server, which supports the Intelligent Platform Management Interface (IPMI) architecture.
  • the BMC (180) manages the interface between system management software and platform hardware.
  • the keyboard driver (130) redirects keyboard events and scan codes to the BMC firmware (150), such that the BIOS and the system processor (170) do not acquire the actual scan codes and cannot access the actual passwords.
  • the BMC firmware (150) may further comprise a keyboard controller firmware, which processes the keyboard events inputted locally or remotely from an integrated remote console (160).
  • FIG. 1 illustrates a detailed flow chart (200) for the BIOS requesting the BMC firmware to enter a password authentication mode for user privilege authentication.
  • a user opens the password input box in an HII setup browser (201).
  • the BIOS gets the user’s instructions, chooses the UI operation and notifies the BMC to enter a password authentication mode (202).
  • the BMC enters the password authentication mode (203) and notifies the BIOS keyboard driver to also enter a password authentication mode (204).
  • the BIOS keyboard driver enters the password authentication mode and redirects keyboard events to the BMC instead of the BIOS (205).
  • the BMC receives and processes the keyboard events and the scan codes of the inputted strings (206).
  • the BMC exits the password input mode (207).
  • the BMC checks the passwords inputted by the user, compares the inputted passwords with valid passwords and sets the user privilege (208).
  • the BMC then notifies the BIOS of the authentication result and notifies the BIOS keyboard driver to exit the password authentication mode (208).
  • the BIOS keyboard driver exits the password authentication mode (209) and resumes the normal mode (210).
  • the BMC exits the password authentication mode and runs in the normal mode (211 ).
  • the BIOS processes the following UI operation in response to the user (212) and may inquire into the user’s privilege with the BMC if required (213).
  • Figure 3 illustrates a flow chart (300) of user privilege
  • the integrated remote console module provided by the BMC can be operated over a network via the integrated remote console. If a user enters instructions for set up user privilege in the BIOS of a server computer, the BIOS requests a BMC to enter a password
  • the BMC receives all of the keyboard events and passes fake scan codes to the BIOS, such that the BIOS cannot access the actual input scan codes (320).
  • the BMC encrypts the passwords and compares the inputted passwords with valid passwords stored in the BMC (330).
  • the BMC decides an authentication result after the aforesaid comparison and saves the authentication result (340).
  • the BMC exits the password authentication mode and notifies the BIOS of the authentication result (350).
  • Figure 4 illustrates three types of the authentication results under a BIOS user privilege control operation.
  • BIOS When the BIOS requests the BMC for user privilege authentication, the BIOS needs to indicate the type of the user privilege to be processed by a unique number, usually a GUID used by the UEFI BIOS.
  • the specified user privilege mechanism provides the option ROM with the ability to process the user privilege authentication.
  • the user privilege can be categorized as one of the followings (for example and not limited to): BIOS power on user privilege; BIOS administrator user privilege; BMC access user privilege; and specified option ROM user privilege. Different privileges provide different authorities for the control of the computer.
  • BIOS power on user privilege enables an authority for setting a specific time by a user, such that the computer can be automatically powered on at the aforesaid specific time.
  • the BIOS administrator user privilege enables an authority for a user to change the system setup options in the BIOS.
  • the BMC access user privilege enables an authority for a user to access the setting stored in the BMC.
  • the specified option ROM user privilege enables an authority for a user to change the setup options stored in the option ROM.
  • the authentication results (401) under a BIOS user privilege control operation may be“no password”,“password denied”, or“password granted”. If the user privilege is “no password” (402), the BIOS and BMC will process to set up the passwords (405). If the user privilege is“password denied” (403), the BIOS and BMC will process to verify the passwords (406).
  • FIG. 5 illustrates a flow chart (500) for the process of the BIOS keyboard driver under user privilege operation mode.
  • the BMC when the BMC enters the password authentication mode, the BMC notifies a BIOS keyboard driver to enter the password authentication mode (510).
  • the BIOS keyboard driver enters the password authentication mode (520) and redirects keyboard events to the BMC instead of the BIOS, such that the BIOS does not receive the key strings of the keyboard events (530).
  • the BMC Upon the BMC exiting the password authentication mode, the BMC notifies the BIOS keyboard driver to exit the password authentication mode (540).
  • the BIOS keyboard driver then resumes the normal mode (550).
  • any server computers and systems including the disclosed functionality of the BIOS and BMC may also secure the BIOS passwords and are also claimed by the present application.
  • BIOS, system processor and system memory cannot access the actual passwords, so the spy software has no chance to discover the BIOS passwords.
  • the hacker cannot steal the passwords with any codecrack methods, such as applying unauthorized applications or unauthorized option ROM, to read the passwords from the BIOS NVRAM storage. Accordingly, the present invention secures the user privilege for server computers and systems.
  • the aforesaid detailed descriptions illustrate the preferred embodiments of the present application. However, the scope of the claimed invention should not be limited by any of the above-described exemplary embodiments, but should be defined only in accordance with the following claims and their equivalents.

Landscapes

  • Engineering & Computer Science (AREA)
  • Computer Security & Cryptography (AREA)
  • Computer Hardware Design (AREA)
  • General Engineering & Computer Science (AREA)
  • Theoretical Computer Science (AREA)
  • Software Systems (AREA)
  • General Physics & Mathematics (AREA)
  • Physics & Mathematics (AREA)
  • Computing Systems (AREA)
  • Computer Networks & Wireless Communication (AREA)
  • Signal Processing (AREA)
  • Stored Programmes (AREA)
  • Storage Device Security (AREA)

Abstract

A method for securing BIOS passwords in a server computer under a BIOS user privilege control operation is disclosed. Said method comprises: a BIOS (Basic Input/Output System) of the server computer requesting a BMC (Baseboard Management Controller) to enter a password authentication mode for user privilege authentication; the BMC receiving passwords inputted by a user and comparing the inputted passwords with valid passwords, wherein the valid passwords are stored in the BMC; the BMC deciding an authentication result after the comparing the inputted passwords with the stored valid passwords and saving the authentication result; and the BMC exiting the password authentication mode and notifying the BIOS of the authentication result; wherein the BMC passes fake scan codes of key strings of the inputted passwords to the BIOS, such that the BIOS does not have access to the actual passwords.

Description

SECURE BIOS PASSWORD METHOD IN SERVER COMPUTER TECHNICAL FIELD [0001] The present application relates to user privilege control operations. In particular, the present application relates to methods and systems for securing Basic Input/Output System (BIOS) passwords in a server computer under user privilege control operations, and the server computer thereof. BACKGROUND [0002] In a server computer, the traditional BIOS User Privilege Control operation runs on a system processor, which uses BIOS to perform user authentications. BIOS User Privilege Control comprises User Privilege and User Authentication. User privilege can be read from Non-volatile random- access memory (NVRAM) or written to NVRAM by BIOS. User Authentication depends on saved User Privilege. [0003] In traditional methods, BIOS reads the valid passwords from an NVRAM and the user inputs the passwords from a keyboard. The passwords may be a single string of a password or a list of passwords. The BIOS compares the inputted passwords with the valid passwords. When the user changes the passwords, the BIOS saves the new passwords and sets the user privilege on the BIOS NVRAM. [0004] Such traditional methods handle the user privilege in an unsecured way due to the lack of anti-spy mechanism or encryption over the network. Any spy software may crack the BIOS passwords and then get power on or administration privileges, such that the hacker may obtain the control privilege of a server computer. In a server group, which uses one global set of passwords for all server computers, if the hacker steals the passwords from a server computer in the server group, he/she can then obtain the control privilege of all of the server computers in the group and steal any data in the whole group. BRIEF DESCRIPTION OF THE DRAWINGS [0005] Various features and advantages of the disclosed embodiments will be apparent from the detailed description which follows, taken in conjunction with the accompanying drawings, which together illustrate, by way of example, features of the disclosed embodiments. [0006] Figures 1 A and 1B illustrate a block diagram of the firmware components for user privilege authentication in a server computer. [0007] Figures 2A to 2C illustrate a flow chart of user privilege
authentication. [0008] Figure 3 illustrates a flow chart of user privilege authentication handled by a Baseboard Management Controller (BMC). [0009] Figure 4 illustrates a flow chart of three types of user privilege operation. [0010] Figure 5 illustrates a flow chart for the BIOS keyboard driver under user privilege operation mode. DETAILED DESCRIPTION [0011] As described above, the traditional BIOS User Privilege Control operation applies an unsecured method to handle the user privilege for the password authentication, such that a hacker may easily obtain the control privilege of server computers. The present invention aims to solve the aforesaid issue and provides a different structure over the traditional methods in order to avoid that the BIOS passwords and the control privilege of the server computers being hacked. [0012] The present application proposes methods and systems for securing BIOS passwords in a server computer under user privilege control operations. According to the present invention, the BIOS, system processor and system memory cannot access the actual passwords, so the spy software has no chance to discover the BIOS passwords. According to the present invention, the hacker cannot steal the passwords with any cracking methods, such as applying unauthorized applications or unauthorized option ROM (Read-Only Memory), to read the passwords from the BIOS NVRAM storage. [0013] The proposed invention handles the BIOS User Privilege Control operation by a BMC firmware running in a baseboard management controller (BMC) instead of a BIOS firmware running in a system processor of a server computer. From the hardware’s aspect, the proposed invention comprises a server computer system with a BMC. From the firmware’s aspect, the proposed invention comprises BIOS, BMC firmware and option ROM, which supports the Human Interface Infrastructure (HII) Configuration. The passwords are stored by the BMC, so the BIOS does not need to keep, save or compare them. [0014] Figure 1 illustrates a block diagram (100) of software components of BIOS, BMC firmware (150) and option ROM under user privilege operation mode (password mode). The BIOS loads an HII configuration driver (120) embedded in the BIOS or the option ROM. The HII configuration driver (120) provides an interface between the BIOS and the input devices controlled by a user, and communicates activities initiated by the user. The HII configuration driver (120) initiates an HII setup browser (110), which provides the user with a visual browser including system setup options, and enables a keyboard driver (130) for the user to input instructions in order to check whether the user requests a BIOS user privilege control operation. When the system runs in a normal mode instead of a password mode, the BIOS firmware runs on a system processor (170). However, if the user enters instructions to request a BIOS user privilege control operation, the system will then enter the password mode for user privilege authentication. The BIOS first loads a password mode driver (140) and requests the BMC firmware (150) to enter a password authentication mode for user privilege authentication. The BMC firmware (150) runs on a BMC (180) instead of the system processor (170). The BMC (180) is a specialized microcontroller embedded on a motherboard of a computer, generally a server, which supports the Intelligent Platform Management Interface (IPMI) architecture. The BMC (180) manages the interface between system management software and platform hardware. In the password mode, the keyboard driver (130) redirects keyboard events and scan codes to the BMC firmware (150), such that the BIOS and the system processor (170) do not acquire the actual scan codes and cannot access the actual passwords. The BMC firmware (150) may further comprise a keyboard controller firmware, which processes the keyboard events inputted locally or remotely from an integrated remote console (160). [0015] Under the aforesaid structure, when the user requests the password check operation locally, authentication operation will be handled by the BMC firmware (150) instead of the BIOS firmware running in a system processor of the server computer. When the user requests the password check operation and inputs the passwords remotely from the integrated remote console (160), the inputted passwords sent from the remote console (160) will be encrypted over a network. [0016] Figure 2 illustrates a detailed flow chart (200) for the BIOS requesting the BMC firmware to enter a password authentication mode for user privilege authentication. According to the present invention, a user opens the password input box in an HII setup browser (201). The BIOS gets the user’s instructions, chooses the UI operation and notifies the BMC to enter a password authentication mode (202). The BMC enters the password authentication mode (203) and notifies the BIOS keyboard driver to also enter a password authentication mode (204). The BIOS keyboard driver enters the password authentication mode and redirects keyboard events to the BMC instead of the BIOS (205). The BMC receives and processes the keyboard events and the scan codes of the inputted strings (206). After the user completes the input of the passwords, the BMC exits the password input mode (207). The BMC checks the passwords inputted by the user, compares the inputted passwords with valid passwords and sets the user privilege (208). The BMC then notifies the BIOS of the authentication result and notifies the BIOS keyboard driver to exit the password authentication mode (208). The BIOS keyboard driver exits the password authentication mode (209) and resumes the normal mode (210). The BMC exits the password authentication mode and runs in the normal mode (211 ). The BIOS processes the following UI operation in response to the user (212) and may inquire into the user’s privilege with the BMC if required (213). [0017] Figure 3 illustrates a flow chart (300) of user privilege
authentication handled by a BMC. The method for user privilege
authentication can be processed locally by a BMC or remotely from an integrated remote console. The integrated remote console module provided by the BMC can be operated over a network via the integrated remote console. If a user enters instructions for set up user privilege in the BIOS of a server computer, the BIOS requests a BMC to enter a password
authentication mode (310). The BMC receives all of the keyboard events and passes fake scan codes to the BIOS, such that the BIOS cannot access the actual input scan codes (320). When the user completes the input of the passwords, the BMC encrypts the passwords and compares the inputted passwords with valid passwords stored in the BMC (330). The BMC decides an authentication result after the aforesaid comparison and saves the authentication result (340). Finally, the BMC exits the password authentication mode and notifies the BIOS of the authentication result (350). [0018] Figure 4 illustrates three types of the authentication results under a BIOS user privilege control operation. When the BIOS requests the BMC for user privilege authentication, the BIOS needs to indicate the type of the user privilege to be processed by a unique number, usually a GUID used by the UEFI BIOS. The specified user privilege mechanism provides the option ROM with the ability to process the user privilege authentication. The user privilege can be categorized as one of the followings (for example and not limited to): BIOS power on user privilege; BIOS administrator user privilege; BMC access user privilege; and specified option ROM user privilege. Different privileges provide different authorities for the control of the computer. The BIOS power on user privilege enables an authority for setting a specific time by a user, such that the computer can be automatically powered on at the aforesaid specific time. The BIOS administrator user privilege enables an authority for a user to change the system setup options in the BIOS. The BMC access user privilege enables an authority for a user to access the setting stored in the BMC. The specified option ROM user privilege enables an authority for a user to change the setup options stored in the option ROM. The authentication results (401) under a BIOS user privilege control operation may be“no password”,“password denied”, or“password granted”. If the user privilege is “no password” (402), the BIOS and BMC will process to set up the passwords (405). If the user privilege is“password denied” (403), the BIOS and BMC will process to verify the passwords (406). If the user privilege is“password granted” (404), the BIOS and BMC will process to change or clear the passwords (407). [0019] Figure 5 illustrates a flow chart (500) for the process of the BIOS keyboard driver under user privilege operation mode. According to the present invention, when the BMC enters the password authentication mode, the BMC notifies a BIOS keyboard driver to enter the password authentication mode (510). The BIOS keyboard driver enters the password authentication mode (520) and redirects keyboard events to the BMC instead of the BIOS, such that the BIOS does not receive the key strings of the keyboard events (530). Upon the BMC exiting the password authentication mode, the BMC notifies the BIOS keyboard driver to exit the password authentication mode (540). The BIOS keyboard driver then resumes the normal mode (550). [0020] According to the illustrated operations for BIOS user privilege authentication, any server computers and systems including the disclosed functionality of the BIOS and BMC may also secure the BIOS passwords and are also claimed by the present application. According to the present invention, BIOS, system processor and system memory cannot access the actual passwords, so the spy software has no chance to discover the BIOS passwords. According to the present invention, the hacker cannot steal the passwords with any codecrack methods, such as applying unauthorized applications or unauthorized option ROM, to read the passwords from the BIOS NVRAM storage. Accordingly, the present invention secures the user privilege for server computers and systems. [0021] The aforesaid detailed descriptions illustrate the preferred embodiments of the present application. However, the scope of the claimed invention should not be limited by any of the above-described exemplary embodiments, but should be defined only in accordance with the following claims and their equivalents.

Claims

Claims What is claimed is: 1. A method for securing Basic Input/Output System (BIOS) passwords in a server computer under a BIOS user privilege control operation, comprising: requesting a Baseboard Management Controller (BMC) to enter a password authentication mode for user privilege authentication;
receiving passwords inputted by a user and comparing the inputted passwords with valid passwords by the BMC, wherein the valid passwords are stored in the BMC;
deciding an authentication result by the BMC after the comparing the inputted passwords with the stored valid passwords, and saving the authentication result into the BMC; and
exiting the password authentication mode for the BMC and notifying the BIOS of the authentication result by the BMC;
wherein the BMC passes fake scan codes of key strings of the inputted passwords to the BIOS , such that the BIOS cannot access the actual passwords.
2. The method of claim 1 , wherein the BMC processes the user privilege authentication locally when the user uses a local keyboard or remotely when the user performs a password check operation over a network from a remote console.
3. The method of claim 2, wherein the inputted passwords sent from the remote console over a network are encrypted.
4. The method of claim 1, wherein the authentication result comprises: no password; password denied; or password granted.
5. The method of claim 1 , further comprising:
notifying a BIOS keyboard driver to enter the password authentication mode from a normal mode; entering the password authentication mode for the BIOS keyboard driver and redirecting keyboard events to the BMC instead of the BIOS, such that the BIOS does not receive the key strings of the keyboard events;
upon exiting the password authentication mode for the BMC, notifying the BIOS keyboard driver to exit the password authentication mode by the BMC; and
resuming the normal mode for the BIOS keyboard driver.
6. A system for securing Basic Input/Output System (BIOS) passwords in a server computer under a BIOS user privilege control operation, comprising: a BIOS including a Human Interface Infrastructure (HII) configuration driver, wherein the BIOS loads the HII configuration driver to check whether a user requests the BIOS user privilege control operation; and
a Baseboard Management Controller (BMC) embedded in the server computer, the BMC receiving a request from the BIOS to enter a password authentication mode when the user requests the BIOS user privilege control operation;
wherein the BMC receives passwords inputted by a user and compares the inputted passwords with valid passwords after entering the password authentication mode, the valid passwords are stored in the BMC, and the BMC passes fake scan codes of key strings of the inputted passwords to the BIOS , such that the BIOS cannot access the actual passwords,
the BMC decides an authentication result after the comparing the inputted passwords with the stored valid passwords and saves the
authentication result, and
the BMC exits the password authentication mode and notifies the BIOS of the authentication result.
7. The system of claim 6, wherein the BMC processes the user privilege authentication locally when the user uses a local keyboard or remotely when the user performs a password check operation over a network from a remote console.
8. The system of claim 7, wherein the inputted passwords sent from the remote console over a network are encrypted.
9. The system of claim 6, wherein the authentication result comprises: no password; password denied; or password granted.
10. The system of claim 6, wherein the BIOS further comprises a BIOS keyboard driver, and the BMC notifies the BIOS keyboard driver to enter the password authentication mode from a normal mode;
the BIOS keyboard driver enters the password authentication mode and redirects keyboard events to the BMC instead of the BIOS, such that the BIOS does not receive the key strings of the keyboard events;
upon the BMC exiting the password authentication mode, the BMC notifies the BIOS keyboard driver to exit the password authentication mode; and
the BIOS keyboard driver resumes the normal mode.
11. The system of claim 6, wherein the server computer is included in the system and comprises a storage device storing the BIOS.
12. A non-transitory computer-readable storage medium storing instructions for executing a method for securing Basic Input/Output System (BIOS) passwords in a server computer under a BIOS user privilege control operation, when the instructions are executed by the server computer, cause the server computer to:
requesting a Baseboard Management Controller (BMC) to enter a password authentication mode for user privilege authentication;
receiving passwords inputted by a user and comparing the inputted passwords with valid passwords by the BMC, wherein the valid passwords are stored in the BMC;
deciding an authentication result by the BMC after the comparing the inputted passwords with the stored valid passwords, and saving the authentication result into the BMC; and exiting the password authentication mode for the BMC and notifying the BIOS of the authentication result by the BMC;
wherein the BMC passes fake scan codes of key strings of the inputted passwords to the BIOS , such that the BIOS cannot access the actual passwords.
13. The non-transitory computer-readable storage medium of claim 12, wherein the BMC processes the user privilege authentication locally when the user uses a local keyboard or remotely when the user performs a password check operation over a network from a remote console.
14. The non-transitory computer-readable storage medium of claim 13, wherein the inputted passwords sent from the remote console over a network are encrypted.
15. The non-transitory computer-readable storage medium of claim 12, wherein the authentication result comprises: no password; password denied; or password granted.
16. The non-transitory computer-readable storage medium of claim 12, further cause the server computer to:
notifying a BIOS keyboard driver to enter the password authentication mode from a normal mode;
entering the password authentication mode for the BIOS keyboard driver and redirecting keyboard events to the BMC instead of the BIOS, such that the BIOS does not receive the key strings of the keyboard events;
upon exiting the password authentication mode for the BMC, notifying the BIOS keyboard driver to exit the password authentication mode by the BMC; and
resuming the normal mode for the BIOS keyboard driver.
PCT/US2014/049232 2014-07-31 2014-07-31 Secure bios password method in server computer Ceased WO2016018390A1 (en)

Priority Applications (2)

Application Number Priority Date Filing Date Title
US15/325,299 US10216937B2 (en) 2014-07-31 2014-07-31 Secure BIOS password method in server computer
PCT/US2014/049232 WO2016018390A1 (en) 2014-07-31 2014-07-31 Secure bios password method in server computer

Applications Claiming Priority (1)

Application Number Priority Date Filing Date Title
PCT/US2014/049232 WO2016018390A1 (en) 2014-07-31 2014-07-31 Secure bios password method in server computer

Publications (1)

Publication Number Publication Date
WO2016018390A1 true WO2016018390A1 (en) 2016-02-04

Family

ID=55218104

Family Applications (1)

Application Number Title Priority Date Filing Date
PCT/US2014/049232 Ceased WO2016018390A1 (en) 2014-07-31 2014-07-31 Secure bios password method in server computer

Country Status (2)

Country Link
US (1) US10216937B2 (en)
WO (1) WO2016018390A1 (en)

Cited By (5)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
GB2559831A (en) * 2017-02-21 2018-08-22 Google Llc Integrated second factor authentication
CN110909344A (en) * 2019-12-02 2020-03-24 联想(北京)有限公司 Control method and device
US11443036B2 (en) * 2019-07-30 2022-09-13 Hewlett Packard Enterprise Development Lp Facial recognition based security by a management controller
CN117056883A (en) * 2022-05-03 2023-11-14 昆达电脑科技(昆山)有限公司 Password management method for basic input and output systems and baseboard management controllers
US20240362305A1 (en) * 2023-04-26 2024-10-31 Lenovo Enterprise Solutions (Singapore) Pte Ltd. Unlocking a locked firmware setup utility using multi-factor authentication supported by a baseboard management controller

Families Citing this family (11)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
US10462664B2 (en) * 2017-08-02 2019-10-29 Dell Products, Lp System and method for control of baseboard management controller ports
WO2019117920A1 (en) * 2017-12-14 2019-06-20 Hewlett-Packard Development Company, L.P. Enabling access to capturing devices by basic input and output systems (bios)
WO2020027791A1 (en) * 2018-07-31 2020-02-06 Hewlett-Packard Development Company, L.P. Password updates
US20230169171A1 (en) * 2020-05-11 2023-06-01 Intel Corporation Os-managed bios modules
US12184765B2 (en) * 2020-08-07 2024-12-31 Charter Communications Operating, Llc Password security hardware module
CN114301610B (en) * 2020-09-21 2022-11-08 华为技术有限公司 Method and equipment for identifying computer with defect
CN112559004A (en) * 2020-11-19 2021-03-26 山东云海国创云计算装备产业创新中心有限公司 BIOS upgrading method, device, equipment and medium
CN114003876B (en) * 2021-09-28 2023-11-03 苏州浪潮智能科技有限公司 Method, device, electronic equipment and medium for accessing BIOS password
CN114281890B (en) * 2021-11-26 2024-01-19 苏州浪潮智能科技有限公司 A BIOS out-of-band management system and method
TWI796194B (en) * 2022-04-01 2023-03-11 神雲科技股份有限公司 Password management method for bios and bmc
CN120850276A (en) * 2024-04-26 2025-10-28 戴尔产品有限公司 Method, device and computer program product for verifying a password

Citations (5)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
US20040268140A1 (en) * 2003-06-26 2004-12-30 Zimmer Vincent J. Method and system to support network port authentication from out-of-band firmware
US20080162956A1 (en) * 2006-12-27 2008-07-03 Bozek James J Method of Power State Control for a ClientBlades™ in a BladeCenter™ System
US20110083003A1 (en) * 2009-10-06 2011-04-07 Jaber Muhammed K System And Method For Safe Information Handling System Boot
US20130091260A1 (en) * 2011-10-11 2013-04-11 International Business Machines Corporation Out-Of-Band Management Of Third Party Adapter Configuration Settings In A Computing System
JP2013161210A (en) * 2012-02-03 2013-08-19 Nec Computertechno Ltd Information processing device, method for acquiring information, and program

Family Cites Families (6)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
US7619544B2 (en) 2005-10-27 2009-11-17 Hewlett-Packard Development Company, L.P. BIOS password security using modified scan codes
JP2007156587A (en) * 2005-12-01 2007-06-21 Hitachi Ltd Power supply control method and system for realizing the same
JP4736140B2 (en) 2009-04-03 2011-07-27 日本電気株式会社 Authentication device, server system, authentication method, authentication program
WO2012000092A1 (en) * 2010-06-28 2012-01-05 Lionstone Capital Corporation Seamless end-to-end data obfuscation and encryption
CN102479302A (en) * 2010-11-24 2012-05-30 鸿富锦精密工业（深圳）有限公司 Password protection system and method
US20130019281A1 (en) 2011-07-11 2013-01-17 Cisco Technology, Inc. Server Based Remote Authentication for BIOS

Patent Citations (5)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
US20040268140A1 (en) * 2003-06-26 2004-12-30 Zimmer Vincent J. Method and system to support network port authentication from out-of-band firmware
US20080162956A1 (en) * 2006-12-27 2008-07-03 Bozek James J Method of Power State Control for a ClientBlades™ in a BladeCenter™ System
US20110083003A1 (en) * 2009-10-06 2011-04-07 Jaber Muhammed K System And Method For Safe Information Handling System Boot
US20130091260A1 (en) * 2011-10-11 2013-04-11 International Business Machines Corporation Out-Of-Band Management Of Third Party Adapter Configuration Settings In A Computing System
JP2013161210A (en) * 2012-02-03 2013-08-19 Nec Computertechno Ltd Information processing device, method for acquiring information, and program

Cited By (11)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
GB2559831A (en) * 2017-02-21 2018-08-22 Google Llc Integrated second factor authentication
CN108460255A (en) * 2017-02-21 2018-08-28 谷歌有限责任公司 Integrated second-factor authentication
GB2559831B (en) * 2017-02-21 2019-11-20 Google Llc Integrated second factor authentication
CN108460255B (en) * 2017-02-21 2022-04-12 谷歌有限责任公司 Integrated second factor authentication
US11394704B2 (en) 2017-02-21 2022-07-19 Google Llc Integrated second factor authentication
US11443036B2 (en) * 2019-07-30 2022-09-13 Hewlett Packard Enterprise Development Lp Facial recognition based security by a management controller
CN110909344A (en) * 2019-12-02 2020-03-24 联想(北京)有限公司 Control method and device
CN110909344B (en) * 2019-12-02 2022-03-25 联想(北京)有限公司 Control method and device
CN117056883A (en) * 2022-05-03 2023-11-14 昆达电脑科技(昆山)有限公司 Password management method for basic input and output systems and baseboard management controllers
US20240362305A1 (en) * 2023-04-26 2024-10-31 Lenovo Enterprise Solutions (Singapore) Pte Ltd. Unlocking a locked firmware setup utility using multi-factor authentication supported by a baseboard management controller
US12511355B2 (en) * 2023-04-26 2025-12-30 Lenovo Enterprise Solutions (Singapore) Pte Ltd. Unlocking a locked firmware setup utility using multi-factor authentication supported by a baseboard management controller

Also Published As

Publication number Publication date
US10216937B2 (en) 2019-02-26
US20170185780A1 (en) 2017-06-29

Similar Documents

Publication Publication Date Title
US10216937B2 (en) Secure BIOS password method in server computer
US8348157B2 (en) Dynamic remote peripheral binding
CN107292176B (en) Method and system for accessing a trusted platform module of a computing device
US20170323095A1 (en) Method and system for enterprise network single-sign-on by a manageability engine
US7581111B2 (en) System, method and apparatus for transparently granting access to a selected device using an automatically generated credential
US20100083002A1 (en) Method and System for Secure Booting Unified Extensible Firmware Interface Executables
US11269984B2 (en) Method and apparatus for securing user operation of and access to a computer system
US10037418B2 (en) Pre-boot authentication credential sharing system
TW201721416A (en) System and method for managing BIOS settings and non-transitory computer-readable medium
WO2016110101A1 (en) Fingerprint authentication method and device, intelligent terminal, and computer storage medium
CN102449631A (en) System and method for performing a management operation
US20150242609A1 (en) Universal Authenticator Across Web and Mobile
US20190306155A1 (en) Generating cryptographic keys using supplemental authentication data
JP4541263B2 (en) Remote security enabling system and method
US9286459B2 (en) Authorized remote access to an operating system hosted by a virtual machine
CN114766084B (en) Automatically control re-registration of managed devices
US20190182229A1 (en) Advanced application security utilizing an application key
US12235975B2 (en) Quick management action system
WO2019088975A1 (en) Regulating access
WO2013115773A1 (en) Secure information access over network
EP2966586A1 (en) System and method for managing application passwords
KR102428409B1 (en) User authentication device, user authentication method using security code and computer program
CN104361275A (en) A root user login method for managing Linux systems
US20190171820A1 (en) Securing Resumption from Sleep Mode Using a Storage Medium Authentication Credential
CN101025769B (en) Method for configuring multi-user security chip resources and multi-user security system

Legal Events

Date Code Title Description
121 Ep: the epo has been informed by wipo that ep was designated in this application

Ref document number: 14898487

Country of ref document: EP

Kind code of ref document: A1

WWE Wipo information: entry into national phase

Ref document number: 15325299

Country of ref document: US

NENP Non-entry into the national phase

Ref country code: DE

122 Ep: pct application non-entry in european phase

Ref document number: 14898487

Country of ref document: EP

Kind code of ref document: A1