Information processing method, information processing device, electronic device and storage medium

Abstract

The embodiment of the present application discloses an information processing method, which includes: obtaining a detection result of whether the baseboard management controller is in the operating environment of the boot system when the mainboard is powered on and the in-band access channel is opened; if the detection result indicates that the baseboard management controller is not in the operating environment, notifying the baseboard management controller to close the in-band access channel. The embodiment of the present application also discloses an information processing device, an electronic device and a storage medium.

Description

Technical Field

[0001] The present application relates to but is not limited to the field of information technology, and in particular to an information processing method, an information processing device, an electronic device and a storage medium. Background Art

[0002] The current baseboard management controller (BMC) in-band regular access channel is mainly used for the boot system and the application program under the operating system to communicate with the BMC.

[0003] In a scenario where an attacker has physical access to a server, it is easy to start the server through an external storage device, thereby easily obtaining BMC access rights, thereby easily obtaining data in the BMC and even modifying the system configuration. Summary of the invention

[0004] Embodiments of the present application are intended to provide an information processing method, an information processing device, an electronic device, and a storage medium.

[0005] The technical solution of this application is implemented as follows:

[0006] An information processing method, the method comprising:

[0007] When the mainboard is powered on and the in-band access channel is open, obtaining a detection result of whether the baseboard management controller is accessed through the in-band access channel and is in the operating environment of the boot system;

[0008] If the detection result indicates that the access to the baseboard management controller is not in the operating environment, the baseboard management controller is notified to close the in-band access channel.

[0009] An information processing device, comprising:

[0010] An acquisition module is used to obtain a detection result of whether the baseboard management controller is accessed through the in-band access channel in the operating environment of the boot system when the mainboard is powered on and the in-band access channel is opened;

[0011] The processing module is used to notify the baseboard management controller to close the in-band access channel if the detection result indicates that the access to the baseboard management controller is not in the operating environment.

[0012] An electronic device, comprising: a processor, a memory and a communication bus;

[0013] The communication bus is used to realize the communication connection between the processor and the memory;

[0014] The processor is used to execute the information processing program stored in the memory to implement the steps of the above-mentioned information processing method.

[0015] A computer storage medium stores one or more programs, and the one or more programs can be executed by one or more processors to implement the steps of the above-mentioned information processing method.

[0016] The information processing method, information processing device, electronic device and storage medium provided by the embodiments of the present application include: when the mainboard is powered on and the in-band access channel is opened, obtaining a detection result of whether the baseboard management controller is accessed through the in-band access channel in the operating environment of the boot system; if the detection result indicates that the access to the baseboard management controller is not in the operating environment, notifying the baseboard management controller to close the in-band access channel; that is, as long as it is determined that the baseboard management controller is accessed through the in-band access channel and the detection result is not in the operating environment of the boot system, which indicates that the access right to the in-band access channel is not possessed, the in-band access channel is immediately closed, so that even if an attacker can access the server entity, since the attacker's access to the baseboard management controller is not in the operating environment of the boot system, the in-band access channel is closed, the attacker's access is blocked, and the access security of the baseboard management controller is provided. BRIEF DESCRIPTION OF THE DRAWINGS

[0017] Figure 1 A flowchart of an optional information processing method provided for an embodiment of the present application;

[0018] Figure 2 A flowchart of an optional information processing method provided for an embodiment of the present application;

[0019] Figure 3 A flowchart of an optional information processing method provided for an embodiment of the present application;

[0020] Figure 4 A flowchart of an optional information processing method provided for an embodiment of the present application;

[0021] Figure 5 A schematic diagram of the structure of an information processing device provided in an embodiment of the present application;

[0022] Figure 6 A schematic diagram of the structure of an electronic device provided in an embodiment of the present application. DETAILED DESCRIPTION

[0023] The technical solutions in the embodiments of the present application will be clearly and completely described below in conjunction with the drawings in the embodiments of the present application.

[0024] Unless otherwise defined, all technical and scientific terms used herein have the same meaning as those commonly understood by those skilled in the art to which this application belongs. The terms used herein are only for the purpose of describing the embodiments of this application and are not intended to limit this application.

[0025] Before further describing the embodiments of the present application in detail, the nouns and terms involved in the embodiments of the present application are explained. The nouns and terms involved in the embodiments of the present application are subject to the following interpretations.

[0026] The current BMC in-band regular access channel is mainly used for the boot system and the application programs under the operating system to communicate with the BMC.

[0027] In scenarios where an attacker has physical access to a server, it is easy to start the server through an external storage device, thereby easily obtaining BMC access rights, thereby easily obtaining data in the BMC, and even modifying system configurations. For example, if the edge server is not in the computer room or has weak security, access to the baseboard management controller poses a major security risk to the edge server.

[0028] The embodiment of the present application provides an information processing method, which can be applied to electronic devices. Figure 1 As shown, the method comprises the following steps:

[0029] Step 101: When the mainboard is powered on and the in-band access channel is opened, a detection result of whether the baseboard management controller is accessed through the in-band access channel and is in the operating environment of the boot system is obtained.

[0030] In the embodiment of the present application, the in-band access channel includes but is not limited to a keyboard controller style (Keyboard Controller Style, KCS) channel and a block transfer (Block Transfer, BT) channel.

[0031] In the embodiments of the present application, the boot system is also called a firmware system, and the firmware system includes but is not limited to the Basic Input Output System (BIOS) of fixed electronic devices such as personal computers (PCs), the Unified Extensible Firmware Interface (UEFI), the Extensible Firmware Interface (EFI), and the Bootloader system of mobile electronic devices such as mobile phones. It should be noted that the boot system involved in the embodiments of the present application has a secure boot function, and the core of Secure Boot is to use a digital signature to confirm whether the EFI driver or application is trusted, thereby ensuring the safety and reliability of the system boot.

[0032] For example, when the firmware system is UEFI, most of the code in UEFI is written in C language, and UEFI applications and drivers can be written in C++. UEFI shields the operating system (OS) and OS loader from the underlying hardware details through the firmware operating system interface, making it easy to reuse UEFI upper-layer applications. Compared with traditional BIOS, UEFI has been greatly improved, and the time from booting to entering the operating system has been greatly shortened.

[0033] In the embodiment of the present application, the motherboard, also called the mainboard, is installed in the chassis and is one of the most basic and important components of the microcomputer. The motherboard is generally a rectangular circuit board, on which the main circuit system of the computer is installed, generally including a boot system chip, an input / output (I / O) control chip, a keyboard and a panel control switch interface, an indicator light connector, an expansion slot, a DC power supply connector for the motherboard and the plug-in card, and other components. Among them, the control chip includes but is not limited to a central processing unit (CPU), a field programmable gate array (FPGA) or a complex programmable logic device (CPLD).

[0034] In some embodiments, in the scenario where the electronic device is turned on or restarted, the computer power-on process is executed, and when the mainboard is powered on and the in-band access channel is opened, a detection result is obtained to determine whether the baseboard management controller is in the operating environment of the boot system when accessed through the in-band access channel. Here, the detection result includes the detection result of accessing the baseboard management controller through the in-band access channel and being in the operating environment of the boot system; or the detection result of accessing the baseboard management controller through the in-band access channel and not being in the operating environment of the boot system.

[0035] In the embodiments of the present application, the electronic device includes but is not limited to mobile terminal devices such as mobile phones, tablet computers, laptop computers, personal digital assistants (PDAs), cameras, wearable devices, vehicle-mounted devices, and fixed terminal devices such as desktop computers.

[0036] Step 102: If the detection result indicates that the access to the baseboard management controller is not in the operating environment, notify the baseboard management controller to close the in-band access channel.

[0037] In an embodiment of the present application, if the detection result indicates that the access to the baseboard management controller is not in the operating environment of the boot system, the baseboard management controller is notified to close the in-band access channel. That is to say, the present application limits the in-band access channel to be accessed only in the operating environment of the boot system, and utilizes the security and reliability of the boot system to ensure that the in-band access of the in-band access channel is within a trusted range. Once it is found that it is not in the operating environment of the boot system, the in-band access channel is closed to prevent unsafe access from occurring.

[0038] The information processing method provided by the embodiment of the present application obtains a detection result of whether the baseboard management controller is accessed through the in-band access channel in the operating environment of the boot system when the mainboard is powered on and the in-band access channel is opened; if the detection result indicates that the access to the baseboard management controller is not in the operating environment, the baseboard management controller is notified to close the in-band access channel; that is, as long as it is determined that the baseboard management controller is accessed through the in-band access channel and the detection result is not in the operating environment of the boot system, which indicates that the access right to the in-band access channel is not possessed, the in-band access channel is immediately closed. In this way, even if an attacker can access the server entity, since the attacker accesses the baseboard management controller not in the operating environment of the boot system, the in-band access channel is closed, the attacker's access is blocked, and the access security of the baseboard management controller is provided.

[0039] The embodiment of the present application provides an information processing method, which can be applied to electronic devices. Figure 2As shown, the method comprises the following steps:

[0040] Step 201 : When the mainboard is powered on and the in-band access channel is opened, a detection result of accessing the baseboard management controller through the in-band access channel and not being in the operating environment of the boot system is obtained.

[0041] In the embodiment of the present application, in the following two scenarios, the detection results can be obtained in the operating environment that is not in the boot system:

[0042] Scenario 1: When the mainboard is powered on and the in-band access channel is open, if the boot system self-test is completed, the baseboard management controller is accessed through the in-band access channel, and the test result is obtained in the operating environment of the boot system.

[0043] In scenario one, when the electronic device is turned on or restarted, the computer power-on process will be executed. When the mainboard is powered on and the in-band access channel is opened, if the boot system self-check is completed, the boot system takes over the system control to boot the system and complete the self-check. Next, the operating system will take over the system control. At this time, it is determined that the baseboard management controller is accessed through the in-band access channel, and the detection result is not in the operating environment of the boot system.

[0044] In some embodiments, the output signals of the general-purpose input / output (GPIO) pins of the south bridge chip are detected so as to locate the faulty components according to different combinations of the signal states; the output signals of the GPIO pins of the south bridge chip correspond to the checkpoint codes continuously output by the boot system during the self-check process, which represent the current process and diagnostic results of the system.

[0045] During the boot and self-test process, the boot system continuously outputs checkpoint codes to indicate the diagnostic process currently executed by the system. If the system stops at a certain checkpoint code, it means that there is a problem with the system at this time. These problems can be attributed to the motherboard, memory, I / O devices or Peripheral Component Interconnect (PCI) devices. If a problem is found in a system component, the boot system will parse the checkpoint code and attribute the problem to a specific component, such as the CPU, memory, or motherboard. Under normal circumstances, a corresponding prompt will appear on the display.

[0046] Scenario 2: When the mainboard is powered on and the in-band access channel is opened, if the boot system self-test is completed and the baseboard management controller detects the first system interrupt signal, the first system interrupt signal is processed by the boot system; if the boot system processes the first system interrupt signal, access to the baseboard management controller is obtained through the in-band access channel, and the detection result is not in the running environment.

[0047] In scenario 2, the first system interrupt signal is also called a first system management interrupt (System Management Interrupt, SMI) signal, and SMI is a CPU-level interrupt signal.

[0048] When the mainboard is powered on and the in-band access channel is open, if the boot system self-test is completed and the baseboard management controller detects the first system interrupt signal and enters the first SMI, the control chip on the mainboard notifies the BMC, and the BMC detects that it is currently in SMI mode and the boot system self-test is completed, then the BMC temporarily opens the in-band access channel, or the boot system actively notifies the BMC to open the in-band access channel as needed; the boot system uses the in-band access channel normally using conventional methods in SMI, and processes the first system interrupt signal through the boot system; if the boot system processes the first system interrupt signal, at this time, the BMC detects that the SMI exits and obtains the detection result of accessing the baseboard management controller through the in-band access channel and is not in the operating environment. The above-mentioned use of the in-band access channel using conventional methods includes but is not limited to using the in-band channel to perform various interactive operations with the BMC, including sending data to the BMC, obtaining data and information from the BMC, and controlling the system through the BMC.

[0049] In the embodiment of the present application, the SMI signal may be generated at any time during system operation. During the SMI interrupt processing, the in-band access channel is opened before the BMC in-band access channel is needed, and the in-band access channel is closed after the in-band access channel is used up or when the SMI is exited.

[0050] Step 202: Notify the baseboard management controller to close the in-band access channel.

[0051] That is to say, in any of the above two scenarios, the operating environment of the boot system is out of the trusted range. At this time, the in-band access channel is automatically closed immediately to prevent unsafe access from occurring.

[0052] The embodiment of the present application provides an information processing method, which can be applied to electronic devices. Figure 3 As shown, the method comprises the following steps:

[0053] Step 301: When the mainboard is powered on and the in-band access channel is open, if the boot system self-check is completed, a detection result of accessing the baseboard management controller through the in-band access channel and not being in the running environment is obtained.

[0054] In the embodiment of the present application, when the boot system self-check is completed, it is out of the operating environment of the boot system, that is, the trusted range. At this time, it is detected that the baseboard management controller is accessed through the in-band access channel, and the detection result is not in the operating environment. The in-band access channel is automatically closed immediately to prevent unsafe access from occurring.

[0055] Step 302: Notify the baseboard management controller to close the in-band access channel.

[0056] Step 303: A first system interrupt signal is detected by the baseboard management controller, and an opening event that meets the permission verification condition is generated.

[0057] In an embodiment of the present application, when the mainboard is powered on and the in-band access channel is opened, if the boot system self-test is completed, the in-band access channel is closed first; further, when the first system interrupt signal is detected by the baseboard management controller, that is, when entering the first SMI, an open event that meets the permission verification conditions is generated.

[0058] Step 304: If the opening event satisfies the permission verification condition of the boot system, an in-band access channel is opened in response to the opening event.

[0059] In the embodiment of the present application, it is determined that the opening event represents that the boot system self-check is completed and the first system interrupt signal is detected by the baseboard management controller, then it is determined that the opening event satisfies the permission verification condition of the boot system, and in response to the opening event, the in-band access channel is opened. At this time, the BMC temporarily opens the in-band access channel, or the boot system actively notifies the BMC to open the in-band access channel as needed; the boot system normally uses the conventional method to use the in-band access channel in the SMI, and the first system interrupt signal is processed by the boot system

[0060] In other embodiments of the present application, when the mainboard is powered on, the following steps may also be performed:

[0061] First, open the in-band access channel.

[0062] Here, when the mainboard is powered on, the BMC automatically opens the in-band access channel.

[0063] Secondly, during the process of booting the system self-test, if the baseboard management controller detects the second system interrupt signal, the baseboard management controller is accessed through the in-band access channel to obtain self-test diagnostic information.

[0064] Here, during the boot system boot and self-test process, the boot system continuously outputs checkpoint codes to indicate the diagnostic process currently executed by the system. If the system stops at a certain checkpoint code, it means that a problem has occurred in the system and a second system interrupt signal such as a second SMI signal is generated. Furthermore, the boot system can access the baseboard management controller through an in-band access channel to obtain self-test diagnostic information.

[0065] The embodiment of the present application provides an information processing method, which can be applied to electronic devices. Figure 4 As shown, the method comprises the following steps:

[0066] Step 401: When the mainboard is powered on and the in-band access channel is opened, if the boot system self-check is completed and the baseboard management controller detects a first system interrupt signal, the first system interrupt signal is processed by the boot system.

[0067] Step 402: If the boot system has processed the first system interrupt signal, a detection result is obtained that the baseboard management controller is accessed through the in-band access channel and is not in the running environment.

[0068] Step 403: Notify the baseboard management controller to close the in-band access channel.

[0069] Step 404: Obtain an opening event for the in-band access channel.

[0070] In the embodiment of the present application, when the boot system self-check is completed and the first system interrupt signal processing is completed, the in-band access channel will be closed to prevent the attacker from accessing the baseboard management controller when it is not in the operating environment of the boot system. In order to improve the flexibility of user use, and to facilitate the user to still expect the boot system to retain the in-band channel after the self-check is completed, and to facilitate the operating system level to still question the BMC, the present application performs authorized switch control on the in-band access channel, that is, to ensure that the access to the BMC in-band access channel is carried out in a secure environment, and at the same time, to ensure that the operator itself meets the security verification conditions, so as to achieve the security management of the in-band access channel and further improve the security of the access to the baseboard management controller.

[0071] In the embodiment of the present application, step 404 of obtaining the opening event of the in-band access channel can be implemented by the following steps:

[0072] First, security verification information of the boot system and / or baseboard management controller is obtained.

[0073] Secondly, if the security verification information meets the security verification conditions, the management control of the in-band access channel is displayed in the configuration interface of the boot system; wherein the management control is used to open the in-band access channel when triggered.

[0074] Here, the security verification information may be at least one of the security verification information of the boot system and the security verification information of the baseboard management controller. The security verification information of the boot system includes but is not limited to the user name and password entered into the setup interface of the boot system such as UEFI. The security verification information of the baseboard management controller includes but is not limited to the user name and password entered into the BMC.

[0075] Finally, if the management control is triggered, an open event that meets the permission verification conditions is generated.

[0076] Step 405: If the opening event satisfies the permission verification condition of the boot system, an in-band access channel is opened in response to the opening event.

[0077] In an embodiment of the present application, when the boot system self-test is completed and the first system interrupt signal processing is completed, the in-band access channel will be closed. At this time, if you want to open the in-band access channel, you must meet the boot system's permission verification conditions before you can open the in-band access channel for use.

[0078] The embodiment of the present application provides an information processing device, which can be applied to Figures 1 to 4 In an information processing method provided by a corresponding embodiment, referring to Figure 5 As shown, the information processing device 5 includes:

[0079] The obtaining module 501 is used to obtain the detection result of whether the baseboard management controller is in the operating environment of the boot system through the in-band access channel when the mainboard is powered on and the in-band access channel is opened;

[0080] The processing module 502 is configured to notify the baseboard management controller to close the in-band access channel if the detection result indicates that the access to the baseboard management controller is not in the operating environment.

[0081] In other embodiments of the present application, the obtaining module 501 is used to obtain the detection result of accessing the baseboard management controller through the in-band access channel when the boot system self-test is completed and is not in the operating environment.

[0082] In other embodiments of the present application, the processing module 502 is used to process the first system interrupt signal through the boot system if the boot system self-check is completed and the baseboard management controller detects the first system interrupt signal;

[0083] The obtaining module 501 is used to obtain a detection result that the baseboard management controller is not in the running environment when the boot system processes the first system interrupt signal through the in-band access channel.

[0084] In other embodiments of the present application, the obtaining module 501 is used to obtain an opening event of an in-band access channel;

[0085] The processing module 502 is used to open the in-band access channel in response to the opening event if the opening event meets the permission verification condition of the boot system.

[0086] In other embodiments of the present application, the obtaining module 501 is used to obtain security verification information of the boot system and / or the baseboard management controller;

[0087] Further, the information processing device 5 also includes a display module 503, which is used to display the management control of the in-band access channel in the configuration interface of the boot system if the security verification information meets the security verification condition; wherein the management control is used to open the in-band access channel when triggered;

[0088] The processing module 502 is used to generate an opening event that meets the permission verification condition if the management control is triggered.

[0089] In other embodiments of the present application, the processing module 502 is used to detect the first system interrupt signal through the baseboard management controller and generate an opening event that meets the permission verification condition.

[0090] In other embodiments of the present application, the processing module 502 is used to open the in-band access channel when the mainboard is powered on;

[0091] The processing module 502 is used to access the baseboard management controller through an in-band access channel to obtain self-test diagnostic information if the baseboard management controller detects a second system interrupt signal during the process of guiding the system self-test.

[0092] The information processing device provided in the embodiment of the present application obtains a detection result of whether the baseboard management controller is accessed through the in-band access channel in the operating environment of the boot system when the mainboard is powered on and the in-band access channel is opened; if the detection result indicates that the access to the baseboard management controller is not in the operating environment, the baseboard management controller is notified to close the in-band access channel; that is, as long as it is determined that the detection result of accessing the baseboard management controller through the in-band access channel is not in the operating environment of the boot system, which indicates that the access right to the in-band access channel is not possessed, the in-band access channel is immediately closed. In this way, even if an attacker is able to access the server entity, since the attacker's access to the baseboard management controller is not in the operating environment of the boot system, the in-band access channel is closed, the attacker's access is blocked, and the access security of the baseboard management controller is provided.

[0093] The embodiment of the present application provides an electronic device, which can be applied to Figures 1 to 4In an information processing method provided by a corresponding embodiment, referring to Figure 6 As shown, the electronic device 6 includes: a processor 601, a memory 602 and a communication bus 603, wherein:

[0094] The communication bus 603 is used to implement the communication connection between the processor 601 and the memory 602 .

[0095] The processor 601 is used to execute the information processing program stored in the memory 602 to implement the following steps:

[0096] When the mainboard is powered on and the in-band access channel is opened, a detection result of whether the baseboard management controller is accessed through the in-band access channel and is in the operating environment of the boot system is obtained;

[0097] If the detection result indicates that the access to the baseboard management controller is not in the operating environment, the baseboard management controller is notified to close the in-band access channel.

[0098] In other embodiments of the present application, the processor 601 is used to execute the information processing program stored in the memory 602 to implement the following steps:

[0099] If the boot system self-test is completed, the baseboard management controller is accessed through the in-band access channel and the test result is obtained that it is not in the running environment.

[0100] In other embodiments of the present application, the processor 601 is used to execute the information processing program stored in the memory 602 to implement the following steps:

[0101] If the boot system self-check is completed and the baseboard management controller detects the first system interrupt signal, the first system interrupt signal is processed by the boot system;

[0102] If the boot system processes the first system interrupt signal, a detection result of accessing the baseboard management controller through the in-band access channel and not being in the running environment is obtained.

[0103] In other embodiments of the present application, the processor 601 is used to execute the information processing program stored in the memory 602 to implement the following steps:

[0104] Get the opening event of the in-band access channel;

[0105] If the opening event satisfies the permission verification condition of the boot system, an in-band access channel is opened in response to the opening event.

[0106] In other embodiments of the present application, the processor 601 is used to execute the information processing program stored in the memory 602 to implement the following steps:

[0107] Obtaining security authentication information of a boot system and / or a baseboard management controller;

[0108] If the security verification information satisfies the security verification condition, a management control of the in-band access channel is displayed in the configuration interface of the boot system; wherein the management control is used to open the in-band access channel when triggered;

[0109] If the management control is triggered, an open event that meets the permission verification conditions is generated.

[0110] In other embodiments of the present application, the processor 601 is used to execute the information processing program stored in the memory 602 to implement the following steps:

[0111] The first system interrupt signal is detected by the baseboard management controller, and an opening event that meets the permission verification condition is generated.

[0112] In other embodiments of the present application, the processor 601 is used to execute the information processing program stored in the memory 602 to implement the following steps:

[0113] When the mainboard is powered on, open the in-band access channel;

[0114] During the process of booting the system to self-check, if the baseboard management controller detects the second system interrupt signal, the baseboard management controller is accessed through the in-band access channel to obtain self-check diagnosis information.

[0115] As an example, a processor can be an integrated circuit chip with signal processing capabilities, such as a general-purpose processor, a digital signal processor (DSP), or other programmable logic devices, discrete gate or transistor logic devices, discrete hardware components, etc., where a general-purpose processor can be a microprocessor or any conventional processor, etc.

[0116] The electronic device provided in the embodiment of the present application obtains a detection result of whether the baseboard management controller is accessed through the in-band access channel in the operating environment of the boot system when the mainboard is powered on and the in-band access channel is opened; if the detection result indicates that the access to the baseboard management controller is not in the operating environment, the baseboard management controller is notified to close the in-band access channel; that is, as long as it is determined that the baseboard management controller is accessed through the in-band access channel and the detection result is not in the operating environment of the boot system, which indicates that the access right to the in-band access channel is not possessed, the in-band access channel is immediately closed. In this way, even if an attacker is able to access the server entity, since the attacker's access to the baseboard management controller is not in the operating environment of the boot system, the in-band access channel is closed, the attacker's access is blocked, and the access security of the baseboard management controller is provided.

[0117] The embodiment of the present application provides a computer-readable storage medium, which stores one or more programs, and the one or more programs can be executed by one or more processors to implement the following. Figures 1 to 4 The implementation process of the information processing method provided in the corresponding embodiment will not be repeated here.

[0118] The computer-readable storage medium provided in the embodiment of the present application obtains a detection result of whether the baseboard management controller is accessed through the in-band access channel in the operating environment of the boot system when the mainboard is powered on and the in-band access channel is opened; if the detection result indicates that the access to the baseboard management controller is not in the operating environment, the baseboard management controller is notified to close the in-band access channel; that is, as long as it is determined that the baseboard management controller is accessed through the in-band access channel and the detection result is not in the operating environment of the boot system, which indicates that the access right to the in-band access channel is not possessed, the in-band access channel is immediately closed. In this way, even if an attacker is able to access the server entity, since the attacker's access to the baseboard management controller is not in the operating environment of the boot system, the in-band access channel is closed, the attacker's access is blocked, and the access security of the baseboard management controller is provided.

[0119] Those skilled in the art will appreciate that the embodiments of the present application may be provided as methods, systems, or computer program products. Therefore, the present application may adopt the form of hardware embodiments, software embodiments, or embodiments in combination with software and hardware. Moreover, the present application may adopt the form of a computer program product implemented on one or more computer-usable storage media (including but not limited to disk storage and optical storage, etc.) that contain computer-usable program code.

[0120] The present application is described with reference to the flowcharts and / or block diagrams of the methods, devices (systems), and computer program products according to the embodiments of the present application. It should be understood that each process and / or box in the flowchart and / or block diagram, as well as the combination of the processes and / or boxes in the flowchart and / or block diagram, can be implemented by computer program instructions. These computer program instructions can be provided to a processor of a general-purpose computer, a special-purpose computer, an embedded processor, or other programmable data processing device to generate a machine, so that the instructions executed by the processor of the computer or other programmable data processing device generate instructions for implementing the processes in the flowchart and / or block diagram. Figure 1 A process or multiple processes and / or boxes Figure 1 A device that provides the functions specified in a block or multiple blocks.

[0121] These computer program instructions may also be stored in a computer-readable memory capable of directing a computer or other programmable data processing device to operate in a specific manner, so that the instructions stored in the computer-readable memory produce an article of manufacture comprising an instruction device, which implements the process Figure 1 A process or multiple processes and / or boxes Figure 1 A function specified in one or more boxes.

[0122] These computer program instructions can also be loaded onto a computer or other programmable data processing device so that a series of operating steps are executed on the computer or other programmable device to produce a computer-implemented process, thereby providing instructions for implementing the process. Figure 1 A process or multiple processes and / or boxes Figure 1 The steps for the functions specified in one or more boxes.

[0123] The above description is only a preferred embodiment of the present application and is not intended to limit the protection scope of the present application.

Claims

1. An information processing method, the method comprising: When the mainboard is powered on and the in-band access channel is open, obtaining a detection result of whether the baseboard management controller is accessed through the in-band access channel and is in the operating environment of the boot system; If the detection result indicates that the access to the baseboard management controller is not in the operating environment, the baseboard management controller is notified to close the in-band access channel.

2. The method according to claim 1, wherein obtaining a detection result of whether the baseboard management controller is accessed through the in-band access channel and is in an operating environment of a boot system comprises: If the boot system self-check is completed, a detection result is obtained that the baseboard management controller is accessed through the in-band access channel and is not in the operating environment.

3. The method according to claim 1, wherein obtaining a detection result of whether the baseboard management controller is accessed through the in-band access channel and is in the operating environment of the boot system comprises: If the boot system self-check is completed and the baseboard management controller detects a first system interrupt signal, processing the first system interrupt signal through the boot system; If the boot system processes the first system interrupt signal, a detection result is obtained by accessing the baseboard management controller through the in-band access channel and not being in the operating environment.

4. The method according to claim 1, wherein if the detection result indicates that the access to the baseboard management controller is not in the operating environment, after notifying the baseboard management controller to close the in-band access channel, the method comprises: Obtaining an opening event for the in-band access channel; If the opening event satisfies the permission verification condition of the boot system, the in-band access channel is opened in response to the opening event.

5. The method according to claim 4, wherein the detection result is a detection result obtained after the boot system processes the first system interrupt signal, and the obtaining of the opening event of the in-band access channel comprises: Obtaining security verification information of the boot system and / or the baseboard management controller; If the security verification information satisfies the security verification condition, displaying the management control of the in-band access channel in the configuration interface of the boot system; wherein the management control is used to open the in-band access channel when triggered; If the management control is triggered, an opening event that meets the permission verification condition is generated.

6. The method according to claim 4, wherein the detection result is a detection result obtained after the boot system self-check is completed, and the obtaining of the opening event of the in-band access channel comprises: The baseboard management controller detects a first system interrupt signal and generates an opening event that meets the permission verification condition.

7. The method according to any one of claims 1 to 6, further comprising: When the mainboard is powered on, opening the in-band access channel; During the process of booting the system self-test, if the baseboard management controller detects a second system interrupt signal, the baseboard management controller is accessed through the in-band access channel to obtain self-test diagnostic information.

8. An information processing device, comprising: An acquisition module is used to obtain a detection result of whether the baseboard management controller is accessed through the in-band access channel in the operating environment of the boot system when the mainboard is powered on and the in-band access channel is opened; The processing module is configured to notify the baseboard management controller to close the in-band access channel if the detection result indicates that the access to the baseboard management controller is not in the operating environment.

9. An electronic device, comprising: processor, memory, and communication bus; The communication bus is used to realize the communication connection between the processor and the memory; The processor is used to execute the information processing program stored in the memory to implement the steps of the information processing method according to any one of claims 1 to 7.

10. A storage medium storing executable instructions for causing a processor to execute the instructions to implement the steps of the information processing method according to any one of claims 1 to 7.

Images