Method for preventing computer from being lost under protection of firmware

Abstract

The invention discloses a computer anti-loss method protected by firmware, and relates to the technical field of computer security and data protection. The method comprises the following steps of: checking the existence, the integrity and the reliability of an operating system security protection module stored at a specified position of a computer storage medium by a computer firmware guard module, starting the operating system security protection module when the checking is passed, and starting the operating system security protection module after the operating system security protection module is started. According to the method, the computer risk control management system is requested to return the risk control strategy for preventing the loss of the computer, and the returned risk control strategy is executed, so that the execution and protection of the risk control strategy are not limited to an operating system layer, but sink to computer firmware, and the risk control strategy is protected. According to the technical scheme, the risk control strategy can still be executed under the limit condition that the computer hard disk is replaced or the operating system is formatted, and locking or data erasing can be performed after the computer is lost, so that the application scene and the universality can be expanded, and the practical application and popularization are facilitated.

Description

Technical Field

[0001] The present invention belongs to the technical field of computer security and data protection, and in particular relates to a computer anti-loss method protected by firmware. Background Art

[0002] Computers are the core production tools for corporate offices, which store the company's key data. However, in some cases (such as employee resignation or changes in corporate operations), computers may be stolen or equipment hardware may be replaced, resulting in the loss of tangible assets and data assets.

[0003] At present, there are mainly three existing computer loss prevention solutions:

[0004] (A) Using application software installed on the computer operating system to generate location alarms, perform forced shutdowns, and erase data, but this solution is only effective if the user does not replace the operating system storage medium or reinstall the operating system;

[0005] (B) Integrate the protective device hardware on the computer equipment and implement tracking through independent hardware modules. This solution requires customized design of computer equipment and is not universal;

[0006] (C) BIOS (Basic Input Output System) secure boot technology, which focuses on building the entire trust chain of computer hardware, operating system and application software, with the emphasis on ensuring hardware trustworthiness, system trustworthiness and data trustworthiness. Summary of the invention

[0007] The purpose of the present invention is to provide a computer anti-loss method protected by firmware, so as to solve the problem that the existing computer anti-loss solutions are only effective when the user does not replace the operating system storage medium or reinstall the operating system, resulting in limited applicable scenarios and versatility.

[0008] In order to achieve the above object, the present invention adopts the following technical solutions:

[0009] In a first aspect, a method for preventing computer loss protected by firmware is provided, comprising:

[0010] The computer firmware guard module checks the existence, integrity and reliability of the operating system security protection module stored at a specified location of the computer storage medium;

[0011] When the computer firmware guard module passes the check, the operating system security protection module is started;

[0012] After being started, the operating system security protection module requests the computer risk control management system to return the risk control strategy for preventing computer loss, and executes the returned risk control strategy.

[0013] Based on the above invention content, a new solution for computer security policy protection based on computer firmware is provided, that is, the computer firmware protection module first checks the existence, integrity and reliability of the operating system security protection module stored in the specified location of the computer storage medium, and starts the operating system security protection module when the check passes, and then after the operating system security protection module is started, it requests the computer risk control management system to return the risk control policy for computer loss prevention, and executes the returned risk control policy, so that the execution and protection of the risk control policy are no longer limited to the operating system level, but are sunk to the computer firmware, and because the computer firmware is the first software to run when the computer is turned on, it has the characteristics of being determined to be executed, not being tampered with, and not being deleted. Therefore, it can ensure that in the extreme case that the computer hard disk is replaced or the operating system is formatted, the risk control policy can still be executed, and the computer can be locked or the data can be erased after the computer is lost, thereby expanding the application scenarios and versatility, facilitating practical application and promotion.

[0014] In one possible design, the computer firmware guard module checks the existence of the operating system security protection module stored at a specified location of the computer storage medium, including:

[0015] The computer firmware guard module performs an existence check on the computer storage medium used to store the operating system security protection module;

[0016] When the computer firmware guard module detects the existence of the computer storage medium, it continues to determine whether the data format of the computer storage medium conforms to the expected format;

[0017] When the computer firmware guard module determines that the data format conforms to the expected format, the computer firmware guard module reads a flag value stored at a first designated address of a system reserved partition of the computer storage medium, and determines whether the flag value is a predefined value;

[0018] When the computer firmware guard module determines that the flag value is the predefined value, it determines that the operating system security protection module exists; otherwise, it determines that the operating system security protection module does not exist, and executes a data recovery process to restore the operating system security protection module.

[0019] In one possible design, the computer firmware guard module checks the existence of the operating system security protection module stored at a specified location of the computer storage medium, and further includes:

[0020] When the computer firmware guard module finds that the computer storage medium does not exist or determines that the data format does not conform to the expected format, the check is stopped and ended.

[0021] In one possible design, the computer firmware guard module checks the integrity and reliability of the operating system security protection module stored at a specified location of the computer storage medium, including:

[0022] After checking and determining that the operating system security protection module stored at a designated location of the computer storage medium exists, the computer firmware guard module performs a hash calculation on the code of the operating system security protection module to obtain a current hash value;

[0023] The computer firmware guard module reads a reserved hash value stored at a second designated address of a system reserved partition of the computer storage medium, and determines whether the reserved hash value is consistent with the current hash value;

[0024] When the computer firmware guard module determines that the reserved hash value is consistent with the current hash value, it determines that the operating system security protection module is complete and reliable; otherwise, it determines that the operating system security protection module is incomplete and unreliable, and executes a data recovery process to restore the operating system security protection module.

[0025] In one possible design, executing a data recovery process to recover the operating system security protection module includes:

[0026] Formatting a designated storage area on the computer storage medium for storing the operating system security protection module, resetting a flag value at a first designated address of a system reserved partition of the computer storage medium, and clearing a reserved hash value at a second designated address of the system reserved partition;

[0027] Releasing the operating system security protection module to the designated storage area for storage;

[0028] Performing hash calculation on the code of the operating system security protection module, and storing the calculated hash value as a reserved hash value at the second designated address;

[0029] Writing device configuration information into the operating system security protection module;

[0030] The flag value at the first designated address is updated to a predefined value.

[0031] In a possible design, a request is made to the computer risk control management system to return a risk control strategy for computer loss prevention, including:

[0032] Check whether the local device configuration information exists;

[0033] If it exists, start the network connection module to connect to the Internet;

[0034] If the networking is successful, the device ID, the version number of the operating system security protection module, the risk control strategy execution time range and the policy code are reported to the computer risk control management system in the form of a message according to the device configuration information, so that the computer risk control management system first obtains the risk control strategy for computer loss prevention according to the device ID and the version number in the system, and then verifies the risk control strategy with the risk control strategy execution time range and the policy code, and finally returns the risk control strategy in the form of a message when the verification passes.

[0035] In a possible design, requesting the computer risk control management system to return the risk control strategy for computer loss prevention also includes:

[0036] After checking whether the local device configuration information exists, if not, requesting the computer firmware guard module to return the device configuration information.

[0037] In a possible design, requesting the computer risk control management system to return the risk control strategy for computer loss prevention also includes:

[0038] After the network connection module is started to connect to the network, if the connection to the network fails, a security policy for preventing the computer from losing is obtained from the device configuration information and executed.

[0039] In a possible design, requesting the computer risk control management system to return the risk control strategy for computer loss prevention also includes:

[0040] After verifying the risk control policy with the risk control policy execution time range and the policy code, if the verification fails, an update policy message is sent to update the risk control policy to the operating system security protection module.

[0041] In a possible design, the risk control strategy for executing returns includes:

[0042] Based on the returned risk control policy, the risk control operation of normal computer startup or device locking is performed.

[0043] Beneficial effects of the above scheme:

[0044] (1) The present invention creatively provides a new solution for computer security policy protection based on computer firmware, that is, the computer firmware protection module first checks the existence, integrity and reliability of the operating system security protection module stored in the specified location of the computer storage medium, and starts the operating system security protection module when the check is passed. Then, after the operating system security protection module is started, it requests the computer risk control management system to return the risk control policy for computer loss prevention, and executes the returned risk control policy. In this way, the execution and protection of the risk control policy are no longer limited to the operating system level, but are sunk to the computer firmware. Since the computer firmware is the first software to be run when the computer is turned on, it has the characteristics of being determined to be executed, not being tampered with, and not being deleted. Therefore, it can ensure that in the extreme case that the computer hard disk is replaced or the operating system is formatted, the risk control policy can still be executed, and the computer can be locked or the data can be erased after the computer is lost, thereby expanding the application scenarios and versatility.

[0045] (2) The computer firmware guard module can be compatible with the existing computer BIOS firmware and does not require additional hardware equipment, which is convenient for practical application and promotion. BRIEF DESCRIPTION OF THE DRAWINGS

[0046] In order to more clearly illustrate the embodiments of the present invention or the technical solutions in the prior art, the drawings required for use in the embodiments or the description of the prior art will be briefly introduced below. Obviously, the drawings described below are only some embodiments of the present invention. For ordinary technicians in this field, other drawings can be obtained based on these drawings without paying creative work.

[0047] Figure 1 A flowchart of a computer anti-loss method protected by firmware provided in an embodiment of the present application. DETAILED DESCRIPTION

[0048] In order to more clearly illustrate the technical solutions in the embodiments of the present invention or the prior art, the present invention will be briefly introduced below in combination with the drawings and the description of the embodiments or the prior art. Obviously, the following description of the structures of the drawings is only some embodiments of the present invention. For ordinary technicians in this field, other embodiments can be obtained based on these embodiments without creative work. It should be noted that the description of these embodiments is used to help understand the present invention, but does not constitute a limitation of the present invention.

[0049] It should be understood that although the terms first and second, etc. may be used herein to describe various objects, these objects should not be limited by these terms. These terms are only used to distinguish one object from another object. For example, a first object can be referred to as a second object, and similarly, a second object can be referred to as a first object without departing from the scope of the exemplary embodiments of the present invention.

[0050] It should be understood that the term "and / or" that may appear in this document is merely a description of the association relationship between associated objects, indicating that there may be three relationships. For example, A and / or B can indicate three situations: A exists alone, B exists alone, or A and B exist at the same time. For another example, A, B and / or C can indicate the existence of any one of A, B and C or any combination of them. The term " / and" that may appear in this document describes another type of association object relationship, indicating that there may be two relationships. For example, A / and B can indicate two situations: A exists alone or A and B exist at the same time. In addition, the character " / " that may appear in this document generally indicates that the previous and next associated objects are in an "or" relationship.

[0051] Example

[0052] like Figure 1 As shown, the computer loss prevention method provided by the first aspect of this embodiment and protected by firmware may include, but is not limited to, the following steps S1 to S3.

[0053] S1. The computer firmware guard module checks the existence, integrity and reliability of the operating system security protection module stored in the specified location of the computer storage medium.

[0054] In the step S1, the computer firmware guard module is a software program developed on the basis of computer standard firmware and having data checking function and data recovery function, which is compatible with the original computer standard firmware and can be integrated with the computer standard firmware without rewriting the computer standard firmware. The operating system security protection module is a core software program that queries and executes the risk control strategy for computer loss prevention. Specifically, the computer firmware guard module checks the existence of the operating system security protection module stored in the specified location of the computer storage medium, including but not limited to the following steps S11 to S14.

[0055] S11. The computer firmware guard module performs an existence check on the computer storage medium used to store the operating system security protection module.

[0056] S12. When the computer firmware guard module finds that the computer storage medium exists, it continues to determine whether the data format of the computer storage medium conforms to the expected format.

[0057] In step S12, the purpose of the format judgment may be, but is not limited to, determining whether the computer storage medium for storing the operating system security protection module is replaced; in detail, the expected format may be, but is not limited to, NTFS (New Technology File System) format or extFat (Extended File Allocation Table File System) format, etc. In addition, when the computer firmware guard module finds that the computer storage medium does not exist, it will stop and end the check.

[0058] S13. When the computer firmware guard module determines that the data format conforms to the expected format, it reads the flag value stored at the first specified address of the system reserved partition of the computer storage medium, and determines whether the flag value is a predefined value.

[0059] In step S13, the purpose of the bit value judgment can also be, but is not limited to, determining whether the computer storage medium used to store the operating system security protection module has been replaced. In addition, when the computer firmware guard module finds that the computer storage medium does not exist or determines that the data format does not conform to the expected format, it will also stop and end the inspection.

[0060] S14. When the computer firmware guard module determines that the flag bit value is the predefined value, it determines that the operating system security protection module exists; otherwise, it determines that the operating system security protection module does not exist, and executes a data recovery process to restore the operating system security protection module.

[0061] In the step S14, in detail, a data recovery process is executed to restore the operating system security protection module, including but not limited to the following steps S141 to S145.

[0062] S141. Format the designated storage area on the computer storage medium for storing the operating system security protection module, reset the flag value at the first designated address of the system reserved partition of the computer storage medium, and clear the reserved hash value at the second designated address of the system reserved partition.

[0063] In the step S141, the designated storage area is also the designated location.

[0064] S142. Release the operating system security protection module to the designated storage area for storage.

[0065] S143. Perform hash calculation on the code of the operating system security protection module, and store the calculated hash value as a reserved hash value at the second designated address.

[0066] S144. Write the device configuration information into the operating system security protection module.

[0067] In the step S144, the device configuration information includes but is not limited to the content required for message uploading and the security policy for preventing computer loss.

[0068] S145. Update the flag value at the first designated address to a predefined value.

[0069] In the step S1, specifically, the computer firmware guard module checks the integrity and reliability of the operating system security protection module stored in the specified location of the computer storage medium, including but not limited to the following steps S15 to S17.

[0070] S15. After checking and confirming that the operating system security protection module stored in the designated location of the computer storage medium exists, the computer firmware guard module performs a hash calculation on the code of the operating system security protection module to obtain a current hash value.

[0071] S16. The computer firmware guard module reads a reserved hash value stored at a second designated address of the system reserved partition of the computer storage medium, and determines whether the reserved hash value is consistent with the current hash value.

[0072] In step S16, the purpose of the above consistency judgment can be but is not limited to determining whether the operating system security protection module has been tampered with: if it is consistent, it has not been tampered with; if it is inconsistent, it has been tampered with.

[0073] S17. When the computer firmware guard module determines that the reserved hash value is consistent with the current hash value, it determines that the operating system security protection module is complete and reliable; otherwise, it determines that the operating system security protection module is incomplete and unreliable, and executes a data recovery process to restore the operating system security protection module.

[0074] In the step S17, the specific steps of the data recovery process are the aforementioned steps S141 to S145, which will not be described in detail here.

[0075] S2. When the computer firmware guard module passes the check, the operating system security protection module is started.

[0076] In step S2, the passing of the check means that the operating system security protection module stored in the designated location of the computer storage medium exists, is complete and reliable.

[0077] S3. After being started, the operating system security protection module requests the computer risk control management system to return a risk control strategy for preventing computer loss, and executes the returned risk control strategy.

[0078] In the step S3, the computer risk control management system is a risk control strategy decision center on the network side. Specifically, a request is made to the computer risk control management system to return a risk control strategy for computer loss prevention, including but not limited to the following steps S31 to S33.

[0079] S31. Check whether the local device configuration information exists.

[0080] S32. If it exists, start the network connection module to connect to the Internet.

[0081] In step S32, the specific networking action may include but is not limited to: first checking whether the Internet access conditions are met, if not, prompting the user to connect to the network, and if the user still does not perform the networking operation, it is considered that the networking has failed. In addition, after checking whether the local device configuration information exists, if not, requesting the computer firmware guard module to return the device configuration information.

[0082] S33. If the network connection is successful, the device ID (Identity document), the version number of the operating system security protection module, the risk control strategy execution time range and the policy code are reported to the computer risk control management system in the form of a message according to the device configuration information, so that the computer risk control management system first obtains the risk control strategy for computer loss prevention according to the device ID and the version number in the system, and then verifies the risk control strategy with the risk control strategy execution time range and the policy code, and finally returns the risk control strategy in the form of a message when the verification passes.

[0083] In step S33, the version number of the operating system security protection module and the device ID jointly identify the current characteristics of the computer, and because the version of the operating system security protection module stored in the firmware of the same device is burned into the hardware at the beginning of production, it may be inconsistent with the version before the medium is replaced when it is released and restored to the storage medium. Therefore, the computer risk control management system needs to restore the version of the operating system security protection module to the version before the medium is replaced through the version number, and then check the corresponding policy, so that the operating system security protection module can correctly execute the policy, otherwise the policy execution may fail due to version problems. The specific acquisition process and verification process of the above-mentioned risk control policy are both existing conventional methods; for example, the device ID and the version number can be used to search in the risk control management system until the corresponding risk control policy for computer loss prevention is retrieved, and then the execution time range of the risk control policy and the collective code of the policy content (i.e., the policy code, each risk control policy is configured with a code, such as FK001) are compared with the uploaded risk control policy execution time range and the policy code for consistency. If they are consistent, the verification passes, otherwise the verification fails. In addition, after starting the network connection module to connect to the Internet, if the networking fails, the security policy for preventing computer loss is obtained from the device configuration information and executed; and after verifying the risk control policy with the risk control policy execution time range and the policy code, if the verification fails, an update policy message is sent to update the risk control policy to the operating system security protection module. For example: if it is found that the version of the operating system security protection module is incorrect, the computer risk control management system will push the correct version to the storage medium. The specific update process is consistent with the process of restoring the operating system security protection module by the computer firmware guard module (ie, steps S141 to S145); if the risk control policies are inconsistent, the policy execution time range and policy code corresponding to the device ID are updated to the specified location of the storage medium.

[0084] In the step S3, specifically, executing the returned risk control strategy includes but is not limited to: executing the risk control operation of normal startup of the computer or device locking according to the returned risk control strategy.

[0085] Therefore, based on the computer loss prevention method described in the aforementioned steps S1 to S3, a new solution for computer security policy protection based on computer firmware is provided, that is, the computer firmware protection module first checks the existence, integrity and reliability of the operating system security protection module stored in the specified position of the computer storage medium, and starts the operating system security protection module when the check passes, and then after the operating system security protection module is started, it requests the computer risk control management system to return the risk control policy for computer loss prevention, and executes the returned risk control policy, so that the execution and protection of the risk control policy are no longer limited to the operating system level, but are sunk to the computer firmware, and because the computer firmware is the first software to be run when the computer is turned on, it has the characteristics of being determined to be executed, not being tampered with, and not being deleted. Therefore, it can ensure that in the extreme case that the computer hard disk is replaced or the operating system is formatted, the risk control policy can still be executed, and the computer can be locked or the data can be erased after the computer is lost, thereby expanding the application scenarios and versatility;

[0086] (2) The computer firmware guard module can be compatible with the existing computer BIOS firmware and does not require additional hardware equipment, which is convenient for practical application and promotion.

[0087] Finally, it should be noted that the above description is only a preferred embodiment of the present invention and is not intended to limit the protection scope of the present invention. Any modification, equivalent replacement, improvement, etc. made within the spirit and principle of the present invention shall be included in the protection scope of the present invention.

Claims

1. A computer anti-loss method protected by firmware, characterized in that: include: The computer firmware guard module checks the existence, integrity and reliability of the operating system security protection module stored at a specified location of the computer storage medium; When the computer firmware guard module passes the check, the operating system security protection module is started; After being started, the operating system security protection module requests the computer risk control management system to return the risk control strategy for preventing computer loss, and executes the returned risk control strategy.

2. The computer anti-loss method according to claim 1, characterized in that: The computer firmware guard module checks the existence of the operating system security protection module stored at a specified location of the computer storage medium, including: The computer firmware guard module performs an existence check on the computer storage medium used to store the operating system security protection module; When the computer firmware guard module detects the existence of the computer storage medium, it continues to determine whether the data format of the computer storage medium conforms to the expected format; When the computer firmware guard module determines that the data format conforms to the expected format, the computer firmware guard module reads a flag value stored at a first designated address of a system reserved partition of the computer storage medium, and determines whether the flag value is a predefined value; When the computer firmware guard module determines that the flag value is the predefined value, it determines that the operating system security protection module exists; otherwise, it determines that the operating system security protection module does not exist, and executes a data recovery process to restore the operating system security protection module.

3. The computer loss prevention method according to claim 2, characterized in that: The computer firmware guard module checks the existence of the operating system security protection module stored at a specified location of the computer storage medium, and also includes: When the computer firmware guard module finds that the computer storage medium does not exist or determines that the data format does not conform to the expected format, the check is stopped and ended.

4. The computer loss prevention method according to claim 1, characterized in that: The computer firmware guard module checks the integrity and reliability of the operating system security protection module stored in the specified location of the computer storage medium, including: After checking and determining that the operating system security protection module stored at a designated location of the computer storage medium exists, the computer firmware guard module performs a hash calculation on the code of the operating system security protection module to obtain a current hash value; The computer firmware guard module reads a reserved hash value stored at a second designated address of a system reserved partition of the computer storage medium, and determines whether the reserved hash value is consistent with the current hash value; When the computer firmware guard module determines that the reserved hash value is consistent with the current hash value, it determines that the operating system security protection module is complete and reliable; otherwise, it determines that the operating system security protection module is incomplete and unreliable, and executes a data recovery process to restore the operating system security protection module.

5. The computer anti-loss method according to claim 2 or 4, characterized in that: Executing a data recovery process to recover the operating system security protection module includes: Formatting a designated storage area on the computer storage medium for storing the operating system security protection module, resetting a flag value at a first designated address of a system reserved partition of the computer storage medium, and clearing a reserved hash value at a second designated address of the system reserved partition; Releasing the operating system security protection module to the designated storage area for storage; Performing hash calculation on the code of the operating system security protection module, and storing the calculated hash value as a reserved hash value at the second designated address; Writing device configuration information into the operating system security protection module; The flag value at the first designated address is updated to a predefined value.

6. The computer loss prevention method according to claim 1, characterized in that: Request the computer risk control management system to return the risk control strategy for computer loss prevention, including: Check whether the local device configuration information exists; If it exists, start the network connection module to connect to the Internet; If the networking is successful, the device ID, the version number of the operating system security protection module, the risk control strategy execution time range and the policy code are reported to the computer risk control management system in the form of a message according to the device configuration information, so that the computer risk control management system first obtains the risk control strategy for computer loss prevention according to the device ID and the version number in the system, and then verifies the risk control strategy with the risk control strategy execution time range and the policy code, and finally returns the risk control strategy in the form of a message when the verification passes.

7. The computer anti-loss method according to claim 6, characterized in that: Requesting the computer risk control management system to return the risk control strategy for computer loss prevention, including: After checking whether the local device configuration information exists, if not, requesting the computer firmware guard module to return the device configuration information.

8. The computer anti-loss method according to claim 6, characterized in that: Requesting the computer risk control management system to return the risk control strategy for computer loss prevention, including: After the network connection module is started to connect to the network, if the connection to the network fails, a security policy for preventing the computer from losing is obtained from the device configuration information and executed.

9. The computer anti-loss method according to claim 6, characterized in that: Requesting the computer risk control management system to return the risk control strategy for computer loss prevention, including: After verifying the risk control policy with the risk control policy execution time range and the policy code, if the verification fails, an update policy message is sent to update the risk control policy to the operating system security protection module.

10. The computer anti-loss method according to claim 1, characterized in that: Execute the returned risk control strategy, including: Based on the returned risk control policy, the risk control operation of normal computer startup or device locking is performed.

Images