UEFI BIOS secure startup function verification test method

Abstract

The invention relates to the field of security testing, and discloses a UEFI BIOS security boot function verification testing method, which comprises the following three groups of key generation and verification steps: generating a first private key and a first public key certificate through a preset tool; generating a second private key and a second private key certificate request file, and generating a second public key certificate according to the first private key, the first public key certificate and the second private key certificate request file; generating a third private key and a third private key certificate request file, and generating a third public key certificate according to the second private key, the second public key certificate and the third private key certificate request file; converting the generated three public key certificates into three public key certificate files which can be imported into a BIOS (Basic Input / Output System); and after the three public key certificate files are imported into the BIOS, opening a safe starting option of the BIOS, and signing the target executable file by using the third private key and the third public key certificate to obtain a signed executable file. Therefore, the verification test on the UEFI BIOS security startup function by using the signed executable file is realized.

Description

Technical Field

[0001] The present invention relates to the field of security testing, and in particular to a UEFI BIOS secure boot function verification test method. Background Art

[0002] UEFI (Unified Extensible Firmware Interface) and BIOS (Basic Input Output System) are two firmware interfaces used to initialize hardware and load the operating system when the computer starts.

[0003] Currently, BIOS secure boot testing is mainly performed by applying for a signed OS that supports secure boot from the OS (Operating System) manufacturer, and then installing it on the test machine. When the secure boot of the test machine is turned on, only the OS signed by the OS manufacturer can enter the system normally. An OS that is not signed will be blocked from entering the system.

[0004] The following technical problems often occur in the existing UEFI BIOS secure boot function test:

[0005] First, it is necessary to install the operating system signed by the manufacturer on the server to be tested. Only the signed operating system can enter the system normally. The unsigned operating system will be blocked from entering the system. This method is relatively complex and time-consuming to test the UEFI BIOS secure boot function.

[0006] Second, the existing technology uses a fixed executable file to indiscriminately test the UEFI BIOS secure boot function of the test server, resulting in inaccurate test results; the required encryption algorithm cannot be used quickly and accurately during the key generation process, resulting in low test efficiency;

[0007] Third, since the key and certificate files have an expiration date and are not updated in a timely manner, the quality of the signed executable files is poor, which further leads to low test reliability. Summary of the invention

[0008] The summary of the invention is used to introduce concepts in a brief form, which will be described in detail in the detailed implementation section below. The summary of the invention is not intended to identify the key features or essential features of the technical solution claimed for protection, nor is it intended to limit the scope of the technical solution claimed for protection.

[0009] The present invention proposes a UEFI BIOS secure boot function verification test method to solve one or more of the technical problems mentioned in the above background technology part.

[0010] The present invention provides a UEFI BIOS secure boot function verification test method, comprising executing the following three sets of key generation and verification steps: generating a first private key and a first public key certificate by a preset tool, and converting the first public key certificate into a first public key certificate file that can be imported into BIOS;

[0011] Generate a second private key and a second private key certificate request file through a preset tool, generate a second public key certificate according to the first private key, the first public key certificate and the second private key certificate request file, and convert the second public key certificate into a second public key certificate file that can be imported into BIOS;

[0012] Generate a third private key and a third private key certificate request file through a preset tool, generate a third public key certificate according to the second private key, the second public key certificate and the third private key certificate request file, and convert the third public key certificate into a third public key certificate file that can be imported into the BIOS;

[0013] After importing the first public key certificate file, the second public key certificate file, and the third public key certificate file into the BIOS, turn on the secure boot option of the BIOS, use the third private key and the third public key certificate to sign the target executable file to obtain a signed executable file, and the signed executable file is used to verify the UEFI BIOS secure boot function.

[0014] Optionally, the signed executable is tested for UEFI BIOS Secure Boot functionality by following these steps:

[0015] If the signed executable file runs normally and the target executable file is blocked from running, a verification test result is generated indicating that the UEFI BIOS secure boot function is effective.

[0016] Optionally, before generating the first private key and the first public key certificate by using a preset tool, the method further includes:

[0017] Obtain server security requirement information and server attribute information of the server to be tested, where the server attribute information includes server model information;

[0018] The server security requirement information is parsed to obtain multiple server security items and the security level of each server security item. If the multiple server security items include a secure boot item and the security level of the secure boot item is higher than the preset security level, the security level of the secure boot item is determined as the secure boot item security level, and three sets of key generation and verification steps are performed; wherein the target executable file is generated by the following steps:

[0019] Extracting server manufacturer information and server model from server attribute information, and obtaining a pre-configured executable file library, wherein each executable file in the executable file library is configured with an applicable security verification level, applicable manufacturer information, applicable server model, and update time;

[0020] According to the server manufacturer information, the executable files whose applicable manufacturer information is consistent with the server manufacturer information are screened from the executable file library to obtain a screened executable file group; according to the security level of the secure boot item, the executable files whose applicable security verification level is greater than or equal to the security level of the secure boot item are selected from the screened executable file group to obtain a candidate executable file group; according to the server model, matching is performed in the candidate executable file group to determine whether there is an executable file whose applicable server model matches the server model, and if so, the matching executable file is determined as the target executable file; if not, the executable files in the candidate executable file group are sorted according to the update time to obtain a candidate executable file sequence, and the executable file with the smallest time difference between the update time and the current time in the candidate executable file sequence is determined as the target executable file.

[0021] Optionally, the first public key certificate file includes a first timestamp and a first expiration time, the second public key certificate file includes a second timestamp and a second expiration time, and the third public key certificate file includes a third timestamp and a third expiration time.

[0022] Optionally, before generating the first private key and the first public key certificate by using a preset tool, the method further includes:

[0023] receiving key configuration information input by a user, the key configuration information including a first encryption algorithm identifier, a second encryption algorithm identifier, and a third encryption algorithm identifier; and

[0024] Generate the first private key and the first public key certificate using the preset tool, including:

[0025] Generate a first private key and a first public key certificate using a preset tool and a first encryption algorithm corresponding to the first encryption algorithm identifier;

[0026] Generate the second private key and the second private key certificate request file using the preset tool, including:

[0027] Generate a second private key and a second private key certificate request file using a preset tool and a second encryption algorithm corresponding to the second encryption algorithm identifier;

[0028] Generate the third private key and the third private key certificate request file through the preset tool, including:

[0029] A third private key and a third private key certificate request file are generated by a third encryption algorithm corresponding to a preset tool and a third encryption algorithm identifier.

[0030] The present invention has the following beneficial effects:

[0031] 1. A convenient and fast verification test of the UEFI BIOS secure boot function is achieved. Specifically, three groups of keys are generated through a preset tool, and the public key certificates in each group of keys are formatted into corresponding public key certificate files that can be imported into the BIOS, namely the first public key certificate file, the second public key certificate file, and the third public key certificate file; after the first public key certificate file, the second public key certificate file, and the third public key certificate file are imported into the BIOS, the secure boot option of the BIOS is turned on, and the target executable file is signed with the third private key and the third public key certificate to obtain a signed executable file. The signed executable file is used to verify the UEFI BIOS secure boot function. It only needs to generate three groups of keys once and perform the verification steps. The signed executable file and the generated three groups of keys can verify the validity of the UEFI BIOS secure boot function multiple times, so there is no need to install the operating system back and forth, and the UEFI BIOS secure boot function can be verified and tested conveniently and quickly.

[0032] 2. Improved the efficiency of UEFI BIOS secure boot function testing and the accuracy of test results. Specifically, first, obtain the security requirement information and attribute information of the server to be tested; then, parse the server security requirement information to determine the server security items and their security levels, further determine the security level of the secure boot items, and perform three sets of key generation and verification steps. Among them, determining the target executable file requires: screening out the executable file group that matches the server manufacturer information; then further screening out the candidate executable file group whose security verification level meets the requirements from the executable file group; then matching according to the server model in the candidate executable file group, if a matching executable file is found, it is determined as the target executable file; if no match is found, the candidate executable files are sorted according to the update time, and the one with the smallest difference between the update time and the current time is selected as the target executable file. Targetedly screen out the target executable file that matches the server to be tested, and use the signed executable file to test the UEFI BIOS secure boot function, thereby improving the accuracy of the test results; quickly determine the encryption algorithm used through the encryption algorithm identifier in the key configuration information, thereby improving the efficiency of the test;

[0033] 3. Improved the reliability of the UEFI BIOS secure boot function test. Through the time difference between the current time and the expiration time, if the time difference is less than or equal to the preset time difference threshold, a key update prompt message is generated to obtain an updated signed executable file. According to the dependency relationship between the keys, the first public key certificate file, the second public key certificate file, and the third public key certificate file are sorted to obtain a public key certificate file sequence, and then according to the time difference reaching the critical time difference, the public key certificate file that needs to be updated is determined, and the updated public key certificate file (i.e., the updated public key certificate file) and the retained public key certificate file are used to sign the target executable file, and finally the upgraded signed executable file is obtained. Thereby optimizing the signed executable file and improving the reliability of the test. BRIEF DESCRIPTION OF THE DRAWINGS

[0034] The above and other features, advantages and aspects of the embodiments of the present invention will become more apparent with reference to the following detailed description in conjunction with the accompanying drawings. Throughout the accompanying drawings, the same or similar reference numerals represent the same or similar elements. It should be understood that the drawings are schematic and that components and elements are not necessarily drawn to scale.

[0035] Figure 1 The present invention is a flowchart of a UEFI BIOS secure boot function verification test method. DETAILED DESCRIPTION

[0036] The present invention will be described in more detail below with reference to the accompanying drawings. Although certain embodiments of the present invention are shown in the accompanying drawings, it should be understood that the present invention can be implemented in various forms and should not be construed as being limited to the embodiments set forth herein. On the contrary, these embodiments are provided to provide a more thorough and complete understanding of the present invention. It should be understood that the drawings and embodiments of the present invention are only for exemplary purposes and are not intended to limit the scope of protection of the present invention.

[0037] It should also be noted that, for ease of description, only the parts related to the invention are shown in the drawings. In the absence of conflict, the embodiments of the present invention and the features in the embodiments can be combined with each other.

[0038] It should be noted that the concepts such as "first" and "second" mentioned in the present invention are only used to distinguish different devices, modules or units, and are not used to limit the order or interdependence of the functions performed by these devices, modules or units.

[0039] It should be noted that the modifications of "one" and "plurality" mentioned in the present invention are illustrative rather than restrictive, and those skilled in the art should understand that, unless otherwise clearly indicated in the context, it should be understood as "one or more".

[0040] The names of the messages or information exchanged between multiple devices of the present invention are only for illustrative purposes, and are not used to limit the scope of these messages or information.

[0041] The present invention will be described in detail below with reference to the accompanying drawings and in conjunction with embodiments.

[0042] like Figure 1 As shown, a UEFI BIOS secure boot function verification test method of the present invention is shown, which specifically includes executing the following three sets of key generation and verification steps:

[0043] Step 101, generating a first private key and a first public key certificate by using a preset tool, and converting the first public key certificate into a first public key certificate file that can be imported into BIOS;

[0044] In some embodiments, the execution subject of a UEFI BIOS secure boot function verification test method of the present invention can be a client, and the client can be a laptop computer, a desktop computer, etc. The key is the corresponding substitution relationship between the password and the plain code, which is divided into symmetric keys and asymmetric keys, wherein the asymmetric key includes a public key and a private key. The public key and the private key are a key pair (i.e., a public key and a private key) obtained by an algorithm, one of which is disclosed to the outside world, called the public key; the other is retained by the client, called the private key.

[0045] On this basis, the execution subject generates the first private key and the first public key certificate through a preset tool, wherein the preset tools for generating the first private key and the first public key are various, for example, openSSL (Open Secure Sockets Layer, open secure socket layer protocol), online tools and services, programming languages ​​and libraries, etc. As an example, the preset tool used is openSSL. First, a command for generating the first private key and the first public key certificate is entered in openSSL, wherein this command creates a new certificate request file and a first private key, and x509 is entered to generate an x509 certificate signed by the execution subject. x509 is the format standard of the public key certificate in cryptography. The x509 certificate here is the first public key certificate, which contains the subject information of the certificate, the name of the generated certificate file, the validity period of the certificate, etc. This command also specifies the length of the key and the name of the generated private key file; the SHA256 algorithm is used, wherein the SHA256 algorithm is one of the five algorithms of the SHA (Secure Hash Algorithm, secure hash algorithm) family, and finally the first private key and the first public key certificate are obtained. The first private key is a private key for establishing a trust relationship between the hardware platform and the hardware platform owner. The first public key certificate is a certificate containing the first public key. Secondly, a command for converting the format of the first public key certificate is input in openSSL, wherein the command specifies that the input certificate file is the first public key certificate, the name of the output file is the first public key certificate file, and the output format is specified. The format of the first public key certificate is converted into a file format that can be recognized by BIOS to obtain the first public key certificate file.

[0046] Step 102, generating a second private key and a second private key certificate request file through a preset tool, generating a second public key certificate according to the first private key, the first public key certificate and the second private key certificate request file, and converting the second public key certificate into a second public key certificate file that can be imported into the BIOS;

[0047] In some embodiments, the execution subject first inputs a command for generating a second private key and a second private key certificate request file through the above-mentioned preset tool, wherein this command creates a certificate request file corresponding to the second private key and specifies the subject information of the certificate request file, the length of the private key, and also specifies the name of the generated private key file and the name of the certificate request file, and uses the SHA256 algorithm to obtain the second private key and the second private key certificate request file. The second private key is a private key for establishing a trust relationship between the hardware platform and the operating system, and the second private key certificate request file is a file corresponding to the second private key that requests a signature. The executing subject again inputs a command for generating a second public key certificate through the above-mentioned preset tool, and uses the first private key and the first public key certificate to sign the second private key certificate request file, wherein the command specifies that the input file is the second private key certificate request file, and uses the first public key certificate as the CA (Certificate Authority) certificate, the CA certificate is the issuing agency of the certificate, specifies that the first private key is the private key of the CA, and specifies that the output file is the second public key certificate, and the second public key certificate contains the second public key; the executing subject finally inputs a command for converting the format of the second public key certificate through the above-mentioned preset tool, wherein this command specifies that the input file is the second public key certificate, the output file is the second public key certificate file, and specifies the output format, converts the format of the second public key certificate into a file format that can be recognized by BIOS, and obtains the second public key certificate file.

[0048] Step 103, generating a third private key and a third private key certificate request file through a preset tool, generating a third public key certificate according to the second private key, the second public key certificate and the third private key certificate request file, and converting the third public key certificate into a third public key certificate file that can be imported into the BIOS;

[0049] In some embodiments, the execution subject first inputs a command for generating a third private key and a third private key certificate request file through the above-mentioned preset tool to generate a third private key and a third private key certificate request file. Among them, this command creates a third private key and a certificate request file corresponding to the third private key, and specifies the subject information of the certificate request file, the length of the private key, and also specifies the name of the generated private key file and the name of the certificate request file. The SHA256 algorithm is used to obtain the third private key and the third private key certificate request file. The third private key is a key used for database encryption, access control or digital signature. The third private key certificate request file is a file requesting a signature corresponding to the third private key. On this basis, the execution subject again inputs a command for generating a third public key certificate through the above-mentioned preset tool, and uses the third private key and the second public key certificate to sign the third private key certificate request file, wherein the command specifies that the input file is the third private key certificate request file, and uses the second public key certificate as the CA (Certificate Authority) certificate, the CA certificate is the issuing agency of the certificate, specifies that the second private key is the CA's private key, and specifies that the output file is the third public key certificate, and the third public key certificate contains the third public key; the execution subject finally inputs a command for converting the format of the third public key certificate through the above-mentioned preset tool, wherein this command specifies that the input file is the third public key certificate, the output file is the third public key certificate file, and specifies the output format, converts the format of the third public key certificate into a file format that can be recognized by BIOS, and obtains the third public key certificate file.

[0050] Step 104, after importing the first public key certificate file, the second public key certificate file, and the third public key certificate file into the BIOS, turn on the secure boot option of the BIOS, use the third private key and the third public key certificate to sign the target executable file, and obtain a signed executable file. The signed executable file is used to verify the UEFI BIOS secure boot function.

[0051] In some embodiments, the execution subject imports the first public key certificate file, the second public key certificate file, and the third public key certificate file into the BIOS, and turns on the secure boot option of the BIOS, and signs the target executable file on the tool that provides the signature function through the third private key and the third public key certificate to obtain a signed executable file, and the signed executable file is used to verify the UEFI BIOS secure boot function. Among them, the target executable file is a file in the format of .efi (Extensible Firmware Interface) in the UEFI environment.

[0052] In these embodiments, three groups of keys are generated by a preset tool, and the public key certificates in each group of keys are formatted into corresponding public key certificate files that can be imported into BIOS, namely, the first public key certificate file, the second public key certificate file, and the third public key certificate file; after the first public key certificate file, the second public key certificate file, and the third public key certificate file are imported into BIOS, the secure boot option of BIOS is turned on, and the target executable file is signed using the third private key and the third public key certificate to obtain a signed executable file, which is used to verify the secure boot function of UEFI BIOS. Thus, it is achieved that only three groups of keys need to be generated once and the verification steps need to be performed, and the target executable file is signed using the third private key and the third public key certificate. This file and the three groups of keys generated can verify the validity of the secure boot function of UEFI BIOS multiple times, without the need to install the operating system back and forth, and the secure boot function of UEFI BIOS can be verified and tested conveniently and quickly.

[0053] In some embodiments, in order to further solve the second technical problem described in the background technology section, that is, "the prior art uses a fixed executable file to indiscriminately test the UEFI BIOS secure boot function of the test server, resulting in inaccurate test results; and the required encryption algorithm cannot be used quickly and accurately during the key generation process, resulting in low test efficiency", some embodiments of the present invention further include the following steps:

[0054] The signed executable is tested for UEFI BIOS secure boot functionality via the following steps:

[0055] If the signed executable file runs normally and the target executable file is blocked from running, a verification test result is generated indicating that the UEFI BIOS secure boot function is effective.

[0056] In some embodiments, when the UEFI BIOS secure boot function is turned on, it will perform signature verification on the target executable file that attempts to run. If the target executable file has been correctly signed and the signature is trusted by UEFI, then the target executable file will be allowed to run. On the contrary, if the target executable file is not signed or the signature is not trusted by UEFI, then the target executable file will be blocked from running.

[0057] Before generating the first private key and the first public key certificate by using the preset tool, the following steps are also included:

[0058] Step 1: Obtain server security requirement information and server attribute information of the server to be tested, where the server attribute information includes server model information;

[0059] In some embodiments, the executing entity can obtain the server security requirement information and server attribute information of the server to be tested through server management tools, third-party tools, etc., where the server security requirement information has different security requirements for different servers, which may be system security requirements, network security, data protection and other requirements. The server attribute information includes server model information, server manufacturer information, etc. The server model information refers to a detailed description of the server hardware configuration, usually including the server's brand, model, processor type, memory size, storage configuration, network interface and other key information.

[0060] Step 2: parse the server security requirement information to obtain multiple server security items and the security level of each server security item. If the multiple server security items include a secure boot item and the security level of the secure boot item is higher than the preset security level, the security level of the secure boot item is determined as the secure boot item security level, and three sets of key generation and verification steps are performed; wherein the target executable file is generated by the following steps:

[0061] Extracting server manufacturer information and server model from server attribute information, and obtaining a pre-configured executable file library, wherein each executable file in the executable file library is configured with an applicable security verification level, applicable manufacturer information, applicable server model, and update time;

[0062] According to the server manufacturer information, the executable files whose applicable manufacturer information is consistent with the server manufacturer information are screened from the executable file library to obtain a screened executable file group; according to the security level of the secure boot item, the executable files whose applicable security verification level is greater than or equal to the security level of the secure boot item are selected from the screened executable file group to obtain a candidate executable file group; according to the server model, matching is performed in the candidate executable file group to determine whether there is an executable file whose applicable server model matches the server model, and if so, the matching executable file is determined as the target executable file; if not, the executable files in the candidate executable file group are sorted according to the update time to obtain a candidate executable file sequence, and the executable file with the smallest time difference between the update time and the current time in the candidate executable file sequence is determined as the target executable file.

[0063] In some embodiments, the execution entity first collects server security requirement information, identifies server security items from the information, and each server security item corresponds to a security level. Among them, server security items include secure boot items, user account management, network connection items, etc., and the security level can be set to different levels such as low, medium, high or emergency. If the parsed server security items contain secure boot items and the security level of the secure boot items is higher than the preset security level, the security level of the secure boot items is determined as the secure boot item security level. Among them, the secure boot item security level is a special security level, which reflects the importance of secure boot items in server security and the high requirements for their security. The preset security level is a pre-set level. After determining the security level of the secure boot item, three sets of key generation and verification steps are executed; wherein, the target executable file is generated by the following steps:

[0064] The execution subject extracts the server manufacturer information and server model from the server attribute information. The execution subject has already stored a pre-configured executable file library locally. Among them, each executable file in the executable file library is configured with applicable security verification level, applicable manufacturer information, applicable server model, and update time;

[0065] In practice, as an example, first, the execution subject determines the server manufacturer information, selects executable files whose applicable manufacturer information is consistent with the server manufacturer information from the executable file library, and collects the executable files that are consistent after screening into a group to obtain the screened executable file group A. Among them, the server manufacturer information includes the name of the server manufacturer and related information. Secondly, the execution subject determines the security level of the secure boot item, selects executable files whose applicable security verification level is greater than or equal to the security level of the secure boot item from the screened executable file group A, and obtains the candidate executable file group B. Finally, the execution subject determines the server model, and matches in the candidate executable file group B to determine whether there is an executable file whose applicable server model matches the server model. If so, the matching executable file is determined as the target executable file C; if there is no matching executable file, it is necessary to determine the update time of the remaining executable files in the candidate executable file group B, and sort them to obtain the candidate executable file sequence D. Calculate the difference between the update time of each executable file in the candidate executable file sequence D and the current time, and determine the executable file with the smallest time difference as the target executable file E. The update time refers to the last modification time of the executable file, and the current time is the system time when the matching operation is performed or a manually specified time point.

[0066] The first public key certificate file includes a first timestamp and a first expiration time, the second public key certificate file includes a second timestamp and a second expiration time, and the third public key certificate file includes a third timestamp and a third expiration time.

[0067] In some embodiments, each public key certificate file after importing into BIOS contains two key information: timestamp and expiration time, wherein the timestamp is a complete and verifiable data that can indicate that a piece of data already exists at a specific point in time, and it is proposed mainly to provide users with an electronic evidence to prove the generation time of certain data of the user. The expiration time refers to the expiration time of the certificate. As an example, the validity period of each certificate is 10 years, the first timestamp in the first public key certificate file is 2024-10-239:00, then the first expiration time is 2034-10-239:00; the second timestamp in the second public key certificate file is 2024-10-249:00, then the second expiration time is 2034-10-249:00; the third timestamp in the third public key certificate file is 2024-10-259:00, then the third expiration time is 2034-10-259:00.

[0068] Before generating the first private key and the first public key certificate by using the preset tool, the following steps are also included:

[0069] receiving key configuration information input by a user, the key configuration information including a first encryption algorithm identifier, a second encryption algorithm identifier, and a third encryption algorithm identifier; and

[0070] In some embodiments, the execution subject receives key configuration information input by the user in the key configuration information input interface, and the key configuration information includes a first encryption algorithm identifier, a second encryption algorithm identifier, and a third encryption algorithm identifier. The encryption algorithm is used to encrypt data. The basic process of data encryption is to process the original plain text file or data according to a certain algorithm to make it an unreadable code as "ciphertext", so that it can only display its original content after entering the corresponding key. In this way, the purpose of protecting data from being stolen or read by illegal persons is achieved. Common encryption algorithms include DES (Data Encryption Standard), RSA encryption algorithm, etc. RSA was proposed by Ronald Rivest, Adi Shamir and Leonard Adleman in 1977. RSA is composed of the first letters of the surnames of these three people. The identifier is a mark used for identification. The encryption algorithm identifier refers to the mark that identifies the encryption algorithm. Different encryption algorithms have different identifiers. And

[0071] Generate the first private key and the first public key certificate using the preset tool, including:

[0072] Generate a first private key and a first public key certificate using a preset tool and a first encryption algorithm corresponding to the first encryption algorithm identifier;

[0073] In some embodiments, a first private key and a first public key certificate are generated through a preset tool, including: generating a first private key and a first public key certificate through a first encryption algorithm corresponding to the preset tool and a first encryption algorithm identifier; inputting an identifier corresponding to the first encryption algorithm in the key configuration information input interface of the preset tool to determine that the encryption algorithm used is the first encryption algorithm, and using the first encryption algorithm to generate a first private key and a first public key certificate.

[0074] Generate the second private key and the second private key certificate request file using the preset tool, including:

[0075] Generate a second private key and a second private key certificate request file using a preset tool and a second encryption algorithm corresponding to the second encryption algorithm identifier;

[0076] In some embodiments, a second private key and a second private key certificate request file are generated through a preset tool, including: generating a second private key and a second private key certificate request file through a preset tool and a second encryption algorithm corresponding to a second encryption algorithm identifier; inputting an identifier corresponding to the second encryption algorithm in a key configuration information input interface of the preset tool to determine that the encryption algorithm used is the second encryption algorithm, and using the second encryption algorithm to generate a second private key and a second public key certificate.

[0077] Generate the third private key and the third private key certificate request file through the preset tool, including:

[0078] A third private key and a third private key certificate request file are generated by a third encryption algorithm corresponding to a preset tool and a third encryption algorithm identifier.

[0079] In some embodiments, generating a third private key and a third private key certificate request file by a preset tool includes: generating a third private key and a third private key certificate request file by a third encryption algorithm corresponding to a preset tool and a third encryption algorithm identifier. Entering an identifier corresponding to the third encryption algorithm in a key configuration information input interface of the preset tool to determine that the encryption algorithm used is the third encryption algorithm, and using the third encryption algorithm to generate a third private key and a third public key certificate.

[0080] In these embodiments, the efficiency of the UEFI BIOS secure boot function test and the accuracy of the test results are improved. Specifically, first, the security requirement information and attribute information of the server to be tested are obtained; then, the server security requirement information is parsed to determine the server security items and their security levels, the security level of the secure boot items is further determined, and three sets of key generation and verification steps are performed. Among them, determining the target executable file requires: screening out the executable file group that matches the server manufacturer information; then further screening out the candidate executable file group whose security verification level meets the requirements from the executable file group; then matching according to the server model in the candidate executable file group, if a matching executable file is found, it is determined as the target executable file; if no match is found, the candidate executable files are sorted according to the update time, and the one with the smallest difference between the update time and the current time is selected as the target executable file. The target executable file that matches the server to be tested is screened out in a targeted manner, and the UEFI BIOS secure boot function is tested using the signed executable file, thereby improving the accuracy of the test results; the encryption algorithm used is quickly determined by the encryption algorithm identifier in the key configuration information, thereby improving the efficiency of the test.

[0081] In some embodiments, in order to further solve the technical problem 3 described in the background technology section, that is, "due to the validity period of the key and certificate files, they cannot be updated in time, resulting in poor quality of the signed executable files, which further leads to poor testing results", some embodiments of the present invention further include the following steps:

[0082] Step 1: For each item in the first public key certificate file, the second public key certificate file, and the third public key certificate file, perform the following validity verification operation:

[0083] Determine a time difference between a current time and an expiration time, and determine whether the time difference is less than or equal to a preset time difference threshold; if the time difference is less than or equal to the preset time difference threshold, generate key update prompt information, and add the key update prompt information to the signed executable file to obtain an updated signed executable file; when using the updated signed executable file to perform a verification test on the UEFI BIOS secure boot function, display the key update prompt information in a pop-up window;

[0084] In some embodiments, the expiration time refers to the time when the validity period of the key ends. The difference between the current time and the expiration time is calculated. The preset time difference threshold is a preset value used to determine whether the key is about to expire. The calculated time difference is compared with the preset time difference threshold. If the time difference is less than or equal to the preset time difference threshold, it means that the execution subject will generate a key update prompt information. The key update prompt information is added to the signed executable file to obtain an updated signed executable file. The key update prompt information informs the execution subject in the form of a pop-up message that the key is about to expire and needs to be updated.

[0085] Step 2: Sort the first public key certificate file, the second public key certificate file, and the third public key certificate file according to the dependency relationship between the keys to obtain a public key certificate file sequence;

[0086] In some embodiments, the dependency between keys generally refers to the trust chain between different public key certificates. One certificate may rely on another certificate to establish trust, which is usually because one certificate (called a child certificate) is signed by another certificate (called a parent certificate or a root certificate). The different public key certificates are sorted according to the trust relationship to obtain a sequence of public key certificate files. As an example, the first public key certificate file is a root certificate, the second public key certificate file is an intermediate certificate signed by the first public key certificate file, and the third public key certificate file is a child certificate signed by the second public key certificate file. The order should be the first public key certificate file, the second public key certificate file, and the third public key certificate file, and there is a chronological order between them.

[0087] Step three, when the time difference reaches the critical time difference, the corresponding public key certificate file is determined as the target public key certificate file; the public key certificate file that is arranged after the target public key certificate file in the public key certificate file sequence is determined as the public key certificate file to be updated, and the public key certificate file that is arranged before the target public key certificate file in the public key certificate file sequence is determined as the retained public key certificate file; the target public key certificate file and the public key certificate file to be updated are updated to obtain an updated public key certificate file; the target executable file is signed based on the updated public key certificate file and the retained public key certificate file to obtain an upgraded signed executable file.

[0088] In some embodiments, reaching the critical time difference means that the public key certificate file is close to the expiration time. When the time difference of a certain public key certificate file reaches the critical time difference, it will be determined as the target public key certificate file, which means that the target public key certificate file needs to be updated. In the public key certificate file sequence, the certificate files that are arranged after the target public key certificate file are also regarded as certificates that need to be updated, because they depend on the target public key certificate file, and their validity period is also close to expiration. In the public key certificate file sequence, the certificate files that are arranged before the target public key certificate file are regarded as reserved public key certificate files. These certificates usually have enough validity periods and do not need to be updated immediately. The target public key certificate file and the public key certificate file to be updated are updated, which usually involves generating a new key pair to ensure that the validity period is long enough. Use the updated public key certificate file (i.e., the updated public key certificate file) and the retained public key certificate file to sign the target executable file, and finally obtain the upgraded signed executable file.

[0089] In these embodiments, the reliability of the UEFI BIOS secure boot function test is improved. Through the time difference between the current time and the expiration time, if the time difference is less than or equal to the preset time difference threshold, a key update prompt message is generated to obtain an updated signed executable file. According to the dependency relationship between the keys, the first public key certificate file, the second public key certificate file, and the third public key certificate file are sorted to obtain a public key certificate file sequence, and then according to the time difference reaching the critical time difference, the public key certificate file that needs to be updated is determined, and the updated public key certificate file (i.e., the updated public key certificate file) and the retained public key certificate file are used to sign the target executable file, and finally the upgraded signed executable file is obtained. Thereby, the signed executable file is optimized and the reliability of the test is improved.

[0090] The above descriptions are only some preferred embodiments of the present invention and the explanation of the technical principles used. Those skilled in the art should understand that the scope of the invention involved in the present invention is not limited to the technical solutions formed by the specific combination of the above technical features, but also should cover other technical solutions formed by any combination of the above technical features or their equivalent features without departing from the above inventive concept. For example, the above features are replaced with the technical features with similar functions disclosed in the present invention (but not limited to) to form a technical solution.

Claims

1. A UEFI BIOS secure boot function verification test method, characterized in that: Including executing the following three sets of key generation and verification steps: Generate a first private key and a first public key certificate by using a preset tool, and convert the first public key certificate into a first public key certificate file that can be imported into BIOS; Generate a second private key and a second private key certificate request file by using a preset tool, generate a second public key certificate according to the first private key, the first public key certificate and the second private key certificate request file, and convert the second public key certificate into a second public key certificate file that can be imported into BIOS; Generate a third private key and a third private key certificate request file by using a preset tool, generate a third public key certificate according to the second private key, the second public key certificate and the third private key certificate request file, and convert the third public key certificate into a third public key certificate file that can be imported into BIOS; After importing the first public key certificate file, the second public key certificate file, and the third public key certificate file into the BIOS, turning on the secure boot option of the BIOS, and using the third private key and the third public key certificate to sign the target executable file to obtain a signed executable file, wherein the signed executable file is used to verify the secure boot function of the UEFI BIOS.

2. The UEFI BIOS secure boot function verification test method according to claim 1, characterized in that: The signed executable file is used to verify the UEFI BIOS secure boot function through the following steps: If the signed executable file runs normally and the target executable file is blocked from running, a verification test result is generated indicating that the UEFI BIOS secure boot function is effective.

3. The UEFI BIOS secure boot function verification test method according to claim 2, characterized in that: Before generating the first private key and the first public key certificate by using a preset tool, the method further includes: Obtaining server security requirement information and server attribute information of the server to be tested, wherein the server attribute information includes server model information; The server security requirement information is parsed to obtain multiple server security items and the security level of each server security item. If the multiple server security items include a secure boot item and the security level of the secure boot item is higher than a preset security level, the security level of the secure boot item is determined as the secure boot item security level, and the three sets of key generation and verification steps are performed; wherein the target executable file is generated by the following steps: Extracting server manufacturer information and server model from the server attribute information, and obtaining a pre-configured executable file library, wherein each executable file in the executable file library is configured with an applicable security verification level, applicable manufacturer information, applicable server model, and update time; According to the server manufacturer information, the executable files whose applicable manufacturer information is consistent with the server manufacturer information are screened from the executable file library to obtain a screened executable file group; according to the security level of the secure boot item, the executable files whose applicable security verification level is greater than or equal to the security level of the secure boot item are selected from the screened executable file group to obtain a candidate executable file group; according to the server model, matching is performed in the candidate executable file group to determine whether there is an executable file whose applicable server model matches the server model, and if so, the matching executable file is determined as a target executable file; if not, the executable files in the candidate executable file group are sorted according to the update time to obtain a candidate executable file sequence, and the executable file with the smallest time difference between the update time and the current time in the candidate executable file sequence is determined as the target executable file.

4. The UEFI BIOS secure boot function verification test method according to claim 3, characterized in that: The first public key certificate file includes a first timestamp and a first expiration time, the second public key certificate file includes a second timestamp and a second expiration time, and the third public key certificate file includes a third timestamp and a third expiration time.

5. The UEFI BIOS secure boot function verification test method according to claim 4, characterized in that: Before generating the first private key and the first public key certificate by using a preset tool, the method further includes: receiving key configuration information input by a user, the key configuration information including a first encryption algorithm identifier, a second encryption algorithm identifier, and a third encryption algorithm identifier; and The generating of the first private key and the first public key certificate by using a preset tool includes: Generate a first private key and a first public key certificate using a preset tool and a first encryption algorithm corresponding to the first encryption algorithm identifier; The generating of the second private key and the second private key certificate request file by a preset tool includes: Generate a second private key and a second private key certificate request file using a preset tool and a second encryption algorithm corresponding to the second encryption algorithm identifier; The generating of the third private key and the third private key certificate request file by a preset tool includes: A third private key and a third private key certificate request file are generated by a third encryption algorithm corresponding to a preset tool and a third encryption algorithm identifier.

Images