Basic input and output system version processing method and device, equipment and medium

Abstract

The invention discloses a basic input and output system version processing method and device, equipment and a medium, and relates to the technical field of computers. The method comprises the following steps of: setting an on-off state of a trusted measurement calculation function as a closed state by default so as to determine that a current system version is a universal version; when the system start is in an SEC stage, detecting the on-off state of the trusted measurement calculation function, and when the system start is in a PEI stage, detecting the card slot position state corresponding to the trusted hardware module for enhancing the system security; and when a version switching event that the universal version needs to be switched into the confidential version is monitored, selecting a switching strategy for switching the system version according to the switch state and the card slot position state so as to start a trusted measurement calculation function according to the switching strategy, and switching the universal version into the confidential version. By means of the technical scheme, the operation safety of the trusted measurement calculation function can be guaranteed, and switching from the universal version to the confidential version can be achieved.

Description

Technical Field

[0001] The present invention relates to the field of computer technology, and in particular to a basic input and output system version processing method, device, equipment and medium. Background Art

[0002] Currently, there are two solutions for managing the general version and confidential version (with the trusted measurement calculation function turned on) of the BIOS (Basic Input Output System) of domestic server platforms: separate version processing and combined version processing.

[0003] If the general version and confidential version of BIOS are processed separately, although it meets the security baseline requirements, there is no background that can bypass the trusted measurement calculation function of the confidential version to protect the safe operation of the machine; however, the maintenance of the two versions is labor-intensive. For example, modifications such as bug (vulnerability) fixes and performance optimizations in the general version also need to be synchronized to the confidential version, which will add another version of R&D and testing work.

[0004] If the BIOS general version and confidential version are combined, the trusted metric calculation function switch is set in the general version development. Although maintaining one version saves R&D testing workload and manpower, it will bypass security verification by turning off the trusted metric calculation using this interface, resulting in the risk of the machine being hacked and cracked.

[0005] Therefore, how to provide a solution to the above technical problems is a problem that those skilled in the art need to solve at present. Summary of the invention

[0006] In view of this, the purpose of the present invention is to provide a basic input and output system version processing method, device, equipment and medium, which can not only ensure the security of the operation of the trusted metric calculation function, but also realize the switching from the general version to the confidential version. The specific scheme is as follows:

[0007] In a first aspect, the present application discloses a basic input and output system version processing method, which is applied to a basic input and output system, comprising:

[0008] Setting the switch state of the trust metric calculation function to an off state by default to determine that the current version of the basic input and output system is a universal version;

[0009] When the basic input and output system is in the security verification stage of startup, detecting the switch state of the trusted metric calculation function; when the basic input and output system is in the early initialization stage of the extensible firmware interface of startup, detecting the card slot state corresponding to the trusted hardware module used to enhance system security;

[0010] When a version switching event that requires switching the general version to the confidential version is detected, a switching strategy for switching the basic input and output system version is selected according to the switch state and the card slot state, so that the trusted metric calculation function is enabled according to the switching strategy to switch the general version to the confidential version.

[0011] Optionally, after the switch state of the trust metric calculation function is set to the off state by default to determine that the current version of the basic input and output system is a universal version, the method further includes:

[0012] The code of the basic input / output system is version compiled, and the compiled basic input / output system is version refreshed through a target refresh method; wherein the target refresh method performs version refresh in a configuration-preserving manner by using any one of a command line interpreter, an operating system, a setting interface of the basic input / output system, and a web page interface of a baseboard management controller.

[0013] Optionally, when the basic input / output system is in a startup security verification phase, detecting the switch state of the trust metric calculation function includes:

[0014] When the basic input and output system is in the security verification stage of startup, if the trust metric calculation function is turned on, the switch state is an open state, and the corresponding switch state flag is recorded as a first flag state;

[0015] If the trust metric calculation function is turned off, the switch state is a closed state, and the switch state flag is recorded as a second flag state.

[0016] Optionally, when the basic input / output system is in the early initialization phase of the extensible firmware interface of startup, detecting the card slot status corresponding to the trusted hardware module for enhancing system security includes:

[0017] When the basic input and output system is in the early initialization stage of the extensible firmware interface of startup, the card slot status of the trusted platform module or the trusted cryptographic module is detected.

[0018] Optionally, when the basic input / output system is in the early initialization stage of the extensible firmware interface of startup, detecting the card slot status corresponding to the trusted hardware module for enhancing system security includes:

[0019] When the basic input and output system is in the early initialization stage of the extensible firmware interface of startup, if a device is in place in the card slot corresponding to the trusted hardware module for enhancing system security, the card slot state is in place, and the corresponding card slot state flag is recorded as a third flag state;

[0020] If no device is in place at the card slot corresponding to the trusted hardware module, the card slot status is an absent status, and the card slot status flag is recorded as a fourth flag status.

[0021] Optionally, when a version switching event that requires switching the general version to the confidential version is detected, selecting a switching strategy for switching the basic input and output system version according to the switch state and the card slot state, so as to enable the trust metric calculation function according to the switching strategy to switch the general version to the confidential version, including:

[0022] When a version switching event that requires switching the general version to the confidential version is detected, if the card slot state corresponds to the third flag state, and the switch state corresponds to the second flag state, restarting the basic input and output system, adjusting the switch state of the trust metric calculation function to an on state, and then entering a power-on self-test phase of the basic input and output system;

[0023] In the power-on self-test phase, if the card slot state corresponds to the third flag state, and the switch state corresponds to the first flag state, it is determined that the trust metric calculation function is turned on, then the current version of the basic input and output system is determined to be the confidential version, and the operating system is continuously booted based on the confidential version;

[0024] If the card slot state corresponds to the fourth flag state, and the switch state corresponds to the first flag state, it is determined that the trusted metric calculation function is turned on, and the card slot of the trusted hardware module corresponds to the not-in-place state, then an alarm message is generated on the power-on self-test interface, and reported to the baseboard management controller through an intelligent platform management interface instruction to prompt adjustment of the card slot state;

[0025] When the card slot status is adjusted from the fourth flag status to the third flag status, the step of determining that the current version of the basic input and output system is the confidential version and continuing to boot into the operating system based on the confidential version is triggered.

[0026] Optionally, the basic input and output system version processing method further includes:

[0027] In the power-on self-test stage, if the card slot state corresponds to the fourth flag state, and the switch state corresponds to the second flag state, it is determined that the trusted metric calculation function is turned off, then the current version of the basic input and output system is determined to be the universal version, and the operating system is continued to be booted based on the universal version.

[0028] Optionally, the selecting a switching strategy for switching the basic input / output system version so as to enable the trust metric calculation function according to the switching strategy to switch the general version to the confidential version further includes:

[0029] Check the PCI device list under the operating system through a preset check script, and obtain the machine configuration list currently corresponding to the basic input and output system;

[0030] Comparing the PCI device list with the machine configuration list, so as to determine whether the card slot status of the trusted hardware module in the PCI device list is consistent with the trusted hardware module in the machine configuration list;

[0031] If not, an error message and suggestion information corresponding to the error message are generated.

[0032] Optionally, if not, generating an error message and suggestion information corresponding to the error message, including:

[0033] If the card slot status of the trusted hardware module in the PCI device list is in the in-position state, and the trusted hardware module is not in the machine configuration list, then the startup process is terminated and a suggestion message is generated to power off or unplug the trusted hardware module, and then the basic input and output system is refreshed to restore the confidential version to the general version;

[0034] If the card slot status of the trusted hardware module in the PCI device list is not in place, and the trusted hardware module exists in the machine configuration list, the startup process is terminated and a suggestion message for powering off or inserting the trusted hardware module is generated. After the trusted hardware module is inserted, the startup process is continued.

[0035] In a second aspect, the present application discloses a basic input and output system version processing device, which is applied to a basic input and output system, comprising:

[0036] A default setting module, used to set the switch state of the trust metric calculation function to an off state by default, so as to determine that the current version of the basic input and output system is a universal version;

[0037] a state detection module, used to detect the switch state of the trusted metric calculation function when the basic input and output system is in the security verification stage of startup, and to detect the card slot state corresponding to the trusted hardware module used to enhance system security when the basic input and output system is in the early initialization stage of the extensible firmware interface of startup;

[0038] A version switching module is used to select a switching strategy for switching the basic input and output system version according to the switch state and the card slot state when a version switching event that requires switching the general version to the confidential version is detected, so as to enable the trusted metric calculation function according to the switching strategy to switch the general version to the confidential version.

[0039] In a third aspect, the present application discloses an electronic device, comprising a processor and a memory; wherein the memory is used to store a computer program, and the computer program is loaded and executed by the processor to implement the basic input and output system version processing method as described above.

[0040] In a fourth aspect, the present application discloses a computer-readable storage medium for storing a computer program; wherein the computer program, when executed by a processor, implements the basic input and output system version processing method as described above.

[0041] The present application provides a basic input / output system version processing method, which is applied to a basic input / output system, comprising: setting the switch state of a trusted metric calculation function to an off state by default, so as to determine that the current version of the basic input / output system is a general version; when the basic input / output system is in a security verification phase of startup, detecting the switch state of the trusted metric calculation function; when the basic input / output system is in an early initialization phase of an extensible firmware interface of startup, detecting a card slot state corresponding to a trusted hardware module for enhancing system security; when a version switching event requiring the general version to be switched to a confidential version is detected, selecting a switching strategy for switching the basic input / output system version according to the switch state and the card slot state, so as to enable the trusted metric calculation function according to the switching strategy to switch the general version to the confidential version.

[0042] The beneficial technical effect of the present application is: after the device is turned on, at different stages of the basic input-output system startup, it is determined whether to turn on the trusted metric calculation function based on the detected switch state of the trusted metric calculation function and the judgment of the card slot state corresponding to the trusted hardware module used to enhance the security of the system, thereby converting the general version of the basic input-output system into a confidential version. It can be seen that by using software logic and hardware in-place processing, the trusted metric calculation function is turned on unidirectionally by detecting the in-place state, which can not only ensure the security of the operation of the trusted metric calculation function, but also realize the switching from the general version to the confidential version. In this way, the defects of the previous solution are avoided, which not only meets the security baseline, but also reduces the number of version maintenance and testing workload, and has great economic value.

[0043] In addition, the present application provides a basic input and output system version processing device, equipment and storage medium, which correspond to the above basic input and output system version processing method and have the same effect as above. BRIEF DESCRIPTION OF THE DRAWINGS

[0044] In order to more clearly illustrate the embodiments of the present invention or the technical solutions in the prior art, the drawings required for use in the embodiments or the description of the prior art will be briefly introduced below. Obviously, the drawings described below are only embodiments of the present invention. For ordinary technicians in this field, other drawings can be obtained based on the provided drawings without paying creative work.

[0045] Figure 1 A flowchart of a basic input and output system version processing method disclosed in this application;

[0046] Figure 2 A flowchart of a specific basic input and output system version processing method disclosed in this application;

[0047] Figure 3 A schematic diagram of the structure of a basic input and output system version processing device disclosed in this application;

[0048] Figure 4 This is a structural diagram of an electronic device disclosed in this application. DETAILED DESCRIPTION

[0049] The following will be combined with the drawings in the embodiments of the present invention to clearly and completely describe the technical solutions in the embodiments of the present invention. Obviously, the described embodiments are only part of the embodiments of the present invention, not all of the embodiments. Based on the embodiments of the present invention, all other embodiments obtained by ordinary technicians in this field without creative work are within the scope of protection of the present invention.

[0050] Currently, for the separate versioning solution of BIOS general version and confidential version, the maintenance of two versions is labor-intensive, and there will be an additional version of R&D and testing work. For the combined versioning solution of BIOS general version and confidential version, there is a risk of bypassing security verification after closing the trusted metric calculation using this interface, resulting in the risk of the machine being hacked and cracked.

[0051] To this end, the present application provides a basic input and output system version processing solution, which can not only ensure the security of the operation of the trusted metric calculation function, but also realize the switching from the general version to the confidential version.

[0052] The embodiment of the present invention discloses a basic input and output system version processing method, which is applied to a basic input and output system, see Figure 1 As shown, the method includes:

[0053] Step S11: setting the switch state of the trust metric calculation function to the off state by default, so as to determine that the current version of the basic input and output system is a universal version.

[0054] First, compile and refresh the BIOS version. When compiling the BIOS version, it is processed as a general version, and the trusted metric calculation function is turned off by default. That is, the switch state of the trusted metric calculation function is set to the off state by default. Then compile the BIOS code version, and refresh the compiled BIOS version through various refresh methods and then install it in the machine.

[0055] Specifically, when performing a version refresh, the compiled basic input / output system is refreshed by a target refresh method; wherein the target refresh method performs a version refresh in a configuration-retaining manner by using any one of a command line interpreter (shell), an operating system (OS), a setup interface (setup) of the basic input / output system, and a web page interface (BMC web) of a baseboard management controller.

[0056] Step S12: When the basic input / output system is in the security verification stage of startup, the switch state of the trusted metric calculation function is detected; when the basic input / output system is in the early initialization stage of the extensible firmware interface of startup, the card slot state corresponding to the trusted hardware module used to enhance system security is detected.

[0057] After the device is powered on, the BIOS runs to the SEC (Security Phase) and PEI (Pre-EFIInitialization) phases, and performs different startup processes based on the switch status of the trusted metric calculation function and the card slot status corresponding to the trusted hardware module used to enhance system security.

[0058] It should be pointed out that the detection of the card slot status of the trusted hardware module used to enhance system security includes the detection of the card slot status of the Trusted Platform Module (TPM) or the Trusted Cryptography Module (TCM). The physical identification of whether the TPM or TCM card is in place is used to determine whether to open the trusted measurement calculation function, thereby converting the general version of the BIOS into a confidential version.

[0059] In the embodiment of the present application, when the machine is turned on and starts running to the SEC stage, the current switch state of the trust metric calculation function is detected and recorded in its flag. Specifically, when the basic input and output system is in the security verification stage of startup, if the trust metric calculation function is turned on, the switch state is the open state, and the corresponding switch state flag is recorded as the first flag state; if the trust metric calculation function is turned off, the switch state is the closed state, and the switch state flag is recorded as the second flag state.

[0060] It is understandable that the switch status flag is a flag used to characterize whether the trusted metric calculation function is turned on. In the embodiment of the present application, Flag_Switch is set as the switch status flag. Exemplarily, the current switch status of the trusted metric calculation function is detected, and if the function is turned off, it is set to 0; if the function is turned on, it is set to 1. After the recording is completed, the machine continues to start.

[0061] Further, the startup continues to run to the PEI stage, scans and detects the card slot status of the TPM or TCM, and records its flag. Specifically, when the basic input and output system is in the early initialization stage of the extensible firmware interface of startup, if the card slot corresponding to the trusted hardware module for enhancing system security has a device in place, the card slot status is in place, and the corresponding card slot status flag is recorded as the third flag state; if the card slot corresponding to the trusted hardware module has no device in place, the card slot status is not in place, and the card slot status flag is recorded as the fourth flag state.

[0062] It is understandable that the card slot status flag is a flag used to determine whether there is a device in the PCIE (Peripheral Component Interconnect Express, a high-speed serial computer expansion bus standard) position. In the embodiment of the present application, Flag_Exist is set as the card slot status flag. Exemplarily, it is detected whether there is a device in the PCI position of the TPM or TCM card slot, and it is recorded in Flag_Exist. If the card is in place, it is set to 1; if the card is not in place, it is set to 0.

[0063] Step S13: When a version switching event that requires switching the general version to the confidential version is detected, a switching strategy for switching the basic input and output system version is selected according to the switch state and the card slot state, so as to enable the trusted metric calculation function according to the switching strategy to switch the general version to the confidential version.

[0064] In the embodiment of the present application, if it is necessary to implement the switch from the general version to the confidential version, the switch state can be used to determine which version is currently intended to be applied; the card slot state can be used to determine whether to turn on the trusted metric calculation function, thereby converting the general version to the confidential version. That is, the trusted metric calculation function can only be turned on on the general version through this solution, and cannot be turned off. It can be understood that different switch states and card slot states correspond to the startup process in different situations, and therefore, different startup processes correspond to different version switching strategies. In this way, according to the switch state of the trusted metric calculation function, the trusted metric calculation function is turned on unidirectionally through the card slot state of the TPM / TCM, so as to ensure the security of the operation of the trusted metric calculation function, reduce the number of version maintenance and testing workload, and realize the switch from the general version to the confidential version.

[0065] In addition, based on the design of this solution, when encountering other hardware defect problems, secondary logic processing can be performed by using the hardware in-place signal to optimize the solution to the problem of the function that can only be turned on but not turned off due to safety issues, thereby solving the problem with less time and economic cost.

[0066] The present application provides a basic input / output system version processing method, which is applied to a basic input / output system, comprising: setting the switch state of a trusted metric calculation function to an off state by default, so as to determine that the current version of the basic input / output system is a general version; when the basic input / output system is in a security verification phase of startup, detecting the switch state of the trusted metric calculation function; when the basic input / output system is in an early initialization phase of an extensible firmware interface of startup, detecting a card slot state corresponding to a trusted hardware module for enhancing system security; when a version switching event requiring the general version to be switched to a confidential version is detected, selecting a switching strategy for switching the basic input / output system version according to the switch state and the card slot state, so as to enable the trusted metric calculation function according to the switching strategy to switch the general version to the confidential version.

[0067] The beneficial technical effect of the present application is: after the device is turned on, at different stages of the basic input-output system startup, it is determined whether to turn on the trusted metric calculation function based on the detected switch state of the trusted metric calculation function and the judgment of the card slot state corresponding to the trusted hardware module used to enhance the security of the system, thereby converting the general version of the basic input-output system into a confidential version. It can be seen that by using software logic and hardware in-place processing, the trusted metric calculation function is turned on unidirectionally by detecting the in-place state, which can not only ensure the security of the operation of the trusted metric calculation function, but also realize the switching from the general version to the confidential version. In this way, the defects of the previous solution are avoided, which not only meets the security baseline, but also reduces the number of version maintenance and testing workload, and has great economic value.

[0068] Based on the above embodiment, in a feasible implementation, in order to further ensure the security of the operation of the trusted metric calculation function, in the embodiment of the present application, the alarm information is reported based on the comparison between the card slot status and the configuration list of the trusted hardware module. Specifically, the following steps may be included:

[0069] Check the PCI device list under the operating system through a preset check script, and obtain the machine configuration list currently corresponding to the basic input and output system;

[0070] Comparing the PCI device list with the machine configuration list, so as to determine whether the card slot status of the trusted hardware module in the PCI device list is consistent with the trusted hardware module in the machine configuration list;

[0071] If not, an error message and suggestion information corresponding to the error message are generated.

[0072] In the embodiment of the present application, after the device is turned on, when the BIOS runs through the PEI stage to the post (PowerOn Self Test) interface and enters the process after the OS, the card slot status of the trusted hardware module is compared with the configuration list to report the alarm information.

[0073] When the BIOS boots into the OS based on the current version, the script first checks the PCI device list under the OS and compares it with the configuration list of the current machine, paying attention to the presence of the TPM or TCM card. If the two are consistent, that is, both are present or neither is present, the process is completed and no longer concerned, and other inspection processes continue; if the two are inconsistent, the alarm is handled as required, for example, if the configuration list has a TPM card, but it is not actually present, an alarm prompts you to insert the card.

[0074] If the information comparison between the two is inconsistent, there are two possibilities:

[0075] In a specific implementation, if the card slot status of the trusted hardware module in the PCI device list is in the in-position state, and the trusted hardware module is not in the machine configuration list, the startup process is terminated and a suggestion message is generated to power off or unplug the trusted hardware module, and then the basic input and output system is refreshed to restore the confidential version to the general version. It is understandable that if the trusted hardware module is not found in the configuration list, but the machine detects it, an error message is reported and subsequent processes are stopped. It is recommended to power off and unplug the TPM or TCM card, and refresh the BIOS version to restore the trusted metric calculation function to the default shutdown and then restart the machine.

[0076] In another specific implementation, if the card slot status of the trusted hardware module in the PCI device list is not in place, and the trusted hardware module exists in the machine configuration list, the startup process is terminated and a suggestion message is generated to power off or insert the trusted hardware module. After the trusted hardware module is inserted, the startup process is continued. It is understandable that the trusted hardware module can be queried in the configuration list, but if the machine does not detect it, an error message is reported and a suggestion is given to power off and insert the TPM or TCM card; after the TPM or TCM card is inserted, the startup continues and the aforementioned step S11 / step S12 process is executed.

[0077] Based on the above embodiment, this embodiment will specifically explain S13 in the above embodiment. Among them, when a version switching event that requires switching the general version to the confidential version is detected, a switching strategy for switching the basic input and output system version is selected according to the switch state and the card slot state, so that the trust metric calculation function is enabled according to the switching strategy to switch the general version to the confidential version. The process may include the following steps:

[0078] Step 1: When a version switching event that requires switching the general version to the confidential version is detected, if the card slot state corresponds to the third flag state, and the switch state corresponds to the second flag state, restart the basic input and output system, adjust the switch state of the trust metric calculation function to the on state, and then enter the power-on self-test phase of the basic input and output system.

[0079] In the embodiment of the present application, the device starts and runs to the PEI stage, and detects the card slot status of the TPM or TCM. If it is detected that the card is in place, that is, Flag_Exist=1, and Flag_Switch is 0, it means that the TPM or TCM is in place at this time, and only the trusted metric calculation function needs to be turned on to complete the startup process based on the confidential version. Therefore, at this time, restart the machine, turn on the trusted metric calculation function, and continue the subsequent startup process.

[0080] Step 2: During the power-on self-test phase, if the card slot status corresponds to the third flag status, and the switch status corresponds to the first flag status, it is determined that the trusted metric calculation function is turned on, then the current version of the basic input and output system is determined to be the confidential version, and the operating system is continued to be booted based on the confidential version.

[0081] In the embodiment of the present application, the machine continues to the BIOS POST stage and compares the Flag_Switch state with the Flag_Exist state. If Flag_Switch is equal to 1 and Flag_Exist is equal to 1, the machine continues to boot into the OS.

[0082] Step three: If the card slot status corresponds to the fourth flag status, and the switch status corresponds to the first flag status, it is determined that the trusted metric calculation function is turned on, and the card slot status of the trusted hardware module corresponds to the not-in-place status, then an alarm message is generated on the power-on self-test interface, and reported to the baseboard management controller through the intelligent platform management interface instruction to prompt the adjustment of the card slot status.

[0083] If Flag_Switch is equal to 1 and Flag_Exist is equal to 0, it means that the trusted metric calculation function has been turned on, but there is no TPM or TCM card in place. In this case, an alarm is issued on the BIOS POST interface, and a TPM or TCM card needs to be inserted to use the trusted metric calculation function. At the same time, the BIOS needs to report to the BMC (Baseboard Manager Controller) through the IPMI (Intelligent Platform Management Interface) command that the current trusted metric calculation function has been turned on, but there is no TPM or TCM card inserted, please insert the card as soon as possible. The BMC side displays a prompt alarm message that a TPM or TCM card needs to be inserted to use the trusted metric calculation function.

[0084] Step 4: When the card slot status is adjusted from the fourth flag status to the third flag status, the step of determining that the current version of the basic input and output system is the confidential version and continuing to boot into the operating system based on the confidential version is triggered.

[0085] It is understandable that after inserting the TPM or TCM card, Flag_Exist will change from 0 to 1. At this time, corresponding to the situation where Flag_Switch is equal to 1 and Flag_Exist is equal to 1, the machine continues to boot into the OS.

[0086] Step 5: During the power-on self-test phase, if the card slot status corresponds to the fourth flag status, and the switch status corresponds to the second flag status, it is determined that the trusted metric calculation function is turned off, then the current version of the basic input and output system is determined to be the universal version, and the operating system is continued to be booted based on the universal version.

[0087] It is understandable that if Flag_Switch is equal to 0 and Flag_Exist is equal to 0, the trusted metric calculation function is turned off at this time, so the current version is still the general version, and the confidential version is not switched, and the machine continues to boot into the OS.

[0088] like Figure 2 As shown, it is a schematic diagram of the implementation process of one-way opening of the trusted metric calculation function provided as an example in combination with the content disclosed in the aforementioned embodiments. When the machine starts and runs to the SEC stage, the current switch state of the trusted metric calculation function is detected, and the state Flag_Switch is recorded; it continues to start and run to the PEI stage, and scans and detects whether there is a device Flag_Exist in the PCIE position of the TPM or TCM card slot; if Flag_Switch is on, and Flag_Exist is in place, it continues to start; if Flag_Switch is off, and Flag_Exist is in place, it turns on the trusted metric calculation function after restarting and continues to start; if Flag_Switch is on, and Flag_Exist is not in place, it is prompted to use the trusted metric calculation function after the post stage, and the TPM or TCM card needs to be inserted, and the alarm information is transmitted to the BMC. The BMC end displays a prompt alarm message that the TPM or TCM card needs to be inserted to use the trusted metric calculation function. Furthermore, the machine continues to boot into the OS. The OS detects whether the TPM or TCM card is in place and compares it with the machine configuration list. If they are consistent, the process is completed; if they are inconsistent, the alarm is processed as required. For example, if the configuration list contains a TPM card but it is not actually there, an alarm prompts you to insert the card.

[0089] Correspondingly, the embodiment of the present application also discloses a basic input and output system version processing device, which is applied to the basic input and output system, see Figure 3 As shown, the device comprises:

[0090] A default setting module 11, used to set the switch state of the trust metric calculation function to a closed state by default, so as to determine that the current version of the basic input and output system is a universal version;

[0091] A state detection module 12 is used to detect the switch state of the trusted metric calculation function when the basic input and output system is in the security verification stage of startup, and to detect the card slot state corresponding to the trusted hardware module for enhancing system security when the basic input and output system is in the early initialization stage of the extensible firmware interface of startup;

[0092] The version switching module 13 is used to select a switching strategy for switching the basic input and output system version according to the switch state and the card slot state when a version switching event that requires switching the general version to the confidential version is detected, so as to enable the trusted metric calculation function according to the switching strategy to switch the general version to the confidential version.

[0093] Among them, for more specific working processes of the above-mentioned modules, please refer to the corresponding contents disclosed in the aforementioned embodiments, which will not be repeated here.

[0094] It can be seen that the above scheme of this embodiment is applied to a basic input and output system, including: setting the switch state of the trusted metric calculation function to an off state by default to determine that the current version of the basic input and output system is a general version; when the basic input and output system is in the security verification stage of startup, detecting the switch state of the trusted metric calculation function; when the basic input and output system is in the early initialization stage of the extensible firmware interface of startup, detecting the card slot state corresponding to the trusted hardware module used to enhance system security; when a version switching event that requires switching the general version to a confidential version is detected, selecting a switching strategy for switching the basic input and output system version according to the switch state and the card slot state, so as to enable the trusted metric calculation function according to the switching strategy to switch the general version to the confidential version.

[0095] The beneficial technical effect of the present application is: after the device is turned on, at different stages of the basic input-output system startup, it is determined whether to turn on the trusted metric calculation function based on the detected switch state of the trusted metric calculation function and the judgment of the card slot state corresponding to the trusted hardware module used to enhance the security of the system, thereby converting the general version of the basic input-output system into a confidential version. It can be seen that by using software logic and hardware in-place processing, the trusted metric calculation function is turned on unidirectionally by detecting the in-place state, which can not only ensure the security of the operation of the trusted metric calculation function, but also realize the switching from the general version to the confidential version. In this way, the defects of the previous solution are avoided, which not only meets the security baseline, but also reduces the number of version maintenance and testing workload, and has great economic value.

[0096] In a specific implementation, the default setting module 11 further includes:

[0097] A version compilation and refresh module is used to compile the code of the basic input and output system and refresh the compiled basic input and output system through a target refresh method; wherein the target refresh method uses any one of a command line interpreter, an operating system, a setting interface of the basic input and output system, and a web page interface of a baseboard management controller to perform version refresh in a configuration-preserving manner.

[0098] In a specific implementation, the state detection module 12 includes:

[0099] A first flag state recording module, used for, when the basic input and output system is in the security verification stage of startup, if the trust metric calculation function is turned on, the switch state is turned on, and the corresponding switch state flag is recorded as the first flag state;

[0100] The second flag state recording module is used to, if the trust metric calculation function is turned off, set the switch state to the off state, and record the switch state flag as the second flag state.

[0101] A third flag state recording module is used for, when the basic input and output system is in the early initialization stage of the extensible firmware interface of startup, if a device is in place at the card slot corresponding to the trusted hardware module for enhancing system security, the card slot state is in place, and the corresponding card slot state flag is recorded as a third flag state;

[0102] The fourth flag status recording module is used to record the card slot status as an absent status if no device is in the card slot corresponding to the trusted hardware module, and record the card slot status flag as a fourth flag status.

[0103] In a specific implementation, the state detection module 12 is specifically used to:

[0104] When the basic input and output system is in the early initialization stage of the extensible firmware interface of startup, the card slot status of the trusted platform module or the trusted cryptographic module is detected.

[0105] In a specific implementation, the version switching module 13 is specifically used to:

[0106] When a version switching event that requires switching the general version to the confidential version is detected, if the card slot state corresponds to the third flag state, and the switch state corresponds to the second flag state, restarting the basic input and output system, adjusting the switch state of the trust metric calculation function to an on state, and then entering a power-on self-test phase of the basic input and output system;

[0107] In the power-on self-test phase, if the card slot state corresponds to the third flag state, and the switch state corresponds to the first flag state, it is determined that the trust metric calculation function is turned on, then the current version of the basic input and output system is determined to be the confidential version, and the operating system is continuously booted based on the confidential version;

[0108] If the card slot state corresponds to the fourth flag state, and the switch state corresponds to the first flag state, it is determined that the trusted metric calculation function is turned on, and the card slot of the trusted hardware module corresponds to the not-in-place state, then an alarm message is generated on the power-on self-test interface, and reported to the baseboard management controller through an intelligent platform management interface instruction to prompt adjustment of the card slot state;

[0109] When the card slot status is adjusted from the fourth flag status to the third flag status, the step of determining that the current version of the basic input and output system is the confidential version and continuing to boot into the operating system based on the confidential version is triggered.

[0110] In a specific implementation, the basic input and output system version processing device further includes:

[0111] A universal version startup module is used to determine that the trusted metric calculation function is turned off during the power-on self-test phase if the card slot state corresponds to the fourth flag state and the switch state corresponds to the second flag state, then determine that the current version of the basic input and output system is the universal version, and continue to boot into the operating system based on the universal version.

[0112] In a specific implementation, the basic input and output system version processing device further includes a checking module, which is used to:

[0113] Check the PCI device list under the operating system through a preset check script, and obtain the machine configuration list currently corresponding to the basic input and output system;

[0114] Comparing the PCI device list with the machine configuration list, so as to determine whether the card slot status of the trusted hardware module in the PCI device list is consistent with the trusted hardware module in the machine configuration list;

[0115] If not, an error message and suggestion information corresponding to the error message are generated.

[0116] In a specific implementation, the inspection module includes:

[0117] A first processing unit is configured to terminate the startup process and generate a suggestion message of powering off or unplugging the trusted hardware module if the card slot status of the trusted hardware module in the PCI device list is in the in-position state and the trusted hardware module is not in the machine configuration list, and then refresh the basic input and output system to restore the confidential version to the general version;

[0118] The second processing unit is used to terminate the startup process and generate suggestion information for powering off or inserting the trusted hardware module if the card slot status of the trusted hardware module in the PCI device list is not in place and the trusted hardware module exists in the machine configuration list, and continue to execute the startup process after the trusted hardware module is inserted.

[0119] Furthermore, the present application also discloses an electronic device. Figure 4 This is a structural diagram of an electronic device 20 according to an exemplary embodiment, and the content in the diagram cannot be regarded as any limitation on the scope of use of the present application.

[0120] Figure 4 A schematic diagram of the structure of an electronic device 20 provided in an embodiment of the present application. The electronic device 20 may specifically include: at least one processor 21, at least one memory 22, a power supply 23, a communication interface 24, an input / output interface 25, and a communication bus 26. The memory 22 is used to store a computer program, which is loaded and executed by the processor 21 to implement the relevant steps in the basic input / output system version processing method disclosed in any of the aforementioned embodiments. In addition, the electronic device 20 in this embodiment may specifically be a computer.

[0121] In this embodiment, the power supply 23 is used to provide working voltage for each hardware device on the electronic device 20; the communication interface 24 can create a data transmission channel between the electronic device 20 and the external device, and the communication protocol it follows is any communication protocol that can be applied to the technical solution of the present application, and is not specifically limited here; the input and output interface 25 is used to obtain external input data or output data to the outside world, and its specific interface type can be selected according to specific application needs and is not specifically limited here.

[0122] In addition, the memory 22 as a carrier for resource storage may be a read-only memory, a random access memory, a disk or an optical disk, etc. The resources stored thereon may include an operating system 221, a computer program 222 and data 223, etc. The data 223 may include various data. The storage method may be temporary storage or permanent storage.

[0123] The operating system 221 is used to manage and control the hardware devices and computer programs 222 on the electronic device 20, and can be Windows Server, Netware, Unix, Linux, etc. In addition to including a computer program that can be used to complete the basic input and output system version processing method performed by the electronic device 20 disclosed in any of the aforementioned embodiments, the computer program 222 can further include a computer program that can be used to complete other specific tasks.

[0124] Further, the embodiment of the present application also discloses a computer-readable storage medium, wherein the computer-readable storage medium mentioned here includes a random access memory (Random Access Memory, RAM), a memory, a read-only memory (Read-Only Memory, ROM), an electrically programmable ROM, an electrically erasable programmable ROM, a register, a hard disk, a magnetic disk or an optical disk or any other form of storage medium known in the technical field. Wherein, when the computer program is executed by the processor, the aforementioned basic input and output system version processing method is implemented. For the specific steps of the method, reference can be made to the corresponding contents disclosed in the aforementioned embodiment, which will not be repeated here.

[0125] Furthermore, an embodiment of the present application also provides a computer program product, including a computer program / instruction, which implements any one of the above-mentioned basic input and output system version processing methods when executed by a processor.

[0126] In this specification, each embodiment is described in a progressive manner, and each embodiment focuses on the differences from other embodiments. The same or similar parts between the embodiments can be referred to each other. For the device disclosed in the embodiment, since it corresponds to the method disclosed in the embodiment, the description is relatively simple, and the relevant parts can be referred to the method part.

[0127] The steps of the basic input / output system version processing method or algorithm described in conjunction with the embodiments disclosed herein can be implemented directly using hardware, a software module executed by a processor, or a combination of the two. The software module can be placed in a random access memory (RAM), a memory, a read-only memory (ROM), an electrically programmable ROM, an electrically erasable programmable ROM, a register, a hard disk, a removable disk, a CD-ROM, or any other form of storage medium known in the technical field.

[0128] Finally, it should be noted that, in this article, relational terms such as first and second, etc. are only used to distinguish one entity or operation from another entity or operation, and do not necessarily require or imply any such actual relationship or order between these entities or operations. Moreover, the terms "include", "comprise" or any other variants thereof are intended to cover non-exclusive inclusion, so that a process, method, article or device including a series of elements includes not only those elements, but also other elements not explicitly listed, or also includes elements inherent to such process, method, article or device. In the absence of further restrictions, the elements defined by the sentence "comprise a ..." do not exclude the presence of other identical elements in the process, method, article or device including the elements.

[0129] The above is a detailed introduction to a basic input and output system version processing method, device, equipment and medium provided by the present invention. Specific examples are used in this article to illustrate the principles and implementation methods of the present invention. The description of the above embodiments is only used to help understand the method of the present invention and its core idea; at the same time, for general technical personnel in this field, according to the idea of ​​the present invention, there will be changes in the specific implementation method and application scope. In summary, the content of this specification should not be understood as a limitation on the present invention.

Claims

1. A basic input and output system version processing method, characterized in that: Applicable to basic input and output systems, including: Setting the switch state of the trust metric calculation function to an off state by default to determine that the current version of the basic input and output system is a universal version; When the basic input and output system is in the security verification stage of startup, detecting the switch state of the trusted metric calculation function; when the basic input and output system is in the early initialization stage of the extensible firmware interface of startup, detecting the card slot state corresponding to the trusted hardware module used to enhance system security; When a version switching event that requires switching the general version to the confidential version is detected, a switching strategy for switching the basic input and output system version is selected according to the switch state and the card slot state, so that the trusted metric calculation function is enabled according to the switching strategy to switch the general version to the confidential version.

2. The basic input and output system version processing method according to claim 1, characterized in that: After the switch state of the trust metric calculation function is set to the off state by default to determine that the current version of the basic input and output system is a universal version, the method further includes: The code of the basic input / output system is version compiled, and the compiled basic input / output system is version refreshed through a target refresh method; wherein the target refresh method performs version refresh in a configuration-retaining manner by using any one of a command line interpreter, an operating system, a setting interface of the basic input / output system, and a web page interface of a baseboard management controller.

3. The basic input and output system version processing method according to claim 1, characterized in that: When the basic input / output system is in the security verification stage of startup, detecting the switch state of the trust metric calculation function includes: When the basic input and output system is in the security verification stage of startup, if the trust metric calculation function is turned on, the switch state is an open state, and the corresponding switch state flag is recorded as a first flag state; If the trust metric calculation function is turned off, the switch state is a closed state, and the switch state flag is recorded as a second flag state.

4. The basic input and output system version processing method according to claim 1, characterized in that: When the basic input and output system is in the early initialization stage of the extensible firmware interface of the startup, detecting the card slot status corresponding to the trusted hardware module for enhancing the system security includes: When the basic input and output system is in the early initialization stage of the extensible firmware interface of startup, the card slot status of the trusted platform module or the trusted cryptographic module is detected.

5. The basic input and output system version processing method according to claim 3, characterized in that: When the basic input and output system is in the early initialization stage of the extensible firmware interface of startup, detecting the card slot status corresponding to the trusted hardware module for enhancing system security includes: When the basic input and output system is in the early initialization stage of the extensible firmware interface of startup, if a device is in place in the card slot corresponding to the trusted hardware module for enhancing system security, the card slot state is in place, and the corresponding card slot state flag is recorded as a third flag state; If no device is in place at the card slot corresponding to the trusted hardware module, the card slot status is an absent status, and the card slot status flag is recorded as a fourth flag status.

6. The basic input and output system version processing method according to claim 5, characterized in that: When a version switching event that requires switching the general version to the confidential version is detected, a switching strategy for switching the basic input and output system version is selected according to the switch state and the card slot state, so as to enable the trust metric calculation function according to the switching strategy to switch the general version to the confidential version, including: When a version switching event that requires switching the general version to the confidential version is detected, if the card slot state corresponds to the third flag state, and the switch state corresponds to the second flag state, restarting the basic input and output system, adjusting the switch state of the trust metric calculation function to an on state, and then entering a power-on self-test phase of the basic input and output system; In the power-on self-test phase, if the card slot state corresponds to the third flag state, and the switch state corresponds to the first flag state, it is determined that the trust metric calculation function is turned on, then the current version of the basic input and output system is determined to be the confidential version, and the operating system is continuously booted based on the confidential version; If the card slot state corresponds to the fourth flag state, and the switch state corresponds to the first flag state, it is determined that the trusted metric calculation function is turned on, and the card slot of the trusted hardware module corresponds to the not-in-place state, then an alarm message is generated on the power-on self-test interface, and reported to the baseboard management controller through an intelligent platform management interface instruction to prompt adjustment of the card slot state; When the card slot status is adjusted from the fourth flag status to the third flag status, the step of determining that the current version of the basic input and output system is the confidential version and continuing to boot into the operating system based on the confidential version is triggered.

7. The basic input and output system version processing method according to claim 6, characterized in that: Also includes: In the power-on self-test stage, if the card slot state corresponds to the fourth flag state, and the switch state corresponds to the second flag state, it is determined that the trusted metric calculation function is turned off, then the current version of the basic input and output system is determined to be the universal version, and the operating system is continued to be booted based on the universal version.

8. The basic input and output system version processing method according to any one of claims 1 to 7, characterized in that: After selecting a switching strategy for switching the basic input / output system version so as to enable the trust metric calculation function according to the switching strategy to switch the general version to the confidential version, the method further includes: Check the PCI device list under the operating system through a preset check script, and obtain the machine configuration list currently corresponding to the basic input and output system; Comparing the PCI device list with the machine configuration list, so as to determine whether the card slot status of the trusted hardware module in the PCI device list is consistent with the trusted hardware module in the machine configuration list; If not, an error message and suggestion information corresponding to the error message are generated.

9. The basic input and output system version processing method according to claim 8, characterized in that: If not, an error message and suggestion information corresponding to the error message are generated, including: If the card slot status of the trusted hardware module in the PCI device list is in the in-position state, and the trusted hardware module is not in the machine configuration list, then the startup process is terminated and a suggestion message is generated to power off or unplug the trusted hardware module, and then the basic input and output system is refreshed to restore the confidential version to the general version; If the card slot status of the trusted hardware module in the PCI device list is not in place, and the trusted hardware module exists in the machine configuration list, the startup process is terminated and a suggestion message for powering off or inserting the trusted hardware module is generated. After the trusted hardware module is inserted, the startup process is continued.

10. A basic input and output system version processing device, characterized in that: Applicable to basic input and output systems, including: A default setting module, used to set the switch state of the trust metric calculation function to an off state by default, so as to determine that the current version of the basic input and output system is a universal version; a state detection module, used to detect the switch state of the trusted metric calculation function when the basic input and output system is in the security verification stage of startup, and to detect the card slot state corresponding to the trusted hardware module used to enhance system security when the basic input and output system is in the early initialization stage of the extensible firmware interface of startup; A version switching module is used to select a switching strategy for switching the basic input and output system version according to the switch state and the card slot state when a version switching event that requires switching the general version to the confidential version is detected, so as to enable the trusted metric calculation function according to the switching strategy to switch the general version to the confidential version.

11. An electronic device, characterized in that: The electronic device comprises a processor and a memory; wherein the memory is used to store a computer program, and the computer program is loaded and executed by the processor to implement the basic input and output system version processing method as claimed in any one of claims 1 to 9.

12. A computer-readable storage medium, characterized in that: Used to store computer programs; wherein when the computer program is executed by the processor, the basic input and output system version processing method as described in any one of claims 1 to 9 is implemented.

Images