A BIOS-based port control method and system

Abstract

The present invention discloses a port control method and system based on BIOS. Through the dual-layer control method of BIOS layer and OS layer, port control at the BIOS layer is realized in the absence of hardware or other mechanism support. In the system of the present invention, only the administrator can open or close the port at the BIOS layer, and ordinary users cannot change the port status without authorization. After the port is closed at the BIOS layer, even the operating system administrator cannot open the port under the operating system, and the BIOS layer is still required to open the port. When the hardware layer supports it, the corresponding GPIO control port is directly pulled through the hardware layer; when the hardware layer does not support it, the BIOS layer port information transmission module collects the port information of the BIOS layer port control module, and reports it to the OS layer information receiving module through the unified communication interface between the BIOS and the operating system, so as to realize the synchronization of the port control at the OS layer.

Description

Technical Field

[0001] The present invention relates to the technical field of computer firmware, and in particular to a port control method and system based on BIOS. Background Art

[0002] BIOS (Basic Input Output System) is a startup program deployed on the motherboard ROM chip. BIOS is responsible for calculating the system self-test program (POST, Power On Self Test) and the system self-starting program. It is the first program after the computer system starts. BIOS is stored in the ROM (Read Only Memory) chip and can still maintain the original settings after power failure.

[0003] At present, port control is an important means of preventing data leakage. By using the non-volatile characteristics of BIOS to close ports at the BIOS layer, the channels for data leakage and transmission can be effectively closed at the bottom of the computer. However, some domestic computers do not support BIOS port control at present. Even if the port is closed at the BIOS layer, it will still be opened at the OS (operating system) layer. That is, the onboard USB, SATA, network and other ports need to be controlled under the BIOS to control their functional use under the BIOS and OS. Therefore, there are loopholes in port control.

[0004] There are two problems with the existing BIOS port control method: first, some computers have device controllers that do not support port control through configuration registers; second, the hardware environment does not provide relevant support for BIOS control ports. Therefore, there is an urgent need for a port control method that is not affected by registers and hardware environments. Summary of the invention

[0005] In view of this, the present invention provides a BIOS-based port control method and system, which can achieve port control through BIOS layer configuration without being affected by registers and hardware environment. In the absence of registers, port control can still be performed through the BIOS layer.

[0006] In order to achieve the above-mentioned object of the invention, the technical solution of the present invention is:

[0007] A BIOS-based port control method is applied to a port control system including an OS layer information receiving module, an OS layer port control module, a BIOS layer port information transmission module, a BIOS layer port control module, a BIOS layer identity authentication module and a hardware layer, and the specific steps include:

[0008] Step 1: Power on the computer and enter the BIOS configuration interface.

[0009] Step 2: The BIOS identity authentication module identifies the operator's identity and authority and decides whether to grant administrator authority.

[0010] Step 3: The administrator inputs a port control request, and the BIOS port control module receives it and determines whether there is a corresponding register.

[0011] Step 4: The BIOS port information transmission module reports the port information to the OS layer information receiving module using the unified communication interface between the BIOS and the operating system.

[0012] Step 5: The OS layer information receiving module receives the port information reported by the BIOS layer port information transmission module, and transmits the port information to the OS layer port control module.

[0013] Step 6: The OS layer port control module controls the corresponding port through the hardware layer according to the port information.

[0014] Furthermore, the port control system also includes an OS layer identity authentication module.

[0015] Furthermore, the administrator's permissions are as follows:

[0016] When operating as a first-level administrator, the corresponding port control permissions are opened, and then the port switch control can be selected in the configuration interface; when operating as a non-first-level administrator, port control permissions are not granted; the OS layer identity authentication module identifies the identity of the second-level administrator and grants the second-level administrator the control permissions of the corresponding ports. The second-level administrator has a higher priority than the first-level administrator.

[0017] Furthermore, step three also includes:

[0018] When the corresponding register exists, directly configure the register to realize the control of the port; when the corresponding register does not exist, determine whether there is hardware support at the hardware layer; if there is hardware support, the BIOS port control module directly pulls or notifies the hardware layer to pull the corresponding GPIO to control the port; if there is no hardware support, go to step 4.

[0019] A BIOS-based port control system, aimed at the above method, comprises an OS layer, a BIOS layer and a hardware layer.

[0020] The OS layer includes an OS layer information receiving module, an OS layer port control module and an OS layer identity authentication module; the BIOS layer includes a BIOS layer port information transmission module, a BIOS layer port control module and a BIOS layer identity authentication module; the hardware layer includes a CPU, a port controller and a port pulling device.

[0021] In the hardware layer:

[0022] The port controller is used to directly control the port; the port pull device and the CPU together constitute the hardware support for the port. Under the control of the BIOS layer port control module, the corresponding GPIO is pulled to control the port.

[0023] In the BIOS layer:

[0024] The BIOS layer port control module is connected to the OS layer port control module, and both are connected to the CPU and port controller of the hardware layer; the BIOS layer identity authentication module grants the first layer administrator the control authority of the corresponding port by identifying the identity of the first layer administrator, and other users cannot control the port; the BIOS layer port control module controls the port status by configuring the corresponding register for the port; the BIOS layer port information transmission module obtains the port information collected by the BIOS layer port control module, and reports the information to the OS layer information receiving module through the unified communication interface between BIOS and the operating system; the BIOS port control module exerts control authority on the port to set the control authority scope of the OS layer on the port.

[0025] In OS layer:

[0026] The OS layer information receiving module receives the port information reported by the BIOS layer, and issues instructions to the OS layer port control module based on the port information; the OS layer port control module opens or closes the port based on the issued instructions; the OS layer identity authentication module identifies the identity of the second-layer administrator and grants the second-layer administrator the control authority of the corresponding port. The second-layer administrator has a higher priority than the first-layer administrator.

[0027] Beneficial effects:

[0028] 1. The present invention realizes port control at the BIOS layer in the absence of hardware or other mechanism support through a dual-layer control method of the BIOS layer and the OS layer.

[0029] 2. In the system of the present invention, only the administrator can open or close the port at the BIOS layer, and ordinary users cannot change the port status without authorization. After the BIOS layer closes the port, even the operating system administrator cannot open the port under the operating system, and the BIOS layer is still required to open the port.

[0030] 3. The system of the present invention directly pulls the corresponding GPIO control port through the hardware layer when the hardware layer supports it; when the hardware layer does not support it, the BIOS layer port information transmission module collects the port information of the BIOS layer port control module, and reports the information to the OS layer information receiving module through the unified communication interface between the BIOS and the operating system, so as to achieve the synchronization of the OS layer on the port control. Once the BIOS port is closed, the port state will be immediately closed or locked synchronously, so that ordinary users cannot open the port, and the closed state of the port is kept consistent with the BIOS layer setting. BRIEF DESCRIPTION OF THE DRAWINGS

[0031] Figure 1 This is a connection framework diagram of the BIOS layer, OS layer and hardware layer.

[0032] Figure 2 The figure is a flow chart of the method of the present invention. DETAILED DESCRIPTION

[0033] The present invention is described in detail below with reference to the accompanying drawings and embodiments.

[0034] like Figure 2 As shown, the present invention proposes a BIOS-based port control method, the specific steps of which include:

[0035] Step 1: Power on the computer and enter the BIOS configuration interface;

[0036] Step 2: The BIOS identity authentication module identifies the operator's identity and authority. If the operator is a first-level administrator, the corresponding port control authority is enabled, and the operator can then select the port switch control on the configuration interface. If the operator is not a first-level administrator, the port control authority is not granted. The OS layer identity authentication module identifies the second-level administrator and grants the second-level administrator the control authority for the corresponding port. The second-level administrator has a higher priority than the first-level administrator.

[0037] Step 3: The administrator inputs a port control request, and the BIOS port control module receives it and determines whether there is a corresponding register; if so, directly configure the register to implement port control; if there is no corresponding register, determine whether there is hardware support at the hardware layer; if there is hardware support, the BIOS port control module directly pulls or notifies the hardware layer to pull the corresponding GPIO to control the port; if there is no hardware support, proceed to step 4;

[0038] Step 4, the BIOS port information transmission module uses the unified communication interface specification between BIOS and the operating system, such as SMBIOS, to report the port information to the OS layer information receiving module; the network status in the port controller is described by a specific network status flag bit, and does not need to be controlled to the Port; the SATA controller in the port controller needs to be controlled to the PORT, and the Port status is represented by a specific Port status flag bit. When the entire controller is Disabled, the Port Status value is ignored; the USB in the port controller needs to be controlled to the PORT, and the Port status is represented by a specific Port status flag bit. When the entire controller is Disabled, the Port Status value is ignored;

[0039] Step 5: Restart the computer to make the configurations from step 1 to step 4 take effect;

[0040] Step 6: The OS layer information receiving module receives the port information reported by the BIOS layer port information transmission module, and transmits the port information to the OS layer port control module;

[0041] Step 7: The OS layer port control module controls the corresponding port through the hardware layer according to the port information.

[0042] like Figure 1 As shown, the present invention provides a BIOS-based port management and control system. When the switch option is used in the BIOS configuration interface to control USB, SATA, network and other ports, it is achieved by configuring the registers of its controller. When such registers do not exist, both hardware and software solutions are provided.

[0043] In the hardware solution, the BIOS layer controls the electrical signal or clock signal of the port through the GPIO signal line, directly pulls the GPIO or the BIOS layer informs the port pull device (such as TPCM card, EC and CPLD, etc.) through the corresponding interface to pull the corresponding GPIO to control the access to the interface. After the signal is sent, restart the machine to take effect.

[0044] Port control is implemented by software. When there is no hardware environment support and the port cannot be controlled by registers or other hardware methods such as GPIO, the BIOS layer needs to use software methods, such as not enumerating and scanning the corresponding ports. In this case, the BIOS layer needs to pass the corresponding port status to the OS layer through the unified communication interface between the BIOS and the operating system. The same type of controller is distinguished by specific device numbers, function numbers and other identifiers, and different types of controllers are distinguished by the controller device type. The communication process block follows the communication interface specification, such as SMBIOS (SMBIOS is a unified specification that motherboard or system manufacturers need to follow to display product management information in a standard format). After receiving the data, the OS layer determines the port status and then controls the port accordingly. The BIOS layer imposes port control permissions on related devices to prevent the port from being privately controlled under the OS layer.

[0045] like Figure 1 As shown, a BIOS-based port control system includes an OS layer, a BIOS layer and a hardware layer; the port controller includes USB, SATA and network. Among them, the OS layer information receiving module, the OS layer port control module and the OS layer identity authentication module are set in the kernel space of the OS.

[0046] The OS layer includes an OS layer information receiving module, an OS layer port control module, and an OS layer identity authentication module; the BIOS layer includes a BIOS layer port information transmission module, a BIOS layer port control module, and a BIOS layer identity authentication module; the hardware layer includes a CPU, a port controller, and a port pull device;

[0047] In the hardware layer:

[0048] The port controller is used to directly control the port; the port pull device and the CPU together constitute the hardware support for the port. Under the control of the BIOS layer port control module, the corresponding GPIO is pulled to control the port;

[0049] In the BIOS layer:

[0050] The BIOS layer port control module is connected to the OS layer port control module, and both are connected to the CPU and port controller of the hardware layer; the BIOS layer identity authentication module identifies the identity of the first layer administrator and grants the first layer administrator the control authority of the corresponding port, while other users cannot control the port; the BIOS layer port control module controls the port status by configuring the corresponding register for the port; the BIOS layer port information transmission module obtains the port information collected by the BIOS layer port control module, and reports the information to the OS layer information receiving module through the unified communication interface specification between BIOS and the operating system, such as SMBIOS; the BIOS port control module applies control authority to the port to set the control authority range of the OS layer to the port;

[0051] In OS layer:

[0052] The OS layer information receiving module receives the port information reported by the BIOS layer, and issues instructions to the OS layer port control module based on the port information; the OS layer port control module opens or closes the port based on the issued instructions; the OS layer identity authentication module identifies the identity of the second-layer administrator and grants the second-layer administrator the control authority of the corresponding port. The second-layer administrator has a higher priority than the first-layer administrator.

[0053] In summary, the above are only preferred embodiments of the present invention and are not intended to limit the protection scope of the present invention. Any modifications, equivalent substitutions, improvements, etc. made within the spirit and principles of the present invention should be included in the protection scope of the present invention.

Claims

1. A BIOS-based port control method, characterized in that: Applied to a port control system including an OS layer information receiving module, an OS layer port control module, a BIOS layer port information transmission module, a BIOS layer port control module, a BIOS layer identity authentication module and a hardware layer, the specific steps include: Step 1: Power on the computer and enter the BIOS configuration interface; Step 2: The BIOS identity authentication module identifies the operator's identity and authority and decides whether to grant administrator authority; Step 3: The administrator inputs a port control request, and the BIOS port control module receives it and determines whether there is a corresponding register; Step 4: The BIOS port information transmission module reports the port information to the OS layer information receiving module using a unified communication interface between the BIOS and the operating system; Step 5: The OS layer information receiving module receives the port information reported by the BIOS layer port information transmission module, and transmits the port information to the OS layer port control module; Step 6: The OS layer port control module controls the corresponding port through the hardware layer according to the port information; The step three also includes: When the corresponding register exists, directly configure the register to realize the control of the port; when the corresponding register does not exist, determine whether there is hardware support at the hardware layer; if there is hardware support, the BIOS port control module directly pulls or notifies the hardware layer to pull the corresponding GPIO to control the port; if there is no hardware support, go to step 4.

2. The method according to claim 1, characterized in that The port management and control system also includes an OS layer identity authentication module.

3. The method according to claim 1 or 2, characterized in that The administrator rights are as follows: When operating as a first-tier administrator, the corresponding port control authority is enabled, and then the port switch control can be selected in the configuration interface; when operating as a non-first-tier administrator, the port control authority is not granted; The OS layer identity authentication module identifies the second-layer administrator's identity and grants the second-layer administrator the control authority of the corresponding port. The second-layer administrator has a higher priority than the first-layer administrator.

4. A BIOS-based port control system, characterized in that: According to any one of claims 1 to 3, the method comprises an OS layer, a BIOS layer and a hardware layer; The OS layer includes an OS layer information receiving module, an OS layer port control module and an OS layer identity authentication module; the BIOS layer includes a BIOS layer port information transmission module, a BIOS layer port control module and a BIOS layer identity authentication module; the hardware layer includes a CPU, a port controller and a port pulling device; In the hardware layer: The port controller is used to directly control the port; the port pull device and the CPU together constitute the hardware support for the port, and under the control of the BIOS layer port control module, pull the corresponding GPIO to control the port; In the BIOS layer: The BIOS layer port control module is connected to the OS layer port control module, and both are connected to the CPU and port controller of the hardware layer. The BIOS layer identity authentication module identifies the identity of the first layer administrator and grants the first layer administrator the control authority of the corresponding port. At the same time, other users cannot control the port. The BIOS layer port control module controls the port status by configuring the corresponding registers for the port; the BIOS layer port information transmission module obtains the port information collected by the BIOS layer port control module and reports the information to the OS layer information receiving module through the unified communication interface between the BIOS and the operating system; the BIOS port control module applies control authority to the port to set the control authority range of the OS layer to the port; In OS layer: The OS layer information receiving module receives the port information reported by the BIOS layer, and issues instructions to the OS layer port control module based on the port information; the OS layer port control module opens or closes the port based on the issued instructions; the OS layer identity authentication module identifies the identity of the second-layer administrator and grants the second-layer administrator the control authority of the corresponding port. The second-layer administrator has a higher priority than the first-layer administrator.

Images