Operating system boot security verification methods, devices, systems and related equipment

Abstract

This disclosure provides an operating system security verification method, apparatus, system, and related devices. The method includes: executing initial boot block code to read first image data of a basic input / output system image from a serial peripheral interface flash memory; performing a first security verification on the first image data, and if the first security verification result is passed, executing the basic input / output system image and reading second image data of a bootloader image; performing a second security verification on the second image data, and if the second security verification result is passed, executing the bootloader image and reading third image data of an operating system kernel image from a main storage device; performing a third security verification on the third image data, and if the third security verification result is passed, executing the operating system kernel image.

Description

Technical Field

[0001] This disclosure relates to the field of operating system security verification, and in particular to an operating system security verification method, apparatus, system and related equipment. Background Technology

[0002] With the rapid development of information technology, the security and reliability of the operating system, as the core device for data processing and storage, have become particularly important. During operation, the operating system needs to load multiple layers of firmware and software, including the Basic Input / Output System (BIOS), the bootloader, and the operating system kernel. The integrity of these components directly affects the security of the entire operating system.

[0003] However, the traditional operating system boot process lacks an effective mechanism to verify the integrity of firmware and software at each level, which makes the operating system vulnerable to malicious tampering and attacks during the boot process, thus leading to security vulnerabilities in the operating system during boot. Summary of the Invention

[0004] This disclosure provides an operating system security verification method, apparatus, system, and related devices, which can effectively verify the security of firmware and software during the operating system boot process and prevent security vulnerabilities from appearing in the operating system during boot.

[0005] To address the aforementioned technical problems, this disclosure provides an operating system security verification method applied to a processor, the method comprising:

[0006] Execute the initial boot block code preset in the serial peripheral interface flash memory to read the first image data of the basic input / output system image from the serial peripheral interface flash memory;

[0007] Perform a first security verification on the first image data and obtain the first security verification result;

[0008] If the first security verification result is passed, the basic input / output system image is executed to read the second image data of the bootloader image from the serial peripheral interface flash memory;

[0009] Perform a second security verification on the second image data and obtain the second security verification result;

[0010] If the second security verification result is passed, the bootloader image is executed to read the third image data of the operating system kernel image from the main storage device;

[0011] Perform a third security verification on the third mirror data and obtain the third security verification result;

[0012] If the third security verification result is passed, the operating system kernel image is executed.

[0013] Optionally, performing a first security verification on the first image data and obtaining a first security verification result includes:

[0014] Perform a hash calculation on the first image data to obtain the basic input / output system image measurement value of the basic input / output system image;

[0015] The basic input / output system mirror measurement value is extended and calculated, and it is determined whether the basic input / output system mirror measurement value is consistent with the basic input / output system mirror reference value.

[0016] If the judgment result is yes, then the first security verification result is passed.

[0017] Optionally, the extended operation on the mirrored measurement values ​​of the basic input / output system includes:

[0018] Send the basic input / output system image measurement values ​​to the trusted platform module;

[0019] A platform configuration register extension instruction is sent to the first platform configuration register of the trusted platform module, so that the trusted platform module performs an extension operation on the basic input / output system image measurement value based on the first initial hash value in the first platform configuration register, and updates the first initial hash value using the basic input / output system image measurement value.

[0020] Optionally, performing a second security verification on the second mirror data and obtaining the second security verification result includes:

[0021] Perform a hash calculation on the second image data to obtain the bootloader image measurement value of the bootloader image;

[0022] The measured values ​​of the bootloader image are expanded and calculated, and it is determined whether the measured values ​​of the bootloader image are consistent with the reference values ​​of the bootloader image.

[0023] If the judgment result is yes, then the second security verification result is passed.

[0024] Optionally, the step of expanding the measurement values ​​of the bootloader image includes:

[0025] Send the bootloader image measurement values ​​to the trusted platform module;

[0026] A platform configuration register extension instruction is sent to the second platform configuration register of the trusted platform module, so that the trusted platform module performs an extension operation on the bootloader image measurement value based on the second initial hash value in the second platform configuration register, and updates the second initial hash value using the bootloader image measurement value.

[0027] Optionally, performing a third security verification on the third mirror data and obtaining the third security verification result includes:

[0028] The third image data is hashed to obtain the operating system kernel image measurement value of the operating system kernel image;

[0029] The measured value of the operating system kernel image is expanded, and it is determined whether the expanded value of the operating system kernel image is consistent with the reference value of the operating system kernel image.

[0030] If the judgment result is yes, then the third security verification result is passed.

[0031] Optionally, the expansion operation on the measurement value of the operating system kernel image includes:

[0032] Send the operating system kernel image measurement values ​​to the trusted platform module;

[0033] A platform configuration register extension instruction is sent to the third platform configuration register of the trusted platform module, so that the trusted platform module performs an extension operation on the operating system kernel image measurement value based on the third initial hash value in the third platform configuration register, and updates the third initial hash value using the operating system kernel image measurement value.

[0034] Optionally, if the first security verification result fails, or if the third security verification result passes, the method further includes:

[0035] The startup process is terminated, and a notification indicating that the security verification result failed is sent to the baseboard management controller, so that the baseboard management controller records the corresponding security event.

[0036] This disclosure also provides an operating system security verification device, applied to a processor in an operating system, the device comprising:

[0037] The first execution unit is used to execute the initial boot block code preset in the serial peripheral interface flash memory to read the first image data of the basic input / output system image from the serial peripheral interface flash memory;

[0038] The first verification unit is used to perform a first security verification on the first image data and obtain the first security verification result.

[0039] The second execution unit is configured to execute the basic input / output system image if the first security verification result is passed, so as to read the second image data of the bootloader image from the serial peripheral interface flash memory;

[0040] The second verification unit is used to perform a second security verification on the second image data and obtain the second security verification result.

[0041] The third execution unit is used to execute the bootloader image if the second security verification result is passed, so as to read the third image data of the operating system kernel image from the main storage device;

[0042] The third verification unit is used to perform a third security verification on the third mirror data and obtain the third security verification result.

[0043] The fourth execution unit is used to execute the operating system kernel image if the third security verification result is passed.

[0044] This disclosure also provides an operating system security verification system, the system including a processor, a serial peripheral interface flash memory, and a main storage device;

[0045] The processor, mounted on the operating system motherboard, is configured to execute initial boot block code pre-stored in the serial peripheral interface flash memory to read first image data of the basic input / output system image from the serial peripheral interface flash memory; perform a first security verification on the first image data and obtain a first security verification result; if the first security verification result is passed, execute the basic input / output system image to read second image data of the bootloader image from the serial peripheral interface flash memory; perform a second security verification on the second image data and obtain a second security verification result; if the second security verification result is passed, execute the bootloader image to read third image data of the operating system kernel image from the main storage device; perform a third security verification on the third image data and obtain a third security verification result; if the third security verification result is passed, execute the operating system kernel image.

[0046] The serial peripheral interface flash memory is soldered onto the operating system motherboard and is communicatively connected to the processor. It is used to store the initial boot block code, the basic input / output system image, and the bootloader image.

[0047] The main storage device is communicatively connected to the processor and is used to store the operating system kernel image.

[0048] Optionally, the system further includes a trusted platform module that is communicatively connected to the processor;

[0049] The trusted platform module includes a first platform configuration register, a second platform configuration register, and a third platform configuration register. The first platform configuration register stores a first initial hash value required for performing a first security verification on the first image data. The second platform configuration register stores a second initial hash value required for performing a second security verification on the second image data. The third platform configuration register stores a third initial hash value required for performing a third security verification on the third image data. The trusted platform module also stores a basic input / output system image reference value required for performing a first security verification on the first image data, a bootloader image reference value required for performing a second security verification on the second image data, and an operating system kernel image reference value required for performing a third security verification on the third image data.

[0050] Optionally, the system further includes a backplane management controller that is communicatively connected to the processor;

[0051] The baseboard management controller is used to receive a notification from the processor that the security verification result has failed, and to record the corresponding security event.

[0052] This disclosure also provides an electronic device, including:

[0053] At least one processor; and

[0054] A memory communicatively connected to the at least one processor; wherein,

[0055] The memory stores instructions that can be executed by the at least one processor, which, when executed by the at least one processor, enables the at least one processor to perform the operating system security verification method provided in this disclosure.

[0056] This disclosure also provides a non-transitory computer-readable storage medium storing computer instructions for causing the computer to execute the operating system security verification method provided in this disclosure.

[0057] This disclosure provides an operating system security verification method, comprising: executing initial boot block code preset in the serial peripheral interface flash memory to read first image data of a basic input / output system image from the serial peripheral interface flash memory; performing a first security verification on the first image data to obtain a first security verification result; if the first security verification result is passed, executing the basic input / output system image to read second image data of a bootloader image from the serial peripheral interface flash memory; performing a second security verification on the second image data to obtain a second security verification result; if the second security verification result is passed, executing the bootloader image to read third image data of an operating system kernel image from a main storage device; performing a third security verification on the third image data to obtain a third security verification result; and if the third security verification result is passed, executing the operating system kernel image.

[0058] According to the scheme of this disclosure, by executing the initial boot block code preset in the serial peripheral interface flash memory, the processor can perform minimal initialization of the system carried by the operating system. Then, it reads the first image data of the Basic Input / Output System (BIOS) image from the BIOS. If the security verification of the first image data passes, the BIOS image is executed to read the second image data of the bootloader image from the BIOS. If the security verification of the second image data passes, the bootloader image is executed to read the third image data of the operating system kernel image from the main storage device. If the third security verification passes, the operating system kernel image is executed, completing the boot of the operating system. In the above-mentioned operating system boot process, the scheme provided by this disclosure performs progressive security verification on the firmware and software during the operating system boot process. The corresponding image code is only executed after the security verification of the previous firmware or software has passed, preventing malicious tampering of the operating system firmware or software during the boot process, thereby avoiding security vulnerabilities in the operating system during boot.

[0059] It should be understood that the description in this section is not intended to identify key or essential features of the embodiments of this application, nor is it intended to limit the scope of this application. Other features of this application will become readily apparent from the following description. Attached Figure Description

[0060] The accompanying drawings are provided to better understand this solution and do not constitute a limitation of this disclosure. Wherein:

[0061] Figure 1 A flowchart illustrating an operating system security verification method provided in this embodiment of the disclosure;

[0062] Figure 2 This is a flowchart illustrating another operating system security verification method provided in an embodiment of this disclosure;

[0063] Figure 3 This is a flowchart illustrating another operating system security verification method provided in an embodiment of this disclosure;

[0064] Figure 4 This is a flowchart illustrating another operating system security verification method provided in an embodiment of this disclosure;

[0065] Figure 5 A flowchart illustrating an operating system security verification method provided as an application example of this disclosure;

[0066] Figure 6 This is a schematic diagram of the structure of an operating system security verification device provided in an embodiment of the present disclosure;

[0067] Figure 7 This is a schematic diagram of the structure of an operating system security verification system provided in an embodiment of this disclosure;

[0068] Figure 8 This is a schematic diagram of the hardware composition structure of an electronic device provided in an embodiment of this disclosure. Detailed Implementation

[0069] The exemplary embodiments of this disclosure are described below with reference to the accompanying drawings, including various details of the embodiments to aid understanding, and should be considered merely exemplary. Therefore, those skilled in the art will recognize that various changes and modifications can be made to the embodiments described herein without departing from the scope and spirit of this disclosure. Similarly, for clarity and brevity, descriptions of well-known functions and structures are omitted in the following description.

[0070] With the rapid development of information technology, the security and reliability of the operating system, as the core device for data processing and storage, have become particularly important. During the boot process, the operating system needs to load multiple layers of firmware and software, including the BIOS, bootloader, and operating system kernel. The integrity of these components directly affects the security of the entire system.

[0071] Trusted computing, as a crucial means of ensuring computing environment security, establishes a root of trust at the hardware level to achieve comprehensive monitoring and protection of the operating system's boot and runtime processes. The Trusted Platform Module (TPM), as an important component of trusted computing, provides hardware-level security functions, including key management, data encryption, and integrity measurement, and is widely used in areas such as secure boot, remote authentication, and data protection.

[0072] However, among related technologies, comprehensive solutions based on hardware Root of Trust (such as TPM) are still imperfect. There is still a lack of effective mechanisms to verify the integrity of firmware and software at each level during the operating system boot process. As a result, the operating system is vulnerable to malicious tampering and attacks during the boot process, which in turn leads to security vulnerabilities in the operating system during the boot process.

[0073] In order to solve the technical problems existing in the related technologies, the embodiments of this disclosure provide an operating system security verification method, apparatus, system, electronic device and storage medium.

[0074] Before detailing the embodiments of this disclosure, the technical terms used in this disclosure will be explained below.

[0075] TMP is a dedicated security encryption processor used to perform encryption operations and provide hardware-level security features. TPM is primarily used to generate, store, and restrict the use of encryption keys to ensure platform security. It conforms to the TPM 2.0 specification developed by the Trusted Computing Group (TCG) and provides a range of security functions, such as key generation and management, data encryption and decryption, and platform integrity measurement.

[0076] The Platform Configuration Register (PCR) is a set of registers within the TPM used to store measurements (such as hash values) of system components. Each PCR stores a fixed-length initial hash value (typically 256 bits). The initial hash value of the PCR is updated through the PCR Extend operation, ensuring that any modifications to system components are reflected in the PCR value, thereby enabling continuous monitoring and verification of the system status.

[0077] Serial Peripheral Interface (SPI) flash memory is a type of non-volatile memory that communicates with the Central Processing Unit (CPU) via SPI. It is typically used to store system firmware, such as BIOS images and bootloader images.

[0078] BOOTLOADER is a small program responsible for loading and initializing the operating system kernel during system startup. It resides in the system's boot chain and is typically stored in SPI Flash or a solid state drive (SSD).

[0079] SHA-256 (Secure Hash Algorithm 256-bit) is a widely used cryptographic hash function that can convert input data of arbitrary length into a fixed-length 256-bit (32-byte) hash value. SHA-256 is one-way, collision-resistant, and tamper-resistant, ensuring the integrity and uniqueness of the input data.

[0080] PCR Extend is an operation provided by TPM that hashes new measurements with existing PCR initial values ​​to update the PCR initial values.

[0081] A Baseboard Management Controller (BMC) is a standalone microcontroller integrated on the operating system's motherboard, responsible for monitoring and managing the physical state of the operating system. The BMC typically communicates with external management systems via an Intelligent Platform Management Interface (IPMI) to provide remote management and monitoring capabilities.

[0082] The embodiments of this disclosure will now be described in detail.

[0083] like Figure 1 As shown, embodiments of this disclosure provide an operating system security verification method, executed by a processor in the operating system, such as a CPU. The method includes the following steps:

[0084] Step 101: Execute the initial boot block code preset in the serial peripheral interface flash memory to read the first image data of the basic input / output system image from the serial peripheral interface flash memory;

[0085] In one embodiment, after the operating system is powered on, the CPU begins executing the Initial Boot Block (IBB) code preset in the SPI Flash. This IBB is read-only factory firmware, pre-installed by the motherboard manufacturer. During this stage, the CPU performs minimal initialization of the system state, enabling it to access the SPI Flash and perform basic communication with the TPM. Therefore, after power-on initialization, the CPU can read the BIOS image data, i.e., the first image data, from the SPI Flash.

[0086] Step 102: Perform a first security verification on the first image data and obtain the first security verification result;

[0087] In one embodiment, the Root of Trust principle based on TMP can be used to perform a first security verification on the first image data and obtain a first security verification result; wherein, the first security verification result includes a first security verification result of passing or a first security verification result of failing; a first security verification result of passing indicates that the current BIOS image has not been maliciously tampered with and its trustworthiness is confirmed, and a first security verification result of failing indicates that the current BIOS image may have been maliciously tampered with and its trustworthiness cannot be confirmed.

[0088] Step 103: If the first security verification result is passed, execute the basic input / output system image to read the second image data of the bootloader image from the serial peripheral interface flash memory;

[0089] In one embodiment, the first security verification result is passed, indicating that the current BIOS image has not been maliciously tampered with and its trustworthiness is confirmed. At this point, the CPU jumps to execute the BIOS code, thereby giving the BIOS primary control over the system hardware. It initializes the memory, peripheral devices, and interrupt vectors to ensure that the subsequent loading and verification of the bootloader image are performed in a controlled environment. After BIOS initialization, the CPU can read the bootloader image data, i.e., the second image data, from the SPI Flash through the BIOS.

[0090] Step 104: Perform a second security verification on the second image data and obtain the second security verification result;

[0091] In one embodiment, similar to the first security verification, a second security verification can be performed on the second image data using the Root of Trust principle based on TMP, and a second security verification result can be obtained. The second security verification result includes either "passed" or "failed". A "passed" second security verification result indicates that the current BOOTLOADER image has not been maliciously tampered with and its trustworthiness is confirmed; a "failed" first security verification result indicates that the current BOOTLOADER image may have been maliciously tampered with and its trustworthiness cannot be confirmed.

[0092] Step 105: If the second security verification result is passed, execute the bootloader image to read the third image data of the operating system kernel image from the main storage device;

[0093] In one embodiment, the second security verification result is passed, indicating that the current bootloader image has not been maliciously tampered with and its trustworthiness is confirmed. At this point, the CPU jumps to execute the bootloader code. At this time, the TPM is already in a trusted state that has undergone two levels of verification (both the BIOS and bootloader have passed security verification). Subsequently, the CPU can read the operating system kernel image image data from the SSD through the bootloader, i.e., the third image data.

[0094] Step 106: Perform a third security verification on the third mirror data and obtain the third security verification result;

[0095] In one embodiment, similar to the first and second security verifications, a third security verification can be performed on the third image data using the Root of Trust principle based on TMP, and a third security verification result can be obtained. The third security verification result includes either a passed result or a failed result. A passed result indicates that the current operating system kernel image has not been maliciously tampered with and its trustworthiness is confirmed; a failed result indicates that the current operating system kernel image may have been maliciously tampered with and its trustworthiness cannot be confirmed.

[0096] Step 107: If the third security verification result is passed, execute the operating system kernel image.

[0097] In one embodiment, after successfully verifying the security of the operating system kernel image, the CPU executes the operating system kernel image code. At this point, the operating system kernel boot process unfolds on a complete and trusted foundational chain, completing the security vulnerability-free boot process of the operating system.

[0098] In one embodiment, after the operating system starts up, the operating system kernel may also choose to continue performing security verification steps similar to step 102, or step 104, or step 106 on dynamically loaded kernel modules or critical service components while the operating system is running, so as to further strengthen the trusted environment of the entire operating system and thus form an extended trusted operating environment.

[0099] This disclosure provides an operating system security verification method, comprising: executing initial boot block code preset in the serial peripheral interface flash memory to read first image data of a basic input / output system image from the serial peripheral interface flash memory; performing a first security verification on the first image data to obtain a first security verification result; if the first security verification result is passed, executing the basic input / output system image to read second image data of a bootloader image from the serial peripheral interface flash memory; performing a second security verification on the second image data to obtain a second security verification result; if the second security verification result is passed, executing the bootloader image to read third image data of an operating system kernel image from a main storage device; performing a third security verification on the third image data to obtain a third security verification result; and if the third security verification result is passed, executing the operating system kernel image.

[0100] According to the scheme of this disclosure, by executing the initial boot block code preset in the serial peripheral interface flash memory, the processor can perform minimal initialization of the system carried by the operating system. Then, it reads the first image data of the basic input / output system image from the serial peripheral interface flash memory. If the security verification of the first image data passes, the basic input / output system image is executed to read the second image data of the bootloader image from the serial peripheral interface flash memory. If the security verification of the second image data passes, the bootloader image is executed to read the third image data of the operating system kernel image from the main storage device. If the third security verification result passes, the operating system kernel image is executed, completing the boot of the operating system. In the above-mentioned operating system boot process, the scheme provided by this disclosure performs hierarchical security verification on the firmware and software during the operating system boot process. The corresponding image code is only executed after the security verification of the previous firmware or software has passed, preventing malicious tampering of the operating system firmware or software during the boot process, thereby avoiding security vulnerabilities in the operating system during boot.

[0101] In one embodiment, such as Figure 2 As shown, step 102 above includes:

[0102] Step 201: Perform a hash calculation on the first image data to obtain the basic input / output system image measurement value of the basic input / output system image;

[0103] In one embodiment, the hash calculation performed on the first image data can be a SHA-256 hash calculation to obtain the basic input / output system image measurement value M_BIOS of the BIOS image.

[0104] Step 202: Perform an expansion operation on the basic input / output system mirror measurement value, and determine whether the basic input / output system mirror expansion value is consistent with the basic input / output system mirror reference value;

[0105] Specifically, the extended calculation of the mirror measurement values ​​of the basic input / output system includes:

[0106] Send the basic input / output system image measurement values ​​to the trusted platform module;

[0107] A platform configuration register extension instruction is sent to the first platform configuration register of the trusted platform module, so that the trusted platform module performs an extension operation on the basic input / output system image measurement value based on the first initial hash value in the first platform configuration register, and updates the first initial hash value using the basic input / output system image measurement value.

[0108] In one embodiment, the CPU and TMP communicate via the SPI / LPC protocol. The CPU can send the PCRExtend instruction to the TMP to enable the TMP to perform an extension operation on M_BIOS and update M_BIOS to the first platform configuration register of the TMP, that is, to update the first initial hash value using M_BIOS.

[0109] In one embodiment, the basic input / output system image reference value RM_BIOS can be stored in the non-volatile NV memory of the TPM. The CPU obtains RM_BIOS by reading the NV memory of the TPM. Furthermore, the CPU determines whether M_BIOS and RM_BIOS are completely identical by comparing them byte by byte.

[0110] Step 203: If the judgment result is yes, then the first security verification result is passed.

[0111] In one embodiment, if M_BIOS and RM_BIOS are completely identical, the first security verification result is passed, indicating that the BIOS image has not been maliciously tampered with; conversely, if M_BIOS and RM_BIOS are not completely identical, the first security verification result is failed, indicating that the BIOS image may have been maliciously tampered with. In this case, the boot process should be terminated immediately to prevent a security event of malicious BIOS image tampering.

[0112] In the above embodiments, the CPU performs security verification on the BIOS image through TMP, which can accurately determine whether the BIOS image may be maliciously tampered with. If the BIOS image may be maliciously tampered with, the boot program can be terminated immediately, further ensuring the security of the operating system during the boot process.

[0113] In one embodiment, such as Figure 3 As shown, step 104 includes:

[0114] Step 301: Perform a hash calculation on the second image data to obtain the bootloader image measurement value of the bootloader image;

[0115] In one embodiment, the hash calculation performed on the second image data can be a SHA-256 hash calculation to obtain the basic input / output system image measurement value M_BOOTLOADER of the BOOTLOADER image.

[0116] Step 302: Perform an extended calculation on the measured value of the bootloader image and determine whether the measured value of the bootloader image is consistent with the reference value of the bootloader image;

[0117] The process of expanding the measurement values ​​of the bootloader image includes:

[0118] Send the bootloader image measurement values ​​to the trusted platform module;

[0119] A platform configuration register extension instruction is sent to the second platform configuration register of the trusted platform module, so that the trusted platform module performs an extension operation on the bootloader image measurement value based on the second initial hash value in the second platform configuration register, and updates the second initial hash value using the bootloader image measurement value.

[0120] In one embodiment, the CPU and TMP communicate via the SPI / LPC protocol. The CPU can send the PCRExtend instruction to the TMP to enable the TMP to perform an extension operation on M_BOOTLOADER and update M_BOOTLOADER to the second platform configuration register of the TMP, that is, to update the second initial hash value using M_BOOTLOADER.

[0121] In one embodiment, the bootloader image reference value RM_BOOTLOADER can be stored in the non-volatile NV memory of the TPM. The CPU obtains RM_BOOTLOADER by reading the NV memory of the TPM. Furthermore, the CPU compares M_BOOTLOADER and RM_BOOTLOADER byte by byte to determine whether M_BOOTLOADER and RM_BOOTLOADER are completely identical.

[0122] Step 303: If the judgment result is yes, then the second security verification result is passed.

[0123] In one embodiment, if M_BOOTLOADER and RM_BOOTLOADER are completely identical, the second security verification result is passed, indicating that the BOOTLOADER image has not been maliciously tampered with. Conversely, if M_BOOTLOADER and RM_BOOTLOADER are not completely identical, the second security verification result is failed, indicating that the BOOTLOADER image may have been maliciously tampered with. In this case, the startup process should be terminated immediately to prevent a security event of malicious tampering of the BOOTLOADER image.

[0124] In the above embodiments, the CPU's security verification of the bootloader image via TMP can accurately determine whether the bootloader image may have been maliciously tampered with. If the bootloader image may have been maliciously tampered with, the boot program can be terminated immediately, further ensuring the security of the operating system during the boot process. Furthermore, the security verification of the bootloader image is performed on the premise that the security verification of the BIOS image has passed. Therefore, based on the operating system's boot process, a tiered security verification method can be used to further ensure the security of the operating system during boot.

[0125] In one embodiment, such as Figure 4 As shown, step 106 includes:

[0126] Step 401: Perform hash calculation on the third image data to obtain the operating system kernel image measurement value of the operating system kernel image;

[0127] In one embodiment, the hash calculation performed on the third image data can be a SHA-256 hash calculation to obtain the operating system kernel image measurement value M_BKERNEL of the operating system kernel image.

[0128] Step 402: Perform an expansion operation on the measured value of the operating system kernel image, and determine whether the expanded value of the operating system kernel image is consistent with the reference value of the operating system kernel image;

[0129] The process of expanding the measured values ​​of the operating system kernel image includes:

[0130] Send the operating system kernel image measurement values ​​to the trusted platform module;

[0131] A platform configuration register extension instruction is sent to the third platform configuration register of the trusted platform module, so that the trusted platform module performs an extension operation on the operating system kernel image measurement value based on the third initial hash value in the third platform configuration register, and updates the third initial hash value using the operating system kernel image measurement value.

[0132] In one embodiment, the CPU and TMP communicate via the SPI / LPC protocol. The CPU can send the PCRExtend instruction to the TMP to enable the TMP to perform an extension operation on M_KERNEL and update M_KERNEL to the third platform configuration register of the TMP, that is, to update the third initial hash value using M_KERNEL.

[0133] In one embodiment, the operating system kernel image reference value RM_KERNEL can be stored in the non-volatile NV memory of the TPM. The CPU obtains RM_KERNEL by reading the NV memory of the TPM. Furthermore, the CPU compares M_KERNEL and RM_KERNEL byte by byte to determine whether M_KERNEL and RM_KERNEL are completely consistent.

[0134] Step 403: If the judgment result is yes, then the third security verification result is passed.

[0135] In the above embodiments, the CPU's security verification of the operating system kernel image via TMP can accurately determine whether the operating system kernel image may have been maliciously tampered with. If the operating system kernel image may have been maliciously tampered with, the boot process can be terminated immediately, further ensuring the security of the operating system during the boot process. Furthermore, the security verification of the operating system kernel image is performed on the premise that the security verification of the BIOS image and the bootloader image has passed. Therefore, based on the system boot process, a tiered security verification method can be used to further ensure the security of the operating system during the boot process.

[0136] In one embodiment, if the first security verification result is not passed, or if the third security verification result is passed, the operating system security verification method provided in this disclosure further includes:

[0137] The startup process is terminated, and a notification indicating that the security verification result failed is sent to the baseboard management controller, so that the baseboard management controller records the corresponding security event.

[0138] In one embodiment, the Baseboard Management Controller (BMC), also known as the Baseboard Management Controller, communicates with the CPU via the I2C protocol. The CPU can send fault notification commands to the BMC via the I2C bus. These commands indicate that the corresponding security verification result is failed, prompting the BMC to record the corresponding security event. Furthermore, the BMC can also send corresponding fault notifications to the Administrator via the Management Network (Mgmt Network), enabling the Administrator to promptly detect and address the fault.

[0139] The operating system security verification method provided in this disclosure will be further illustrated below with a specific example. For example... Figure 5 As shown in the illustration, the operating system security verification method provided in this application embodiment includes the following steps:

[0140] Step 501: Power on the operating system;

[0141] Step 502: The CPU executes the IBB code preset in the SPI Flash;

[0142] Step 503: The CPU reads the first image data of the BIOS image and performs SHA-256 hash calculation on the first image data to obtain M_BIOS;

[0143] Step 504: The CPU performs a PCR Extend operation on M_BIOS via TMP;

[0144] Step 505: The CPU reads RM_BIOS from NV in TMP and determines whether RM_BIOS is consistent with M_BIOS;

[0145] If the judgment result is yes, proceed to step 506;

[0146] If the result is negative, proceed to step 507;

[0147] Step 506: The CPU executes the verified BIOS code and proceeds to step 508;

[0148] Step 507: Stop the startup process and alert the BMC;

[0149] Step 508: The CPU reads the second image data of the BOOTLOADER image through the BIOS, and performs SHA-256 hash calculation on the second image data to obtain M_BOOTLOADER;

[0150] Step 509: The CPU performs a PCR Extend operation on M_BOOTLOADER via TMP;

[0151] Step 510: The CPU reads RM_BOOTLOADER from NV in TMP and determines whether RM_BOOTLOADER is consistent with M_BOOTLOADER.

[0152] If the judgment result is yes, proceed to step 511;

[0153] If the result is negative, proceed to step 507;

[0154] Step 511: The CPU executes the verified BOOTLOADER code and proceeds to step 512;

[0155] Step 512: The CPU reads the third image data of the operating system kernel image from the SSD through the BOOTLOADER, and performs SHA-256 hash calculation on the third image data to obtain M_KERNEL;

[0156] Step 513: The CPU performs a PCR Extend operation on M_KERNEL via TMP;

[0157] Step 514: The CPU reads RM_KERNEL from NV in TMP and determines whether RM_KERNEL is consistent with M_KERNEL;

[0158] If the judgment result is yes, proceed to step 511;

[0159] If the result is negative, proceed to step 507;

[0160] Step 515: The CPU executes the verified operating system kernel code.

[0161] To implement the operating system security verification method provided in this disclosure, this disclosure also provides an operating system security verification device, such as... Figure 6 As shown, the operating system security verification device 600 includes:

[0162] The first execution unit 601 is used to execute the initial boot block code preset in the serial peripheral interface flash memory to read the first image data of the basic input / output system image from the serial peripheral interface flash memory;

[0163] The first verification unit 602 is used to perform a first security verification on the first image data and obtain a first security verification result.

[0164] The second execution unit 603 is configured to execute the basic input / output system image when the first security verification result is passed, so as to read the second image data of the bootloader image from the serial peripheral interface flash memory;

[0165] The second verification unit 604 is used to perform a second security verification on the second image data and obtain the second security verification result.

[0166] The third execution unit 605 is used to execute the bootloader image when the second security verification result is passed, so as to read the third image data of the operating system kernel image from the main storage device;

[0167] The third verification unit 606 is used to perform a third security verification on the third mirror data and obtain the third security verification result.

[0168] The fourth execution unit 607 is used to execute the operating system kernel image if the third security verification result is passed.

[0169] In one embodiment, the first verification unit 602 is specifically used for:

[0170] Perform a hash calculation on the first image data to obtain the basic input / output system image measurement value of the basic input / output system image;

[0171] The basic input / output system mirror measurement value is extended and calculated, and it is determined whether the basic input / output system mirror measurement value is consistent with the basic input / output system mirror reference value.

[0172] If the judgment result is yes, then the first security verification result is passed.

[0173] In one embodiment, the first verification unit 602 is further specifically used for:

[0174] Send the basic input / output system image measurement values ​​to the trusted platform module;

[0175] A platform configuration register extension instruction is sent to the first platform configuration register of the trusted platform module, so that the trusted platform module performs an extension operation on the basic input / output system image measurement value based on the first initial hash value in the first platform configuration register, and updates the first initial hash value using the basic input / output system image measurement value.

[0176] In one embodiment, the second verification unit 604 is specifically used for:

[0177] Perform a hash calculation on the second image data to obtain the bootloader image measurement value of the bootloader image;

[0178] The measured values ​​of the bootloader image are expanded and calculated, and it is determined whether the measured values ​​of the bootloader image are consistent with the reference values ​​of the bootloader image.

[0179] If the judgment result is yes, then the second security verification result is passed.

[0180] In one embodiment, the second verification unit 604 is further specifically used for:

[0181] Send the bootloader image measurement values ​​to the trusted platform module;

[0182] A platform configuration register extension instruction is sent to the second platform configuration register of the trusted platform module, so that the trusted platform module performs an extension operation on the bootloader image measurement value based on the second initial hash value in the second platform configuration register, and updates the second initial hash value using the bootloader image measurement value.

[0183] In one embodiment, the third verification unit 606 is specifically used for:

[0184] The third image data is hashed to obtain the operating system kernel image measurement value of the operating system kernel image;

[0185] The measured value of the operating system kernel image is expanded, and it is determined whether the expanded value of the operating system kernel image is consistent with the reference value of the operating system kernel image.

[0186] If the judgment result is yes, then the third security verification result is passed.

[0187] In one embodiment, the third verification unit 606 is further specifically used for:

[0188] Send the operating system kernel image measurement values ​​to the trusted platform module;

[0189] A platform configuration register extension instruction is sent to the third platform configuration register of the trusted platform module, so that the trusted platform module performs an extension operation on the operating system kernel image measurement value based on the third initial hash value in the third platform configuration register, and updates the third initial hash value using the operating system kernel image measurement value.

[0190] In one embodiment, the operating system security verification apparatus provided in this disclosure further includes an alarm unit, which is used for:

[0191] If the first security verification result is not passed, or if the third security verification result is passed, the method further includes:

[0192] The startup process is terminated, and a notification indicating that the security verification result failed is sent to the baseboard management controller, so that the baseboard management controller records the corresponding security event.

[0193] It should be noted that the operating system security verification device provided in the above embodiments is only illustrated by the division of the above program modules when performing operating system security verification. In practical applications, the above processing can be assigned to different program modules as needed, that is, the internal structure of the operating system security verification device can be divided into different program modules to complete all or part of the processing described above. In addition, the operating system security verification device provided in the above embodiments and the operating system security verification method embodiments provided in this disclosure belong to the same concept, and the specific implementation process is detailed in the method embodiments, which will not be repeated here.

[0194] This disclosure also provides an operating system security verification system, such as... Figure 7 As shown, the operating system security verification system 700 includes:

[0195] Processor 701, serial peripheral interface flash memory 702, and main storage device 703;

[0196] The processor 701, mounted on the operating system motherboard, is used to execute initial boot block code preset in the serial peripheral interface flash memory 702 to read first image data of the basic input / output system image from the serial peripheral interface flash memory 702; perform a first security verification on the first image data and obtain a first security verification result; if the first security verification result is passed, execute the basic input / output system image to read second image data of the bootloader image from the serial peripheral interface flash memory 702; perform a second security verification on the second image data and obtain a second security verification result; if the second security verification result is passed, execute the bootloader image to read third image data of the operating system kernel image from the main storage device 703; perform a third security verification on the third image data and obtain a third security verification result; if the third security verification result is passed, execute the operating system kernel image.

[0197] The serial peripheral interface flash memory 702 is soldered onto the operating system motherboard and is communicatively connected to the processor 701. It is used to store the initial boot block code, the basic input / output system image, and the boot loader image.

[0198] The main storage device 703 is communicatively connected to the processor 701 and is used to store the operating system kernel image.

[0199] Specifically, the processor 701 and the serial peripheral interface flash memory 702 can communicate via the SPI communication protocol, and the processor 701 and the main storage device 703 can communicate via the PCIe / SATA communication protocol.

[0200] In one embodiment, the operating system security verification system 700 further includes a trusted platform module 704 that is communicatively connected to the processor 701;

[0201] The trusted platform module 704 includes a first platform configuration register, a second platform configuration register, and a third platform configuration register. The first platform configuration register stores a first initial hash value required for performing a first security verification on the first image data. The second platform configuration register stores a second initial hash value required for performing a second security verification on the second image data. The third platform configuration register stores a third initial hash value required for performing a third security verification on the third image data. The trusted platform module 704 also stores a basic input / output system image reference value required for performing a first security verification on the first image data, a bootloader image reference value required for performing a second security verification on the second image data, and an operating system kernel image reference value required for performing a third security verification on the third image data.

[0202] Specifically, the processor 701 and the trusted platform module 704 can communicate via the SPI / LPC communication protocol.

[0203] In one embodiment, the operating system security verification system 700 further includes a backplane management controller 705 that is communicatively connected to the processor 701;

[0204] The baseboard management controller 705 is used to receive a notification from the processor 701 that the security verification result has failed, and to record the corresponding security event.

[0205] Specifically, the processor 701 and the backplane management controller 705 can communicate via the I2C communication protocol. The backplane management controller 705 also sends fault alerts to the administrator 706 through the management network Mgmt Network.

[0206] Figure 8 This is a schematic diagram of the hardware composition structure of the electronic device provided in the embodiments of this disclosure, such as... Figure 8 As shown, the electronic device 800 includes at least one processor 802; and a memory 801 communicatively connected to the at least one processor 802; wherein the memory 801 stores instructions executable by the at least one processor 802, the instructions being executed by the at least one processor 802 to implement the steps of the operating system security verification method described in the embodiments of this disclosure.

[0207] Optionally, the electronic device may specifically be an operating system security verification device according to the embodiments of this application, and the electronic device may implement the corresponding processes implemented by the operating system security verification device in the various methods of the embodiments of this application. For the sake of brevity, it will not be described in detail here.

[0208] It is understood that the electronic device also includes a communication interface 803. Various components in the electronic device are coupled together via a bus system 804. It is understood that the bus system 804 is used to implement communication between these components. In addition to a data bus, the bus system 804 also includes a power bus, a control bus, and a status signal bus. However, for clarity, in... Figure 8 The general labeled all buses as Bus System 804.

[0209] It is understood that memory 801 can be volatile memory or non-volatile memory, or both. Specifically, non-volatile memory can be read-only memory (ROM) or programmable read-only memory (PROM). Erasable Programmable Read-Only Memory (EPROM) Electrically Erasable Programmable Read-Only Memory (EEPROM) Only memory), magnetic random access memory (FRAM), flash memory, magnetic surface memory, optical disc, or read-only optical disc (CD). ROM, Compact Disc Read Only memory); magnetic surface memory can be disk storage or tape storage. Volatile memory can be random access memory (RAM), which is used as an external cache. By way of example, but not limitation, many forms of RAM are available, such as static random access memory (SRAM), synchronous static random access memory (SSRAM), dynamic random access memory (DRAM), synchronous dynamic random access memory (SDRAM), double data rate synchronous dynamic random access memory (DDRSDRAM), enhanced synchronous dynamic random access memory (ESDRAM), synclink dynamic random access memory (SLDRAM), and direct memory bus random access memory (DRRAM). The memory 801 described in this embodiment of the invention is intended to include, but is not limited to, these and any other suitable types of memory.

[0210] The methods disclosed in the above embodiments can be applied to or implemented by processor 802. Processor 802 may be an integrated circuit chip with signal processing capabilities. During implementation, each step of the above methods can be completed by integrated logic circuits in the hardware of processor 802 or by instructions in software form. Processor 802 may be a general-purpose processor, DSP, or other programmable logic devices, discrete gate or transistor logic devices, discrete hardware components, etc. Processor 802 can implement or execute the methods, steps, and logic block diagrams disclosed in the embodiments of this invention. A general-purpose processor may be a microprocessor or any conventional processor, etc. The steps of the methods disclosed in the embodiments of this invention can be directly manifested as execution by a hardware decoding processor, or execution by a combination of hardware and software modules in the decoding processor. The software modules may be located in a storage medium, specifically memory 801. Processor 802 reads information from memory 801 and, in conjunction with its hardware, completes the steps of the aforementioned methods.

[0211] In an exemplary embodiment, the electronic device may be implemented by one or more application-specific integrated circuits (ASICs), DSPs, programmable logic devices (PLDs), complex programmable logic devices (CPLDs), FPGAs, general-purpose processors, controllers, MCUs, microprocessors, or other electronic components to perform the aforementioned method.

[0212] This disclosure also provides a non-transitory computer-readable storage medium storing computer instructions, which are used to cause the computer to execute the steps of the operating system security verification method described in this disclosure.

[0213] This disclosure also provides a computer program product, including a computer program that, when executed by a processor, implements the steps of the operating system security verification method described in this disclosure.

[0214] Optionally, the computer-readable storage medium can be applied to the operating system security verification device in the embodiments of this application, and the computer instructions cause the computer to execute the corresponding processes implemented by the operating system security verification device in the various methods of the embodiments of this application. For the sake of brevity, they will not be described in detail here.

[0215] In the several embodiments provided in this application, it should be understood that the disclosed devices and methods can be implemented in other ways. The device embodiments described above are merely illustrative. For example, the division of units is only a logical functional division, and in actual implementation, there may be other division methods, such as: multiple units or components can be combined, or integrated into another system, or some features can be ignored or not executed. In addition, the coupling, direct coupling, or communication connection between the various components shown or discussed can be through some interfaces, and the indirect coupling or communication connection between devices or units can be electrical, mechanical, or other forms.

[0216] The units described above as separate components may or may not be physically separate. The components shown as units may or may not be physical units, that is, they may be located in one place or distributed across multiple network units. Some or all of the units may be selected to achieve the purpose of this embodiment according to actual needs.

[0217] In addition, in the various embodiments of the present invention, each functional unit can be integrated into one processing unit, or each unit can be a separate unit, or two or more units can be integrated into one unit; the integrated unit can be implemented in hardware or in the form of hardware plus software functional units.

[0218] Those skilled in the art will understand that all or part of the steps of the above method embodiments can be implemented by hardware related to program instructions. The aforementioned program can be stored in a computer-readable storage medium. When the program is executed, it performs the steps of the above method embodiments. The aforementioned storage medium includes various media that can store program code, such as mobile storage devices, ROM, RAM, magnetic disks, or optical disks.

[0219] Alternatively, if the integrated units of this invention are implemented as software functional modules and sold or used as independent products, they can also be stored in a computer-readable storage medium. Based on this understanding, the technical solutions of the embodiments of this invention, or the parts that contribute to the prior art, can be embodied in the form of a software product. This computer software product is stored in a storage medium and includes several instructions to cause a computer device (which may be a personal computer, server, or network device, etc.) to execute all or part of the methods described in the various embodiments of this invention. The aforementioned storage medium includes various media capable of storing program code, such as mobile storage devices, ROM, RAM, magnetic disks, or optical disks.

[0220] The above description is merely a specific embodiment of the present invention, but the scope of protection of the present invention is not limited thereto. Any variations or substitutions that can be easily conceived by those skilled in the art within the technical scope disclosed in the present invention should be included within the scope of protection of the present invention. Therefore, the scope of protection of the present invention should be determined by the scope of the claims.

Claims

1. A system security verification method, applied to a processor in a system, comprising: executing a preset initial start block code in a serial peripheral interface flash memory to read first image data of a basic input output system image from the serial peripheral interface flash memory; performing first security verification on the first image data to obtain a first security verification result; in a case where the first security verification result is passed, executing the basic input output system image to read second image data of a bootloader image from the serial peripheral interface flash memory; performing second security verification on the second image data to obtain a second security verification result; in a case where the second security verification result is passed, executing the bootloader image to read third image data of a system kernel image from a main storage device; performing third security verification on the third image data to obtain a third security verification result; and in a case where the third security verification result is passed, executing the system kernel image. The first security verification on the first image data comprises: performing hash calculation on the first image data to obtain a basic input output system image measurement value of the basic input output system image; performing extension operation on the basic input output system image measurement value, and determining whether the basic input output system image measurement value is consistent with a basic input output system image reference value; and in a case where the determination result is yes, the first security verification result is passed. The extension operation on the basic input output system image measurement value comprises: sending the basic input output system image measurement value to a trusted platform module; and sending a platform configuration register extension instruction to a first platform configuration register of the trusted platform module, so that the trusted platform module performs extension operation on the basic input output system image measurement value based on a first initial hash value in the first platform configuration register, and updates the first initial hash value by using the basic input output system image measurement value. The second security verification on the second image data comprises: performing hash calculation on the second image data to obtain a bootloader image measurement value of the bootloader image; performing extension operation on the bootloader image measurement value, and determining whether the bootloader image measurement value is consistent with a bootloader image reference value; and in a case where the determination result is yes, the second security verification result is passed. The extension operation on the bootloader image measurement value comprises: sending the bootloader image measurement value to the trusted platform module. ​ ​ ​ ​ 2. The method of claim 1, wherein, ​ ​ ​ ​ 3. The method of claim 2, wherein, ​ ​ ​ 4. The method of claim 1, wherein, ​ ​ ​ ​ 5. The method of claim 4, wherein, ​ ​ sending a platform configuration register extension instruction to a second platform configuration register of a trusted platform module, so that the trusted platform module performs an extension operation on the bootloader image measurement value based on a second initial hash value in the second platform configuration register, and updates the second initial hash value by using the bootloader image measurement value.

6. The method of claim 1, wherein, The third security verification result is passed if the third security verification result is passed. The third security verification result is passed if the third security verification result is passed. The third security verification result is passed if the third security verification result is passed. The third security verification result is passed if the third security verification result is passed.

7. The method of claim 6, wherein, The third security verification result is passed if the third security verification result is passed. The third security verification result is passed if the third security verification result is passed. The third security verification result is passed if the third security verification result is passed.

8. The method of claim 1, wherein, 9.An operating system security verification device, applied to a processor in an operating system, and having the following characteristics. The device includes: a first execution unit configured to execute an initial startup block code pre-stored in a serial peripheral interface flash memory, to read first image data of a basic input output system image from the serial peripheral interface flash memory; a first verification unit configured to perform a first security verification on the first image data, to obtain a first security verification result; a second execution unit configured to execute the basic input output system image if the first security verification result is passed, to read second image data of a bootloader image from the serial peripheral interface flash memory; a second verification unit configured to perform a second security verification on the second image data, to obtain a second security verification result; a third execution unit configured to execute the bootloader image if the second security verification result is passed, to read third image data of an operating system kernel image from a main storage device; a third verification unit configured to perform a third security verification on the third image data, to obtain a third security verification result; a fourth execution unit configured to execute the operating system kernel image if the third security verification result is passed. 10.An operating system security verification system, having the following characteristics. ​ ​ The system comprises a processor, a serial peripheral interface flash memory and a main storage device; The processor is arranged on an operating system mainboard and is configured to execute an initial startup block code pre-stored in the serial peripheral interface flash memory to read first mirror data of a basic input output system mirror from the serial peripheral interface flash memory; The first mirror data is subjected to first security verification to obtain a first security verification result; In a case where the first security verification result is passed, the basic input output system mirror is executed to read second mirror data of a bootloader mirror from the serial peripheral interface flash memory; The second mirror data is subjected to second security verification to obtain a second security verification result; In a case where the second security verification result is passed, the bootloader mirror is executed to read third mirror data of an operating system kernel mirror from the main storage device; The third mirror data is subjected to third security verification to obtain a third security verification result; In a case where the third security verification result is passed, the operating system kernel mirror is executed; The serial peripheral interface flash memory is welded on the operating system mainboard and is in communication connection with the processor and is configured to store the initial startup block code, the basic input output system mirror and the bootloader mirror; The main storage device is in communication connection with the processor and is configured to store the operating system kernel mirror.

11. The system of claim 10, wherein, The system further comprises a trusted platform module in communication connection with the processor; The trusted platform module comprises a first platform configuration register, a second platform configuration register and a third platform configuration register; the first platform configuration register is configured to store a first initial hash value required for the first security verification of the first mirror data, the second platform configuration register is configured to store a second initial hash value required for the second security verification of the second mirror data, and the third platform configuration register is configured to store a third initial hash value required for the third security verification of the third mirror data; The trusted platform module is further configured to store a basic input output system mirror reference value required for the first security verification of the first mirror data, a bootloader mirror reference value required for the second security verification of the second mirror data and an operating system kernel mirror reference value required for the third security verification of the third mirror data.

12. The system of claim 10, wherein, The system further comprises a baseboard management controller in communication connection with the processor; The baseboard management controller is configured to receive a notification of a failed security verification result sent by the processor and record a corresponding security event.

13. An electronic device, comprising: Comprise: At least one processor; And A memory in communication connection with the at least one processor; wherein The memory stores instructions executable by the at least one processor, and the instructions are executed by the at least one processor to enable the at least one processor to execute the method in any one of claims 1 to 8.

14. A non-transitory computer-readable storage medium having stored thereon computer instructions, wherein, The computer instructions are for causing the computer to perform the method of any one of claims 1 to 8.

Images