A control method and control device
By controlling the timing signals and legitimacy verification of the host system of electronic devices, the verification and authentication problem of BIOS during the S5 to S0 process is solved, ensuring the safe startup and normal operation of the system.
Patent Information
- Authority / Receiving Office
- CN · China
- Patent Type
- Patents(China)
- Current Assignee / Owner
- LENOVO (BEIJING) LTD
- Filing Date
- 2021-03-31
- Publication Date
- 2026-05-26
AI Technical Summary
Existing technologies cannot achieve complete BIOS verification and authentication during the transition of electronic devices from S5 to S0.
The target controller controls the timing signals of the host system of the electronic device, prohibits the host system from accessing the boot system, and performs legality verification operations in different operating states, including calculating verification information and parsing signature data, to ensure the legality of the BIOS.
It enables complete BIOS verification and authentication during the transition of electronic devices from S5 to S0, ensuring secure system startup and normal operation.
Smart Images
Figure CN113111343B_ABST
Abstract
Description
Technical Field
[0001] This application relates to control technology in the field of computers, and more particularly to a control method and control device. Background Technology
[0002] Currently, based on the National Institute of Standards and Technology Special Publication 800-193 (NIST-SP800-193) series of standards, the process of implementing security verification of the Basic Input / Output System (BIOS) on the Intel platform using embedded controllers (EC) or controllers combining input / output functions and embedded controller functions (Embedded Controller Super Input / Output, ESIO) can only achieve the complete verification and authentication process of electronic devices from G3 to S0; however, the complete verification and authentication process cannot be achieved for the process of electronic devices from S5 to S0. Summary of the Invention
[0003] The technical solution of this application is implemented as follows:
[0004] A control method, comprising:
[0005] The operating status of the electronic device is determined, and the timing signals of the host system of the electronic device are controlled by the target controller according to the operating status to prevent the host system from accessing the boot system of the electronic device.
[0006] Perform a legality verification operation on the boot system;
[0007] If the verification result indicates that the boot system is legitimate, then the host system is allowed to access the boot system;
[0008] The timing signals controlled by the target controller differ under different operating conditions.
[0009] In the above scheme, the step of controlling the timing signals of the host system of the electronic device by the target controller according to the operating state to prevent the host system from accessing the boot system of the electronic device includes:
[0010] If the electronic device is in the first operating state, the target controller blocks the first timing signal that resets the southbridge of the electronic device, thereby preventing the host system from accessing the boot system.
[0011] In the above scheme, the step of controlling the timing signals of the host system of the electronic device by the target controller according to the operating state to prevent the host system from accessing the boot system of the electronic device further includes:
[0012] If the electronic device is in the second operating state, the target controller blocks the second timing signal of the electronic device to prevent the host system from accessing the boot system.
[0013] In the above scheme, the step of performing the legality verification operation of the boot system includes:
[0014] First verification information is obtained by calculating the first content data in the boot system;
[0015] Determine whether the first verification information matches the second verification information obtained by parsing the signature data in the boot system;
[0016] If the first verification information matches the second verification information, the boot system is determined to be legitimate.
[0017] In the above scheme, the step of calculating the first verification information from the first content data in the guidance system includes:
[0018] If the electronic device is in a first operating state, it accesses the first content data in the boot system through a first signal channel and performs first calculation logic on it to obtain the first verification information; and / or,
[0019] If the electronic device is in a second operating state, it accesses the first content data of the guidance system through the second signal channel and performs first calculation logic on it to obtain the first verification information.
[0020] In the above scheme, the step of performing the first calculation logic to obtain the first verification information includes:
[0021] The first content data is obtained by reading the contents of the image file of the boot system;
[0022] The target controller uses the RSA algorithm to calculate the first content data to obtain the first verification information.
[0023] In the above scheme, before determining whether the first verification information matches the second verification information obtained by parsing the signature data in the boot system, the method further includes:
[0024] The target controller reads third verification information from the memory of the boot system;
[0025] The third verification information is parsed to obtain the second verification information.
[0026] In the above scheme, the step of parsing the third verification information to obtain the second verification information includes:
[0027] According to the target encryption algorithm, the third verification information is decrypted using the first key to obtain the second verification information.
[0028] The method in the above scheme further includes:
[0029] Read the second content data from the image file of the boot system, and calculate the fourth verification information based on the second content data;
[0030] According to the target encryption algorithm, the fourth verification information is encrypted using the second key to obtain the third verification information, and the third verification information is stored in the memory of the boot system.
[0031] A control device, the device comprising:
[0032] The control unit is used to determine the operating status of the electronic device, and according to the operating status, the target controller controls the timing signals of the host system of the electronic device to prevent the host system from accessing the boot system of the electronic device.
[0033] The processing unit is used to perform a legality verification operation on the boot system;
[0034] The processing unit is further configured to allow the host system to access the boot system if the verification result indicates that the boot system is legitimate;
[0035] The timing signals controlled by the target controller differ under different operating conditions.
[0036] An electronic device, comprising: a processor, a memory, and a communication bus;
[0037] The communication bus is used to realize the communication connection between the processor and the memory;
[0038] The processor is used to execute a control program in memory to perform the following steps:
[0039] The operating status of the electronic device is determined, and the timing signals of the host system of the electronic device are controlled by the target controller according to the operating status to prevent the host system from accessing the boot system of the electronic device.
[0040] Perform a legality verification operation on the boot system;
[0041] If the verification result indicates that the boot system is legitimate, then the host system is allowed to access the boot system;
[0042] The timing signals controlled by the target controller differ under different operating conditions.
[0043] A computer-readable storage medium storing one or more programs that can be executed by one or more processors to implement the steps of the control method described above.
[0044] The control method and control device provided in the embodiments of this application determine the operating state of an electronic device, and control the timing signals of the host system of the electronic device by a target controller according to the operating state to prohibit the host system from accessing the boot system of the electronic device, perform a legality verification operation on the boot system, and if the verification result indicates that the boot system is legal, then the host system is allowed to access the boot system. The timing signals controlled by the target controller are different in different operating states. In this way, the legality verification of the BIOS can be achieved by controlling different timing signals when the electronic device is in different operating states. This solves the problem that the complete verification and authentication process of the BIOS cannot be achieved in the process of the electronic device from S5 to S0, and realizes the verification of the BIOS in the process from S5 to S0. Attached Figure Description
[0045] Figure 1 A flowchart illustrating a control method provided for an embodiment of this application;
[0046] Figure 2 A flowchart illustrating another control method provided for an embodiment of this application;
[0047] Figure 3 A flowchart illustrating yet another control method provided for an embodiment of this application;
[0048] Figure 4 A schematic diagram of an architecture for EC to perform BIOS legitimacy verification, provided for embodiments of this application;
[0049] Figure 5 A flowchart illustrating a control method according to another embodiment of this application;
[0050] Figure 6 A schematic diagram of the structure of an electronic device provided for an embodiment of this application;
[0051] Figure 7 This is a schematic diagram of the structure of a control device provided in an embodiment of this application. Detailed Implementation
[0052] The technical solutions in the embodiments of this application will be clearly and completely described below with reference to the accompanying drawings.
[0053] It should be understood that the specific embodiments described herein are for illustrative purposes only and are not intended to limit the scope of the invention.
[0054] Embodiments of this application provide a control method that can be applied to electronic devices, see below. Figure 1 As shown, the method includes the following steps:
[0055] Step 101: Determine the operating status of the electronic device. Based on the operating status, the target controller controls the timing signals of the host system of the electronic device to prevent the host system from accessing the boot system of the electronic device.
[0056] In this embodiment, the operating state of an electronic device represents a certain operating stage of the electronic device. The operating state can include multiple working states. The working states of the electronic device can include G3, S0, S1, S2, S3, S4 and S5. Among them, in the G3 state, only the motherboard is powered by the battery; the S1 state is also called POS (Power on Suspend), in which the CPU is turned off by the CPU clock controller, but other components are still working normally; in the S2 state, the CPU is turned off; S3 can also be called (Suspend to RAM, STR), which refers to the hibernation state. At this time, the system uses memory to save the current working state and information, and other devices are turned off. Once another device makes a request, it can return to the S0 state; the S4 state is also called (Suspend to Disk, STD), in which the main power of the system is turned off, but the hard drive is still powered and can be woken up; the S5 state is the most straightforward, that is, all devices, including the power supply, are turned off, and the power consumption is 0; S0 is the normal working state, in which the functions of all devices in the system are active, and the power is also the maximum.
[0057] It should be noted that, depending on the operating state of the electronic device, different timing signals can be controlled to regulate the host system's access to the device's boot system. Here, the host system can refer to the electronic device's operating system, and the boot system can refer to the BIOS.
[0058] Step 102: Perform a legality verification operation on the boot system.
[0059] In this embodiment of the application, the legality verification operation of the boot system can be performed by the target controller of the electronic device; in this embodiment of the application, the target controller may include an embedded controller (EC), or an embedded controller super input / output (ESIO) that combines input / output functions with the functions of an embedded controller.
[0060] It should be noted that the boot system legitimacy verification operation can be performed by EC / ESIO to verify the BIOS legitimacy under different operating states of the electronic device; that is, EC / ESIO can determine whether the BIOS has been maliciously attacked, causing changes to the information in the BIOS and affecting the normal boot of the electronic device. Furthermore, the BIOS legitimacy verification operation is performed after the timing signals corresponding to the different operating states are blocked.
[0061] Step 103: If the verification result indicates that the boot system is legitimate, then the host system is allowed to access the boot system.
[0062] In particular, the timing signals controlled by the target controller are different under different operating conditions.
[0063] In this embodiment, if the BIOS is deemed legitimate by EC / ESIO, the BIOS legitimacy verification is considered successful. At this point, the BIOS is secure, and the electronic device can control itself to run the boot system and start the host system after the boot system runs successfully, thus ensuring the normal power-on and startup of the electronic device. At the same time, the operating system can also perform various access operations on the BIOS normally to ensure the normal operation of the electronic device.
[0064] The control method provided in the embodiments of this application can verify the legitimacy of the BIOS by controlling different timing signals when the electronic device is in different operating states. This solves the problem that a complete verification and authentication process of the BIOS cannot be achieved during the transition from S5 to S0 of the electronic device, and realizes the verification of the BIOS during the transition from S5 to S0.
[0065] Based on the foregoing embodiments, embodiments of this application provide a control method, referring to... Figure 2 As shown, the method includes the following steps:
[0066] Step 201: Determine the operating status of the electronic device.
[0067] In this embodiment, the operating state of the electronic device can be determined by parameters based on the current state of the electronic device; specifically, the current operating state of the electronic device can be determined based on its power consumption and / or the operation of the central processing unit (CPU). It should be noted that if the detected current power consumption of the electronic device is 0, then the current operating state of the electronic device can be considered to include working state S5; if the CPU is off, then the current operating state of the electronic device can be considered to include working state S2. Of course, this embodiment is merely an example illustrating a method for determining the operating state of an electronic device; any other method for determining the operating state of an electronic device is feasible in this solution.
[0068] It should be noted that after step 201, you can choose to execute either step 202 or step 203;
[0069] Step 202: If the electronic device is in the first operating state, the electronic device blocks the first timing signal for resetting the southbridge of the electronic device through the target controller, so as to prevent the host system from accessing the boot system.
[0070] In this application embodiment, the first operating state can refer to an operating phase; in a feasible implementation, the first operating state can refer to the operating phase of the electronic device from state G3 to state S5; the first timing signal can include the Rsmrst# signal used for resetting; that is, during the operating phase of the electronic device from state G3 to state S5, the Rsmrst# signal is blocked by EC / ESIO to prevent the operating system from accessing the BIOS. The blocking of the Rsmrst# signal can be implemented in computer language by holding / blocking the Rsmrst# signal using EC / ESIO.
[0071] It should be noted that the Rsmrst# signal is used to reset the southbridge chip, and after the southbridge chip is reset, the operating system can access the BIOS; therefore, once the Rsmrst# signal is held / blocked, the operating system cannot access the BIOS.
[0072] Step 203: If the electronic device is in the second operating state, the electronic device blocks the second timing signal of the electronic device through the target controller to prevent the host system from accessing the boot system.
[0073] In this embodiment, the second operating state may also refer to an operating phase; and the second operating state is different from the first operating state; wherein, the second operating state may include two operating phases. In one feasible implementation, the second operating state may refer to two operating phases of the electronic device from state S5 to state S0, or from state S3 to state S0; the second timing signal may include a power timing signal for powering on; in one feasible implementation, the second timing signal may include power timing signals such as PS_ON or SLP_S3.
[0074] In other words, during the transition of an electronic device from state S5 to state S0, or from state S3 to state S0, power timing signals such as PS_ON or SLP_S3 are blocked via EC / ESIO to prevent the operating system from accessing the BIOS. In computer terminology, blocking power timing signals such as PS_ON or SLP_S3 can be achieved by holding / blocking these signals using EC / ESIO.
[0075] It should be noted that steps 204 to 207 can be executed after steps 202 and 203.
[0076] Step 204: The electronic device calculates the first content data in the boot system to obtain the first verification information.
[0077] The first piece of data can be the boot data in the BIOS (Initial Boot Block, IBB) stage. Since the BIOS IBB stage is the initial stage during BIOS startup, checking the boot data in the BIOS IBB stage can ensure the accuracy of the BIOS legitimacy check to a greater extent, while reducing the amount of data that needs to be checked and improving detection efficiency. It should be noted that if the boot data in the BIOS IBB stage is detected to have been tampered with, it means that the data in the BIOS is definitely abnormal, and there is no need to check the data in other stages of the BIOS. Alternatively, the first verification information can be calculated from all data in the BIOS, or from data in other stages.
[0078] It should be noted that, depending on the operating state of the electronic device, the EC can calculate the first verification information from the first data in the BIOS through different signal channels. However, the calculation logic for obtaining the first verification information from the first data is the same regardless of the operating state.
[0079] Step 205: The electronic device determines whether the first verification information matches the second verification information obtained by parsing the signature data in the boot system.
[0080] In this embodiment of the application, the second verification information may be obtained by parsing the signature data pre-stored in the BIOS memory; of course, the signature data may be obtained by pre-signing and encrypting specific parts of the data in the BIOS.
[0081] Step 206: If the first verification information matches the second verification information, the electronic device determines that the boot system is legitimate.
[0082] In the embodiments of this application, matching the first verification information with the second verification information can mean that the first verification information and the second verification information are the same; if the first verification information and the second verification information are the same, the first data in the BIOS of the specification has not been tampered with, which can also be considered as the data in the BIOS not being tampered with, that is, it indicates that the BIOS has not experienced any abnormalities and is legitimate.
[0083] Step 207: If the verification result indicates that the boot system is legitimate, the electronic device allows the host system to access the boot system.
[0084] It should be noted that the explanation of the same or corresponding steps in the embodiments of this application and other embodiments can be referred to the description in other embodiments, and will not be repeated here.
[0085] The control method provided in the embodiments of this application can verify the legitimacy of the BIOS by controlling different timing signals when the electronic device is in different operating states. This solves the problem that a complete verification and authentication process of the BIOS cannot be achieved during the transition from S5 to S0 of the electronic device, and realizes the verification of the BIOS during the transition from S5 to S0.
[0086] Based on the foregoing embodiments, embodiments of this application provide a control method, referring to... Figure 3 As shown, the method includes the following steps:
[0087] Step 301: The electronic device determines its operating status.
[0088] It should be noted that after step 301, steps 302-303 or steps 304-305 can be executed;
[0089] Step 302: If the electronic device is in the first operating state, the electronic device blocks the first timing signal for resetting the southbridge of the electronic device through the target controller, so as to prevent the host system from accessing the boot system.
[0090] Step 303: If the electronic device is in the first operating state, the electronic device accesses the first content data in the boot system through the first signal channel and performs the first calculation logic to obtain the first verification information.
[0091] In this embodiment, the first signal channel may refer to a Serial Peripheral Interface (SPI). The control method in this embodiment can be applied as shown in the figure. Figure 4 The architecture shown may include: a southbridge a, a first memory b, and a target controller c, wherein: the first memory b stores the BIOS; one end of the target controller c is connected to the southbridge a, and the other end of the target controller c is connected to the first memory b, used for validating the BIOS of the electronic device. Figure 4 The dotted line in the diagram corresponds to the SPI channel. When the electronic device is in the operation phase from G3 state to S5 state, the EC can access the BIOS through SPI to obtain the first content data in the BIOS.
[0092] Step 304: If the electronic device is in the second operating state, the electronic device blocks the second timing signal of the electronic device through the target controller to prevent the host system from accessing the boot system.
[0093] Step 305: If the electronic device is in the second operating state, the electronic device accesses the first content data of the boot system through the second signal channel and performs the first calculation logic to obtain the first verification information.
[0094] In this embodiment of the application, the second signal channel may refer to the Enhanced-Serial Peripheral Interface (eSPI); such as Figure 4 The solid line in the diagram corresponds to the eSPI channel. When the electronic device is in the operation phase of transitioning from S5 to S0, or from S3 to S0, the EC can access the BIOS via eSPI and through the Southbridge to obtain the first data in the BIOS.
[0095] Steps 306 to 308 can be executed after steps 303 and 305.
[0096] Step 306: The electronic device determines whether the first verification information matches the second verification information obtained by parsing the signature data in the boot system.
[0097] Step 307: If the first verification information matches the second verification information, the electronic device determines that the boot system is legitimate.
[0098] Step 308: If the verification result indicates that the boot system is legitimate, the electronic device allows the host system to access the boot system.
[0099] Based on the foregoing embodiments, in other embodiments of this application, the "performing first calculation logic to obtain first verification information" in steps 304 and 305 can be implemented in the following ways:
[0100] Step A1: The electronic device reads the contents of the boot system image file to obtain the first content data.
[0101] In this embodiment, before the electronic device is put into operation, a key pair can be generated using OpenSSL tools. This key pair includes a public key and a private key. The public key can be made public and stored in an internal storage medium of the EC, such as an electrically erasable programmable read-only memory (EEPROM). The private key must not be disclosed and can be stored on a specific server. The electronic device can obtain the first content data by reading the content data from the BIOS image file.
[0102] Step A2: The electronic device uses the RSA algorithm through the target controller to calculate the first content data and obtain the first verification information.
[0103] After reading the first data content of the BIOS image file, the first hash value of the first data content can be calculated using the RSA algorithm, thereby obtaining the first verification information. In other words, the first data content of the BIOS image file is the data content of the BIOS image file currently generated by the electronic device. It should be noted that the method for calculating the hash value of the first data content using the RSA algorithm can refer to existing calculation methods, and will not be elaborated here.
[0104] Based on the foregoing embodiments, in other embodiments of this application, the second verification information in step 306 can be obtained in the following way:
[0105] Step B1: The electronic device reads the second content data from the image file of the boot system and calculates the fourth verification information based on the second content data.
[0106] In this embodiment, before the electronic device is put into operation, the electronic device can use software tools to calculate the target hash value, and then use OpenSSL software to sign the target hash value using the RSA-2048 algorithm with a private key to generate a signature, which is then appended to the previous image file. That is, the second content data of the BIOS image file can be the content data of the BIOS image file generated before the electronic device is put into operation; the fourth verification information can be the information obtained by calculating the target hash value of the second content.
[0107] Step B2: The electronic device uses the second key to encrypt the fourth verification information according to the target encryption algorithm to obtain the third verification information, and stores the third verification information in the memory of the boot system.
[0108] In this embodiment, the target encryption algorithm may include the RSA-2048 algorithm; the third verification information may be a signature obtained by signing the target hash value using the RSA-2048 algorithm with a private key using OpenSSL software. The third verification information may be stored in the BIOS flash memory.
[0109] Step B3: The electronic device reads the third verification information from the memory of the boot system through the target controller.
[0110] Step B4: The electronic device parses and processes the third verification information to obtain the second verification information.
[0111] In step B4, the electronic device parses and processes the third verification information to obtain the second verification information, which can be achieved in the following way:
[0112] Based on the target encryption algorithm, the first key is used to decrypt the third verification information to obtain the second verification information.
[0113] In this embodiment, the second verification information can be the second hash value obtained by parsing the signature information using the RSA-2048 algorithm and the public key. It should be noted that the first content data and the second content data are the same part of the BIOS content data at different times; and, as long as the final first hash value is the same as the second hash value, it indicates that the BIOS is legitimate.
[0114] It should be noted that the explanation of the same or corresponding steps in the embodiments of this application and other embodiments can be referred to the description in other embodiments, and will not be repeated here.
[0115] The control method provided in the embodiments of this application can verify the legitimacy of the BIOS by controlling different timing signals when the electronic device is in different operating states. This solves the problem that a complete verification and authentication process of the BIOS cannot be achieved during the transition from S5 to S0 of the electronic device, and realizes the verification of the BIOS during the transition from S5 to S0.
[0116] In other embodiments of this application, the electronic device is in a second operating state, i.e., the operating phase from state G3 to state S5, and the overall process of EC verification of BIOS can be as follows: Figure 5 As shown, the entire process includes pre-generating a BIOS image file, calculating the hash value of the second content data in the image file, then encrypting the hash value of the second content data using the RSA-2048 algorithm and a private key to obtain the third verification information, and storing it in the BIOS memory. During the two operating phases of the electronic device, from S5 state to S0 state, or from S3 state to S0 state, the EC / ESIO blocks the PS_ON or SLP_S3 signal to prevent the operating system from accessing the BIOS. Then, the EC / ESIO reads the first content data in the BIOS and calculates its hash value to obtain the second verification information. At the same time, the third verification information previously stored in the BIOS memory is parsed using the RSA-2048 algorithm and a public key to obtain the second verification. When the first verification information and the second verification information are the same, the BIOS authentication is confirmed to be successful, and the boot operation can continue.
[0117] Based on the foregoing embodiments, embodiments of this application provide an electronic device 4, which can be applied to... Figures 1-3 In the control method provided in the corresponding embodiment, refer to Figure 6 As shown, the device 4 may include: a processor 41, a second memory 42, and a communication bus 43, wherein:
[0118] Communication bus 43 is used to realize the communication connection between processor 41 and second memory 42;
[0119] The processor 41 is used to execute the control program stored in the second memory 42 to perform the following steps:
[0120] The operating status of the electronic device is determined, and the timing signals of the host system of the electronic device are controlled by the target controller according to the operating status to prevent the host system from accessing the boot system of the electronic device.
[0121] Perform a validation operation on the legitimacy of the boot system;
[0122] If the verification result indicates that the boot system is legitimate, then the host system is allowed to access the boot system.
[0123] In particular, the timing signals controlled by the target controller are different under different operating conditions.
[0124] In other embodiments of this application, the processor 41 is configured to execute timing signals stored in the second memory 42 representing the host system of the electronic device controlled by the target controller according to the operating state, to prevent the host system from accessing the boot system of the electronic device, thereby implementing the following steps:
[0125] If the electronic device is in the first operating state, the target controller blocks the first timing signal that resets the southbridge of the electronic device to prevent the host system from accessing the boot system.
[0126] In other embodiments of this application, the processor 41 is configured to execute timing signals stored in the second memory 42 representing the host system of the electronic device controlled by the target controller according to the operating state, to prevent the host system from accessing the boot system of the electronic device, thereby implementing the following steps:
[0127] If the electronic device is in the second operating state, the second timing signal of the electronic device is blocked by the target controller to prevent the host system from accessing the boot system.
[0128] In other embodiments of this application, the processor 41 is configured to execute the legality verification operation of the boot system stored in the second memory 42 to achieve the following steps:
[0129] The first verification information is obtained by calculating the first content data in the boot system;
[0130] Determine whether the first verification information matches the second verification information obtained by parsing the signature data in the boot system;
[0131] If the first verification information matches the second verification information, the boot system is deemed legitimate.
[0132] In other embodiments of this application, the processor 41 is used to perform calculations on the first content data in the boot system stored in the second memory 42 to obtain first verification information, in order to implement the following steps:
[0133] If the electronic device is in a first operating state, it accesses the first content data in the boot system through the first signal channel and performs first calculation logic on it to obtain first verification information; and / or,
[0134] If the electronic device is in the second operating state, it accesses the first content data of the boot system through the second signal channel and performs the first calculation logic on it to obtain the first verification information.
[0135] In other embodiments of this application, the processor 41 is used to execute the first calculation logic stored in the second memory 42 to obtain the first verification information, in order to implement the following steps:
[0136] The first content data is obtained by reading the contents of the boot system's image file;
[0137] The target controller uses the RSA algorithm to calculate the first content data to obtain the first verification information.
[0138] In other embodiments of this application, the processor 41 is used to execute the control program stored in the second memory 42, and can also perform the following steps:
[0139] The target controller reads the third verification information from the boot system's memory;
[0140] The third verification information is parsed and processed to obtain the second verification information.
[0141] In other embodiments of this application, the processor 41 is used to perform parsing processing of the third verification information stored in the second memory 42 to obtain the second verification information, in order to implement the following steps:
[0142] Based on the target encryption algorithm, the first key is used to decrypt the third verification information to obtain the second verification information.
[0143] In other embodiments of this application, the processor 41 is used to execute the control program stored in the second memory 42, and can also perform the following steps:
[0144] Read the second content data from the boot system image file and calculate the fourth verification information based on the second content data;
[0145] According to the target encryption algorithm, the fourth verification information is encrypted using the second key to obtain the third verification information, and the third verification information is stored in the memory of the boot system.
[0146] It should be noted that the specific implementation process of the steps executed by the processor in this embodiment can be referred to Figures 1-3 The implementation process of the control method provided in the corresponding embodiments will not be described in detail here.
[0147] The control method provided in the embodiments of this application can verify the legitimacy of the BIOS by controlling different timing signals when the electronic device is in different operating states. This solves the problem that a complete verification and authentication process of the BIOS cannot be achieved during the transition from S5 to S0 of the electronic device, and realizes the verification of the BIOS during the transition from S5 to S0.
[0148] Based on the foregoing embodiments, embodiments of this application provide a control device 5, which can be applied to... Figures 1-3 In the control method provided in the corresponding embodiment, refer to Figure 7 As shown, the device may include:
[0149] Control unit 51 is used to determine the operating status of the electronic device, and according to the operating status, the target controller controls the timing signals of the host system of the electronic device to prevent the host system from accessing the boot system of the electronic device.
[0150] Processing unit 52 is used to perform a legality verification operation on the boot system;
[0151] The processing unit 52 is further configured to allow the host system to access the boot system if the verification result indicates that the boot system is legitimate;
[0152] In particular, the timing signals controlled by the target controller are different under different operating conditions.
[0153] In other embodiments of this application, the control unit 51 is also configured to perform the following steps:
[0154] If the electronic device is in the first operating state, the target controller blocks the first timing signal that resets the southbridge of the electronic device to prevent the host system from accessing the boot system.
[0155] In other embodiments of this application, the control unit 51 is also configured to perform the following steps:
[0156] If the electronic device is in the second operating state, the second timing signal of the electronic device is blocked by the target controller to prevent the host system from accessing the boot system.
[0157] In other embodiments of this application, the processing unit 51 is further configured to perform the following steps:
[0158] The first verification information is obtained by calculating the first content data in the boot system;
[0159] Determine whether the first verification information matches the second verification information obtained by parsing the signature data in the boot system;
[0160] If the first verification information matches the second verification information, the boot system is deemed legitimate.
[0161] In other embodiments of this application, the processing unit 51 is further configured to perform the following steps:
[0162] If the electronic device is in a first operating state, it accesses the first content data in the boot system through the first signal channel and performs first calculation logic on it to obtain first verification information; and / or,
[0163] If the electronic device is in the second operating state, it accesses the first content data of the boot system through the second signal channel and performs the first calculation logic on it to obtain the first verification information.
[0164] In other embodiments of this application, the processing unit 51 is further configured to perform the following steps:
[0165] The first content data is obtained by reading the contents of the boot system's image file;
[0166] The target controller uses the RSA algorithm to calculate the first content data to obtain the first verification information.
[0167] In other embodiments of this application, the processing unit 51 is further configured to perform the following steps:
[0168] The target controller reads the third verification information from the boot system's memory;
[0169] The third verification information is parsed and processed to obtain the second verification information.
[0170] In other embodiments of this application, the processing unit 51 is further configured to perform the following steps:
[0171] Based on the target encryption algorithm, the first key is used to decrypt the third verification information to obtain the second verification information.
[0172] In other embodiments of this application, the processing unit 51 is further configured to perform the following steps:
[0173] Read the second content data from the boot system image file and calculate the fourth verification information based on the second content data;
[0174] According to the target encryption algorithm, the fourth verification information is encrypted using the second key to obtain the third verification information, and the third verification information is stored in the memory of the boot system.
[0175] It should be noted that the specific implementation process of the steps performed by each unit in this embodiment can be referred to Figures 1-3 The implementation process of the control method provided in the corresponding embodiments will not be described in detail here.
[0176] The control device provided in the embodiments of this application can verify the legitimacy of the BIOS by controlling different timing signals when the electronic device is in different operating states. This solves the problem that a complete verification and authentication process of the BIOS cannot be achieved during the process of the electronic device changing from S5 to S0, and realizes the verification of the BIOS during the process of changing from S5 to S0.
[0177] Based on the foregoing embodiments, embodiments of this application provide a computer-readable storage medium storing one or more programs, which can be executed by one or more processors to implement... Figures 1-3 The steps in the control method provided in the corresponding embodiment.
[0178] It should be understood that the phrase "one embodiment" or "an embodiment" throughout the specification means that a specific feature, structure, or characteristic related to the embodiment is included in at least one embodiment of this application. Therefore, "in one embodiment" or "in an embodiment" appearing throughout the specification does not necessarily refer to the same embodiment. Furthermore, these specific features, structures, or characteristics can be combined in any suitable manner in one or more embodiments. It should be understood that in the various embodiments of this application, the sequence numbers of the above-described processes do not imply a sequential order of execution; the execution order of each process should be determined by its function and internal logic, and should not constitute any limitation on the implementation process of the embodiments of this application. The sequence numbers of the above-described embodiments are merely descriptive and do not represent the superiority or inferiority of the embodiments.
[0179] It should be noted that, in this document, the terms "comprising," "including," or any other variations thereof are intended to cover non-exclusive inclusion, such that a process, method, article, or apparatus that comprises a list of elements includes not only those elements but also other elements not expressly listed, or elements inherent to such a process, method, article, or apparatus. Unless otherwise specified, an element defined by the phrase "comprising one..." does not exclude the presence of other identical elements in the process, method, article, or apparatus that includes that element.
[0180] In the several embodiments provided in this application, it should be understood that the disclosed devices and methods can be implemented in other ways. The device embodiments described above are merely illustrative. For example, the division of units is only a logical functional division, and in actual implementation, there may be other division methods, such as: multiple units or components can be combined, or integrated into another system, or some features can be ignored or not executed. In addition, the coupling, direct coupling, or communication connection between the various components shown or discussed can be through some interfaces, and the indirect coupling or communication connection between devices or units can be electrical, mechanical, or other forms.
[0181] In addition, each functional unit in the various embodiments of this application can be integrated into one processing unit, or each unit can be a separate unit, or two or more units can be integrated into one unit; the integrated unit can be implemented in hardware or in the form of hardware plus software functional units.
[0182] Those skilled in the art will understand that all or part of the steps of the above method embodiments can be implemented by hardware related to program instructions. The aforementioned program can be stored in a computer-readable storage medium. When the program is executed, it performs the steps of the above method embodiments. The aforementioned storage medium includes various media that can store program code, such as mobile storage devices, read-only memory (ROM), magnetic disks, or optical disks.
[0183] Alternatively, if the integrated units described above are implemented as software functional modules and sold or used as independent products, they can also be stored in a computer-readable storage medium. Based on this understanding, the technical solutions of the embodiments of this application, or the parts that contribute to the prior art, can be embodied in the form of a software product. This computer software product is stored in a storage medium and includes several instructions to cause a computer device (which may be a personal computer, server, or network device, etc.) to execute all or part of the methods of the various embodiments of this application. The aforementioned storage medium includes various media capable of storing program code, such as mobile storage devices, ROMs, magnetic disks, or optical disks.
[0184] The above are merely specific embodiments of this application, but the scope of protection of this application is not limited thereto. Any variations or substitutions that can be easily conceived by those skilled in the art within the scope of the technology disclosed in this application should be included within the scope of protection of this application. Therefore, the scope of protection of this application should be determined by the scope of the claims.
Claims
1. A control method, comprising: The operating state of an electronic device is determined, and based on the operating state, the target controller controls the timing signals of the host system of the electronic device corresponding to the operating state to prohibit the host system from accessing the boot system of the electronic device; wherein, the operating state represents the power state of the electronic device; the operating state includes multiple different power states; Under different operating conditions, the legitimacy verification operation of the boot system is performed through different signal channels; If the verification result indicates that the boot system is legitimate, then the host system is allowed to access the boot system; The timing signals controlled by the target controller differ under different operating conditions.
2. The method according to claim 1, wherein, The step of controlling the host system of the electronic device according to the operating state by the target controller to control the timing signals corresponding to the operating state of the host system, so as to prohibit the host system from accessing the boot system of the electronic device, includes: If the electronic device is in the first operating state, the target controller blocks the first timing signal that resets the southbridge of the electronic device, thereby preventing the host system from accessing the boot system.
3. The method according to claim 1, wherein, The step of controlling the host system of the electronic device according to the operating state by the target controller to control the timing signals corresponding to the operating state of the host system, so as to prohibit the host system from accessing the boot system of the electronic device, further includes: If the electronic device is in the second operating state, the target controller blocks the second timing signal of the electronic device to prevent the host system from accessing the boot system.
4. The method according to claim 1, wherein, The execution of the legality verification operation for the boot system includes: First verification information is obtained by calculating the first content data in the boot system; Determine whether the first verification information matches the second verification information obtained by parsing the signature data in the boot system; If the first verification information matches the second verification information, the boot system is determined to be legitimate.
5. The method according to claim 4, wherein, The calculation of the first verification information from the first content data in the boot system includes: If the electronic device is in a first operating state, it accesses the first content data in the boot system through a first signal channel and performs first calculation logic on it to obtain the first verification information; and / or, If the electronic device is in a second operating state, it accesses the first content data of the guidance system through the second signal channel and performs first calculation logic on it to obtain the first verification information.
6. The method according to claim 5, wherein, The step of performing the first calculation logic to obtain the first verification information includes: The first content data is obtained by reading the contents of the image file of the boot system; The target controller uses the RSA algorithm to calculate the first content data to obtain the first verification information.
7. The method according to claim 4, wherein, Before determining whether the first verification information matches the second verification information obtained by parsing the signature data in the boot system, the method further includes: The target controller reads third verification information from the memory of the boot system; The third verification information is parsed to obtain the second verification information.
8. The method according to claim 7, wherein, The step of parsing the third verification information to obtain the second verification information includes: According to the target encryption algorithm, the third verification information is decrypted using the first key to obtain the second verification information.
9. The method according to claim 7, wherein, The method further includes: Read the second content data from the image file of the boot system, and calculate the fourth verification information based on the second content data; According to the target encryption algorithm, the fourth verification information is encrypted using the second key to obtain the third verification information, and the third verification information is stored in the memory of the boot system.
10. A control device, wherein, The device includes: A control unit is used to determine the operating state of an electronic device, and according to the operating state, a target controller controls the timing signals of the host system of the electronic device corresponding to the operating state to prevent the host system from accessing the boot system of the electronic device; wherein, the operating state represents the power state of the electronic device; the operating state includes multiple different power states; The processing unit is used to perform the legality verification operation of the boot system through different signal channels under different operating states; The processing unit is further configured to allow the host system to access the boot system if the verification result indicates that the boot system is legitimate; The timing signals controlled by the target controller differ under different operating conditions.