WO2024131018A1

WO2024131018A1 - Verification method and apparatus for server

Info

Publication number: WO2024131018A1
Application number: PCT/CN2023/104191
Authority: WO
Inventors: 许鑫; 吴保锡; 韩春超; 徐国振; 崔士伟; 王传国
Original assignee: 苏州元脑智能科技有限公司
Priority date: 2022-12-19
Filing date: 2023-06-29
Publication date: 2024-06-27

Abstract

A verification method and apparatus for a server. The method comprises: in the situation in which a power supply of an in-band management system is on, determining whether initialization data of a basic input/output system in the in-band management system is complete or not, and obtaining a determination result; if the determination result indicates yes, outputting a power-on command to the in-band management system, so that the basic input/output system operates and sends measurement chain information; and, according to received measurement chain information, verifying the integrity of components except for the initialization data of the basic input/output system in the in-band management system. By using the described method, the problem that a substrate management controller cannot acquire the integrity of other components is solved, thus the substrate management controller can verify the integrity of board cards and components in a basic input/output system and a server.

Description

Authentication method and device for server

CROSS-REFERENCE TO RELATED APPLICATIONS

This application claims priority to a Chinese patent application filed with the China Patent Office on December 19, 2022, with application number 202211634914.4 and application name “Authentication Method and Device for Server”, all contents of which are incorporated by reference in this application.

Technical Field

Embodiments of the present application relate to the field of server security, and in particular, to a verification method, a verification device, a non-volatile readable storage medium, and an electronic device for a server.

Background technique

With the rise of cloud computing and big data, servers are carrying more and more computing power. As the basic unit of the data center, servers run important information such as business systems and user data. Once the server hardware is maliciously tampered with, the information in the server will also face the risk of being tampered with and stolen.

The root of trust is a passively called security hardware that requires the call of firmware to complete the integrity collection and integrity verification operations. Therefore, it is necessary to ensure the security of the code that initially uses the root of trust in order to ensure the security and trustworthiness of the subsequent root of trust behavior. At present, the detection of the first section of running code on the server relies on specific CPU (Central Processing Unit) functions (such as Intel PFR technology or Intel TXT technology), which are not compatible with all processors; or use the baseboard management controller (Baseboard Management Controller, BMC) to verify the Basic Input Output System (Basic Input Output System, BIOS) technology, but the BMC verification of BIOS technology is only valid when loading the BIOS firmware, and can only verify the BIOS firmware itself, and cannot obtain the integrity of other components, such as Raid (Redundant Arrays of Independent Disks) cards, graphics cards, operating system kernels, etc.

Based on this, how to verify the integrity of components in the server other than the BIOS firmware and ensure the security and reliability of the hardware environment when the operating system is running is a technical problem that urgently needs to be solved.

Summary of the invention

The embodiments of the present application provide a verification method, a verification device, a non-volatile readable storage medium, and an electronic device for a server, so as to at least solve the problem in the related art that the integrity of components other than BIOS firmware in the server cannot be verified.

According to an embodiment of the present application, a verification method for a server is provided, the verification method is applied to a baseboard management controller, the server includes an in-band management system, the verification method includes: when the power state of the in-band management system is a startup state, judging whether the initialization data of the basic input/output system in the in-band management system is complete, and obtaining a judgment result; when the judgment result indicates that the initialization data of the basic input/output system in the in-band management system is complete, outputting a power-on instruction to the in-band management system, so that the basic input/output system runs, and sending measurement chain information; Based on the received metric chain information, the integrity of components in the in-band management system except for the initialization data of the basic input and output system is verified.

In an exemplary embodiment, the verification method further includes: before determining whether the initialization data of the basic input and output system in the in-band management system is complete, detecting the power state of the in-band management system, wherein the power state includes: startup state, running state, and power-off state.

In an exemplary embodiment, determining whether initialization data of a basic input/output system in an in-band management system is complete to obtain a determination result includes: calculating a measurement value of the initialization data of the basic input/output system to obtain measurement value information; and determining whether the measurement value information is complete based on a reference value library to obtain a determination result, wherein the reference value library includes integrity values of multiple basic input/output system components corresponding to the basic input/output system.

In an exemplary embodiment, the verification method also includes: obtaining a basic input/output system update request and an updated BIOS file, wherein the BIOS file includes updated integrity values of multiple basic input/output system components; parsing the BIOS file according to the update request to obtain a set of integrity values corresponding to the update request; and using the integrity value set to update a baseline value library.

In an exemplary embodiment, the verification method further includes: when the judgment result indicates that the initialization data of the BIOS in the in-band management system is incomplete, powering off components in the in-band management system except the initialization data of the BIOS.

In an exemplary embodiment, the verification method further includes: sending measurement value information to a basic input/output system, so that the basic input/output system generates measurement chain information according to the measurement value information and integrity information of components in the in-band management system except for the initialization data of the basic input/output system.

In an exemplary embodiment, sending measurement value information to a basic input/output system includes: exchanging a session key with the basic input/output system to obtain a first key, and allowing the basic input/output system to obtain a second key; encrypting the measurement value information using the second key to generate a measurement value ciphertext; sending the measurement value ciphertext to the basic input/output system, so that the basic input/output system decrypts the measurement value ciphertext according to the second key to obtain the measurement value information.

In an exemplary embodiment, the above-mentioned verification method also includes: before verifying the integrity of components other than the initialization data of the basic input/output system in the in-band management system according to the measurement chain information, using the first key to decrypt the measurement chain ciphertext to obtain the measurement chain information, wherein the basic input/output system obtains the measurement chain ciphertext according to the measurement value information and the integrity information of the components other than the initialization data of the basic input/output system in the in-band management system.

In an exemplary embodiment, the verification method also includes: recording a first moment when the measurement value information is sent to a basic input/output system, and a second moment when the measurement chain information is received; determining whether a time difference between the first moment and the second moment is greater than a preset threshold; and when the determination result indicates that the time difference between the first moment and the second moment is greater than the preset threshold, performing a power-off operation on components in the in-band management system except for the initialization data of the basic input/output system.

According to another embodiment of the present application, another verification method for a server is provided, the server includes an in-band management system, the verification method is applied to a basic input/output system in the in-band management system, the verification method includes: when the power state of the in-band management system is a startup state, sending a startup signal to a baseboard management controller, so that the baseboard management controller determines whether the initialization data of the basic input/output system is complete, and outputs a power-on instruction when the judgment result indicates that the initialization data of the basic input/output system is complete; when the power-on instruction is received, controlling the basic input/output system to run, and sending measurement chain information to the baseboard management controller, so that the baseboard management controller verifies the components in the in-band management system except the initialization data of the basic input/output system according to the received measurement chain information. The integrity of the parts.

In an exemplary embodiment, the verification method further includes: when the judgment result indicates that the initialization data of the basic input/output system is incomplete, receiving a control signal sent by the baseboard management controller, the control signal being used to control power-off of components in the in-band management system except for the initialization data of the basic input/output system.

In an exemplary embodiment, the above-mentioned verification method also includes: sending a basic input/output system update request and an updated BIOS file to a baseboard management controller, so that the baseboard management controller parses the BIOS file according to the update request, obtains a set of integrity values corresponding to the update request, and uses the integrity value set to update the baseline value library, wherein the BIOS file includes updated integrity values of multiple basic input/output system components.

In an exemplary embodiment, the verification method also includes: receiving measurement value information sent by a baseboard management controller, wherein the measurement value information includes the measurement value of the initialization data of the basic input and output system; obtaining the integrity information of the components in the in-band management system except the initialization data of the basic input and output system; and generating measurement chain information based on the measurement value information and the integrity information.

In an exemplary embodiment, receiving measurement value information sent by a baseboard management controller includes: exchanging a session key with the baseboard management controller to obtain a second key, and allowing the baseboard management controller to obtain a first key, wherein the second key is used to encrypt the measurement value information to generate a measurement value ciphertext; and using the second key to decrypt the measurement value ciphertext to obtain the measurement value information.

In an exemplary embodiment, sending measurement chain information to a baseboard management controller includes: encrypting the measurement chain information using a first key to obtain a measurement chain ciphertext; sending the measurement chain ciphertext to the baseboard management controller, so that the baseboard management controller decrypts the measurement chain ciphertext using the first key to obtain the measurement chain information.

In an exemplary embodiment, the verification method further includes: receiving a control signal sent by a baseboard management controller when a time difference between a first moment and a second moment is greater than a preset threshold, wherein the first moment is a moment when measurement value information sent by the baseboard management controller is received, and the second moment is a moment when measurement chain information is sent to the baseboard management controller, and the control signal is used to control the power-off of components in the in-band management system except for the initialization data of the basic input and output system.

According to another embodiment of the present application, a verification device for a server is provided, the verification device is applied to a baseboard management controller, the server includes an in-band management system, the verification device includes: a judgment module, which is used to judge whether the initialization data of the basic input-output system in the in-band management system is complete when the power state of the in-band management system is the startup state, and obtain a judgment result; an output module, which is used to output a power-on instruction to the in-band management system when the judgment result indicates that the initialization data of the basic input-output system in the in-band management system is complete, so that the basic input-output system runs and sends measurement chain information; a verification module, which is used to verify the integrity of components in the in-band management system except the initialization data of the basic input-output system according to the received measurement chain information.

According to another embodiment of the present application, another verification device for a server is provided, which is applied to a basic input/output system in an in-band management system. The server includes the in-band management system, and the verification device includes: a first sending module, which is used to send a startup signal to a baseboard management controller when the power state of the in-band management system is a startup state, so that the baseboard management controller determines whether the initialization data of the basic input/output system is complete, and outputs a power-on instruction when the judgment result indicates that the initialization data of the basic input/output system is complete; a second sending module, which is used to control the operation of the basic input/output system when the power-on instruction is received, and send measurement chain information to the baseboard management controller, so that the baseboard management controller verifies the integrity of components in the in-band management system except the initialization data of the basic input/output system according to the received measurement chain information.

According to another embodiment of the present application, a non-volatile readable storage medium is provided, in which a computer program is stored, wherein the computer program is configured to execute the steps of any of the above method embodiments when running.

According to another embodiment of the present application, an electronic device is provided, including a memory and a processor, wherein a computer program is stored in the memory, and the processor is configured to run the computer program to execute the steps in any one of the above method embodiments.

Through the present application, before loading BIOS, the baseboard management controller (BMC) is first used to determine whether the initialization data of the basic input and output system (BIOS) in the in-band management system is complete, so that the integrity of the BootBlock (the boot block in the basic input and output system, which contains the minimum instruction set for booting) first run by the BIOS can be verified, thereby ensuring the security and reliability of the initial running state of the BIOS; after the BIOS is executed, the BMC receives the measurement chain collected during this startup and transmitted by the BIOS, and performs secondary verification to verify the integrity of other hardware, kernel and other components. Only after the integrity verification of the BIOS and other hardware, kernel and other components is completed can the operating system be started, so that the integrity of the BIOS and other components in the in-band management system can be verified in stages through the BMC, and the out-of-band manager can directly obtain the integrity status of the hardware, kernel and other components through the BMC without entering the in-band management system, thereby solving the problem that the BMC cannot obtain the integrity of other components (such as Raid cards, graphics cards, operating system kernels, etc.), and achieving the effect that the BMC can verify the integrity of the BIOS and other components in the server.

BRIEF DESCRIPTION OF THE DRAWINGS

FIG1 is a flow chart of a method for verifying integrity of a server according to an embodiment of the present application;

FIG2 is a system structure block diagram of a method for verifying the integrity of a server according to an embodiment of the present application;

3 is a flowchart of updating a reference value in a method for verifying integrity of a server according to an embodiment of the present application;

FIG4 is a startup timing diagram of a method for verifying integrity of a server according to an embodiment of the present application;

FIG5 is a schematic diagram of a complete process of an integrity verification method according to an embodiment of the present application;

FIG6 is a flow chart of another integrity verification method for a server according to an embodiment of the present application;

7 is a structural block diagram of an integrity verification device for a server according to an embodiment of the present application;

FIG8 is a structural block diagram of another integrity verification device for a server according to an embodiment of the present application.

Detailed ways

The embodiments of the present application will be described in detail below with reference to the accompanying drawings and in combination with the embodiments.

It should be noted that the terms "first", "second", etc. in the specification and claims of this application and the above-mentioned drawings are used to distinguish similar objects, and are not necessarily used to describe a specific order or sequence.

For the convenience of description, some nouns or terms involved in the embodiments of the present application are explained below:

Trusted root: A security device that provides trusted services according to relevant specifications. The currently released trusted root specifications include TPM (Trusted Platform Module) and TCM (Trusted Cryptography Module).

Baseboard Management Controller (BMC): A controller that is independent of the server computing The management unit of the unit is connected to the server computing unit through a hardware bus and is used to monitor the hardware status, operating status, etc. of the computer.

Basic Input Output System (BIOS): A program solidified in the memory chip, the first code executed by the computer's computing unit, generally used to complete computer hardware initialization, hardware self-test, and provide a hardware management interface for the operating system.

In-band management system: A system that uses a unified physical channel to transmit management control information and data information. In the server field, in-band management operations refer to the management of various hardware units within the server computing unit.

Out-of-bind management system: Management control information and data information are transmitted through different physical channels. The two are completely independent and do not affect each other. In the server field, out-of-band management operations refer to managing various hardware units on the server through the network services provided by BMC.

Management unit and computing unit: The management unit is used to monitor and control the status of various hardware on the computer. In the server field, the management unit refers to the BMC system. The computing unit refers to the CPU, memory, storage and other hardware that the operating system relies on when running, and is generally also called the Host side. The management unit and the computing unit operate independently of each other and only transmit management information through a limited hardware bus. To reduce ambiguity, in this case, BMC, management unit, and out-of-band management are the same concept, which refers to monitoring various hardware on the server through BMC; Host, computing unit, and in-band management are the same concept, which refers to the CPU, memory, storage and other hardware transmitting information through physical links.

BootBlock: A type of firmware volume that contains the first program loaded and run in the BIOS firmware. It is used for initialization operations and is the first program executed after the host is powered on.

Example 1

In this embodiment, a server integrity verification method is provided. FIG. 1 is a flow chart of a server integrity verification method according to an embodiment of the present application. As shown in FIG. 1 , the process includes the following steps:

Step S102, when the power state of the in-band management system is the startup state, the baseboard management controller determines whether the initialization data of the basic input and output system in the in-band management system is complete, and obtains a determination result;

Step S104, when the judgment result indicates yes, the baseboard management controller outputs a power-on instruction to the in-band management system to enable the basic input and output system to run and send the measurement chain information;

Step S106 : The baseboard management controller verifies the integrity of components in the in-band management system except the initialization data of the basic input and output system according to the received metric chain information.

Through the above steps, before loading the BIOS, the baseboard management controller (BMC) is first used to determine whether the initialization data of the basic input and output system (BIOS) in the in-band management system is complete, so that the integrity of the BootBlock first run by the BIOS can be verified, ensuring the security and reliability of the initial running state of the BIOS; after the BIOS is executed, the BMC receives the measurement chain collected during this startup and transmitted by the BIOS, and performs secondary verification to verify the integrity of other hardware, kernel and other components. Only after the integrity verification of the BIOS and other hardware, kernel and other components is completed can the operating system be started, so that the integrity of the BIOS and other components in the in-band management system can be verified in stages through the BMC, solving the problem that the BMC cannot obtain the integrity of other components (such as Raid cards, graphics cards, operating system kernels, etc.), and achieving the effect that the BMC can verify the integrity of the BIOS and other components in the server.

Furthermore, through the above steps, the server can complete the measurement and integrity verification of the BIOS initial running program without relying on a specific CPU architecture. The in-band management system collects data from the verified component, and the out-of-band management system executes the verification logic. The out-of-band manager can directly obtain the integrity information of each server component from the BMC without logging into the in-band system.

In the above step S102, when the power state of the in-band management system is the startup state, the baseboard management controller (BMC) determines whether the initialization data of the basic input and output system (BIOS) in the in-band management system is complete, and obtains a determination result. That is, when the power state of the server changes to startup (operations such as power on, restart, and quick startup), the first stage verification of the BIOS is immediately performed.

In some optional implementations, the baseboard management controller (BMC) includes a power status monitoring module 110, as shown in Figure 2. At this time, the verification method in this embodiment also includes: the power status monitoring module detects the power status of the in-band management system, wherein the power status includes: startup status, running status, and power-off status.

In the above implementation, the power status monitoring module in the BMC can obtain the change of the power status of the in-band management system, so that when the server power status changes to startup, the first stage verification of the BIOS is immediately performed to ensure the security and reliability of the initial running logic of the BIOS.

In order to perform the first stage verification of the BIOS, the baseboard management controller (BMC) includes a first verification module 120, as shown in Figure 2. In some optional implementations, the BMC determines whether the initialization data of the basic input and output system (BIOS) in the in-band management system is complete, and obtains a judgment result, including: the first verification module calculates the measurement value of the initialization data of the BIOS to obtain the measurement value information, the boot program with the above initialization data is the first program loaded and run in the BIOS firmware, which is used for the initial initialization operation and is the first program executed after the Host is powered on; the first verification module determines whether the measurement value information is complete according to the reference value library, and obtains the judgment result, wherein the reference value library includes the integrity values of multiple basic input and output system components (BIOS components) corresponding to the BIOS.

Specifically, the first verification module is used to verify the BootBlock of the BIOS for the first time, calculate the BootBlock metric value in the current BIOS Flash, and verify the BIOS BootBlock according to the benchmark value library. If the verification fails, the Host is powered off to ensure that the initial execution logic of the BIOS is secure and reliable.

In some optional implementations, the baseboard management controller (BMC) further includes a reference value management module 130, as shown in Figure 2. At this time, the verification method in this embodiment further includes: the reference value management module obtains a basic input and output system (BIOS) update request and an updated BIOS file, wherein the BIOS file includes updated integrity values of multiple BIOS components; the reference value management module parses the BIOS file according to the update request to obtain an integrity value set corresponding to the update request; and uses the integrity value set to update the reference value library.

The above-mentioned benchmark value management module can not only provide verification benchmark values for the verification module, but also provide benchmark value update services. After the BMC completes the BIOS update operation, it will calculate the updated integrity value of the BIOS component, thereby synchronously updating the benchmark value to ensure that the BIOS update and the updated benchmark value can be carried out synchronously.

Exemplarily, as shown in FIG3 , the updating process of the above-mentioned reference value may include the following steps:

1) BMC completes BIOS flashing: BMC has integrated the functional logic of BIOS flashing, and this functional logic will also verify the integrity and legality of the BIOS file to be flashed. Therefore, the baseline value update logic can reuse the existing BMC BIOS update logic without the need to independently verify the legality of the BIOS file;

2) Parsing BIOS files: BIOS files contain multiple BIOS components, such as various FVs (Firmware Volumes), SecureBoot, etc. Calculate the integrity value of each component, that is, calculate the hash value (hash function, or hash value) of each BIOS module;

3) Update the runtime benchmark value library: Update the integrity value set calculated in step 2) to the runtime benchmark value library to ensure that the new BIOS can start normally, that is, the benchmark value library module parses and updates the calculated hash value to the runtime benchmark value library;

4) Update the baseline value library: Each time the BMC starts, it creates a runtime baseline value library based on the persistent storage baseline value library protected by the trusted root. Therefore, the update operation should also update the persistent storage baseline value library.

In the above step S104, when the judgment result indicates yes, the baseboard management controller (BMC) outputs a power-on instruction to the in-band management system, so that the basic input and output system (BIOS) runs and sends the measurement chain information.

Specifically, the first verification module sends the measurement value information to the basic input and output system (BIOS), so that the BIOS generates measurement chain information according to the measurement value information and the integrity information of the components in the in-band management system except the BootBlock of the BIOS. The measurement chain is based on the trusted root and collects the integrity information of each component when the computer is started, such as the BIOS, OpROM (option read-only memory, OptionROM), operating system kernel, etc.

In some optional embodiments, the baseboard management controller (BMC) further includes a control module 140, as shown in FIG2. At this time, the verification method in this embodiment also includes: the power state monitoring module records the first moment when the measurement value of the boot program is sent to the basic input and output system (BIOS), and the second moment when the measurement chain information is received; the power state monitoring module determines whether the time difference between the first moment and the second moment is greater than a preset threshold; when the judgment result indicates that it is greater than the preset threshold, the power state monitoring module sends a power-off instruction to the control module, so that the control module performs a power-off operation on the components in the in-band management system except the BootBlock of the BIOS according to the power-off instruction. Among them, the Host control module refers to the logic module that controls the in-band power-on in the existing BMC, and the module related to the integrity verification calls the module according to the verification result to implement the power-off operation on the Host.

Specifically, since the integrity verification in this embodiment has two processes, in order to prevent malicious attackers from bypassing the logic of the second verification, a timer may be provided in the power status monitoring module. By starting the timer for timing, if the measurement chain information sent by the BIOS cannot be obtained within the specified time, it is considered that the BIOS has been maliciously modified. At this time, the control module of the Host may be called to power off the Host.

In order to ensure the security and reliability of verification data transmitted between the baseboard management controller (BMC) and the basic input and output system (BIOS), both parties ensure the security and reliability of the interactive data through their own trusted roots.

In some optional implementations, the above-mentioned BMC also includes a first trusted root management module 150, as shown in FIG2. At this time, the BMC sends the measurement value of the boot program to the BIOS, including: the first trusted root management module exchanges session keys with the BIOS to obtain the first key, and enables the BIOS to obtain the second key; the first trusted root management module uses the second key to encrypt the measurement value information to generate a measurement value ciphertext; the first trusted root management module sends the measurement value ciphertext to the BIOS, so that the BIOS decrypts the measurement value ciphertext according to the second key to obtain the measurement value information. Among them, the trusted root management module refers to the key engine using the trusted root to ensure the confidentiality of the data. The BMC uses the cryptographic mechanism of the trusted root to ensure the confidentiality of the data interacting with the BIOS. At the same time, in order to ensure the security of the benchmark value library, the key in the trusted root must also be used to protect the confidentiality of the benchmark value library. It is necessary to complete the session key interaction with the BIOS during the BIOS operation phase to ensure the security of subsequent communication data.

In the above optional implementation, the confidentiality of the reference value library is ensured by the BMC. Since the BMC has an independent root of trust, the cryptographic engine in the BMC root of trust can be used to ensure the confidentiality of the reference value library. The BMC uses the cryptographic mechanism of the root of trust to ensure the confidentiality of the data interacting with the BIOS. By completing the session key interaction with the BIOS during the BIOS operation phase, the security of subsequent communication data can be ensured.

At the same time, since the BMC has integrated the logic of flashing the BIOS firmware, the operation of updating the benchmark value library can be simultaneously added to the logic of flashing the BIOS, and the existing BIOS file verification logic during BIOS update can be reused.

Specifically, the first trusted root management module is the trusted root management module of the BMC, which uses the key engine of the trusted root to ensure the confidentiality of the data. After the BMC completes the key initialization, it exchanges the session key with the BIOS; if the BMC cannot obtain the session key information on the BIOS side, it waits in a loop to ensure the security of subsequent data interaction. In addition, in order to ensure the security of the reference value library, the key in the trusted root can also be used to protect the confidentiality of the reference value library.

In the above step S106, the baseboard management controller (BMC) verifies the integrity of the components in the in-band management system except the BootBlock of the basic input and output system (BIOS) according to the received metric chain information.

In some optional implementations, the BMC further includes a second verification module 160, as shown in FIG2. If the BMC receives the measurement chain ciphertext encrypted by the BIOS, the first trusted root management module can use the first key to decrypt the measurement chain ciphertext to obtain the measurement chain information; then, the second verification module performs a second integrity verification on the hardware, kernel and other components on the server according to the measurement chain information sent by the BIOS to ensure the security and reliability of the hardware environment in which the operating system runs.

Exemplarily, the server startup timing diagram based on dual trusted roots in this embodiment is shown in Figure 4. After the BMC is powered on, the first trusted root management module is initialized, and the benchmark value library is loaded and decrypted; after the BMC obtains the power signal of the Host, the BootBlock of the BIOS is verified according to the benchmark value library; after the first stage of BIOS verification is passed, the BMC exchanges session keys with the BIOS, and transmits the measurement value ciphertext, and receives the measurement chain information ciphertext transmitted by the BIOS on the BMC side to perform hardware integrity verification.

The verification method in this embodiment will be further described below with reference to FIG. 5 . As shown in the flowchart of FIG. 5 , the integrity verification process may include:

1) Monitor the power status: The BMC power status detection module obtains power-on information. When the server in-band system is powered on, restarted, or performs startup operations such as quick startup, the BMC obtains these signals and immediately performs verification operations;

2) Verify BIOS BootBlock: Use the first verification module of BMC to calculate the BootBlock measurement value in the current BIOS Flash, and verify whether the BIOS BootBlock is normal based on the benchmark value library. If the verification fails, power off the Host to ensure the security and reliability of the initial execution logic of the BIOS;

3) Initialize the first trusted root management module: After the host is powered on and the BIOS starts running, the BMC initializes the first trusted root management module and builds the session key required for this startup;

4) Exchange session keys with BIOS: After BMC completes key initialization, it exchanges session keys with BIOS; if BIOS cannot obtain session key information from BMC, it waits in a loop to ensure the security of subsequent data interaction;

5) Transmit BootBlock measurement values: Since the BMC cannot access the trusted root of the BIOS, the BMC needs to transmit the BootBlock measurement data to the in-band system. The BIOS generates BootBlock measurement events and stores them in the trusted root of the in-band system.

6) Start the timer: Since the first verification only verifies the integrity of the BootBlock and cannot verify the integrity of other BIOS components, in order to prevent other BIOS components from being maliciously tampered with, resulting in the inability to execute the logic of sending measurement information, the timer is started to wait for the measurement chain information sent by the BIOS. The timer can only be turned off when the BMC completes the verification within the specified time. If no valid measurement information is obtained within the specified time, the BIOS is considered untrustworthy and the power-off operation is executed;

7) Host integrity verification: BMC obtains the integrity baseline values of various hardware, kernel and other components in the baseline value library, and compares them with the obtained measurement chain information. If there is a component with damaged integrity, it will be powered off to ensure the in-band operating system The operating environment is secure and reliable;

8) Record verification results: BMC records the results of each verification. The out-of-band system administrator can directly obtain the integrity information of each component of the in-band system through BMC without logging into the in-band system.

Through the description of the above implementation methods, those skilled in the art can clearly understand that the method according to the above embodiment can be implemented by means of software plus a necessary general hardware platform, and of course by hardware, but in many cases the former is a better implementation method. Based on this understanding, the technical solution of the present application, or the part that contributes to the prior art, can be embodied in the form of a software product, which is stored in a storage medium (such as ROM/RAM, magnetic disk, optical disk), and includes a number of instructions for a terminal device (which can be a mobile phone, computer, server, or network device, etc.) to execute the methods described in each embodiment of the present application.

Example 2

In this embodiment, a server integrity verification method is provided. FIG. 6 is a flow chart of a server integrity verification method according to an embodiment of the present application. As shown in FIG. 6 , the process includes the following steps:

Step S202, when the power state of the in-band management system is the startup state, the basic input and output system in the in-band management system sends a startup signal to the baseboard management controller, so that the baseboard management controller determines whether the initialization data of the basic input and output system is complete, and outputs a power-on instruction when the judgment result indicates yes;

Step S204, when the in-band management system receives the power-on instruction, it controls the operation of the basic input/output system and sends the measurement chain information to the baseboard management controller, so that the baseboard management controller verifies the integrity of the components in the in-band management system except the initialization data of the basic input/output system according to the received measurement chain information.

Through the above steps, the basic input and output system (BIOS) in the in-band management system first sends a startup signal to the baseboard management controller (BMC), so that the BMC determines whether the initialization data of the BIOS is complete, and can verify the integrity of the BootBlock that the BIOS runs first, ensuring the security and reliability of the initial running state of the BIOS; after the BIOS is executed, the measurement chain collected in this startup is sent to the BMC for secondary verification to verify the integrity of other hardware, kernel and other components. Only after the integrity verification of the BIOS and other hardware, kernel and other components is completed can the operating system be started, so that the integrity of the BIOS and other components in the in-band management system can be verified in stages, which solves the problem that the BMC cannot obtain the integrity of other components (such as Raid cards, graphics cards, operating system kernels, etc.), and achieves the effect that the BMC can verify the integrity of the BIOS and other components in the server.

In addition, through the above steps, the server can complete the measurement and integrity verification of the initial BIOS running program without relying on a specific CPU architecture. The in-band management system collects the data of the verified components, and the out-of-band management system executes the verification logic, realizing the isolation of verification data and verification logic. The out-of-band manager can directly obtain the integrity information of each component of the server from the BMC without logging into the in-band system.

In the above step S202, when the power state of the in-band management system is the startup state, the basic input and output system (BIOS) in the in-band management system sends a startup signal to the baseboard management controller (BMC), so that the BMC determines whether the initialization data of the BIOS is complete, and outputs a power-on instruction when the judgment result indicates yes.

When the above determination result indicates no, a control signal sent by a control module in the BMC may be received, where the control signal is used to control the components in the in-band management system except the initialization data of the basic input and output system to be powered off.

Specifically, the power status monitoring module in the BMC can obtain the change of the power status of the in-band management system, so that when the server power status changes to startup, the first stage verification of the BIOS is immediately performed to ensure that the BIOS is the most stable and reliable one. The initial operation logic is safe and reliable. The BIOS BootBlock is verified for the first time through the BMC, the BootBlock measurement value in the current BIOS Flash is calculated, and the BIOS BootBlock is verified according to the benchmark value library. If the verification fails, the host is powered off to ensure the safety and reliability of the initial execution logic of the BIOS.

In some optional embodiments, a basic input/output system update request and an updated BIOS file are sent to a baseboard management controller, so that the baseboard management controller parses the BIOS file according to the update request, obtains a set of integrity values corresponding to the update request, and uses the integrity value set to update a baseline value library, wherein the BIOS file includes updated integrity values of multiple basic input/output system components.

In the above step S204, upon receiving the power-on instruction, the in-band management system controls the operation of the basic input and output system (BIOS) and sends measurement chain information to the baseboard management controller (BMC), so that the BMC verifies the integrity of the components in the in-band management system except the BootBlock of the BIOS based on the received measurement chain information.

In some optional implementations, the basic input and output system (BIOS) includes a measurement chain module 210, as shown in Figure 2. At this time, the verification method in this embodiment also includes: the measurement chain module receives measurement value information sent by the baseboard management controller (BMC), wherein the measurement value information includes the measurement value of the initialization data of the BIOS; the measurement chain module obtains the integrity information of the components in the in-band management system except the boot program (BootBlock) with the initialization data of the BIOS; the measurement chain module generates the measurement chain information according to the measurement value information and the integrity information.

In the above optional implementation, the measurement chain module can reuse the existing BIOS measurement chain technology to collect the integrity information of each component when the BIOS is started and store it in the trusted root.

Specifically, the measurement chain module receives the measurement value information transmitted by the BMC, and generates the measurement chain information according to the measurement value information and the integrity information of the components other than BIOS in the in-band management system. The measurement chain is based on the trusted root and collects the integrity information of each component (such as BIOS, OpROM, operating system kernel, etc.) when the computer is started.

In some optional embodiments, the above-mentioned BIOS also includes a second trusted root management module 220. As shown in Figure 2, the BIOS receives the measurement value information sent by the BMC, including: the second trusted root management module exchanges session keys with the BMC to obtain the second key, and enables the BMC to obtain the first key, wherein the second key is used to encrypt the measurement value information and generate a measurement value ciphertext; the second trusted root management module uses the second key to decrypt the measurement value ciphertext to obtain the measurement value information.

In the above optional implementation, the second trusted root management module is the trusted root management module of BIOS, which uses the trusted root key engine to ensure the confidentiality of data. BIOS uses the trusted root cryptographic mechanism to ensure the confidentiality of data interacting with BMC.

In some optional embodiments, the above-mentioned basic input and output system (BIOS) further includes an authentication module 230, as shown in Figure 2, sending the measurement chain information to the baseboard management controller (BMC), including: the second trusted root management module uses the first key to encrypt the measurement chain information to obtain the measurement chain ciphertext; the authentication module sends the measurement chain ciphertext to the BMC, so that the BMC uses the first key to decrypt the measurement chain ciphertext to obtain the measurement chain information.

In the above optional implementation, the authentication module is based on the measurement chain built when the BIOS is started. Before the BIOS hands over the control of the server to the next component, the measurement chain information is sent to the BMC, and the BMC verifies the integrity of the hardware, kernel, etc. of the in-band system.

In some optional embodiments, the moment when the measurement value information sent by the baseboard management controller is received is recorded as the first moment, and the moment when the measurement chain information is sent to the baseboard management controller is recorded as the second moment. When the time difference between the first moment and the second moment is greater than a preset threshold, a control signal sent by the control module in the BMC is received, and the control signal is used to control the power-off of components in the in-band management system except for the initialization data of the basic input and output system.

Exemplarily, the server startup timing diagram based on dual trusted roots in this embodiment is shown in FIG4 . After the BMC passes the first-stage verification of the BIOS, it controls the Host to power on and the BootBlock to run; the BIOS initializes the second trusted root management module, exchanges session keys with the BMC, and receives the measurement value ciphertext it passes, then records the BootBlock measurement event, and performs hardware initialization and measurement chain construction.

Example 3

In the present embodiment, a verification device for a server is provided, which is used to implement the above-mentioned embodiment 1 and the preferred implementation mode thereof, and the description thereof will not be repeated. As used below, the term "module" can implement a combination of software and/or hardware of a predetermined function. Although the device described in the following embodiments is preferably implemented in software, the implementation of hardware, or a combination of software and hardware is also possible and conceivable.

FIG. 7 is a structural block diagram of a verification device for a server according to an embodiment of the present application. As shown in FIG. 7 , the device includes:

The judgment module 302 is used to use the baseboard management controller to judge whether the initialization data of the basic input and output system in the in-band management system is complete when the power state of the in-band management system is in the startup state, and obtain a judgment result;

The output module 304 is used to output a power-on instruction to the in-band management system using the baseboard management controller when the judgment result indicates yes, so that the basic input and output system runs and sends the measurement chain information;

The verification module 306 is used to verify the integrity of components in the in-band management system except the initialization data of the basic input and output system according to the received measurement chain information using the baseboard management controller.

It should be noted here that the above-mentioned judgment module 302, output module 304 and verification module 306 can correspond to steps S102 to S106 in Example 1, and the instances and application scenarios implemented by multiple modules and corresponding steps are the same, but are not limited to the contents disclosed in the above-mentioned Example 1.

Through the above modules, before loading the BIOS, the judgment module 302 is used to judge whether the initialization data of the basic input and output system (BIOS) in the in-band management system is complete, so that the integrity of the BootBlock first run by the BIOS can be verified, ensuring the safety and reliability of the initial running state of the BIOS; after the BIOS is executed, the BMC receives the measurement chain collected during this startup transmitted by the BIOS, and performs secondary verification through the verification module 306 to verify the integrity of other hardware, kernel and other components. Only after the integrity verification of the BIOS and other hardware, kernel and other components is completed can the operating system be started, so that the integrity of the BIOS and other components in the in-band management system can be verified in stages through the BMC, which solves the problem that the BMC cannot obtain the integrity of other components (such as Raid cards, graphics cards, operating system kernels, etc.), and achieves the effect that the BMC can verify the integrity of the BIOS and other components in the server.

In some optional embodiments, the baseboard management controller (BMC) includes a power status monitoring module 110, as shown in FIG2 , and the power status monitoring module is used to detect the power status of the in-band management system, wherein the power status includes: startup status, running status, and power-off status.

In order to perform the first stage verification of the BIOS, the baseboard management controller (BMC) includes a first verification module 120, as shown in FIG. 2 , the first verification module is used to calculate the measurement value of the initialization data of the BIOS to obtain the measurement value information. The boot program with the above-mentioned initialization data is the first program loaded and run in the BIOS firmware, which is used for the initial initialization operation and is the first program executed after the Host is powered on; the first verification module is also used to determine whether the measurement value information is complete based on the benchmark value library to obtain a judgment result, wherein the benchmark value library includes the integrity values of multiple BIOS components corresponding to the BIOS.

In some optional embodiments, the baseboard management controller (BMC) further includes a baseline value management module 130, as shown in FIG2 , wherein the baseline value management module is used to obtain a basic input output system (BIOS) update request and an updated BIOS file, wherein the BIOS file includes updated integrity values of multiple BIOS components; the baseline value management module is also used to parse the BIOS file according to the update request to obtain a set of integrity values corresponding to the update request; the baseline value management module is also used to update the baseline value library using the integrity value set.

In some optional implementations, the first verification module is further used to send the measurement value information to the basic input and output system (BIOS), so that the BIOS generates measurement chain information based on the measurement value information and the integrity information of the components other than the BootBlock of the BIOS in the in-band management system. The measurement chain is based on the trusted root and collects the integrity information of each component (such as BIOS, OpROM, operating system kernel, etc.) when the computer is started.

In some optional embodiments, the baseboard management controller (BMC) further includes a control module 140, as shown in FIG2 , the power status monitoring module is also used to record the first moment when the measurement value of the boot program is sent to the basic input and output system (BIOS), and the second moment when the measurement chain information is received; the power status monitoring module is used to determine whether the time difference between the first moment and the second moment is greater than a preset threshold; when the judgment result indicates that it is greater than the preset threshold, the power status monitoring module sends a power-off instruction to the control module, so that the control module performs a power-off operation on the components in the in-band management system except the BootBlock of the BIOS according to the power-off instruction. Among them, the Host control module refers to the logic module that controls the in-band power-on in the existing BMC, and the module related to the integrity verification calls the module according to the verification result to implement the power-off operation on the Host.

In order to ensure the security and reliability of verification data transmitted between BMC and BIOS, both parties use their own trusted roots to ensure the security and reliability of the interactive data.

In some optional implementations, the above-mentioned BMC also includes a first trusted root management module 150, as shown in FIG2, the first trusted root management module is used to exchange session keys with the BIOS, obtain a first key, and enable the BIOS to obtain a second key; the first trusted root management module is also used to encrypt the measurement value information using the second key to generate a measurement value ciphertext; the first trusted root management module is also used to send the measurement value ciphertext to the BIOS, so that the BIOS decrypts the measurement value ciphertext according to the second key to obtain the measurement value information. Among them, the trusted root management module refers to the key engine using the trusted root to ensure the confidentiality of the data. The BMC uses the cryptographic mechanism of the trusted root to ensure the confidentiality of the data interacting with the BIOS. At the same time, in order to ensure the security of the benchmark value library, the key in the trusted root is also used to protect the confidentiality of the benchmark value library. It is necessary to complete the session key interaction with the BIOS during the BIOS operation phase to ensure the security of subsequent communication data.

In some optional implementations, the BMC further includes a second verification module 160. As shown in FIG2 , the first trusted root management module is further configured to decrypt the measurement chain ciphertext using the first key to obtain measurement chain information. The second verification module is configured to perform a second integrity verification on hardware, kernel and other components on the server according to the measurement chain information sent by the BIOS to ensure the security and reliability of the hardware environment in which the operating system runs.

The BMC may further include an integrity information maintenance module 170, as shown in FIG. 2, for maintaining the integrity verification result. The out-of-band manager may call the module to obtain the integrity verification result.

It should be noted that the above modules can be implemented by software or hardware. For the latter, it can be implemented in the following ways, but not limited to: the above modules are all located in the same processor; or the above modules are implemented in any way. The combined forms are located in different processors.

Example 4

In the present embodiment, another verification device for a server is provided, which is used to implement the above-mentioned embodiment 2 and the preferred implementation mode thereof, and the description thereof will not be repeated. As used below, the term "module" can implement a combination of software and/or hardware of a predetermined function. Although the device described in the following embodiments is preferably implemented in software, the implementation of hardware, or a combination of software and hardware is also possible and conceived.

FIG8 is a structural block diagram of a verification device for a server according to an embodiment of the present application. As shown in FIG8 , the device includes:

The first sending module 402 is used for sending a startup signal to a baseboard management controller using a basic input/output system in the in-band management system when the power state of the in-band management system is the startup state, so that the baseboard management controller determines whether the initialization data of the basic input/output system is complete, and outputs a power-on instruction when the judgment result indicates yes;

The second sending module 404 is used to control the operation of the basic input and output system when the in-band management system receives a power-on instruction, and send measurement chain information to the baseboard management controller, so that the baseboard management controller verifies the integrity of the components in the in-band management system except the initialization data of the basic input and output system according to the received measurement chain information.

It should be noted here that the above-mentioned judgment module 402 and output module 404 can correspond to steps S202 to S206 in Example 2, and the instances and application scenarios implemented by multiple modules and corresponding steps are the same, but are not limited to the contents disclosed in the above-mentioned Example 2.

Through the above modules, a startup signal is first sent to a baseboard management controller (BMC) through the first sending module 402, so that the BMC determines whether the initialization data of the BIOS is complete, and can verify the integrity of the BootBlock that the BIOS runs first, ensuring the safety and reliability of the initial running state of the BIOS; after the BIOS is executed, the measurement chain collected in this startup is sent to the BMC through the second sending module 404 for secondary verification to verify the integrity of other hardware, kernel and other components. Only after the integrity verification of the BIOS and other hardware, kernel and other components is completed can the operating system be started, thereby realizing the staged verification of the integrity of the BIOS and other components in the in-band management system, solving the problem that the BMC cannot obtain the integrity of other components (such as Raid card, graphics card, operating system kernel, etc.), and achieving the effect that the BMC can verify the integrity of the BIOS and other components in the server.

In some optional embodiments, the above-mentioned basic input and output system (BIOS) includes a measurement chain module 210, as shown in Figure 2, the measurement chain module is used to receive measurement value information sent by a baseboard management controller (BMC), wherein the measurement value information includes the measurement value of the initialization data of the BIOS; the measurement chain module is also used to obtain the integrity information of components in the in-band management system except the boot program (BootBlock) with initialization data of the BIOS; the measurement chain module is also used to generate measurement chain information based on the measurement value information and the integrity information.

In some optional embodiments, the above-mentioned BIOS also includes a second trusted root management module 220, as shown in Figure 2, the second trusted root management module is used to exchange session keys with the BMC to obtain a second key, and enable the BMC to obtain a first key, wherein the second key is used to encrypt the measurement value information and generate a measurement value ciphertext; the second trusted root management module is also used to use the second key to decrypt the measurement value ciphertext to obtain the measurement value information.

In some optional embodiments, the above-mentioned basic input and output system (BIOS) also includes an authentication module 230. As shown in Figure 2, the second trusted root management module is also used to encrypt the measurement chain information using the first key to obtain the measurement chain ciphertext; the authentication module is used to send the measurement chain ciphertext to the BMC, so that the baseboard management controller uses the first key to decrypt the measurement chain ciphertext to obtain the measurement chain information.

In some optional implementations, as shown in FIG2 , the Host trusted root module of the in-band management system includes a key engine and an integrity engine.

Other embodiments of the present application further provide a non-volatile readable storage medium, in which a computer program is stored, wherein the computer program is configured to execute the steps of any of the above method embodiments when running.

In an exemplary embodiment, the above-mentioned non-volatile readable storage medium may include, but is not limited to: a USB flash drive, a read-only memory (ROM), a random access memory (RAM), a mobile hard disk, a magnetic disk or an optical disk, and other media that can store computer programs.

Other embodiments of the present application further provide an electronic device, including a memory and a processor, wherein the memory stores a computer program, and the processor is configured to run the computer program to execute the steps in any one of the above method embodiments.

In an exemplary embodiment, the electronic device may further include a transmission device and an input/output device, wherein the transmission device is connected to the processor, and the input/output device is connected to the processor.

For specific examples in this embodiment, reference may be made to the examples described in the above embodiments and exemplary implementation modes, and this embodiment will not be described in detail herein.

Obviously, those skilled in the art should understand that the above modules or steps of the present application can be implemented by a general computing device, they can be concentrated on a single computing device, or distributed on a network composed of multiple computing devices, they can be implemented by a program code executable by a computing device, so that they can be stored in a storage device and executed by the computing device, and in some cases, the steps shown or described can be executed in a different order from that herein, or they can be made into individual integrated circuit modules, or multiple modules or steps therein can be made into a single integrated circuit module for implementation. Thus, the present application is not limited to any specific combination of hardware and software.

The above description is only the preferred embodiment of the present application and is not intended to limit the present application. For those skilled in the art, the present application may have various modifications and variations. Any modification, equivalent replacement, improvement, etc. made within the principles of the present application shall be included in the protection scope of the present application.

Claims

A verification method for a server, characterized in that the verification method is applied to a baseboard management controller, the server includes an in-band management system, and the verification method includes:

When the power state of the in-band management system is in the startup state, determining whether the initialization data of the basic input and output system in the in-band management system is complete, and obtaining a determination result;

When the judgment result indicates that the initialization data of the basic input and output system in the in-band management system is complete, outputting a power-on instruction to the in-band management system so that the basic input and output system runs and sends the measurement chain information;

The integrity of components in the in-band management system except the initialization data of the basic input and output system is verified according to the received metric chain information.
The verification method according to claim 1, characterized in that the verification method further comprises:

Before determining whether the initialization data of the basic input/output system is complete, the power state of the in-band management system is detected, wherein the power state includes: the startup state, the running state, and the power-off state.
The verification method according to claim 2 is characterized in that judging whether the initialization data of the basic input and output system in the in-band management system is complete and obtaining the judgment result comprises:

Calculating the metric value of the initialization data of the basic input and output system to obtain metric value information;

According to a reference value library, it is judged whether the measurement value information is complete to obtain the judgment result, wherein the reference value library includes integrity values of multiple basic input and output system components corresponding to the basic input and output system.
The verification method according to claim 3, characterized in that the verification method further comprises:

Obtaining an update request for the basic input/output system and an updated BIOS file, wherein the BIOS file includes updated integrity values of a plurality of basic input/output system components;

Parsing the BIOS file according to the update request to obtain a set of integrity values corresponding to the update request;

The reference value library is updated using the integrity value set.
The verification method according to claim 3, characterized in that the verification method further comprises:

When the determination result indicates that the initialization data of the basic input/output system in the in-band management system is incomplete, a power-off operation is performed on components in the in-band management system except for the initialization data of the basic input/output system.
The verification method according to claim 3, further comprising:

The metric value information is sent to the basic input/output system, so that the basic input/output system generates metric chain information according to the metric value information and integrity information of components in the in-band management system except initialization data of the basic input/output system.
The verification method according to claim 6, wherein the sending the measurement value information to the basic input and output system comprises:

The session key is exchanged with the basic input and output system to obtain a first key, and the basic input and output system The system obtains the second key;

Encrypting the measurement value information using the second key to generate measurement value ciphertext;

The metric value ciphertext is sent to the basic input/output system, so that the basic input/output system decrypts the metric value ciphertext according to the second key to obtain the metric value information.
The verification method according to claim 7, further comprising:

Before verifying the integrity of the components in the in-band management system except the initialization data of the basic input-output system according to the measurement chain information, the measurement chain ciphertext is decrypted using the first key to obtain the measurement chain information, wherein the basic input-output system obtains the measurement chain ciphertext according to the measurement value information and the integrity information of the components in the in-band management system except the initialization data of the basic input-output system.
The verification method according to claim 6, characterized in that the verification method further comprises:

Recording a first time when the metric value information is sent to the basic input and output system, and a second time when the metric chain information is received;

Determining whether the time difference between the first moment and the second moment is greater than a preset threshold;

When the judgment result indicates that the time difference between the first moment and the second moment is greater than the preset threshold, a power-off operation is performed on components in the in-band management system except for the initialization data of the basic input and output system.
A verification method for a server, characterized in that the server includes an in-band management system, the verification method is applied to a basic input and output system in the in-band management system, and the verification method includes:

When the power state of the in-band management system is in the startup state, sending a startup signal to the baseboard management controller, so that the baseboard management controller determines whether the initialization data of the basic input and output system is complete, and outputs a power-on instruction when the judgment result indicates that the initialization data of the basic input and output system is complete;

When the power-on instruction is received, the basic input-output system is controlled to run, and measurement chain information is sent to the baseboard management controller, so that the baseboard management controller verifies the integrity of components in the in-band management system except the initialization data of the basic input-output system according to the received measurement chain information.
The verification method according to claim 10, characterized in that the verification method further comprises:

When the judgment result indicates that the initialization data of the basic input/output system is incomplete, a control signal sent by the baseboard management controller is received, wherein the control signal is used to control the components in the in-band management system except the initialization data of the basic input/output system to be powered off.
The verification method according to claim 10, characterized in that the verification method further comprises:

Sending an update request for the basic input/output system and an updated BIOS file to the baseboard management controller, so that the baseboard management controller parses the BIOS file according to the update request, obtains a set of integrity values corresponding to the update request, and uses the set of integrity values to update a baseline value library, wherein the BIOS file includes updated integrity values of multiple basic input/output system components.
The verification method according to claim 10, characterized in that the verification method further comprises:

Receive the metric value information sent by the baseboard management controller, wherein the metric value information includes the basic input Metrics of initialization data for input and output systems;

Acquire integrity information of components in the in-band management system except for the initialization data of the basic input and output system;

Generate measurement chain information according to the measurement value information and the integrity information.
The verification method according to claim 13, wherein receiving the measurement value information sent by the baseboard management controller comprises:

exchanging a session key with the baseboard management controller to obtain a second key, and enabling the baseboard management controller to obtain a first key, wherein the second key is used to encrypt the measurement value information to generate a measurement value ciphertext;

The second key is used to decrypt the metric value ciphertext to obtain the metric value information.
The verification method according to claim 14, wherein the sending of the measurement chain information to the baseboard management controller comprises:

Encrypting the measurement chain information using the first key to obtain a measurement chain ciphertext;

The measurement chain ciphertext is sent to the baseboard management controller, so that the baseboard management controller uses the first key to decrypt the measurement chain ciphertext to obtain the measurement chain information.
The verification method according to claim 15, further comprising:

In a case where a time difference between a first moment and a second moment is greater than a preset threshold, a control signal sent by the baseboard management controller is received, wherein the first moment is a moment when the measurement value information sent by the baseboard management controller is received, and the second moment is a moment when the measurement chain information is sent to the baseboard management controller, and the control signal is used to control the power-off of components in the in-band management system except for the initialization data of the basic input and output system.
A verification device for a server, characterized in that the verification device is applied to a baseboard management controller, the server includes an in-band management system, and the verification device includes:

A judgment module, used for judging whether the initialization data of the basic input and output system in the in-band management system is complete when the power state of the in-band management system is in the startup state, and obtaining a judgment result;

an output module, configured to output a power-on instruction to the in-band management system, so that the basic input-output system runs, and send measurement chain information, if the judgment result indicates that the initialization data of the basic input-output system in the in-band management system is complete;

A verification module is used to verify the integrity of components in the in-band management system except the initialization data of the basic input and output system according to the received measurement chain information.
A verification device for a server, characterized in that the server includes an in-band management system, the verification device is applied to a basic input and output system in the in-band management system, and the verification device includes:

a first sending module, configured to send a startup signal to a baseboard management controller when the power state of the in-band management system is a startup state, so that the baseboard management controller determines whether the initialization data of the basic input/output system is complete, and outputs a power-on instruction when the determination result indicates that the initialization data of the basic input/output system is complete;

The second sending module is used to control the operation of the basic input and output system and send measurement chain information to the baseboard management controller when receiving the power-on instruction, so that the baseboard management controller verifies the integrity of components in the in-band management system except the initialization data of the basic input and output system according to the received measurement chain information.
A non-volatile readable storage medium, characterized in that a computer program is stored in the non-volatile readable storage medium, wherein when the computer program is executed by a processor, the steps of the verification method described in any one of claims 1 to 9 are implemented, or the steps of the verification method described in any one of claims 10 to 16 are implemented.
An electronic device comprises a memory, a processor and a computer program stored in the memory and executable on the processor, wherein the processor implements the steps of the verification method described in any one of claims 1 to 9 or the steps of the verification method described in any one of claims 10 to 16 when executing the computer program.