Certificate activation method and computing device

Abstract

The embodiment of the invention provides a certificate activation method and computing equipment. The method comprises the steps of obtaining certificate data of at least one first certificate; determining at least one second certificate in the at least one first certificate based on certificate data of the first certificate; wherein the second certificate is a certificate needing to be activated; storing the at least one second certificate in a shared memory and / or a processing unit; and when it is detected that the basic output system of the computing device is started up, triggering an interrupt operation, so that the basic input / output system obtains and activates at least one target certificate from the shared memory and / or the processing unit in response to the interrupt operation. By adopting the method, the processing unit can obtain and activate the required certificate from the shared memory and / or the processing unit by triggering the interrupt operation in the process that the basic input and output system is started and the actual service logic is processed, so that online on-demand activation of the certificate is realized, and the operation flexibility is improved.

Description

Technical Field

[0001] This application relates to the field of security authentication technology, and in particular to a certificate activation method and computing device. Background Technology

[0002] In large-scale remote deployment scenarios, to ensure secure communication between the central computing device and remote computing devices, an authentication mechanism is typically required to verify the identities of both parties. This authentication mechanism is generally based on certificates, verifying the identity through the matching of public and private keys, thereby enhancing deployment security.

[0003] Before using certificates for authentication, certificate activation is required to enable the certificate to participate in subsequent secure communications. However, existing certificate activation mechanisms typically involve embedding multiple certificates into the Basic Input / Output System (BIOS), resulting in limited flexibility as activation can only be achieved by restarting the BIOS during operation. Summary of the Invention

[0004] This application provides a certificate activation method and computing device. After the basic input / output system has started up and is processing actual business logic, an interrupt operation can be triggered to retrieve and activate the required certificate from shared memory and / or processing unit, thereby realizing online on-demand certificate activation and improving operational flexibility.

[0005] To achieve the above objectives, the embodiments of this application adopt the following technical solutions:

[0006] In a first aspect, embodiments of this application provide a certificate activation method applied to a processing unit of a computing device. The method includes: acquiring certificate data of at least one first certificate; determining at least one second certificate among the at least one first certificate based on the certificate data of the first certificate; wherein the second certificate is a certificate that needs to be activated; storing at least one second certificate in shared memory and / or a processing unit; and triggering an interrupt operation when it is detected that the basic input / output system of the computing device has finished starting up, so that the basic input / output system responds to the interrupt operation by acquiring and activating at least one target certificate from the shared memory and / or the processing unit.

[0007] Based on this scheme, during the operation of the basic input / output system, the required certificate can be dynamically loaded and activated through the interrupt coordination mechanism between the processing unit and the basic input / output system. There is no need to pre-embed the certificate into the firmware of the basic input / output system, nor is it necessary to rely on device restart. This realizes online on-demand activation of the certificate, improving operational flexibility and efficiency.

[0008] In one possible implementation, the processing unit determines at least one second certificate based on the certificate data of the first certificate, including: the processing unit determines at least one third certificate conforming to a preset specification among the at least one first certificate based on the certificate data of the first certificate and preset certificate data; and the processing unit determines at least one second certificate among the at least one third certificate if the certificate data of the determined third certificate includes configuration data.

[0009] Based on this solution, by pre-setting certificate data, the system verifies the validity of multiple first certificates. Then, it retrieves the certificate that needs to be activated from the valid certificates, i.e., the second certificate. In this way, the layered certificate filtering mechanism can improve the intelligence and flexibility of certificate management, and effectively avoid the accidental or redundant activation of unnecessary certificates, thereby saving system resources and improving efficiency.

[0010] In another possible implementation, storing at least one second certificate in shared memory includes: converting the data content of at least one second certificate into a new format, and then storing the converted data content in shared memory.

[0011] Based on this solution, a shared memory and data format standardization mechanism are introduced into the certificate activation process to avoid storage limitations. Specifically, the data content of the second certificate is format-converted before being written to shared memory, enabling certificate data from different sources and in different formats to be correctly parsed and used by the basic input / output system under a unified format. In this way, storing the certificate to be activated in shared memory avoids it being permanently stored in the basic input / output system, achieving dynamic loading and flexible management of certificate data.

[0012] In another possible implementation, obtaining at least one first certificate includes: receiving a first input operation from a user based on an out-of-band management interface, the first input operation including at least one first certificate.

[0013] Based on this solution, at least one first certificate is obtained through the out-of-band management interface, enabling the processing unit to receive certificate data from the remote management terminal even when the local operating system is not started, is abnormal, or unavailable, and to independently complete the certificate storage and filtering process, thus ensuring the reliability of certificate management.

[0014] In another possible implementation, the processing unit includes a substrate management controller or a central processing unit.

[0015] Based on this solution, out-of-band acquired certificates can be screened and stored through either the baseboard management controller or the central processing unit. This enables flexible management and security control of certificates, thereby improving the security of the entire computing device.

[0016] Another possible implementation includes: the processing unit constructs shared memory based on the address space; the address space is used to identify the starting location and access permissions of the shared memory; so that the basic input / output system establishes an access mapping relationship with the shared memory based on the address space.

[0017] Based on this scheme, shared memory and its access mapping are established between the processing unit and the basic input / output system before the startup phase, enabling the processing unit and the basic input / output system to exchange certificate-related data efficiently and securely.

[0018] Secondly, embodiments of this application also provide another certificate activation method, applied to a processing unit of a computing device, comprising: acquiring certificate data of at least one first certificate; determining at least one second certificate among the at least one first certificate based on the certificate data of the first certificate; wherein the second certificate is a certificate that needs to be activated; storing at least one second certificate in shared memory and / or a processing unit; and, if it is detected that the basic input / output system of the computing device has not completed startup, causing the basic input / output system to acquire and activate at least one target certificate from the shared memory and / or the processing unit.

[0019] Based on this scheme, through the collaborative mechanism between the processing unit and the basic input / output system (PIS), the required certificate can be obtained and activated in shared memory or the processing unit during the early stages of the PIS startup, without relying on firmware hardening or system restart. This enables online, on-demand certificate activation, improving the flexibility of certificate management.

[0020] Thirdly, this application also provides another certificate activation method applied to the basic input / output system of a computing device. The method includes: when the basic input / output system of the computing device has been started, in response to an interrupt operation, suspending the execution of business processing logic, and obtaining and activating at least one target certificate from shared memory and / or processing unit.

[0021] Based on this solution, the basic input / output system can respond to interruption operations, pause the execution of business processing logic, dynamically load and activate the required certificates, without pre-hardening the certificates into the firmware or relying on device restarts, thereby realizing online on-demand certificate activation and improving operational flexibility and efficiency.

[0022] In one possible implementation, in response to an interrupt operation, obtaining and activating at least one target certificate from shared memory and a processing unit includes: obtaining configuration data of the certificate to be activated from the processing unit; obtaining certificate data corresponding to the configuration data from shared memory based on the configuration data; and obtaining and activating at least one target certificate from the activated certificate based on the certificate data and preset data.

[0023] Based on this scheme, the Basic Input / Output System (BIOS) can obtain at least one second certificate from the processing unit and shared memory. This improves the flexibility of the certificate acquisition path; simultaneously, it performs secondary verification on certificates requiring activation, identifying at least one target certificate that conforms to preset specifications from among the certificates requiring activation. This avoids certificate modification before it is obtained from the processing unit to the BIOS, thus improving the overall security of the computing device.

[0024] In another possible implementation, it further includes: in response to a second input operation by the user in the visual interface, obtaining at least one fourth certificate; and identifying at least one target certificate that conforms to a preset specification among the at least one fourth certificate.

[0025] Based on this solution, the basic input / output system can also obtain the certificate that needs to be activated through in-band and verify the legality of the obtained certificate. In this way, while ensuring security, the system achieves diversification of the target certificate acquisition method and improves the system's flexibility.

[0026] Fourthly, embodiments of this application also provide another certificate activation method applied to the basic input / output system of a computing device. The method includes: when it is detected that the basic input / output system of the computing device has not been fully started, the basic input / output system obtains and activates at least one target certificate from shared memory and / or processing unit.

[0027] Based on this solution, when the basic input / output system of a computing device is detected as not having fully started, the basic input / output system can dynamically load and activate the required certificate without pre-hardening the certificate into the firmware or relying on a device restart. This achieves online on-demand activation of the certificate, improving operational flexibility and efficiency.

[0028] Fifthly, embodiments of this application also provide another certificate activation method applied to a computing device. The method includes: a processing unit of the computing device acquiring certificate data of at least one first certificate; the processing unit determining at least one second certificate among the at least one first certificate based on the certificate data of the first certificate; wherein the second certificate is a certificate that needs to be activated; the processing unit triggering an interrupt operation when it detects that the basic input / output system of the computing device has finished starting; in response to the interrupt operation, the basic input / output system suspends the processing logic of the basic input / output system executing business, and acquires and activates at least one target certificate from shared memory and / or the processing unit.

[0029] Based on this scheme, during the operation of the basic input / output system, the required certificate can be dynamically loaded and activated through the interrupt coordination mechanism between the processing unit and the basic input / output system. There is no need to pre-embed the certificate into the firmware or rely on device restart, thus realizing online on-demand activation of the certificate and improving operational flexibility and efficiency.

[0030] Another possible implementation includes: the processing unit constructs shared memory based on the address space; the address space is used to identify the starting location and access permissions of the shared memory; and the basic input / output system establishes an access mapping relationship with the shared memory based on the address space.

[0031] Based on this scheme, shared memory and its access mapping are established between the processing unit and the basic input / output system before the startup phase, enabling the processing unit and the basic input / output system to exchange certificate-related data efficiently and securely.

[0032] Fifthly, embodiments of this application also provide another certificate activation method applied to a computing device. The method includes: a processing unit of the computing device acquiring certificate data of at least one first certificate; the processing unit determining at least one second certificate among the at least one first certificate based on the certificate data of the first certificate; wherein the second certificate is a certificate that needs to be activated; and when the processing unit detects that the basic input / output system of the computing device has not been fully started, the basic input / output system acquires and activates at least one target certificate from shared memory and / or the processing unit.

[0033] Based on this scheme, through the collaborative mechanism between the processing unit and the basic input / output system (PIS), the required certificate can be obtained and activated in shared memory or the processing unit during the early stages of the PIS startup, without relying on firmware hardening or system restart. This enables online, on-demand certificate activation, improving the flexibility of certificate management.

[0034] In a sixth aspect, embodiments of this application also provide a computing device, including: a processor and a memory; the processor and the memory are coupled; the memory is used to store program instructions; the processor is used to execute the program instructions to perform the method as described in any one of the first and fifth aspects above.

[0035] In a seventh aspect, embodiments of this application provide a chip for performing the methods described in any one of the first and fifth aspects above.

[0036] Eighthly, embodiments of this application provide a computer-readable storage medium storing computer-executable instructions, which, when executed by a computer, implement the method as described in any one of the first and fifth aspects.

[0037] Ninthly, embodiments of this application provide a program product including a computer program that, when executed by a processor, implements the method as described in any one of the first and fifth aspects. Attached Figure Description

[0038] Figure 1 This is a schematic diagram of a remote server deployment scenario provided in an embodiment of this application;

[0039] Figure 2 This is a schematic diagram of a hardware system architecture for a computing device used to perform certificate activation operations, provided in an embodiment of this application.

[0040] Figure 3 This is a first flowchart illustrating a certificate activation method provided in an embodiment of this application;

[0041] Figure 4 This is a first structural schematic diagram of a certificate activation method provided in an embodiment of this application;

[0042] Figure 5 This is the first interactive schematic diagram of a certificate activation method provided in this application embodiment;

[0043] Figure 6 This is a schematic diagram of a certificate data structure provided in an embodiment of this application;

[0044] Figure 7 This is a schematic diagram illustrating the determination of at least one target certificate according to an embodiment of this application;

[0045] Figure 8 This is a schematic diagram of the interface of a basic input / output system provided in an embodiment of this application;

[0046] Figure 9 This is a second flowchart illustrating a certificate activation method provided in an embodiment of this application;

[0047] Figure 10 This is a third structural diagram of a certificate activation method provided in an embodiment of this application;

[0048] Figure 11 This is a second interactive schematic diagram of a certificate activation method provided in an embodiment of this application;

[0049] Figure 12 This is a schematic diagram of a shared memory construction method provided in an embodiment of this application;

[0050] Figure 13 This is a schematic flowchart of a method for a processing unit to perform certificate activation according to an embodiment of this application;

[0051] Figure 14This is a schematic flowchart of a method for activating a certificate in a basic input / output system, provided in an embodiment of this application.

[0052] Figure 15 This is a schematic diagram of a computing device provided in an embodiment of this application. Detailed Implementation

[0053] The technical solutions of the embodiments of this application will now be described with reference to the accompanying drawings. To facilitate a clear description of the technical solutions of the embodiments of this application, the use of terms such as "first," "second," etc., in the embodiments of this application is for illustrative purposes and to distinguish the objects being described. There is no particular order between them, nor does it indicate a specific limitation on the number of devices in the embodiments of this application, and they do not constitute any limitation on the embodiments of this application.

[0054] To enable those skilled in the art to better understand the technical solutions in this application, the technical solutions in the embodiments of this application will be clearly and completely described below with reference to the accompanying drawings. Obviously, the described embodiments are only some embodiments of this application, and not all embodiments. Based on the embodiments in this application, all other embodiments obtained by those of ordinary skill in the art without creative effort should fall within the scope of protection of this application.

[0055] It should be noted that many specific details are set forth in the following description in order to provide a full understanding of this application. However, this application may also be implemented in other ways different from those described herein. Therefore, the scope of protection of this application is not limited to the specific embodiments disclosed below.

[0056] The following explanations of the technical terms mentioned in the embodiments of this application are provided to facilitate understanding by those skilled in the art.

[0057] The Basic Input / Output System (BIOS) is the lowest-level firmware that runs first when a computer boots up. It is responsible for initializing the hardware and loading the operating system. It begins operating the moment power is supplied and continues through two consecutive, overlapping lifecycles: the "boot phase" and the "run phase." The boot phase, also known as the pre-boot phase, begins when the computing device powers on or restarts until the operating system kernel image is successfully loaded and gains control. During this period, the BIOS primarily performs hardware self-tests and hardware initialization. In the run phase, after the operating system kernel has taken over system control, the BIOS does not completely exit but runs in the background. During this period, the BIOS primarily performs hardware event handling and firmware upgrades.

[0058] An operating system (OS) is system software that controls and manages the hardware and software resources of a computing device, organizes workflows, and provides a unified interface and services for users and applications. It is the most core and fundamental system software in a computing device, acting as a bridge between users, applications, and hardware.

[0059] The baseboard management controller (BMC) is an independent, always-powered microcontroller located on the motherboard of a computing device. It typically serves as a core component for out-of-band management (OOBM) functions in computing devices. The BMC has its own processor, memory, firmware, and network interface, enabling it to continue operating even when the operating system is not running, the system has crashed, or the device is powered off (but the motherboard remains powered on).

[0060] A digital certificate is a digital authentication that identifies the parties involved in internet communication and can be used to verify their identity online. A digital certificate includes specific data content, which is fixed and unchangeable once the certificate is created. In this embodiment, for simplicity, a certificate will be used as the basis for explanation.

[0061] The embodiments of this application will now be described with reference to the accompanying drawings.

[0062] In large-scale remote deployment scenarios, to ensure secure communication between the central computing device and remote computing devices, an authentication mechanism is typically required to verify the identities of both parties. This authentication mechanism is generally based on certificates, verifying the identity through the matching of public and private keys, thereby enhancing deployment security.

[0063] For example, the following is combined with Figure 1 A specific example is provided to illustrate the deployment process of remote computing devices.

[0064] Figure 1 This is a schematic diagram of a remote server deployment scenario provided in an embodiment of this application.

[0065] like Figure 1As shown, central computing device 1 is used for unified management and deployment of multiple remote computing devices, such as remote computing devices 3a, 3b, and 3c. After a remote computing device powers on, since no IP address has been assigned, it first checks whether HTTPS Boot is enabled in its basic input / output system. If HTTPS Boot is enabled, the remote computing device will broadcast a request to Dynamic Host Configuration Protocol (DHCP) computing device 2 to obtain an IP address and query the Uniform Resource Locator (URL) information required for booting. The DHCP server responds to the request, assigns an IP address to the remote computing device, and provides the URL information for booting the central computing device. The remote computing device accesses central computing device 1 based on this URL information to prepare to download the boot file. Before attempting to download the boot file from the central computing device, the remote computing device must first verify the identities of both parties through a certificate-based authentication mechanism, such as public key and private key matching verification. After successful authentication, the remote computing device downloads and executes the boot file from the central computing device, continuing the operating system loading and deployment process.

[0066] Before using certificates for authentication as described above, the certificate needs to be activated to ensure that a valid certificate can be used in subsequent authentication processes.

[0067] Figure 2 This is a schematic diagram of the hardware system architecture of a computing device for performing certificate activation operations, provided in an embodiment of this application.

[0068] Combination Figure 2 As shown, an out-of-band tool 21 in the computing device acquires at least one first certificate input by the user. The out-of-band tool 21 sends the at least one certificate to a processing unit 22 in the computing device. The processing unit 22 determines at least one second certificate from the at least one first certificate that meets a preset specification and needs to be activated. The processing unit 22 stores the second certificate that meets the preset specification and needs to be activated in shared memory 23 and stores the certificate that meets the preset specification in non-volatile memory 24 in the computing device. If the basic input / output system 25 of the computing device detects that the basic output system of the computing device is not complete, the basic input / output system 25 acquires and activates at least one target certificate from shared memory and / or the processing unit. If the basic input / output system 25 detects that the basic output system of the computing device has started successfully, the processing unit 22 triggers an interrupt operation. The basic input / output system 25 responds to the interrupt operation and acquires and activates at least one target certificate from shared memory and / or the processing unit.

[0069] The certificate activation method is described in detail below with reference to the accompanying drawings.

[0070] Figure 3 This is a schematic diagram of the first process of a certificate activation method provided in an embodiment of this application.

[0071] Figure 4 This is the first structural schematic diagram of a certificate activation method provided in the embodiments of this application.

[0072] like Figure 3 and Figure 4 As shown, the certificate activation method includes the following steps:

[0073] S1: The processing unit acquires the certificate data of at least one first certificate.

[0074] The processing unit can be a baseboard management controller or a central processing unit (CPU); no specific limitation is made here. For example... Figure 4 As shown, the processing unit may include a certificate management engine 01, which is used to perform various operations related to certificates. For the sake of clarity, the certificate management engine 01 will be described using the processing unit as the main execution entity.

[0075] In one implementation, the processing unit receives a first input operation from the user based on an out-of-band management interface to obtain certificate data for at least one first certificate.

[0076] An out-of-band management interface (OI) is a communication interface provided by a hardware-level remote management subsystem (out-of-band tool) independent of the main operating system and processing unit. Even if the computing device is not powered on or the operating system has crashed, it can still be monitored and controlled through the OI. An OI refers to a communication interface (e.g., a RESTful API) that supports communication between a client and a computing device. The OI can run on the processing unit (e.g., the BMC) or independently on the motherboard of the computing device; no specific limitation is made here.

[0077] Figure 5 This is the first interactive schematic diagram of a certificate activation method provided in the embodiments of this application.

[0078] Combination Figure 5 As shown, the processing unit receiving the user's first input operation based on the out-of-band management interface may include step S1003.

[0079] S1003: The processing unit receives a first input operation from the user based on the out-of-band management interface. The first input operation includes at least one first certificate.

[0080] The first certificate can be a certificate encapsulated in JSON format or other formats, without any specific restrictions here.

[0081] Out-of-band tools can provide an out-of-band management interface to present operation entry points to users and receive their input commands. This out-of-band management interface can take various forms, such as a command-line interface (CLI), an application programming interface (API), or other types of user interfaces. The specific interface form provided depends on the type of out-of-band tool used and is not limited here.

[0082] For example, the processing unit responds to the first input operation entered by the user in the out-of-band management interface. If the first input operation includes a first number of 8 certificates, namely certificate A, certificate B, certificate C, certificate D, certificate E, certificate F, certificate G, and certificate H, then the processing unit obtains certificate A, certificate B, certificate C, certificate D, certificate E, certificate F, certificate G, and certificate H based on the out-of-band management interface.

[0083] It should be noted that, continuing to combine Figure 5 As shown, before the processing unit acquires multiple first certificates, the basic input / output system performs necessary out-of-band configuration to ensure system security. Simultaneously, to enable the system to interact smoothly with external services, such as acquiring certificates, the processing unit requires specific user configuration. Specifically, the configuration steps include steps S1001 and S1002.

[0084] S1001: In response to a power-on operation, the basic input / output system starts and performs out-of-band configuration.

[0085] For example, out-of-band configuration may include secure boot policy configuration, processing unit management interface access control policy, etc.

[0086] S1002: In response to power-on operation, the processing unit performs user configuration.

[0087] For example, user configuration may include network parameter settings, identity authentication information configuration, certificate usage definition, access control, etc.

[0088] It should be noted that the order of steps S1001 and S1002 is not specifically limited.

[0089] S2: The processing unit determines at least one second certificate from at least one first certificate based on the certificate data of the first certificate.

[0090] The certificate data may include the specific content contained in the digital certificate itself (such as certificate subject information, public key, issuer, validity period, signature, etc.). Alternatively, the certificate data may include both the specific content contained in the digital certificate itself (such as certificate subject information, public key, issuer, validity period, signature, etc.) and configuration data related to the certificate. The configuration data is used to represent management operation information for the certificate, such as operation identifiers for update, add, etc.

[0091] Combination Figure 6 As shown, Figure 6 This is a schematic diagram of the data structure of a certificate provided in an embodiment of this application.

[0092] For example, such as Figure 6 As shown in (a) above, the certificate data can include only the specific content contained in the digital certificate itself. For example... Figure 6 As shown in (b), the certificate data includes both the specific content contained in the digital certificate itself and the configuration data associated with the certificate.

[0093] In one implementation, the combination continues. Figure 4 As shown, step S2 includes steps S21-S24.

[0094] S21: The processing unit determines at least one third certificate that conforms to the preset specifications from at least one first certificate based on the certificate data of the first certificate and the preset certificate data.

[0095] The processing unit verifies the certificate data content against preset certificate data. The preset certificate data can be generated according to the data structure defined by the standard certificate protocol, or it can directly use the standard certificate protocol itself. The standard certificate protocol encapsulates the basic content of the certificate, including fields such as certificate subject information, public key, issuer, validity period, and digital signature. This standard certificate protocol can be used to verify the legitimacy of certificates. When the certificate data content meets all the requirements of the standard certificate protocol, the certificate is determined to be a legitimate certificate, i.e., it conforms to the preset specifications; conversely, if the certificate does not meet the protocol requirements, it is determined to be an illegitimate certificate, i.e., it does not conform to the preset specifications.

[0096] For example, a standard certificate protocol could be the x509 protocol.

[0097] In one example, continue combining Figure 5 As shown, step S21 includes step S1004.

[0098] S1004: The processing unit determines at least one third certificate that conforms to the preset specifications.

[0099] Continuing with the example above, among the eight first certificates, assume that five are valid, such as certificate A, certificate B, certificate C, certificate D, and certificate E. That is, there are five third certificates, namely certificate A, certificate B, certificate C, certificate D, and certificate E.

[0100] Optionally, after obtaining at least one third certificate that conforms to the preset specifications, in order to enhance the security of the computing device, the third certificate can be stored in the non-volatile memory of the processing unit for subsequent security verification or encrypted communication.

[0101] The following explanation is based on step S22.

[0102] S22: The processing unit stores at least one third certificate into the non-volatile memory corresponding to the processing unit.

[0103] Non-volatile memory (NVM) is a type of computer memory that retains data even after the power is turned off.

[0104] In one example, to ensure security, at least one third-party certificate is stored in non-volatile memory using encryption.

[0105] Continue to combine Figure 5 As shown, step S22 includes step S1005.

[0106] S1005: The processing unit uses an encryption protocol to encrypt and store at least one third certificate in non-volatile memory.

[0107] For example, the encryption protocol could be TLS, AES, etc., without being specifically limited here.

[0108] Following step S1005 and before determining the second certificate, a preparation phase is included to ensure adequate preparation for the subsequent certificate verification process. The specific details of this preparation phase can be explained in conjunction with steps S1006-S1007.

[0109] S1006: During the startup phase, the Basic Input / Output System determines that the current computing device is configured with a network startup item.

[0110] Network boot is a method by which a computing device loads an operating system or bootloader from a remote server via a network interface during the boot process, instructing the computing device where to begin loading.

[0111] A network startup item can be either an HTTP Boot startup item or a TFTP startup item; no specific limitation is made here. The following explanation uses an HTTP Boot startup item as an example.

[0112] like Figure 4 As shown, the Basic Input / Output System (PIS) may include a dynamic loading engine 02, used for dynamically loading certificates and performing activation operations. For the sake of clarity, the dynamic loading engine 02 will be described using the PIS as the execution entity as an example.

[0113] S1007: The basic input / output system executes the startup item based on the network startup item and sends an acquisition request to the processing unit.

[0114] For example, during the startup phase, the Basic Input / Output System detects that the current computing device is configured with an HTTP Boot startup item, executes the HTTP Boot startup item, and sends an retrieval request to the processing unit. This retrieval request is used to obtain the certificate that needs to be activated.

[0115] After confirming that at least one third-party certificate complies with the relevant specifications, the next step is to determine which of these certificates need to be activated. In one implementation, the need for certificate activation can be determined based on the certificate data within the certificate: if the certificate data contains configuration information, it indicates that the certificate may need to be activated in order to take effect in the system and participate in subsequent security verification or configuration processes.

[0116] The following is a detailed explanation of step S23.

[0117] S23: If the processing unit determines that the certificate data of the first certificate includes configuration data, it determines at least one second certificate that needs to be activated from at least one third certificate.

[0118] If the certificate data includes configuration data, it means the certificate needs to be activated. Continue to combine... Figure 6 As shown in (b), the “Operation” field can be used as an activation identifier to indicate that the certificate is the one that needs to be used at the moment and to include it in the subsequent operation process.

[0119] In one example, continue combining Figure 5 As shown, step S23 includes step S1008.

[0120] S1008: In response to the acquisition request, the processing unit determines at least one second certificate that needs to be activated from at least one third certificate.

[0121] The second certificate is the one that needs to be activated. Certificates requiring activation must meet the preset specifications.

[0122] Continuing with the example above, suppose that only two of the five certificates mentioned above contain configuration data in their third certificates, namely Certificate A and Certificate B. In this case, the processing unit determines the two second certificates that need to be activated from among Certificate A, Certificate B, Certificate C, Certificate D, and Certificate E, namely Certificate A and Certificate B.

[0123] S3: The processing unit stores at least one second certificate in shared memory and / or in the processing unit.

[0124] In one implementation, at least one second certificate is stored in shared memory as an example.

[0125] Shared memory is a pre-built and configured memory region that can be accessed by both the processing unit and the basic input / output system.

[0126] The second certificate can be encapsulated in JSON format. It should be noted that the configuration data within the certificate data can be stored directly in shared memory, or it can be converted to a different format before being stored in shared memory; no specific limitation is made here.

[0127] The following example illustrates how configuration data from certificate data can be directly stored in shared memory. Specifically, the content contained in the second certificate itself is extracted, i.e., the data content, and converted into a unified data format to generate standardized data content. This standardized data content, along with the configuration data, is then stored in shared memory.

[0128] For example, a uniform certificate structure can be an original equipment manufacturer (OEM) certificate structure or other standardized structure forms, without specific limitations here.

[0129] For example, data encapsulated in JSON format can be converted into an OEM certificate structure and stored in shared memory.

[0130] In another embodiment, at least one second certificate is stored in the processing unit as an example.

[0131] In one example, the processing unit stores the certificate data of at least one second certificate in the processing unit. Exemplarily, the data content in the certificate data can be converted to a uniform format, and the uniform format data content and configuration data can be stored in the processing unit. Alternatively, the certificate data of the second certificate can be directly stored in the processing unit; no specific limitation is made here.

[0132] In another embodiment, the configuration data in the certificate data of at least one second certificate is stored in the processing unit, the data content in the certificate data of at least one second certificate is converted into a format, and the converted data content is stored in shared memory.

[0133] For example, continue to combine Figure 5 As shown, the example of storing at least one second certificate in shared memory is used for illustration. Step S3 includes steps S1009-S1010.

[0134] S1009: The processing unit stores at least one second certificate in a uniform format into shared memory.

[0135] Continuing with the example above, the processing unit receives the data content of certificate A and certificate B. These certificates are encapsulated in JSON format. The processing unit performs format conversion to obtain the converted data content of certificate A' and certificate B', and stores the data content of certificate A' and certificate B' in shared memory.

[0136] Optionally, the processing unit may inform the basic input / output system of the storage status of the certificate. The following is an illustrative description in conjunction with step S1010.

[0137] S1010: The processing unit sends the storage status to the basic input / output system.

[0138] The storage status is used to characterize the status of storing the second certificate.

[0139] For example, the processing unit sends a message to the basic input / output system stating that "the data content of certificate A' and the data content of certificate B' have been stored in shared memory".

[0140] When the processing unit detects that the basic output system of the computing device is in the startup phase, that is, the basic input / output system is in the startup phase, the basic input / output system can obtain at least one second certificate from shared memory and / or the processing unit. The following is an illustrative description in conjunction with step S5.

[0141] S4: The basic input / output system obtains at least one target certificate from shared memory and / or processing units.

[0142] The target certificate is the certificate that needs to be activated currently. The target certificate may include only the certificate from the second certificate that conforms to the preset specifications, or it may include not only the certificate from the second certificate but also the certificate from the fourth certificate that conforms to the preset specifications. The fourth certificate is the certificate that meets the preset specifications and is obtained by the basic input / output system in-band.

[0143] The following is an example of how to obtain the two types of certificates to be activated.

[0144] In one implementation, when the target certificate only includes certificates that conform to the preset specifications in the second certificate, the basic input / output system may determine at least one certificate to be activated in steps S41-S42.

[0145] S41: If the target certificate includes a second certificate that conforms to a preset specification, the basic input / output system obtains at least one second certificate from shared memory and / or the processing unit.

[0146] Continue to combine Figure 4 As shown, the basic input / output system can determine at least one second certificate in various ways, such as directly from shared memory, from the processing unit, or by obtaining it from both shared memory and the processing unit.

[0147] The implementation method described above will be explained in detail below.

[0148] Figure 7 This is a schematic diagram illustrating the determination of at least one target certificate according to an embodiment of this application.

[0149] like Figure 7 As shown in (a) in the example, step S41 includes step S411.

[0150] S411: The basic input / output system obtains at least one second certificate from the processing unit.

[0151] For example, the basic input / output system sends a certificate request to the processing unit to obtain "at least one second certificate"; in response to the certificate request, the processing unit sends at least one second certificate, namely certificate A and certificate B, to the basic input / output system.

[0152] like Figure 7 As shown in (b) of the example, in another example, step S41 includes step S412.

[0153] S412: The basic input / output system obtains the configuration data of the certificate to be activated from the processing unit; based on the configuration data to be activated, the basic input / output system obtains the certificate data corresponding to the configuration data to be activated from the shared memory.

[0154] For example, the basic input / output system obtains the configuration data of the certificate to be activated, namely configuration data A1 and configuration data B1, from the processing unit. Then, the basic input / output system obtains the certificate data corresponding to the configuration data to be activated, namely certificate A corresponding to configuration data A1 and certificate B corresponding to configuration data B1, from shared memory.

[0155] like Figure 7 As shown in (c) in another example, step S41 includes step S413.

[0156] S413: The basic input / output system obtains at least one second certificate from shared memory.

[0157] For example, the basic input / output system parses the certificate structure in shared memory to obtain at least one second certificate, namely certificate A and certificate B.

[0158] The following will continue to combine Figure 5 As shown, taking step S413 as an example, step S413 includes step S1011.

[0159] S1011: The basic input / output system obtains at least one second certificate from shared memory.

[0160] Continuing with the example above, the Basic Input / Output System parses the certificate structure in shared memory to obtain two secondary certificates, namely Certificate A and Certificate B.

[0161] S42: The basic input / output system determines at least one target certificate that conforms to a preset specification from at least one second certificate.

[0162] The following will continue to combine Figure 5 As shown, step S42 includes step S1012.

[0163] S1012: The basic input / output system determines at least one target certificate that conforms to a preset specification from at least one second certificate.

[0164] Step S42 can be referred to the specific content of step S21 above, and will not be repeated here.

[0165] Continuing with the example above, suppose that only certificate A meets the preset specifications. In this case, the basic input / output system determines that the target certificate is certificate A.

[0166] In another implementation, the basic input / output system can also provide an entry point for obtaining a certificate to be activated. Specifically, when the certificate to be activated includes a second certificate that conforms to a preset specification and a fourth certificate that conforms to a preset specification, the basic input / output system determines at least one certificate to be activated, i.e., the target certificate, based on at least one second certificate and at least one fourth certificate.

[0167] The following steps are combined with steps S43-S45.

[0168] S43: The basic input / output system acquires at least one second certificate.

[0169] Step S43 can refer to the specific content of step S41 above, and is not specifically limited here.

[0170] Based on the example above, the basic input / output system obtains certificate A.

[0171] S44: The basic input / output system obtains at least one fourth certificate in response to a second input operation by the user in the visual interface.

[0172] Figure 8 This is a schematic diagram of the interface of a basic input / output system provided in an embodiment of this application.

[0173] like Figure 8 As shown, the basic input / output system responds to a second input operation 081 by the user importing control 81 in the visual interface, and obtains at least one fourth certificate, namely certificate X, certificate Y and certificate Z.

[0174] It should be noted that this application only uses a visual interface of a basic input / output system as an example, but other interface forms are also possible, and no specific limitation is made here.

[0175] S45: The basic input / output system determines at least one target certificate that conforms to a preset specification among at least one fourth certificate and at least one second certificate.

[0176] S45 can refer to the specific content of step S21 above, and is not specifically limited here.

[0177] For example, if only certificate Z in the fourth certificate conforms to the preset specifications, then among certificate A, certificate X, certificate Y and certificate Z, at least one target certificate that conforms to the preset specifications is determined, namely certificate A and certificate Z.

[0178] S5: The basic input / output system activates at least one target certificate.

[0179] In one implementation, the combination continues. Figure 5 As shown, step S5 includes step S1012.

[0180] S1013: The Basic Input / Output System activates the target certificate.

[0181] In one example, the certificate data of the target certificate is converted into binary format and stored in the variable pool of the basic input / output system to complete the activation of the target certificate.

[0182] The variable pool can be a variable pool based on the Transport Layer Security (TLS) protocol, i.e., a TLS variable pool, or other variable pools. Different certificates can be stored in different variable pools or in the same variable pool; no specific restrictions are made here.

[0183] It should be noted that after the target certificate is activated, the basic input / output system sends the certificate status of the target certificate to the processing unit for reporting in the security log. The specific process will not be described in detail here.

[0184] Optionally, after activating the target certificate, to enhance the security of the computing device, the activated certificate can be stored in the non-volatile memory of the processing unit for subsequent security verification or encrypted communication. This will be explained below in conjunction with step S6.

[0185] S6: The Basic Input / Output System stores the activated certificate in shared memory.

[0186] In one implementation, the combination continues. Figure 5 As shown, step S6 includes step S1014.

[0187] S1014: The basic input / output system converts the format of the activated certificate and stores the converted activated certificate in shared memory.

[0188] Step S1014 can be referred to the specific content of step S1008 above, and will not be repeated here.

[0189] Continuing with the example above, the activated certificate A” and the activated certificate Z” are stored in shared memory.

[0190] S7: The basic input / output system sends a notification message to the processing unit.

[0191] The activated certificate is the target certificate that has been activated as described above.

[0192] In one implementation, the combination continues. Figure 5 As shown, step S7 includes step S1015.

[0193] S1015: The basic input / output system sends a notification message to the processing unit.

[0194] The notification message is used to inform the processing unit that the certificate activation has been completed.

[0195] S8: In response to the notification message, the processing unit retrieves at least one activated certificate from shared memory and stores it in non-volatile memory.

[0196] In one implementation, the combination continues. Figure 5 As shown, step S8 includes steps S1016-S1018.

[0197] S1016: In response to the notification message, the processing unit sends a response message to the basic input / output system.

[0198] The response message is used to inform the recipient that the Basic Input / Output System certificate has been received.

[0199] S1017: The processing unit retrieves at least one activated certificate from shared memory.

[0200] Continuing with the example above, the processing unit retrieves the activated certificate A and the activated certificate Z from shared memory.

[0201] S1018: The processing unit stores the activated certificate into non-volatile memory.

[0202] Following the example above, the activated certificate A” and activated certificate Z” of the processing unit are stored in non-volatile memory.

[0203] It's important to note that the processing unit stores activated certificates in non-volatile memory, facilitating the subsequent export of certificate-related data and enabling batch deployment to homogeneous computing devices. The specific process will not be detailed here. This method supports cross-node migration and offers high operational efficiency.

[0204] In summary, through the collaborative efforts between the processing unit and the basic input / output system, the required certificates can be intelligently selected and activated based on actual business needs. Therefore, certificates are no longer permanently stored in the basic input / output system, but are instead managed and provided uniformly by the processing unit. This avoids the resource waste caused by indiscriminately activating all certificates and significantly improves the flexibility of certificate management.

[0205] Corresponding to the embodiment of the first certificate activation method, after the basic input / output system completes the above-described startup phase and enters the runtime phase, certificate activation can also be performed, such as when an existing certificate has expired and needs to be updated or modified. For example, assume that the basic input / output system has already entered the runtime phase and is executing service M.

[0206] The following combination Figure 10 and Figure 11 An example is provided.

[0207] Figure 9 This is a second flowchart illustrating a certificate activation method provided in an embodiment of this application.

[0208] Figure 10 This is a third structural diagram of a certificate activation method provided in an embodiment of this application.

[0209] like Figure 9 and Figure 10 As shown, the certificate activation method includes the following steps:

[0210] S91: The processing unit acquires the certificate data of at least one first certificate.

[0211] like Figure 11 As shown, Figure 11 This is the second interactive schematic diagram of a certificate activation method provided in the embodiments of this application.

[0212] In one implementation, the combination continues. Figure 11 As shown, step S91 includes step S1019.

[0213] S1019: The processing unit receives a first input operation from the user based on the out-of-band management interface. The first input operation includes at least one first certificate.

[0214] Step S1019 can refer to the specific content of step S1003 above, and is not specifically limited here.

[0215] S92: The processing unit determines at least one second certificate from at least one first certificate based on the certificate data of the first certificate.

[0216] The second certificate is one that meets the preset specifications and needs to be activated.

[0217] In one implementation, the combination continues. Figure 10 As shown, step S92 includes steps S921-S923.

[0218] S921: The processing unit determines at least one third certificate that conforms to the preset specifications from at least one first certificate based on the certificate data of the first certificate and the preset certificate data.

[0219] In one example, continue combining Figure 11 As shown, step S921 includes step S1020.

[0220] S1020: The processing unit determines at least one third certificate that conforms to a preset specification from at least one first certificate.

[0221] Step S1020 can refer to the specific content of step S1004 above, and is not specifically limited here.

[0222] S922: The processing unit stores at least one third certificate into the non-volatile memory corresponding to the processing unit.

[0223] In one example, continue combining Figure 11 As shown, step S922 includes step S1020.

[0224] S1021: The processing unit uses an encryption protocol to encrypt and store at least one third certificate in non-volatile memory.

[0225] Step S1021 can refer to the specific content of step S1005 above, and is not specifically limited here.

[0226] S923: When the processing unit determines that the certificate data of the first certificate includes configuration data, it determines at least one second certificate that needs to be activated from at least one third certificate.

[0227] In one example, continue combining Figure 11 As shown, step S923 includes step S1022.

[0228] S1022: The processing unit determines, from at least one third certificate, at least one second certificate that needs to be activated.

[0229] Step S1022 can refer to the specific content of step S1007 above, and is not specifically limited here.

[0230] S93: The processing unit performs format conversion on the data content of at least one second certificate and stores the converted data content in shared memory.

[0231] In one example, continue combining Figure 11 As shown, step S93 includes steps S1023-S1024.

[0232] S1023: The processing unit stores at least one second certificate in a uniform format into shared memory.

[0233] S1024: The processing unit sends the storage status to the basic input / output system.

[0234] Steps S1023-S1024 can refer to the specific content of steps S1008-S1009 above, and are not specifically limited here.

[0235] After storing the acquired second certificate in shared memory, the processing unit determines whether the basic input / output system has completed the startup operation. The following is a detailed explanation of step S94.

[0236] S94: The processing unit triggers an interrupt operation when it determines that the basic input / output system has completed the startup operation.

[0237] The completion of the startup operation signifies that the basic input / output system has entered the operational phase and is executing corresponding services. For example, assume that the basic input / output system has entered the operational phase and is executing the corresponding service M.

[0238] In one implementation, the combination continues. Figure 11 As shown, step S94 includes step S1025.

[0239] S1025: The processing unit triggers an interrupt operation.

[0240] S95: In response to an interrupt operation, the Basic Input / Output System (PIOS) suspends its operational services, executes the service processing logic, and retrieves at least one target certificate from shared memory and / or a processing unit.

[0241] The target certificate includes the second certificate that conforms to the preset specifications.

[0242] Continue to combine Figure 10 As shown, during the operation phase of the basic input / output system, the corresponding business logic is being executed. When the interrupt handling module of the basic input / output system receives an interrupt operation, it suspends the operation of the basic input / output system and further retrieves at least one target certificate from the shared memory and / or processing unit.

[0243] In one example, continue combining Figure 11 As shown, step S95 includes steps S1026-S1027.

[0244] S1026: In response to an interrupt operation, the Basic Input / Output System (PIOS) suspends the processing logic of its business operations.

[0245] For example, in response to an interrupt operation, the basic input / output system suspends service M.

[0246] S1027: The basic input / output system obtains at least one target certificate from shared memory and / or processing units.

[0247] Step S1027 can be referred to the specific content of step S5 above, and will not be repeated here.

[0248] S96: The basic input / output system activates at least one target certificate.

[0249] In one implementation, the combination continues. Figure 11 As shown, step S96 includes step S1028.

[0250] S1028: The basic input / output system activates at least one target certificate.

[0251] Step S1028 can be referred to the specific content of step S1010 above, and will not be repeated here.

[0252] S97: The basic input / output system stores the activated certificate in shared memory and sends a notification message to the processing unit.

[0253] In one implementation, the combination continues. Figure 11 As shown, step S97 includes steps S1029-S1030.

[0254] S1029: The basic input / output system converts the format of the activated certificate and stores the converted activated certificate in shared memory.

[0255] S1030: The basic input / output system sends a notification message to the processing unit.

[0256] Steps S1029-S1030 can refer to the specific content of steps S1011-S1011 above, and will not be repeated here.

[0257] S98: In response to the notification message, the processing unit retrieves at least one activated certificate from shared memory and stores it in non-volatile memory.

[0258] In one implementation, the combination continues. Figure 11 As shown, step S98 includes steps S1031-S1033.

[0259] S1031: In response to the notification message, the processing unit sends a response message to the basic input / output system.

[0260] S1032: The processing unit retrieves at least one activated certificate from shared memory.

[0261] S1033: The certificate that has been activated by the processing unit is stored in non-volatile memory.

[0262] Steps S1031-S1033 can refer to the specific content of steps S1013-S1015 above, and will not be repeated here.

[0263] In summary, through the interrupt coordination mechanism between the processing unit and the basic input / output system (PIS), intelligent certificate screening and on-demand activation are achieved. During the operation of the PIS, the processing unit and the PIS work together to dynamically update and adjust the certificate configuration according to actual business needs. This eliminates the need to embed certificates in the PIS firmware or rely on device restarts for flexible certificate loading and activation, improving deployment flexibility and efficiency.

[0264] Before step S1 in the above embodiment, it is also necessary to create shared memory. The following will be combined with... Figure 12 Please provide an explanation.

[0265] Figure 12 This is a schematic diagram of a shared memory construction method provided in an embodiment of this application.

[0266] like Figure 12 As shown, the shared memory construction method includes the following steps:

[0267] S121: The processing unit constructs shared memory based on the address space.

[0268] The address space is used to identify the starting location and access permissions of shared memory. When constructing shared memory, the address space is used to specify the starting address and size of the shared memory.

[0269] S122: The basic input / output system establishes an access mapping relationship with shared memory based on the address space.

[0270] Access mapping refers to mapping the physical address of shared memory to the address space of a device or system. In the embodiments of this application, the physical address of shared memory is mapped to the address space of the basic input / output system, so that the basic input / output system can access the shared memory.

[0271] In summary, establishing shared memory and its access mappings between the processing unit and the basic input / output system before the startup phase enables the processing unit and the basic input / output system to exchange certificate-related data efficiently and securely.

[0272] To more intuitively understand the specific implementation of the certificate activation method described above, the following example, using a processing unit, illustrates the certificate activation method. The following section combines... Figure 13 Please provide a detailed explanation.

[0273] Figure 13 This is a schematic diagram of a method for a processing unit to perform certificate activation, provided in an embodiment of this application.

[0274] like Figure 13 As shown, the certificate activation method includes the following steps:

[0275] S1301: The processing unit acquires the certificate data of at least one first certificate.

[0276] Step S1301 can refer to the specific content of step S1 above, and will not be repeated here.

[0277] S1302: The processing unit determines at least one third certificate from at least one first certificate based on the certificate data of the first certificate.

[0278] S1303: The processing unit stores at least one third certificate into non-volatile memory.

[0279] S1304: The processing unit determines at least one second certificate from at least one third certificate based on the certificate data of the third certificate.

[0280] Steps S1302-S1304 can refer to the specific content of steps S21-S23 above, and will not be repeated here.

[0281] S1305: The processing unit stores at least one second certificate in shared memory and / or the processing unit.

[0282] Step S1305 can be referred to the specific content of step S3 above, and will not be repeated here.

[0283] S1306: The processing unit determines whether the basic input / output system has been started successfully.

[0284] S1307: If the processing unit determines that the basic input / output system has not completed startup, it causes the basic input / output system to retrieve and activate at least one target certificate from shared memory and / or the processing unit.

[0285] The following explanations all use the example of obtaining and activating at least one target certificate from shared memory.

[0286] In one implementation, step S1307 includes steps S0371-S0372. S0371: If the processing unit determines that the basic input / output system has not completed startup, it causes the basic input / output system to obtain at least one second certificate from shared memory.

[0287] The statement "Basic Input / Output System Not Started Complete" indicates that the Basic Input / Output System is in the startup phase, during which the Basic Input / Output System retrieves at least one secondary certificate from shared memory.

[0288] To prevent certificates from being tampered with, damaged, or accidentally modified during transmission, storage, or system startup, which could affect system security and stability, it is necessary to verify the certificate again before performing the certificate activation operation. This verification step ensures that the certificate used remains intact, valid, and complies with the system's preset security specifications. The following explanation, in conjunction with step S0382, will further elaborate on this point.

[0289] S0372: To enable the basic input / output system to determine and activate at least one target certificate that conforms to a preset specification from at least one second certificate.

[0290] S0372 can refer to the specific content of steps S1012-S1013 above, and is not specifically limited here.

[0291] S1308: When the processing unit determines that the basic input / output system has been successfully started, it triggers an interrupt operation to cause the basic input / output system to retrieve and activate at least one target certificate from shared memory and / or the processing unit in response to the interrupt operation.

[0292] Step S1308 can be referred to in similar detail to steps S94-S96 above, and will not be repeated here.

[0293] S1309: In response to the notification message, the processing unit retrieves at least one activated certificate from shared memory and stores it in non-volatile memory.

[0294] The notification message is used to inform the processing unit that the activation operation of the certificate to be activated (target certificate) has been completed.

[0295] Step S1309 can be referred to the specific content of steps S6-S8 above, and will not be repeated here.

[0296] In summary, by working collaboratively with the Basic Input / Output System (BIOS), the processing unit can dynamically filter and activate required certificates based on business needs. This avoids the resource waste caused by the traditional approach of embedding all certificates in the BIOS and activating them uniformly, thus improving the flexibility of certificate management. Furthermore, certificate activation can be performed during the BIOS's runtime phase without requiring a complete overhaul of the BIOS to update or configure certificates. The processing unit can load and activate certificates while the system is running normally, simplifying the process and improving efficiency.

[0297] To more intuitively understand the specific implementation of the certificate activation method described above, a basic input / output system will be used as an example to illustrate the certificate activation method below. Figure 14 Please provide a detailed explanation.

[0298] Figure 14 This is a schematic diagram of a method for activating a certificate in a basic input / output system, as provided in an embodiment of this application.

[0299] like Figure 14 As shown, the certificate activation method includes the following steps:

[0300] S1401: In response to the power-on operation, the basic input / output system enters the startup phase.

[0301] S1402: The Basic Input / Output System checks whether the current computing device is configured with a network startup item.

[0302] S1403: The basic input / output system determines that a network startup item has been configured, executes the startup item, and sends an acquisition request to the processing unit so that the processing unit acquires at least one second certificate and stores at least one second certificate in the processing unit and / or shared memory.

[0303] Steps S1401-S1403 can be referred to the specific content of steps S1006-S1008 and S3 above, and will not be repeated here.

[0304] S1404: If it is determined that the Basic Input / Output System has not completed startup, the Basic Input / Output System obtains at least one second certificate from shared memory.

[0305] In one embodiment, step S1404 includes steps S4041-S4042.

[0306] S4041: If it is determined that the basic input / output system has not completed startup, obtain at least one second certificate from shared memory.

[0307] S4042: The basic input / output system determines at least one target certificate that conforms to a preset specification from at least one second certificate.

[0308] Steps S4041-S4042 can be referred to as similar specific content as steps S0381-S0382 above, and will not be repeated here.

[0309] It should be noted that the source of the certificate to be activated (target certificate) may include the second certificate obtained by the processing unit, or the certificate to be activated obtained by the basic input / output system itself through in-band method. The following explanation will take step S1404, including steps S4043-S4045, as an example.

[0310] S4043: If it is determined that the basic input / output system has not completed startup, obtain at least one second certificate from shared memory.

[0311] S4044: The basic input / output system obtains at least one fourth certificate in response to a second input operation by the user in the visual interface.

[0312] Step S4044 can be referred to the specific content of step S44 above, and will not be repeated here.

[0313] The order of steps S4043 and S4044 is not specifically limited.

[0314] S4045: The basic input / output system determines at least one target certificate among at least one second certificate and a fourth certificate.

[0315] Step S4045 can be referred to the specific content of step S45 above, and will not be repeated here.

[0316] S1405: The basic input / output system activates at least one target certificate.

[0317] Step S1405 can be referred to the specific content of step S5 above, and will not be repeated here.

[0318] S1406: The basic input / output system stores the activated certificate in shared memory and sends a notification message to the processing unit.

[0319] Step S1406 can be referred to the specific content of steps S6-S7 above, and will not be repeated here.

[0320] In summary, by working collaboratively with the Basic Input / Output System (BIOS), the processing unit can dynamically filter and activate required certificates based on business needs. This avoids the resource waste caused by the traditional approach of embedding all certificates in the BIOS and activating them uniformly, thus improving the flexibility of certificate management. Furthermore, certificate activation can be performed during the BIOS's runtime phase without requiring a complete overhaul of the BIOS to update or configure certificates. The processing unit can load and activate certificates while the system is running normally, simplifying the process and improving efficiency.

[0321] Figure 15 This is a schematic diagram of a computing device provided in an embodiment of this application.

[0322] like Figure 15 As shown, the computing device 1500 includes a processor 1501, a memory 1502, a baseboard management controller 1503, and a basic input / output system 1504. Exemplarily, the computing device 1500 may also include a communications interface 1505 and a communications bus 1506. The processor 1501, memory 1502, and communications interface 1505 communicate with each other via the communications bus 1506. The communications interface 1505 may include a transmitter and receiver for communicating with other devices or communication networks, and can be a wired interface (port), such as a fiber distributed data interface (FDDI) or a gigabit Ethernet interface (GE). The baseboard management controller 1503, as an independent hardware management subsystem, is used to implement remote monitoring, fault diagnosis, and out-of-band management functions, improving the maintainability and reliability of the system. The basic input / output system 1504 is responsible for hardware initialization and boot loading during system startup.

[0323] In some embodiments, the processor 1501 is used to execute program 1507, specifically performing the relevant steps in the above-described inference task execution method embodiments. Specifically, program 1507 may include program code, which includes computer-executable instructions.

[0324] For example, processor 1501 may be a central processing unit (CPU), an application-specific integrated circuit (ASIC), or one or more integrated circuits configured to implement some embodiments of this application. Computing device 1100 may include one or more processors, which may be processors of the same type, such as one or more CPUs; or they may be processors of different types, such as one or more CPUs and one or more ASICs. The CPU may be a single-core CPU or a multi-core CPU.

[0325] In some embodiments, memory 1502 is used to store program 1507. Memory 1502 may include high-speed random access memory (RAM) or non-volatile memory (NVM), such as at least one disk storage device.

[0326] Specifically, program 1505 can be called by processor 1501 to cause computing device 1500 to perform inference task execution method operations.

[0327] Some embodiments of this application provide a computer-readable storage medium storing at least one executable instruction that, when executed on a computing device 1500, causes the computing device 1500 to perform the business processing method described above.

[0328] For example, the computer-readable storage medium can be a read-only memory (ROM), a random access memory (RAM), a compact disc read-only memory (CD-ROM), magnetic tape, a floppy disk, and an optical data storage device.

[0329] Some embodiments of this application provide a chip system applied to a server. The chip system includes one or more interface circuits and one or more processors. The interface circuits and processors are interconnected via lines. The interface circuits are used to receive signals from the server's memory and send signals to the processors, the signals including computer instructions stored in the memory. When the server processor executes the computer instructions, the server performs various steps in the inference task execution method shown in the above-described method embodiments.

[0330] The beneficial effects that the readable storage medium provided in some embodiments of this application can achieve can be referred to the beneficial effects in the corresponding inference task execution method provided above, and will not be repeated here.

[0331] It should be noted that, in this application, relational terms such as "first" and "second" are used merely to distinguish one entity or operation from another, and do not necessarily require or imply any such actual relationship or order between these entities or operations. Furthermore, the terms "comprising," "including," or any other variations thereof are intended to cover non-exclusive inclusion, such that a process, method, article, or apparatus that comprises a list of elements includes not only those elements but also other elements not expressly listed, or elements inherent to such a process, method, article, or apparatus. Without further limitations, an element defined by the phrase "comprising one..." does not exclude the presence of other identical elements in the process, method, article, or apparatus that includes the element.

[0332] The various embodiments in this specification are described in a related manner. Similar or identical parts between embodiments can be referred to mutually. Each embodiment focuses on describing the differences from other embodiments. In particular, the apparatus embodiments are basically similar to the method embodiments, so the description is relatively simple; relevant parts can be referred to the descriptions of the method embodiments.

[0333] The logic and / or steps represented in the flowchart or otherwise described herein, for example, can be considered as a sequenced list of executable instructions for implementing logical functions, and can be embodied in any computer-readable medium for use by, or in conjunction with, an instruction execution system, apparatus or device (such as a computer-based system, a processor-included system or other system that can fetch and execute instructions from, an instruction execution system, apparatus or device).

[0334] For the purposes of this specification, "computer-readable medium" can mean any means that can contain, store, communicate, propagate, or transmit programs for use by or in conjunction with an instruction execution system, apparatus, or device.

[0335] More specific examples (a non-exhaustive list) of computer-readable media include the following: electrical connections having one or more wires (electronic devices), portable computer disks (magnetic devices), random access memory (RAM), read-only memory (ROM), erasable and editable read-only memory (EPROM or flash memory), fiber optic devices, and portable optical disc read-only memory (CDROM).

[0336] Furthermore, the computer-readable medium can even be paper or other suitable media on which the program can be printed, because the program can be obtained electronically, for example, by optically scanning the paper or other medium, followed by editing, interpreting, or otherwise processing as necessary, and then stored in computer memory. It should be understood that various parts of this application can be implemented using hardware, software, firmware, or a combination thereof.

[0337] In the above embodiments, multiple steps or methods can be implemented using software or firmware stored in memory and executed by a suitable instruction execution system. For example, if implemented in hardware, as in another embodiment, it can be implemented using any one or a combination of the following techniques known in the art: discrete logic circuits having logic gates for implementing logical functions on data signals, application-specific integrated circuits (ASICs) having suitable combinational logic gates, programmable gate arrays (PGAs), field-programmable gate arrays (FPGAs), etc. The embodiments described above are merely specific embodiments of this application and are not intended to limit the scope of protection of this application. Any modifications, equivalent substitutions, improvements, etc., made based on the technical solutions of this application should be included within the scope of protection of this application.

Claims

1. A certificate activation method, characterized in that, A processing unit used in a computing device includes: Obtain the certificate data of at least one primary certificate; Based on the certificate data of the first certificate, at least one second certificate is determined from the at least one first certificate; wherein the second certificate is a certificate that needs to be activated; The at least one second certificate is stored in shared memory and / or the processing unit; Upon detecting that the basic input / output system of the computing device has been started, an interrupt operation is triggered so that the basic input / output system, in response to the interrupt operation, retrieves and activates at least one target certificate from the shared memory and / or the processing unit.

2. The certificate activation method according to claim 1, characterized in that, The determination of at least one second certificate based on the certificate data of the first certificate includes: Based on the certificate data of the first certificate and the preset certificate data, at least one third certificate that conforms to the preset specification is determined from the at least one first certificate; If the certificate data of the third certificate includes configuration data, the at least one second certificate is determined from the at least one third certificate.

3. The certificate activation method according to claim 1 or 2, characterized in that, The step of storing the at least one second certificate in shared memory includes: The data content of the at least one second certificate is converted into a new format, and the converted data content is stored in the shared memory.

4. The certificate activation method according to any one of claims 1-3, characterized in that, The acquisition of certificate data for at least one first certificate includes: The system receives a first input operation from the user based on the out-of-band management interface. The first input operation includes certificate data of the at least one first certificate.

5. The certificate activation method according to any one of claims 1-4, characterized in that, The processing unit includes a substrate management controller or a central processing unit.

6. A certificate activation method, characterized in that, The basic input / output system used in computing devices includes: Once the basic output system has been started, in response to an interrupt operation, the execution of services is suspended, and at least one target certificate is retrieved and activated from shared memory and / or processing units.

7. The certificate activation method according to claim 6, characterized in that, The step of retrieving and activating at least one target certificate from shared memory and the processing unit in response to an interrupt operation includes: The configuration data of the certificate to be activated is obtained from the processing unit; Based on the configuration data, obtain the certificate data corresponding to the configuration data from the shared memory; Based on the certificate data and preset data, at least one target certificate is obtained and activated from the activated certificates.

8. The certificate activation method according to claim 6 or 7, characterized in that, Also includes: In response to a second input operation by the user in the visual interface, obtain at least one fourth certificate; Among the at least one fourth certificate, at least one target certificate that conforms to the preset specifications is determined.

9. A certificate activation method, characterized in that, Applied to computing devices, including: The processing unit of the computing device acquires certificate data for at least one first certificate; Based on the certificate data of the first certificate, the processing unit determines at least one second certificate from the at least one first certificate; wherein the second certificate is a certificate that needs to be activated; The processing unit triggers an interrupt operation when it detects that the basic output system of the computing device has been started. In response to the interrupt operation, the basic input / output system suspends the processing logic of the business operations performed by the basic input / output system, and retrieves and activates at least one target certificate from shared memory and / or processing unit.

10. A computing device, characterized in that, The computing device includes a memory and a processor; the memory and the processor are coupled; the memory is used to store computer program code, the computer program code including computer instructions, which, when executed by the processor, cause the computing device to perform the certificate activation method as described in any one of claims 1 to 9.

Images