A method for detecting statement failures in a BIOS program during a startup process

Abstract

A method for detecting statement faults within a BIOS program during the boot process, belonging to the technical field of BIOS boot program tamper prevention, is characterized by using statement code length, logical operations within the statement, arithmetic operations, and flag symbols as characteristic parameters, and the order of appearance of these characteristic parameters as a statement characteristic parameter list. This is compared with the text of a BIOS boot program with the same name, version, and publication date that also has trusted boot properties. The method can determine: the coordinate position of the tampered area within a detection cycle from the start end to the end end of the statement, as well as the change in the coordinates of the tampered content size between two adjacent detection points. It can also detect statement faults caused by changes in the operation sequence. Compared with the existing technology, the method achieves process control over tampering behavior, achieves a combination of macro and micro control through the combination of code length and operation identifiers, and limits the tampering behavior pattern through the sorting rules of operation identifiers.

Description

Technical Field

[0001] The invention discloses a method for detecting statement failure in a BIOS program during a startup process, belonging to the technical field of tamper-proofing of trusted BIOS program texts. Background Art

[0002] After passing the trusted verification, the BIOS version based on trusted boot technology faces the problem of how to prevent third-party tampering.

[0003] Zhengzhou Yunhai Information Technology Co., Ltd. A method for locating and troubleshooting faults in a NFV platform after starting a test network element: CN201710834008.1[P]. January 23, 2018.

[0004] The invention discloses a method for locating and troubleshooting faults by starting a test network element in an NFV platform. The method selects a VNF mapping template and startup parameters based on fault prediction, and then manually or by a MANO based on collected information. The fault detection factors include computing, storage, network, cloud platform connected EMS, and the network element itself. The granularity is large and cannot provide more accurate problem location. Summary of the Invention

[0005] The object of the present invention is to provide a method for detecting statement faults in a BIOS program, which is implemented in a statement fault detection system of a BIOS program by sequentially following the steps below:

[0006] Step (1): System construction, the system includes: system main controller CPU S , access module, BIOS startup module, counting clock pulse generation module and BIOS program statement fault detection module, wherein:

[0007] Access module, which contains:

[0008] The initial measured value data volume of characteristic parameters of the initial BIOS boot program text that has passed the trusted boot test includes: the measured time, the measured code length, the name of each logical operation symbol involved, the symbol identifier, the code length of the binary code at the time of application, and the number sorted by the time of application, as well as similar characteristic values of other operation symbols including operation symbols and punctuation operation symbols. The symbols including at least the above-mentioned logical operations, operation operations, and punctuation identifiers are collectively referred to as operation identifier symbols. The initial time T0 of the timing is

[0009] The initial value of the characteristic parameter of the initial BIOS startup program text also includes a sequence of identification symbols and their numbers sorted by the time of action.

[0010] BIOS boot module, including BMC controller CPU BAnd the U-boot, BMC kernel and BIOS cascaded in sequence,

[0011] The counting clock pulse generation module consists of a counting controller CPU A Its counting clock pulse input / output terminal is connected to the system main controller CPU S The monitoring / control output / input terminal is connected to

[0012] BIOS program statement fault detection module, including the statement fault detection CPU connected in series C , buffer module and comparison module, the system main controller CPU S AND statement fault detection module CPU C are connected to each other, the controller of the comparison module is connected to the controller of the access module,

[0013] Step (2), system main controller CPU S Follow these steps to detect statement failures in the BIOS program:

[0014] Step (2.1) is to determine the initial value of a reliable BIOS boot program version called a sample whose publication name, version number, and publication date are the same as those of the reliable BIOS boot program version to be tested according to the following steps.

[0015] Step (2.1.1), system main controller CPU S After the CPU B Start the BIOS startup program and detect the CPU B After entering the startup state, the counting clock pulse generation module controller CPU A Send out a start counting instruction T1, and at the same time monitor the binary output signal sent by the BMC startup module to the counting clock pulse generation module, which contains the measured value of the BIOS startup program version used as the sample in step (2.1) as the initial measured data chain of the sample, and sends it to the access module.

[0016] Step (2.2): According to the method described in step (2.1), a sequence of sentence feature parameter values of a text to be tested is measured, i.e., a measured data chain of the text to be tested.

[0017] The code lengths measured in step (3), step (2.1), and step (2.2) must be equal, the coordinates of all operation identifiers on the horizontal axis of the code plane must be equal, and the order of the operation identifiers at the time of measurement must remain unchanged. The three rules used to determine whether the statement has a fault are used to determine whether the three positions correspond one to one. Otherwise, as long as one of the rules fails, it is determined that a statement fault exists:

[0018] The operation identification symbols are arranged in a different order according to time, which proves that the operation process has been illegally tampered with.

[0019] The code length is shortened, and the content of the proof statement is deleted.

[0020] When the operation identification symbol appears, the coordinates of the position of the code length segment change, proving that an illegal operation has occurred at that position.

[0021] The advantages of the present invention are:

[0022] 1. The present invention uses the position of the operation identification symbol on the horizontal axis of the code plane marked by time or code length segment, and its change over time as the entry point, which not only reflects the temporal position of the illegal tampering behavior, but also reflects the impact area of the illegal tampering behavior in space, thereby overcoming the semantic recognition problem brought about by using keywords as the entry point, and opening up a new idea for identifying sentence faults.

[0023] 2. The present invention proposes the concept of a statement feature parameter list, in which: the feature parameters of the operation identifier in the initial state reflect the initial positions of all operation identifiers when they appear on the horizontal axis of the code plane when the statement has not been tampered with, and the dynamic change value of the feature value parameter measured at any time thereafter reflects the position change between two adjacent ones, indirectly reflecting the position and action area when the statement is tampered with.

[0024] 3. The present invention uses the time sequence of the operation symbols in each detection as one of the characteristic parameters, with the purpose of detecting whether there is disordered operation procedures in the statement, thereby causing the phenomenon of statement confusion. BRIEF DESCRIPTION OF THE DRAWINGS

[0025] Figure 1 , main program flow chart.

[0026] Figure 2 , system block diagram. DETAILED DESCRIPTION

[0027] Once a BIOS startup program that has passed the trusted startup test is tampered with by a third party, a program or statement failure will occur.

[0028] All operation identifiers, including logical operators, algorithmic operators, and punctuation marks, exist independently in the statement in form, and only in form, without relying on all elements in the statement, including keywords. However, like the relationship between nodes and beams, they also play a guiding role. In particular, the order in which the operation identifiers act regulates the operation procedures. Therefore, we propose the concept of statement feature parameters as the basis for determining whether there is illegal tampering.

[0029] In order to capture the temporal changes of third-party tampering behavior through the characteristic changes of program characteristic parameters in time series, the sample comparison method is adopted to compare the sample startup text and the startup text to be tested. BIOS files with the same publication name, version number, and publication date are used as samples, and the sample to be tested is used as the object to be compared. They are run on the same platform successively. The sample text is detected first to obtain the characteristic parameter value coordinates, and then the parameter value coordinates of the text to be tested are detected. By comparing the two characteristic parameter values, it is possible to determine whether there is illegal tampering.

[0030] Therefore, three rules for judgment statements are proposed:

[0031] Code length: If the code length remains unchanged, it means that there is no illegal tampering operation. If the code length decreases, it means that illegal tampering operation has occurred. The difference between the sample code length and the code length of the text to be tested is the equivalent area of the illegal tampering operation area.

[0032] The functions of the operation identifiers are arranged in order. If they remain unchanged, it means there is no statement fault. If they change, it means there is a statement fault.

[0033] The position of an operation identifier changes between two adjacent tests. If the position of the operation identifier remains unchanged between the two adjacent tests, it indicates that there is no illegal tampering. If it changes, it indicates that there is illegal tampering.

[0034] That is to say, as long as one rule is changed, there is a statement failure.

Claims

1. A method for detecting statement failures in a BIOS program during a startup process, characterized in that: In a BIOS program statement fault detection system, perform the following steps: Step (1): System construction, the system includes: system main controller CPU S , access module, BIOS startup module, counting clock pulse generation module and BIOS program statement fault detection module, wherein: Access module, which contains: The initial measured value data of characteristic parameters of the initial BIOS boot program text that has passed the trusted boot test includes: the measured time, the measured code length, the name and symbol identifier of each logical operation symbol involved, the code length of the binary code at the time of application, and the number sorted by the time of application, as well as characteristic values of other operation symbols including operation symbols and punctuation operation symbols. The symbols including at least the aforementioned logical operations, operation operations, and punctuation operations are collectively referred to as operation identifier symbols. The initial time T0 of the timing is used. The initial value of the characteristic parameter of the initial BIOS startup program text also includes a sequence of identification symbols and their numbers sorted by the time of action. BIOS boot module, including BMC controller CPU B And the U-boot, BMC kernel and BIOS cascaded in sequence, Counting clock pulse generation module, there is a counting controller CPU A Its counting clock pulse input / output terminal is connected to the system main controller CPU S The monitoring / control output / input terminal is connected to BIOS program statement fault detection module, including the statement fault detection CPU connected in series C , buffer module and comparison module, the system main controller CPU S AND statement fault detection module CPU C are connected to each other, the controller of the comparison module is connected to the controller of the access module, Step (2), system main controller CPU S Implement the detection of statement failures in the BIOS program: Step (2.1) is to determine the initial value of a credible BIOS boot program text called a sample whose publication name, version number, and publication date are the same as those of the credible BIOS boot program text to be tested according to the following steps. Step (2.1.1), system main controller CPU S After the CPU B Start the BIOS startup program and detect the CPU B After entering the startup state, the counting clock pulse generation module controller CPU A Sending a start counting instruction T1, while monitoring the binary output signal sent by the BIOS startup module to the counting clock pulse generation module, including the measured value of the BIOS startup program text used as a sample in step (2.1) as the initial measured data chain of the sample, and sending it to the access module, Step (2.2): According to step (2.1), a sequence of sentence feature parameter values of the text to be tested is measured, i.e., the measured data chain of the text to be tested. In step (3), the code lengths measured in step (2.1) and step (2.2) must be equal, the coordinates of all operation identifiers on the horizontal axis of the code plane must be equal, and the order of the operation identifiers at the time of measurement must remain unchanged. As a judgment rule, we will determine whether the three positions correspond one to one. As long as any one of the rules fails, it is determined that there is a statement fault: The operation identification symbols are arranged in a different order according to time, which proves that the operation process has been illegally tampered with. The code length is shortened, and the content of the proof statement is deleted. When the operation identification symbol appears, the position coordinates of the code length segment change, proving that an illegal operation has occurred at that position.

Images