A server startup protection method and device, electronic equipment and storage medium

Abstract

The application provides a server startup protection method and device, electronic equipment and a storage medium, and relates to the field of servers.The method comprises the following steps: when it is detected that a server starts to perform a UEFI boot process, extracting to-be-detected operation information from a data stream sent to the server through a serial communication interface of the server; when it is determined that a to-be-detected operation corresponding to the to-be-detected operation information does not belong to an existing operation in the UEFI boot process, determining that the to-be-detected operation belongs to an abnormal operation; when it is determined that the to-be-detected operation belongs to an existing operation, performing abnormal detection on the to-be-detected operation information, and when it is detected that the to-be-detected operation information is abnormal, determining that the to-be-detected operation belongs to an abnormal operation; and performing shielding processing on the abnormal operation. Abnormal interaction content between the server and the outside through the serial communication interface of the server in the UEFI boot process can be automatically found, the abnormal interaction is shielded in a timely manner, and the server startup process can be effectively protected.

Description

TECHNICAL FIELD

[0001] The present application relates to the field of servers, in particular to a server startup protection method and device, electronic equipment and a computer readable storage medium. BACKGROUND

[0002] Security protection of a server is an important link to ensure safe operation of the server. In related technologies, the server is very weak in the firmware startup link, which is difficult to resist external attacks, and even vulnerable to external control interference and unable to start, thereby easily leading to server crashes and endangering the normal operation of the server.

[0003] Therefore, how to effectively protect the server startup link is a technical problem faced by those skilled in the art. SUMMARY

[0004] The purpose of the present application is to provide a server startup protection method, device, electronic equipment and computer readable storage medium, which can automatically discover abnormal interaction content between an external and a server through a serial communication interface of the server in a UEFI boot process, and timely shield these abnormal interactions to effectively protect the server startup process.

[0005] To solve the above technical problems, the present application provides a server startup protection method, comprising:

[0006] When it is detected that the server starts to execute a UEFI boot process, extracting to-be-detected operation information from a data stream sent to the server through a serial communication interface of the server;

[0007] When it is determined that a to-be-detected operation corresponding to the to-be-detected operation information does not belong to an existing operation in the UEFI boot process, determining that the to-be-detected operation belongs to an abnormal operation;

[0008] When it is determined that the to-be-detected operation belongs to the existing operation, performing abnormal detection on the to-be-detected operation information, and when it is detected that the to-be-detected operation information has an abnormality, determining that the to-be-detected operation belongs to the abnormal operation;

[0009] Shielding the abnormal operation.

[0010] Optionally, the shielding the abnormal operation comprises:

[0011] Finding a process corresponding to the abnormal operation, and closing the process.

[0012] Optionally, the abnormal detection on the to-be-detected operation information comprises:

[0013] extract a to-be-detected boot ID from the to-be-detected operation information, and extract a preset boot ID from the mirror check information of the server;

[0014] When it is determined that the to-be-detected boot ID is different from the preset boot ID, it is determined that the to-be-detected operation information is abnormal.

[0015] Optionally, the abnormality detection on the to-be-detected operation information comprises:

[0016] When it is determined that the server starts to perform a specified operation in the UEFI boot process, to-be-detected signature information is extracted from the to-be-detected operation information, and signature verification is performed on the to-be-detected signature information.

[0017] When it is determined that the to-be-detected signature information is invalid, it is determined that the to-be-detected operation information is abnormal.

[0018] Optionally, the extraction of the to-be-detected signature information from the to-be-detected operation information comprises:

[0019] The to-be-detected signature information is extracted from a plurality of specified positions in the to-be-detected operation information.

[0020] Optionally, after the shielding processing on the abnormal operation, further comprising:

[0021] It is determined whether operation information corresponding to the abnormal operation exists in a data stream that has completed the shielding processing.

[0022] If yes, the software shielding is performed on the serial communication interface until it is detected that the server completes the UEFI boot process, and the software shielding is released.

[0023] Optionally, further comprising:

[0024] When it is detected that the server completes the UEFI boot process, it is determined whether operation information corresponding to the abnormal operation exists in the data stream.

[0025] If yes, the operation information corresponding to the abnormal operation is forwarded to a specified interface, so that preset code logic in the specified interface responds to the abnormal operation, and an attack end corresponding to the abnormal operation is guided to enter a dead loop state.

[0026] The application further provides a server startup protection device, comprising:

[0027] An information extraction module is configured to extract to-be-detected operation information from a data stream sent to a server through a serial communication interface of the server when it is detected that the server starts to perform a UEFI boot process.

[0028] The first detection module is configured to determine that the to-be-detected operation belongs to an abnormal operation when it is determined that the to-be-detected operation corresponding to the to-be-detected operation information does not belong to an existing operation in the UEFI boot process.

[0029] The second detection module is configured to perform abnormal detection on the to-be-detected operation information when it is determined that the to-be-detected operation belongs to the existing operation, and determine that the to-be-detected operation belongs to the abnormal operation when it is detected that the to-be-detected operation information is abnormal.

[0030] The shielding module is configured to perform shielding processing on the abnormal operation.

[0031] The present application further provides an electronic device, comprising:

[0032] The memory is configured to store a computer program.

[0033] The processor is configured to implement the server startup protection method as described above when executing the computer program.

[0034] The present application further provides a computer readable storage medium, wherein the computer readable storage medium stores computer executable instructions, and the computer executable instructions are loaded and executed by a processor to implement the server startup protection method as described above.

[0035] The present application provides a server startup protection method, comprising: extracting to-be-detected operation information from a data stream sent to a server through a serial communication interface of the server when it is detected that the server starts to execute a UEFI boot process; determining that a to-be-detected operation corresponding to the to-be-detected operation information does not belong to an existing operation in the UEFI boot process when it is determined that the to-be-detected operation does not belong to the existing operation; performing abnormal detection on the to-be-detected operation information when it is determined that the to-be-detected operation belongs to the existing operation, and determining that the to-be-detected operation belongs to an abnormal operation when it is detected that the to-be-detected operation information is abnormal; and performing shielding processing on the abnormal operation.

[0036] It can be seen that, in the application, when it is detected that the server starts to perform the UEFI boot process, the data stream sent to the server through the serial communication interface of the server can be automatically monitored, that is, the to-be-detected operation information contained in the data stream can be extracted and detected; then the application will determine whether the to-be-detected operation corresponding to the operation information belongs to the existing operation in the UEFI boot process, if not, it is automatically determined that the to-be-detected operation belongs to an abnormal operation, if yes, it will further detect whether the to-be-detected operation information contains abnormal content, if it is determined that the to-be-detected operation information is abnormal, it can be determined that the to-be-detected operation belongs to an abnormal operation, and then the abnormal operation will be shielded, that is, the abnormal interaction between the outside and the server through the serial communication interface of the server in the UEFI boot process can be automatically found, and these abnormal interactions can be shielded in time to avoid interference with the server performing the UEFI boot process, and then the server startup process can be effectively protected. The application also provides a server startup protection device, an electronic device and a computer readable storage medium, which have the above beneficial effects. BRIEF DESCRIPTION OF DRAWINGS

[0037] In order to more clearly illustrate the technical solutions in the embodiments of the present application or the prior art, the following will briefly introduce the drawings needed to be used in the embodiments or the prior art description. Obviously, the drawings in the following description are only some embodiments of the present application, and for those skilled in the art, other drawings can be obtained without creative labor based on the provided drawings.

[0038] Figure 1 A flowchart of a server startup protection method provided by an embodiment of the present application;

[0039] Figure 2 A flowchart of another server startup protection method provided by an embodiment of the present application;

[0040] Figure 3 A structural block diagram of a server startup protection device provided by an embodiment of the present application. DETAILED DESCRIPTION

[0041] In order to make the objects, technical solutions and advantages of the embodiments of the present application more clear, the following will combine the drawings in the embodiments of the present application to clearly and completely describe the technical solutions in the embodiments of the present application. Obviously, the described embodiments are some of the embodiments of the present application, not all the embodiments. Based on the embodiments in the present application, all other embodiments obtained by those skilled in the art without creative labor are within the protection scope of the present application.

[0042] In the related art, the server is very weak in the firmware starting link, is difficult to resist external attacks, and is even easily controlled and disturbed by the outside to be unable to start, and further easily leads to server crash, and harms the normal operation of the server. In view of this, the present application can provide a server starting protection method, which can automatically discover abnormal interaction content between the outside and the server through the serial communication interface of the server in the UEFI boot process, and timely shield these abnormal interactions, to effectively protect the server starting process. Please refer to Figure 1 , Figure 1 A flowchart of a server starting protection method provided by an embodiment of the present application, which can include:

[0043] S101, when it is detected that the server starts to execute the UEFI boot process, extracting to-be-detected operation information from a data stream sent to the server through the serial communication interface of the server.

[0044] The UEFI boot process (UEFI Boot, UEFI: Unified Extensible Firmware Interface) belongs to the general starting process of the server. In this process, the server does not have strong security protection capability because it is still performing initialization configuration operation, and is easily attacked by the outside. For example, an external attacker can perform read-write attack on the BIOS (Basic Input Output System) of the server through the serial communication interface (SPI Flash, Serial Peripheral Interface) of the server, to prevent the server from starting normally, and even can cause the server to be paralyzed and cause more serious server network paralysis. Therefore, it is necessary to detect the data stream sent to the server through the serial communication interface in a targeted manner, to avoid the interference of the external attacker on the server in the starting process through the interface. It should be noted that the present application does not limit the specific server, for example, the server can be an ARM architecture (Advanced RISC Machines) server, which can be selected according to actual application requirements.

[0045] S102, judging whether the to-be-detected operation corresponding to the to-be-detected operation information belongs to the existing operation in the UEFI boot process; if yes, going to step S103; if no, going to step S104.

[0046] After extracting the operation information to be detected from the data stream, the embodiment of the present application first determines whether the operation corresponding to the operation information to be detected belongs to the existing operation in the UEFI boot process. This is because there is an operation in the UEFI boot process that needs to communicate with the outside world through a serial communication interface, so this step needs to be performed to shield the operation information in the data stream that does not belong to the existing operation in the UEFI boot process. It should be noted that the embodiment of the present application does not limit the existing operation in the UEFI boot process, and can refer to the related technology of UEFI. In addition, to improve the detection efficiency, the existing operations can be saved in an information table, and the information table and the operation information to be detected are matched to determine whether the operation to be detected belongs to the existing operation in the UEFI boot process.

[0047] S103, when it is determined that the operation to be detected corresponding to the operation information to be detected does not belong to the existing operation in the UEFI boot process, it is determined that the operation to be detected belongs to an abnormal operation.

[0048] When it is determined that the operation to be detected does not belong to the existing operation in the UEFI boot process, it can be directly determined that the operation belongs to an abnormal operation, and can be directly shielded.

[0049] S104, when it is determined that the operation to be detected belongs to the existing operation, the operation information to be detected is detected for abnormality, and when it is detected that the operation information to be detected has an abnormality, it is determined that the operation to be detected belongs to an abnormal operation.

[0050] To prevent external attackers from disguising normal operations in the UEFI boot to attack the server, after it is determined that the operation to be detected belongs to the existing operation in the UEFI boot, the operation information to be detected possessed by the operation to be detected can be further detected. It should be noted that the operation information to be detected contains specific information of the operation to be detected, such as specific operation parameters, image files, etc., and can refer to the related technology of UEFI. The embodiment of the present application does not limit how to detect the operation information to be detected for abnormality, for example, the Boot ID can be checked. The ID is the existing information of the server image file, and then when the external server communicates and interacts, the operation information sent by the external server to the server should contain the Boot ID, so that the server can match the Boot ID in the existing image file with the Boot ID transmitted by the external server. It should be noted that the embodiment of the present application does not limit the specific form of the Boot ID, and can refer to the related technology of UEFI.

[0051] In one possible case, detecting the operation information to be detected for abnormality can include:

[0052] Step 11: extracting the Boot ID to be detected from the operation information to be detected, and extracting the preset Boot ID from the image verification information of the server;

[0053] Step 12: when determining that the to-be-detected boot ID is different from the preset boot ID, determining that the to-be-detected operation information is abnormal.

[0054] Of course, it can be understood that if the boot ID cannot be extracted from the to-be-detected operation information, it can also be determined that the to-be-detected operation information is abnormal. In addition, the to-be-detected operation information can also be subjected to signature authentication. Specifically, one or more signature information can be attached to the to-be-detected operation information when the external transmits the information to the server. The signature information is obtained by signing with the key determined by the server. Then, the server can verify the signature information by using the stored key, to determine whether the information is correct. It should be noted that the embodiments of the present application do not limit the specific form of the signature information, nor the specific way of signing and the specific verification method of the signature information. For reference, please refer to the related technology of signature. The embodiments of the present application also do not limit the specific signature object, such as the identity authentication information of the external or the signature of the external transmitted image file. Of course, since the signature verification time is relatively long, and a single to-be-detected operation information can carry multiple signature information, it is necessary to verify one by one. In order to reduce the impact of signature verification on the server executing the UEFI boot process, the signature verification of the to-be-detected operation information can be performed when the server executes the specified operation in the UEFI boot process. It should be noted that the embodiments of the present application do not limit the above-mentioned specified operation, which can be set according to actual application requirements.

[0055] In one possible case, the abnormality detection of the to-be-detected operation information can include:

[0056] Step 21: when determining that the server starts to execute the specified operation in the UEFI boot process, extracting the to-be-detected signature information from the to-be-detected operation information, and performing signature verification on the to-be-detected signature information;

[0057] Step 22: when determining that the to-be-detected signature information is invalid, determining that the to-be-detected operation information is abnormal.

[0058] Further, it should be noted that the embodiments of the present application do not limit the number of signature information that a single to-be-detected operation information can carry, which can be selected according to actual application requirements. The embodiments of the present application also do not limit the setting method of the signature information in the to-be-detected operation information, such as being uniformly stored, or being stored in multiple specified positions in the to-be-detected operation information, such as the head, middle and tail. In addition, the specified position can be determined in advance by the server and the trusted external communicator, so as to avoid the attacker from imitating the trusted external communicator to communicate with the server.

[0059] In a possible case, extracting the to-be-detected signature information from the to-be-detected operation information can include:

[0060] Step 31: extracting the to-be-detected signature information from the multiple specified positions in the to-be-detected operation information.

[0061] S105, performing a shielding process on the abnormal operation.

[0062] After determining the abnormal operation, the embodiment of the present application shields the abnormal operation. In addition to discarding and refusing to transmit the abnormal operation information corresponding to the abnormal operation, the shielding process can further query the communication process corresponding to the abnormal operation and close the process to cut off the communication source between the attacker and the server from the root. It should be noted that the embodiment of the present application does not limit how to find the corresponding process according to the abnormal operation, and the related technology of the process can be referred to.

[0063] In a possible case, the shielding process on the abnormal operation can include:

[0064] Step 41: finding the process corresponding to the abnormal operation and closing the process.

[0065] Further, after completing the shielding process on the abnormal operation, the embodiment of the present application can further perform secondary detection on the data stream that has completed the shielding process to determine whether the data stream still contains operation information corresponding to the abnormal operation. When the operation information corresponding to the abnormal operation is detected again from the data stream that has completed the shielding process, the serial communication interface can be directly shielded by software until the UEFI boot process of the server is detected, and then the software shielding is released. In this way, not only can the problem of abnormal operation leakage caused by poor detection or shielding be effectively avoided, but also the shielding level can be further improved by shielding the serial communication interface by software, so as to at least ensure that the server is not disturbed by the outside world and can be normally started. It should be noted that the detection means adopted in the secondary detection is consistent with that in the primary detection, that is, firstly judging whether the to-be-detected operation information in the data stream that has completed the shielding process belongs to the existing operation in the UEFI boot process, if not, it is determined as an abnormal operation; if yes, the to-be-detected operation information is abnormally detected to determine whether the signature information and the boot ID in the information are correct, if not, it is determined as an abnormal operation.

[0066] In a possible case, after the shielding process on the abnormal operation, it can further include:

[0067] Step 51: judging whether there is operation information corresponding to the abnormal operation in the data stream that has completed the shielding process; if yes, going to step 52; if no, ignoring;

[0068] Step 52: software shielding is performed on the serial communication interface until the completion of the UEFI boot process of the server is detected, and the software shielding is released.

[0069] Of course, it can be understood that when the serial communication interface is shielded, the UEFI boot process of the server will be inevitably affected, such as the steps that need to be communicated with the outside through the serial communication interface cannot be completed. Therefore, after shielding the interface, corresponding alarm information can be generated and output to remind the operation and maintenance personnel to timely troubleshoot and handle.

[0070] Based on the above embodiment, in the application, when it is detected that the server starts to execute the UEFI boot process, the data stream sent to the server through the serial communication interface of the server can be automatically monitored, that is, the to-be-detected operation information contained in the data stream can be extracted and detected. Then, the application will determine whether the to-be-detected operation corresponding to the operation information belongs to the existing operation in the UEFI boot process. If not, it is automatically determined that the to-be-detected operation is an abnormal operation. If yes, it will be further detected whether the to-be-detected operation information contains abnormal content. If it is determined that the to-be-detected operation information is abnormal, it is determined that the to-be-detected operation is an abnormal operation. Then, the abnormal operation will be shielded, that is, the abnormal interaction between the outside and the server through the serial communication interface of the server in the UEFI boot process can be automatically found, and these abnormal interactions can be shielded in time to avoid interference with the execution of the UEFI boot process of the server. Thus, the server startup process can be effectively protected.

[0071] Based on the above embodiment, after it is determined that the server completes the UEFI boot process, if the operation information corresponding to the abnormal operation is still extracted from the serial communication interface, the attack behavior can be responded to by guiding the attacker into a crash dead loop without affecting the normal operation of the server. In one possible case, the server startup protection method can further include:

[0072] S201, when it is detected that the server completes the UEFI boot process, it is determined whether there is operation information corresponding to an abnormal operation in the data stream; if yes, step S202 is entered; if no, it is ignored.

[0073] It should be pointed out that the detection means used here is consistent with the first detection, that is, it is first determined whether the to-be-detected operation information in the data stream that has completed the shielding process belongs to the existing operation in the UEFI boot process. If not, it is determined as an abnormal operation. If yes, the to-be-detected operation information is abnormally detected to determine whether the signature information and the boot ID in the information are correct. If not, it is determined as an abnormal operation.

[0074] S201, if yes, the operation information corresponding to the abnormal operation is forwarded to the specified interface, so that the preset code logic in the specified interface responds to the abnormal operation and guides the attack end corresponding to the abnormal operation to enter a dead loop state.

[0075] In the embodiment of the application, a specified interface is additionally added, and preset code logics are in the interface. The code logics are all modified based on the existing UEFI boot process or other server startup processes. The code logics can not only respond to abnormal operations, but also guide the attack end corresponding to the abnormal operation to enter a dead loop state, that is, a virtual space is provided for the attacker, and the attack behavior of the attacker is limited in the space, so that the external attack is effectively coped with without affecting the normal operation of the server. It should be noted that the preset code logics in the embodiment of the application are not limited to the above, as long as the code logics are modified according to the code logics corresponding to the operation in the existing UEFI boot process or other server startup processes, and the code logics can guide the attack end to enter a dead loop state or other crash state.

[0076] Based on the above embodiment, the embodiment of the application can guide the attacker to enter a crash dead loop by using the preset interface and code logic, and thus the external attack can be effectively coped with without affecting the normal operation of the server.

[0077] The server startup protection method is described below with reference to an actual example. Figure 2 , Figure 2 A flowchart of another server startup protection method provided by the embodiment of the application is shown in FIG. 4. The method includes the following steps.

[0078] 1. The FT2000+ARM server is powered on and restarted, and the security protection is started before entering the UEFI boot of the BIOS startup;

[0079] 2. The existing process of the UEFI boot or the digital signature platform verification is used to check and detect the abnormal interaction part of the server device entering through the SPI FLASH, and it is judged whether there is an abnormal attack operation;

[0080] 3. If yes, the abnormal attack operation is completely shielded;

[0081] 4. It is judged whether there is still an abnormal attack operation;

[0082] 5. If yes, the soft entrance of the hardware shielding the SPI is automatically closed, and an alarm prompt information is given;

[0083] 5. When it is determined that the server completes the UEFI boot, the security protection is confirmed, and it is judged whether there is an abnormal attack operation;

[0084] 6. If there is, it is adopted into the open interface form, and the formal code of the pseudo code logic is provided to attack it to induce it into the infinite command line of the dead loop logic state.

[0085] The server startup protection apparatus, the electronic device and the computer readable storage medium provided by the embodiments of the present application are described below. The server startup protection apparatus, the electronic device and the computer readable storage medium described below can be mutually corresponding to the server startup protection method described above.

[0086] Please refer to Figure 3 , Figure 3 The structural block diagram of the server startup protection apparatus provided by the embodiments of the present application can include:

[0087] The information extraction module 301 is configured to extract the to-be-detected operation information from a data stream sent to the server through a serial communication interface of the server when it is detected that the server starts to execute the UEFI boot process.

[0088] The first detection module 302 is configured to determine that the to-be-detected operation belongs to an abnormal operation when it is determined that the to-be-detected operation corresponding to the to-be-detected operation information does not belong to an existing operation in the UEFI boot process.

[0089] The second detection module 303 is configured to perform abnormal detection on the to-be-detected operation information when it is determined that the to-be-detected operation belongs to an existing operation, and determine that the to-be-detected operation belongs to an abnormal operation when it is detected that the to-be-detected operation information is abnormal.

[0090] The shielding module 304 is configured to shield the abnormal operation.

[0091] Optionally, the shielding module 304 can include:

[0092] The process shielding sub-module is configured to find the process corresponding to the abnormal operation and close the process.

[0093] Optionally, the second detection module 303 can include:

[0094] The extraction sub-module is configured to extract the to-be-detected boot ID from the to-be-detected operation information, and extract a preset boot ID from the image verification information of the server.

[0095] The first determination sub-module is configured to determine that the to-be-detected operation information is abnormal when it is determined that the to-be-detected boot ID is different from the preset boot ID.

[0096] Optionally, the second detection module 303 can include:

[0097] The signature verification submodule is configured to extract the to-be-detected signature information from the to-be-detected operation information when it is determined that the server starts to perform the specified operation in the UEFI boot process, and perform signature verification on the to-be-detected signature information.

[0098] The second determination submodule is configured to determine that the to-be-detected operation information is abnormal when it is determined that the to-be-detected signature information is invalid.

[0099] Optionally, the signature verification submodule can include:

[0100] The signature extraction unit is configured to extract the to-be-detected signature information from the multiple specified positions in the to-be-detected operation information.

[0101] Optionally, the apparatus can further include:

[0102] The secondary judgment module is configured to judge whether the operation information corresponding to the abnormal operation exists in the data stream that has completed the shielding process.

[0103] The serial communication interface shielding module is configured to perform software shielding on the serial communication interface until the server completes the UEFI boot process, and then remove the software shielding.

[0104] Optionally, the apparatus can further include:

[0105] The judgment module is configured to judge whether the operation information corresponding to the abnormal operation exists in the data stream when it is detected that the server completes the UEFI boot process.

[0106] The boot module is configured to forward the operation information corresponding to the abnormal operation to the specified interface, so that the preset code logic in the specified interface responds to the abnormal operation, and guides the attack end corresponding to the abnormal operation to enter a dead loop state.

[0107] The embodiment of the present application further provides an electronic device, which includes:

[0108] The memory is configured to store a computer program.

[0109] The processor is configured to implement the steps of the server startup protection method when executing the computer program.

[0110] Since the embodiments of the electronic device part correspond to the embodiments of the server startup protection method part, the embodiments of the electronic device part are described in the description of the embodiments of the server startup protection method part, and will not be described here.

[0111] The embodiment of the present application further provides a computer readable storage medium, which stores a computer program. The computer program is executed by a processor to implement the steps of the server startup protection method of any of the above embodiments.

[0112] Since the embodiments of the computer readable storage medium part correspond to the embodiments of the server startup protection method part, the embodiments of the storage medium part refer to the description of the embodiments of the server startup protection method part, which will not be repeated here.

[0113] The various embodiments in the specification are described in a progressive manner, and each embodiment focuses on the differences from other embodiments. The same or similar parts between the various embodiments can be referred to each other. For the device disclosed in the embodiments, since it corresponds to the method disclosed in the embodiments, the description is relatively simple, and the relevant parts refer to the method part.

[0114] The skilled person can further realize that the units and algorithm steps of the examples described in combination with the embodiments disclosed herein can be realized by electronic hardware, computer software or a combination of the two. In order to clearly show the interchangeability of hardware and software, the components and steps of each example have been described in the above description. Whether the functions are executed in hardware or software depends on the specific application and design constraints of the technical solution. The skilled person can use different methods to implement the described functions for each specific application, but such implementation should not be considered beyond the scope of the present application.

[0115] The steps of the method or algorithm described in combination with the embodiments disclosed herein can be directly implemented by hardware, software modules executed by a processor, or a combination of the two. The software modules can be placed in random access memory (RAM), memory, read-only memory (ROM), electrically programmable ROM, electrically erasable programmable ROM, registers, hard disks, removable disks, CD-ROMs, or any other form of storage medium known in the art.

[0116] The above provides a detailed introduction to the server startup protection method, device, electronic equipment and storage medium provided by the present application. The principles and implementation modes of the present application are described by applying specific examples. The above description of the embodiments is only used to help understand the method and core idea of the present application. It should be pointed out that for ordinary skilled person in the art, without departing from the principles of the present application, some improvements and modifications can be made to the present application, and these improvements and modifications also fall within the protection scope of the claims of the present application.

Claims

1. A method for server launch protection, the method comprising: The method comprises the following steps: extracting to-be-detected operation information from a data stream sent to the server through a serial communication interface of the server when it is detected that the server starts to perform a UEFI boot process; determining that the to-be-detected operation belongs to an abnormal operation when it is determined that the to-be-detected operation corresponding to the to-be-detected operation information does not belong to an existing operation in the UEFI boot process; performing abnormal detection on the to-be-detected operation information and determining that the to-be-detected operation belongs to the abnormal operation when it is detected that the to-be-detected operation information is abnormal when it is determined that the to-be-detected operation belongs to the existing operation; performing shielding processing on the abnormal operation.

2. The server launch guard method of claim 1, wherein, The shielding processing on the abnormal operation comprises the following steps: finding a process corresponding to the abnormal operation and closing the process.

3. The method of claim 1, wherein the server launch guard is configured to: The abnormal detection on the to-be-detected operation information comprises the following steps: extracting a to-be-detected boot ID from the to-be-detected operation information and extracting a preset boot ID from image verification information of the server; determining that the to-be-detected operation information is abnormal when it is determined that the to-be-detected boot ID is different from the preset boot ID.

4. The method of claim 1, wherein the server launch guard method further comprises: The abnormal detection on the to-be-detected operation information comprises the following steps: extracting to-be-detected signature information from the to-be-detected operation information and performing signature verification on the to-be-detected signature information when it is determined that the server starts to perform a specified operation in the UEFI boot process; determining that the to-be-detected operation information is abnormal when it is determined that the to-be-detected signature information is invalid.

5. The method of claim 1, wherein the server launch guard method further comprises: The extraction of the to-be-detected signature information from the to-be-detected operation information comprises the following steps: extracting to-be-detected signature information from a plurality of specified positions in the to-be-detected operation information.

6. The method of claim 1, wherein the server launch guard is configured to: After the shielding processing on the abnormal operation, the method further comprises the following steps: determining whether operation information corresponding to the abnormal operation exists in a data stream on which shielding processing has been completed; if yes, performing software shielding on the serial communication interface until it is detected that the server completes the UEFI boot process, and the software shielding is released.

7. The server launch guard method of any of claims 1 to 6, wherein, The method further comprises the following steps: determining whether operation information corresponding to the abnormal operation exists in the data stream when it is detected that the server completes the UEFI boot process; if yes, forwarding the operation information corresponding to the abnormal operation to a specified interface, so that a preset code logic in the specified interface responds to the abnormal operation and guides an attack end corresponding to the abnormal operation to enter a dead loop state.

8. A server launch guard apparatus, comprising: The method comprises the following steps: an information extraction module is configured to extract to-be-detected operation information from a data stream sent to the server through a serial communication interface of the server when it is detected that the server starts to perform a UEFI boot process; a first detection module is configured to determine that the to-be-detected operation belongs to an abnormal operation when it is determined that the to-be-detected operation corresponding to the to-be-detected operation information does not belong to an existing operation in the UEFI boot process; a second detection module is configured to perform abnormal detection on the to-be-detected operation information and determine that the to-be-detected operation belongs to the abnormal operation when it is detected that the to-be-detected operation information is abnormal when it is determined that the to-be-detected operation belongs to the existing operation; A shielding module is configured to shield the abnormal operation.

9. An electronic device, comprising: The application relates to a computer program product and a server. The application relates to a computer program product and a server. The application relates to a computer program product and a server.

10. A computer-readable storage medium, characterized in that, The application relates to a computer program product and a server.

Images