A server BIOS security system, a control method of the security system, and a server

Abstract

The application provides a kind of server BIOS security system, control method and server, it is related to server technical field.The application includes: arbitration control module and line selection module are connected by first line, second line;BIOS Flash is connected by third line, and BIOS Flash is connected with line selection module;Arbitration control module is used to obtain security information from BIOS Flash;Compare and verify preset information and security information preset to itself, and in the case where comparison and verification pass, connect the line between BIOS Flash and core chip;After server boot, real-time read and monitor the transmission data between BIOS Flash and core chip.The application first carries out security verification before server boot, and verifies boot after verification, improves the security of early stage of server boot, avoids hackers or hostile company technicians to steal the core technology in BIOS through network connection into server, and improves the security strategy of server.

Description

Technical Field

[0001] This invention relates to the field of server technology, and in particular to a server BIOS security system, a control method for the server BIOS security system, and a server. Background Technology

[0002] The server industry is developing rapidly, and the importance of server security is increasing. Manufacturers are investing in research and development to improve the security of their products in order to prevent hackers from intruding and stealing their unique technologies.

[0003] Currently, when a server boots up, it first reads information and parameters stored in non-volatile memory, such as BIOS Flash. If the information and parameters read match and are specific to the company's product, then the BIOS will continue the boot process, thus achieving the security protection goal during server boot.

[0004] However, servers are generally connected to the network so that customers or engineers can connect and remotely operate and use them at any time. This is the most basic requirement and use of servers. But this may pose a risk: hackers or technical personnel from hostile companies may be able to connect to the server via the network and steal core technologies from the BIOS. Summary of the Invention

[0005] In view of the above problems, the present invention is proposed to provide a server BIOS security system, a control method for the server BIOS security system, and a server that solves or partially solves the above problems.

[0006] A first aspect of this invention provides a server BIOS security system, the server BIOS security system comprising: an arbitration control module and a line selection module;

[0007] The arbitration control module and the line selection module are connected via a first line and a second line;

[0008] The arbitration control module is connected to the BIOS Flash via a third line, and the BIOS Flash is connected to the line selection module;

[0009] The arbitration control module is used to control the topology of the line selector through the first line and obtain security information from the BIOS Flash.

[0010] The arbitration control module is used to compare and verify its own preset information and the security information. If the comparison and verification are successful, it controls the line selector to switch the topology through the second line, connecting the line between the BIOS Flash and the core chip so that the two can interact with each other and realize the server boot.

[0011] The arbitration control module is used to read and monitor the transmission data between the BIOS Flash and the core chip in real time through the third line after the server is powered on.

[0012] The arbitration control module is used to control the line selector to switch the topology through the second line when the transmitted data is in an insecure state, thereby cutting off the data interaction between the BIOS Flash and the core chip.

[0013] Optionally, the arbitration control module includes a CPLD or a SIO.

[0014] Optionally, the line selection module includes: a selection circuit or selector conforming to the SPI specification.

[0015] Optionally, the arbitration control module is used to control the line selector to maintain the current topology and disconnect the line between the BIOS Flash and the core chip when the comparison verification fails, while sending alarm information to the upper-level device.

[0016] Optionally, there are two selection circuits or two selectors;

[0017] Each selection circuit or each selector is connected to the arbitration control module via a first data line, to the core chip via a second data line, and to the BIOS Flash via a third data line. The first data line is any one of the first lines, and the third data line is connected to any one of the third lines.

[0018] Each selection circuit or each selector is connected to the arbitration control module via a control line, which is any one of the second lines.

[0019] A second aspect of this invention provides a control method for a server BIOS security system. The control method is applied to a server BIOS security system, which includes: an arbitration control module and a line selection module.

[0020] The arbitration control module and the line selection module are connected via a first line and a second line;

[0021] The arbitration control module is connected to the BIOS Flash via a third line, and the BIOS Flash is connected to the line selection module;

[0022] The control method includes:

[0023] The arbitration control module obtains security information from the BIOS Flash through the first line and the line selector;

[0024] The arbitration control module compares and verifies its own preset information with the security information;

[0025] If the comparison and verification pass, the arbitration control module controls the line selector through the second line to connect the line between the BIOS Flash and the core chip, so that the two can interact with each other and enable the server to boot up.

[0026] After the server is powered on, the arbitration control module reads and monitors the transmission data between the BIOS Flash and the core chip in real time through the third line.

[0027] When the transmitted data is in an insecure state, the arbitration control module controls the line selector through the second line to cut off the line between the BIOS Flash and the core chip, so that the data interaction between the two is disconnected.

[0028] Optionally, the arbitration control module obtains security information from the BIOSFlash via the first line and the line selector, including:

[0029] The arbitration control module sends a first control command to the line selector through the second line;

[0030] The line selector connects the line between the arbitration control module and the BIOS Flash according to the first control instruction, so that the arbitration control module can obtain the security information from the BIOS Flash.

[0031] Optionally, if the arbitration control module passes the comparison and verification, it controls the line selector via the second line to connect the line between the BIOS Flash and the core chip, enabling data interaction between the two and achieving server startup, including:

[0032] If the comparison and verification pass, the arbitration control module sends a second control command to the line selector through the second line.

[0033] The line selector switches the topology of its own line according to the second control instruction to connect the line between the BIOS Flash and the core chip;

[0034] After the line between the BIOS Flash and the core chip is connected, the BIOS Flash and the core chip interact with each other to execute the server boot process and enable the server to boot up.

[0035] If the comparison and verification fails, the arbitration control module sends an alarm message to the superior device, but does not send any instructions to the line selector.

[0036] Optionally, when the transmitted data is in an insecure state, the arbitration control module controls the line selector via the second line to disconnect the line between the BIOS Flash and the core chip, thereby breaking the data interaction between the two, including:

[0037] When the transmitted data is in an insecure state, the arbitration control module sends a third control command to the line selector through the second line.

[0038] According to the third control command, the line selector switches the topology of its own line and cuts off the line between the BIOS Flash and the core chip. After the line between the BIOS Flash and the core chip is cut off, the data interaction between the BIOS Flash and the core chip is disconnected.

[0039] A third aspect of the present invention provides a server, the server including a server BIOS security system as described in any of the first aspects.

[0040] The server BIOS security system provided by this invention connects the arbitration control module and the line selection module via a first line and a second line; and connects the arbitration control module and the BIOS Flash via a third line.

[0041] The arbitration control module obtains security information from the BIOS Flash by controlling the topology of the first-line control line selector. It also compares and verifies its own preset information with the security information. If the verification is successful, it switches the topology via the second-line control line selector, connecting the BIOS Flash and the core chip to enable data exchange and server boot. This method performs security verification before server boot, allowing the core chip to interact with the BIOS Flash and ultimately boot the server. This enhances the security of the server during the initial boot process and prevents hackers or hostile company technicians from gaining access to the server via network connection to steal core technologies from the BIOS.

[0042] After the server is powered on, the arbitration control module reads and monitors the data transmission between the BIOS Flash and the core chip in real time through the third line; it monitors in real time whether there are unauthorized users or hackers stealing the data exchanged, and when the data transmission is in an insecure state, it controls the line selector to switch the topology through the second line, cutting off the data interaction between the BIOS Flash and the core chip. This improves the reliability and security of the data during the data interaction process after power-on, improves the server's security strategy, and has high practicality. Attached Figure Description

[0043] To more clearly illustrate the technical solutions of the embodiments of the present invention, the drawings used in the description of the embodiments of the present invention will be briefly introduced below. Obviously, the drawings described below are only some embodiments of the present invention. For those skilled in the art, other drawings can be obtained based on these drawings without creative effort.

[0044] Figure 1 This is a schematic diagram of a modular structure of a server BIOS security system according to an embodiment of the present invention;

[0045] Figure 2 This is a schematic diagram of a preferred structure of the server BIOS security system in an embodiment of the present invention;

[0046] Figure 3 This is a flowchart of a control method for a server BIOS security system according to an embodiment of the present invention. Detailed Implementation

[0047] The technical solutions of the embodiments of the present invention will be clearly and completely described below with reference to the accompanying drawings. Obviously, the described embodiments are only some, not all, of the embodiments of the present invention. Based on the embodiments of the present invention, all other embodiments obtained by those skilled in the art without creative effort are within the scope of protection of the present invention.

[0048] The inventors discovered that current server BIOS firewalls typically contain security identification code that reads and accesses information and parameters stored in non-volatile memory, such as BIOS Flash, via protocols like SPI. When the server boots up, it first reads this information and parameters from the BIOS Flash. If the read information and parameters match, indicating they are specific to the product, then the BIOS will continue the boot process, thus achieving the security protection goal during server boot.

[0049] However, the inventors further discovered that servers are generally connected to the network so that customers or engineers can connect and remotely operate and use the server at any time. This is the most basic requirement and use of a server. But this may pose a risk: hackers or technical personnel from rival companies could connect to the server via the network and steal core technologies from the BIOS, especially the BIOS firmware.

[0050] To address the aforementioned problems, the inventors have creatively proposed the server BIOS security system, the control method for the server BIOS security system, and the server of this invention. The technical solution of this invention will be explained and described in detail below.

[0051] The server BIOS security system proposed in this invention refers to... Figure 1 The modular structure diagram shown includes: an arbitration control module and a line selection module; the arbitration control module and the line selection module are connected through a first line and a second line; the arbitration control module and the BIOS Flash are connected through a third line, and the BIOS Flash and the line selection module are also connected.

[0052] The server BIOS security system proposed in this invention creatively adds an arbitration control module, a line selector, and related lines to current server BIOS security systems to implement security verification before server startup, ensuring server security before startup. Simultaneously, the arbitration control module monitors the security of data interaction after server startup in real time, further enhancing server data security.

[0053] Based on the above-mentioned inventive concept, the arbitration control module can be used to obtain security information from the BIOS Flash by controlling the topology of the first-line control line selector. That is, unlike existing boot methods, this invention does not perform boot data interaction between the core chip and the BIOS Flash before the server boots up. Instead, the arbitration control module first connects its data line with the BIOS Flash through the topology of the first-line control line selector, actively obtaining its security information from the BIOS Flash. This security information may include some critical information and parameters. Generally, when a hacker or unauthorized user needs to enter the BIOS, they first need to attack or bypass the BIOS firewall. When the BIOS firewall is attacked or bypassed, the critical information and parameters in the BIOS Flash will change. Therefore, the arbitration control module obtains this critical information and parameters before the server boots up.

[0054] After obtaining this critical information and parameters, the arbitration control module also uses it to compare and verify its own preset information and security information. The arbitration control module has preset information that is identical to the critical information and parameters in the BIOS Flash, enabling the comparison and verification operation with security information.

[0055] If the preset information and security information are completely identical, the comparison and verification pass. The arbitration control module is also used to switch the topology via the second line control line selector, connecting the line between the BIOS Flash and the core chip to enable data interaction and server boot. In other words, after successful comparison and verification, the second line control line selector switches the topology to connect the line between the BIOS Flash and the core chip, allowing data interaction between them to begin and boot. This method performs security verification before server boot, and only after successful verification does the core chip and BIOS Flash interact, thus improving the security of the server during the initial boot process and preventing hackers or technical personnel from hostile companies from gaining access to the server via network connection to steal core technologies from the BIOS.

[0056] It is understandable that the arbitration control module can also be used to maintain the current topology through the second line control line selector when the comparison verification fails. That is, the line between the BIOS Flash and the core chip is not connected, and alarm information is sent to the upper-level device so that relevant personnel can be informed in time that there is a security problem with the server BIOS Flash and that important information may have been stolen, and relevant personnel need to take timely countermeasures.

[0057] After the server is powered on, the arbitration control module can also be used to read and monitor the data transmission between the BIOS Flash and the core chip in real time through the third line. At the same time, the arbitration control module is also used to monitor in real time whether there are unauthorized users or hackers stealing the data exchanged. When the data transmission is in an insecure state, the topology is switched through the second line control line selector to cut off the data interaction between the BIOS Flash and the core chip, thereby improving the reliability and security of the data during the data interaction process after power-on and improving the server's security strategy.

[0058] It should be noted that in the server BIOS security system, the data transmission line and the control signal transmission line are separate. Therefore, the first and third lines are used for data transmission, while the second line is used for control signal transmission. The arbitration control module sends control signals to the line selection module through the second line. After receiving the control signals, the line selection module executes according to the specific information of the control signals, changes its own topology, and disconnects or connects the data transmission line.

[0059] Based on the above core ideas, in one possible embodiment, the arbitration control module may include a CPLD or a SIO. CPLD (Complex Programmable Logic Device) is short for ComplexPLD, a type of digital integrated circuit proposed in the mid-1980s. This data integrated circuit is a logic element more complex than a PLD (programmable logic device).

[0060] A CPLD is a digital integrated circuit whose logic functions are constructed by the user according to their own needs. Its basic design method involves using an integrated development environment (IDE) platform, employing schematic diagrams, hardware description languages, and other methods to generate corresponding target files. The code is then transferred to the target chip via a download cable ("in-system" programming) to realize the designed digital system. CPLDs utilize programming technologies such as CMOS EPROM, EEPROM, flash memory, and SRAM, thus forming high-density, high-speed, and low-power programmable logic devices.

[0061] A CPLD consists of three parts: logic blocks, programmable interconnect channels, and I / O blocks. Programming languages ​​include Verilog and VHDL; development tools include Quartus II and ISE. A logic block in a CPLD is similar to a small-scale PLD, typically containing 4 to 20 macrocells. Each macrocell generally consists of a product term array, product term allocation, and programmable registers. Each macrocell has multiple configuration options, and macrocells can be cascaded, thus enabling the implementation of complex combinational and sequential logic functions. For high-integration CPLDs, embedded array blocks with on-chip RAM / ROM are also typically provided. Programmable interconnect channels primarily provide the interconnect network between logic blocks, macrocells, and input / output pins. Input / output blocks (I / O blocks) provide the interface between internal logic and device I / O pins. Larger-scale CPLDs generally also include built-in JTAG boundary scan test circuitry, enabling comprehensive and thorough system testing of programmed high-density programmable logic devices. Furthermore, in-system programming can be performed via the JTAG interface.

[0062] The aforementioned CPLD can also be replaced by an FPGA. Compared to CPLD, CPLD is more suitable for implementing various algorithms and combinational logic, while FPGA is more suitable for implementing sequential logic. The continuous routing structure of CPLD determines that its timing delay is uniform and predictable, while the segmented routing structure of FPGA determines that its delay is unpredictable.

[0063] FPGAs offer greater flexibility in programming than CPLDs. CPLDs are programmed by modifying logic functions with fixed internal interconnects, while FPGAs are primarily programmed by changing the routing of internal interconnects. FPGAs can be programmed at the logic gate level, while CPLDs are programmed at the logic block level. FPGAs have higher integration density than CPLDs, with more complex routing structures and logic implementations. CPLDs are easier to use than FPGAs. CPLD programming uses E2PROM or FastFLASH technology, requiring no external memory chips and is simple to use. In contrast, FPGA programming information must be stored in external memory, making its usage more complex.

[0064] Furthermore, CPLDs are faster than FPGAs and offer greater time predictability. This is because FPGAs are gate-level programmed with distributed interconnects between CLBs, while CPLDs are logic block-level programmed with centralized interconnects between their logic blocks. In terms of programming methods, CPLDs are primarily based on E2PROM or FLASH memory, allowing for up to 10,000 programming cycles. Their advantage is that programming information is not lost when the system is powered off. FPGAs are mostly based on SRAM programming; programming information is lost when the system is powered off, and the programming data must be rewritten into the SRAM externally each time power is restored. Their advantage is that they can be programmed an arbitrary number of times and can be programmed quickly during operation, enabling dynamic configuration at the board and system levels. CPLDs offer better security than FPGAs.

[0065] For the reasons mentioned above, CPLD is more suitable than FPGA for the server BIOS security system proposed in this invention.

[0066] SIO refers to Super Input / Output Chip, and most SIOs are located in the lower left or upper left corner of the motherboard. Commonly used chips include Winbond and ITE, which provide control and processing functions for the motherboard's standard I / O interfaces. Both can be used as arbitration control modules, where code can be designed to implement any required functionality.

[0067] In one possible embodiment, the line selection module includes a selection circuit or selector conforming to the SPI specification. SPI (Serial Peripheral Interface) was first defined by Motorola on its MC68HCXX series processors. The SPI bus is a high-speed, full-duplex, synchronous communication bus that uses only four wires to complete basic data communication, saving chip pins and simplifying PCB layout and routing. Due to its ease of use, more and more chips are integrating this communication protocol.

[0068] SPI communication is simple, operating in a master-slave mode, where one master device can control one or more slave devices. Communication between master and slave devices requires at least four lines: MISO (Master Input / Slave Output data transmission line), MOSI (Master Output / Slave Input data transmission line), SCK (clock), and CS (chip select). MISO is the master data input / slave data output; MOSI is the master data output / slave data input; SCK is the clock signal provided by the master to the slave; and CS is the slave enable signal, controlled by the master.

[0069] For the reasons mentioned above, the line selection module can preferentially select circuits or selectors that conform to the SPI specification. Naturally, it is understandable that selection circuits or selectors conforming to other communication specifications can also be selected, such as those conforming to UART or IIC communication protocols.

[0070] In one possible embodiment, there are two selection circuits or selectors; each selection circuit or selector is connected to the arbitration control module via a first data line, to the core chip via a second data line, and to the BIOS Flash via a third data line. The first data line is any one of the first lines, and the third data line is connected to any one of the third lines.

[0071] Each selection circuit or selector is connected to the arbitration control module via a control line, which can be any one of the lines in the second circuit. The reason for preferentially using two selection circuits or selectors is due to the limited physical space of the server BIOS security system and factors such as device heat dissipation. Using two selection circuits or selectors, with one as a backup, improves reliability. If one fails after prolonged use, the backup selection circuit or selector and its associated backup line can be activated. Replacement and repair are only required if both selection circuits or selectors fail, reducing the maintenance rate.

[0072] Generally, the core chips can include either the CPU (Central Processing Unit) or the PCH (Platform Controller Hub). The PCH is Intel's integrated southbridge. It replaced the previous ICH10 in mainstream mobile and desktop computers. The PCH connects directly to the Nehalemel P55. This chip was designed and completed on September 8, 2009. The southbridge chip is the most important component of the motherboard chipset besides the northbridge chip. It is generally located on the motherboard, far below the CPU socket and near the PCI slots. This layout takes into account the large number of I / O buses it connects to; being further away from the processor facilitates cabling and makes it easier to implement the principle of equal-length signal lines. The southbridge is one of the chips in the motherboard chipset architecture. The southbridge is designed to process low-speed signals and communicates with the central processing unit through the northbridge. This ensures that there is only a single southbridge chip in the entire chipset architecture.

[0073] Taking the arbitration control module CPLD or SIO, the line selection module using two SPI MUXs, and the core chip using CPU or PCH as an example, refer to... Figure 2The diagram illustrates a preferred structural schematic of the server BIOS security system proposed in this invention. The arbitration control module CPLD or SIO is connected to the two SPI MUXs (SPI MUX1 and SPI MUX2) via first lines 11 and 12 and second lines 21 and 22; the arbitration control module CPLD or SIO is connected to the BIOS Flash via third lines 31 and 32, and the BIOS Flash is connected to the two SPI MUXs via lines 41 and 42.

[0074] Before the server is powered on, the arbitration control module CPLD or SIO controls the topology of SPI MUX1, which is connected to the first line 11, through any first line, such as the first line 11. This allows the arbitration control module CPLD or SIO to form a data transmission path with the BIOS Flash through the first line 11, SPI MUX1, and line 41, and obtain security information from the BIOS Flash.

[0075] After obtaining the security information, the arbitration control module CPLD or SIO compares and verifies the pre-set information with the obtained security information. If the comparison and verification fails, the arbitration control module CPLD or SIO controls SPI MUX1 through the second line 21 to maintain the current topology, and does not connect the line between the BIOS Flash and the core chip CPU or PCH (i.e., does not connect line 51). At the same time, the arbitration control module CPLD or SIO sends an email to the superior device ( Figure 2 (Not shown in the image) Send alarm information.

[0076] If the verification passes, the arbitration control module CPLD or SIO controls the SPI MUX1 to switch topologies via the second line 21, connecting the BIOS Flash and the core chip CPU or PCH. Specifically, it connects lines 41 and 51 while disconnecting the first line 11, enabling data exchange between the BIOS Flash and the core chip CPU or PCH, thus booting the server. This method performs security verification before server boot, allowing data exchange between the core chip and BIOS Flash only after successful verification, thereby improving security during the initial boot phase and preventing hackers or hostile company technicians from gaining access to the server via network and stealing core technologies from the BIOS.

[0077] After the server boots up normally according to the procedure, data is transmitted between the BIOS Flash and the core chip CPU or PCH via connection line 41, SPI MUX1, and line 51. Simultaneously, the arbitration control module CPLD or SIO reads and monitors the data transmission between the BIOS Flash and the core chip CPU or PCH in real time via the third line 31. That is, the arbitration control module CPLD or SIO uses the third line 31 to read and monitor the data transmitted on line 41 in real time.

[0078] During the real-time reading and monitoring of data transmission on line 41 using the third line 31, the arbitration control module CPLD or SIO detects unauthorized users or hackers stealing data exchanged between the BIOS Flash and the core chip CPU or PCH. If this is detected, the data transmission is considered insecure. The CPLD or SIO then controls the SPI MUX1 to switch topologies via the second line 21, cutting off the data line between the BIOS Flash and the core chip CPU or PCH (i.e., cutting off line 51). This interrupts data interaction between the BIOS Flash and the core chip CPU or PCH, improving the reliability and security of data exchange after booting, ensuring the security and quality of transmitted data, and enhancing the server's security strategy. Furthermore, based on this structure, the CPLD or SIO can also update data to the BIOS Flash in real time. For example, changing certain information or security parameters and updating the BIOS Flash with the new information or security parameters via the third line 31 and line 41 improves the flexibility of data changes stored in the BIOS Flash.

[0079] The server BIOS security system proposed in this invention differs from existing boot methods. Before the server boots up, the core chip and BIOS Flash do not exchange boot data. Instead, the arbitration control module first connects its data line to the BIOS Flash through the topology of the first line control line selector, actively obtaining security information from the BIOS Flash. Security verification is performed before the server boots up; only after successful verification does the core chip and BIOS Flash exchange data, thus enabling boot. This improves the security of the server in the early boot stage and prevents hackers or hostile company technicians from gaining access to the server via network connection to steal core technologies from the BIOS. Furthermore, after the server boots up, the arbitration control module reads and monitors the data transmission between the BIOS Flash and the core chip in real time through a third line, detecting whether unauthorized users or hackers are stealing the exchanged data. If the data transmission is insecure, the second line control line selector switches the topology, cutting off the data exchange between the BIOS Flash and the core chip. This improves the reliability and security of data during post-boot data exchange, enhancing the server's security strategy. In addition, the arbitration control module can update data to the BIOS Flash in real time, improving the flexibility of data changes stored in the BIOS Flash.

[0080] Based on the aforementioned server BIOS security system, this embodiment of the invention also provides a control method for the server BIOS security system, referring to... Figure 3 The flowchart shown illustrates a control method for a server BIOS security system, which includes: an arbitration control module and a line selection module.

[0081] The arbitration control module and the line selection module are connected via a first line and a second line; the arbitration control module and the BIOS Flash are connected via a third line, and the BIOS Flash is connected to the line selection module.

[0082] The control methods for server BIOS security systems include:

[0083] Step 301: The arbitration control module obtains security information from the BIOS Flash through the first line and the line selector.

[0084] Before the server powers on, the arbitration control module obtains security information from the BIOS Flash via a first line and a line selector. Specifically, the arbitration control module sends a first control command to the line selector via a second line; the line selector, based on the first control command, connects the line between the arbitration control module and the BIOS Flash, enabling the arbitration control module to obtain security information from the BIOS Flash.

[0085] Step 302: The arbitration control module compares and verifies its own preset information with the security information.

[0086] After obtaining the security information, the arbitration control module compares and verifies its own preset information with the security information.

[0087] Step 303: If the comparison and verification pass, the arbitration control module connects the line between the BIOS Flash and the core chip through the second line control line selector, so that the two can interact with each other and realize the server boot.

[0088] If the arbitration control module fails the verification, it sends an alarm message to the higher-level device but does not send any instructions to the line selector, which maintains its current topology. The data lines between the BIOS Flash and the core chip are not connected.

[0089] If the arbitration control module passes the comparison and verification, it sends a second control command to the line selector through the second line. The line selector switches the topology of its own line according to the second control command to connect the line between the BIOS Flash and the core chip. After the line between the BIOS Flash and the core chip is connected, the BIOS Flash and the core chip exchange data and execute the server boot process to realize the server boot.

[0090] Step 304: After the server is powered on, the arbitration control module reads and monitors the data transmission between the BIOSFlash and the core chip in real time through the third line.

[0091] Step 305: When the data transmission is in an insecure state, the arbitration control module disconnects the line between the BIOS Flash and the core chip through the second line control line selector, so that the data interaction between the two is disconnected.

[0092] After the server powers on, the arbitration control module reads and monitors the data transmission between the BIOS Flash and the core chip in real time via the third line. When the data transmission is in an insecure state, the arbitration control module controls the line selector via the second line to disconnect the line between the BIOS Flash and the core chip, thus breaking the data exchange between them. Specifically:

[0093] When the data transmission is in an insecure state, the arbitration control module sends a third control command to the line selector through the second line. According to the third control command, the line selector switches the topology of its own line and cuts off the line between the BIOS Flash and the core chip. After the line between the BIOS Flash and the core chip is cut off, the data interaction between the BIOS Flash and the core chip is disconnected.

[0094] The control methods of the server BIOS security system described above have been explained and described in detail in the aforementioned structural content, which can be referred to in the aforementioned content without further elaboration.

[0095] Based on the above-described server BIOS security system, this invention also proposes a server that includes the server BIOS security system described in any of the preceding embodiments.

[0096] Through the above examples, the server BIOS security system provided by this invention connects the arbitration control module and the line selection module via a first line and a second line; the arbitration control module and the BIOS Flash are connected via a third line. The arbitration control module controls the topology of the line selector via the first line, obtains security information from the BIOS Flash, and compares and verifies its own preset information with the security information. If the comparison and verification pass, it controls the line selector via the second line to switch the topology, connecting the line between the BIOS Flash and the core chip, enabling data interaction between the two and achieving server startup. After the server powers on, the arbitration control module reads and monitors the data transmission between the BIOS Flash and the core chip in real time via the third line; it monitors in real time whether unauthorized users or hackers are stealing the data exchanged, and if the data transmission is in an insecure state, it controls the line selector via the second line to switch the topology, cutting off the data interaction between the BIOS Flash and the core chip.

[0097] The server BIOS security system proposed in this invention differs from existing boot methods. Before the server boots up, the core chip and BIOS Flash do not exchange boot data. Instead, the arbitration control module first connects its data line to the BIOS Flash through the topology of the first line control line selector, actively retrieving security information from the BIOS Flash. Security verification is performed before the server boots up; only after successful verification does the core chip and BIOS Flash exchange data, thus enabling boot. This improves the security of the server in the early boot stage, preventing hackers or hostile company technicians from gaining access to the server via network and stealing core technologies from the BIOS. Furthermore, after the server boots up, the arbitration control module reads and monitors the data transmission between the BIOS Flash and the core chip in real time through a third line. It monitors for unauthorized users or hackers stealing the exchanged data. If the data transmission is insecure, the second line control line selector switches the topology, cutting off the data exchange between the BIOS Flash and the core chip. This improves the reliability and security of data during post-boot data exchange, enhancing the server's security strategy. In addition, the arbitration control module can update data to the BIOS Flash in real time, which improves the flexibility of data changes stored in the BIOS Flash and has high practicality.

[0098] It should be noted that, in this document, the terms "comprising," "including," or any other variations thereof are intended to cover non-exclusive inclusion, such that a process, method, article, or apparatus that comprises a list of elements includes not only those elements but also other elements not expressly listed, or elements inherent to such a process, method, article, or apparatus. Unless otherwise specified, an element defined by the phrase "comprising one..." does not exclude the presence of other identical elements in the process, method, article, or apparatus that includes that element.

[0099] The embodiments of the present invention have been described above with reference to the accompanying drawings. However, the present invention is not limited to the specific embodiments described above. The specific embodiments described above are merely illustrative and not restrictive. Those skilled in the art can make many other forms under the guidance of the present invention without departing from the spirit and scope of the claims. All of these forms are within the protection scope of the present invention.

Claims

1. A server BIOS security system, characterized in that, The server BIOS security system includes: an arbitration control module and a line selection module; The arbitration control module and the line selection module are connected via a first line and a second line; The arbitration control module is connected to the BIOS Flash via a third line, and the BIOS Flash is connected to the line selection module; The arbitration control module is used to control the topology of the line selection module through the first line and obtain security information from the BIOSFlash. The arbitration control module is used to compare and verify its own preset information and the security information. If the comparison and verification are successful, it controls the line selection module to switch the topology through the second line to connect the line between the BIOS Flash and the core chip, so that the two can interact with each other and realize the server boot. The arbitration control module is used to read and monitor the transmission data between the BIOS Flash and the core chip in real time through the third line after the server is powered on, and at the same time monitor whether there are unauthorized users or hackers stealing the interactive data. The arbitration control module is used to control the line selection module to switch the topology structure through the second line when the transmitted data is in an insecure state, thereby cutting off the data interaction between the BIOS Flash and the core chip. The line selection module includes: a selection circuit or selector conforming to the SPI specification; there are two selection circuits or selectors.

2. The server BIOS security system according to claim 1, characterized in that, The arbitration control module includes either a CPLD or a SIO.

3. The server BIOS security system according to claim 1, characterized in that, The arbitration control module is used to control the line selection module to maintain the current topology and disconnect the line between the BIOS Flash and the core chip when the comparison verification fails, while sending alarm information to the upper-level device.

4. The server BIOS security system according to claim 1, characterized in that, Each selection circuit or each selector is connected to the arbitration control module via a first data line, to the core chip via a second data line, and to the BIOS Flash via a third data line. The first data line is any one of the first lines, and the third data line is connected to any one of the third lines. Each selection circuit or each selector is connected to the arbitration control module via a control line, which is any one of the second lines.

5. A control method for a server BIOS security system, characterized in that, The control method is applied to a server BIOS security system, which includes: an arbitration control module and a line selection module; The arbitration control module and the line selection module are connected via a first line and a second line; The arbitration control module is connected to the BIOS Flash via a third line, and the BIOS Flash is connected to the line selection module; The control method includes: The arbitration control module obtains security information from the BIOS Flash through the first line and the line selection module; The arbitration control module compares and verifies its own preset information with the security information; If the comparison and verification pass, the arbitration control module controls the line selection module through the second line to connect the line between the BIOS Flash and the core chip, so that the two can interact with each other and enable the server to boot up. After the server is powered on, the arbitration control module reads and monitors the transmission data between the BIOS Flash and the core chip in real time through the third line, and at the same time monitors whether there are unauthorized users or hackers stealing the data being exchanged; when the transmission data is in an insecure state, the arbitration control module controls the line selection module to cut off the line between the BIOS Flash and the core chip through the second line, so that the data exchange between the two is disconnected. The line selection module includes: a selection circuit or selector conforming to the SPI specification; there are two selection circuits or selectors.

6. The control method according to claim 5, characterized in that, The arbitration control module obtains security information from the BIOS Flash through the first line and the line selection module, including: The arbitration control module sends a first control command to the line selection module through the second line; The line selection module connects the line between the arbitration control module and the BIOS Flash according to the first control instruction, so that the arbitration control module can obtain the security information from the BIOS Flash.

7. The control method according to claim 5, characterized in that, If the comparison and verification pass, the arbitration control module controls the line selection module via the second line to connect the line between the BIOS Flash and the core chip, enabling data interaction between the two and achieving server startup, including: If the comparison and verification pass, the arbitration control module sends a second control command to the line selection module through the second line; The line selection module switches the topology of its own line according to the second control command in order to connect the line between the BIOS Flash and the core chip. After the line between the BIOS Flash and the core chip is connected, the BIOS Flash and the core chip interact with each other to execute the server boot process and enable the server to boot up. If the comparison and verification fails, the arbitration control module sends an alarm message to the superior device, but does not send any instructions to the line selection module.

8. The control method according to claim 5, characterized in that, When the transmitted data is in an insecure state, the arbitration control module controls the line selection module via the second line to disconnect the line between the BIOS Flash and the core chip, thereby breaking the data interaction between the two, including: When the transmitted data is in an insecure state, the arbitration control module sends a third control command to the line selection module through the second line. According to the third control command, the line selection module switches the topology of its own line and cuts off the line between the BIOS Flash and the core chip. After the line between the BIOS Flash and the core chip is cut off, the data interaction between the BIOS Flash and the core chip is disconnected.

9. A server, characterized in that, The server includes a server BIOS security system as described in any one of claims 1 to 5.

Images