System starting method and device, equipment, storage medium and program product

Abstract

The invention relates to the technical field of computers, and discloses a system starting method and device, equipment, a storage medium and a program product.The method comprises the steps that a target identifier is searched for in a target area, where a mirror image file is stored, of a basic input and output system; determining a first platform firmware list area based on the searched target identifier; determining a first information address of the first to-be-protected information and first verification information used for verifying the first to-be-protected information in the first platform firmware list area; acquiring first to-be-protected information based on the first information address; verifying the first to-be-protected information based on the first verification information to obtain a first information verification result; and if the first information verification result is that the verification is passed, storing a first region address of the first platform firmware list region, and starting the basic input / output system. According to the method and the device, the problem that the process of configuring the security module to verify the server firmware is relatively tedious can be solved.

Description

Technical Field

[0001] This disclosure relates to the field of computer technology, specifically to system booting methods, apparatus, devices, storage media, and program products. Background Technology

[0002] As data centers grow in scale and the types of servers become increasingly diverse, the demand for firmware security also rises. Therefore, there is an urgent need to introduce security modules to verify and protect server firmware. When using security modules to verify firmware, a Platform Firmware Manifest (PFM) area needs to be provided in the flash memory layout of the Basic Input Output System (BIOS) for the security module to verify. However, because servers involve different service platforms, and the flash memory layouts of the BIOS differ between these platforms, different versions of security modules are required for different service platforms, making the process of configuring security modules to verify server firmware quite cumbersome. Summary of the Invention

[0003] In view of this, the present disclosure provides a system boot method, apparatus, device, storage medium, and program product to solve the problem that the process of configuring a security module to verify server firmware is cumbersome.

[0004] In a first aspect, this disclosure provides a system startup method applicable to security modules, the method comprising:

[0005] Search for the target identifier in the target area where the image file is stored in the basic input / output system;

[0006] The first platform firmware manifest area is determined based on the found target identifier;

[0007] In the firmware manifest area of ​​the first platform, the first information address of the first information to be protected and the first verification information for verifying the first information to be protected are determined;

[0008] The first information to be protected is obtained based on the first information address;

[0009] The first information to be protected is verified based on the first verification information to obtain the first information verification result.

[0010] If the first information verification result is successful, then the first region address of the first platform firmware manifest region is stored, and the basic input / output system is started.

[0011] Secondly, this disclosure provides a system startup method applicable to a signature platform, the method comprising:

[0012] Obtain the original image file of the basic input / output system, the region address of the platform firmware manifest area, and the platform firmware manifest information. The original image file includes information to be protected, and the platform firmware manifest information includes the information address of the information to be protected in the original image file and first verification information for verifying the information to be protected.

[0013] Based on the region address, a target identifier and the platform firmware manifest information are written into the platform firmware manifest region of the original image file to obtain a target image file; wherein, the target identifier is used by the security module to determine the platform firmware manifest region in the target image file, so that the security module can extract the platform firmware manifest information from the platform firmware manifest region; the platform firmware manifest information is used by the security module to determine and verify the information to be protected in the target image file, and start the basic input / output system if the verification is successful.

[0014] Thirdly, this disclosure provides a system startup device, the device comprising:

[0015] The identifier lookup module is used to search for target identifiers in the target area where the image file of the basic input / output system is stored.

[0016] The manifest area determination module is used to determine the first platform firmware manifest area based on the found target identifier;

[0017] The verification information query module is used to determine the first information address of the first information to be protected and the first verification information for verifying the first information to be protected in the first platform firmware list area.

[0018] The protection information acquisition module is used to acquire the first information to be protected based on the first information address;

[0019] The protection information verification module is used to verify the first information to be protected based on the first verification information to obtain the first information verification result;

[0020] The target system startup module is used to store the first region address of the first platform firmware manifest area and start the basic input / output system if the first information verification result is successful.

[0021] Fourthly, this disclosure provides a system startup device, the device comprising:

[0022] The image information acquisition module is used to acquire the original image file of the basic input / output system, the region address of the platform firmware manifest area, and the platform firmware manifest information. The original image file includes information to be protected, and the platform firmware manifest information includes the information address of the information to be protected in the original image file and first verification information for verifying the information to be protected.

[0023] The manifest information writing module is used to write a target identifier and the platform firmware manifest information into the platform firmware manifest area of ​​the original image file based on the region address to obtain a target image file; wherein, the target identifier is used by the security module to determine the platform firmware manifest area in the target image file, so that the security module can extract the platform firmware manifest information from the platform firmware manifest area; the platform firmware manifest information is used by the security module to determine and verify the information to be protected in the target image file, and to start the basic input / output system if the verification is successful.

[0024] Fifthly, this disclosure provides a computer device, including: a memory and a processor, which are communicatively connected to each other. The memory stores computer instructions, and the processor executes the computer instructions to perform the system startup method of any of the above embodiments.

[0025] In a sixth aspect, this disclosure provides a computer-readable storage medium storing computer instructions for causing a computer to execute the system startup method of any of the above embodiments.

[0026] In a seventh aspect, this disclosure provides a computer program product, including computer instructions for causing a computer to execute the system startup method of any of the above embodiments.

[0027] The system startup method provided in this disclosure involves a signing platform writing a target identifier and platform firmware manifest information into the platform firmware manifest area of ​​the original image file based on the area address of the platform firmware manifest area to obtain a target image file. Then, the security module searches for the target identifier in the target area where the image file is stored in the Basic Input / Output System (BIOS), and determines the first platform firmware manifest area based on the target identifier. Therefore, the security module is not affected by the different area locations of the platform firmware manifest areas on different service platforms; even when facing different service platforms, it can find the corresponding first platform firmware manifest area from the BIOS image file based on the target identifier. Furthermore, it can determine the first information address and first verification information of the first information to be protected from the first platform firmware manifest area, verify the first information to be protected, and start the BIOS when the verification passes. Therefore, it effectively reduces the work of maintaining a set of security module adaptation code for each service platform, allowing all service platforms to use the same version of the security module, thus simplifying the process of configuring the security module to verify the server firmware. Attached Figure Description

[0028] To more clearly illustrate the technical solutions in the specific embodiments of this disclosure or the prior art, the drawings used in the description of the specific embodiments or the prior art will be briefly introduced below. Obviously, the drawings described below are some embodiments of this disclosure. For those skilled in the art, other drawings can be obtained from these drawings without creative effort.

[0029] Figure 1 This is a flowchart illustrating a first system startup method according to an embodiment of the present disclosure;

[0030] Figure 2 This is a flowchart illustrating a second system startup method according to an embodiment of the present disclosure;

[0031] Figure 3 This is a flowchart illustrating a third system startup method according to an embodiment of the present disclosure;

[0032] Figure 4 This is a schematic diagram of partition information of a BIOS image file according to an embodiment of the present disclosure;

[0033] Figure 5 This is a schematic diagram illustrating the process of signing an original image file using a signing platform according to an embodiment of this disclosure;

[0034] Figure 6 This is a schematic diagram of the structure information of a platform firmware manifest area according to an embodiment of the present disclosure;

[0035] Figure 7This is a structural block diagram of a system startup device according to an embodiment of the present disclosure;

[0036] Figure 8 This is a structural block diagram of another system startup device according to an embodiment of the present disclosure;

[0037] Figure 9 This is a structural block diagram of a computer device according to an embodiment of the present disclosure. Detailed Implementation

[0038] To make the objectives, technical solutions, and advantages of the embodiments of this disclosure clearer, the technical solutions of the embodiments of this disclosure will be clearly and completely described below with reference to the accompanying drawings. Obviously, the described embodiments are only some embodiments of this disclosure, and not all embodiments. Based on the embodiments of this disclosure, all other embodiments obtained by those skilled in the art without creative effort are within the scope of protection of this disclosure.

[0039] As data centers grow in scale and the types of servers become increasingly diverse, the demand for firmware security also rises. Therefore, there is an urgent need to introduce security modules to verify and protect server firmware. When verifying firmware, the security module needs to provide a Platform Firmware Manifest (PFM) area in the Basic Input Output System (BIOS) flash layout for verification. However, because servers involve different service platforms, and the flash layouts of the BIOS vary across these platforms, different versions of security modules are required for different service platforms, making the process of configuring security modules to verify server firmware quite cumbersome.

[0040] In related technologies, the common approach is to use a Baseboard Management Controller (BMC) or the BIOS to send the BIOS's platform firmware manifest region address (also known as the PFM offset) to the security module to address the need for different versions of security modules for different service platforms. The specific process is as follows:

[0041] Procedure 1: When the security module is powered on for the first time, the BIOS image file is not verified. After the server boots up, the platform firmware manifest region address is provided to the security module via the BMC or BIOS.

[0042] Step 2: The security module stores the platform firmware manifest area address and verifies the BIOS image file based on the platform firmware manifest area address.

[0043] Step 3: If the BIOS image file is updated, it is necessary to assess whether the flash memory layout of the new BIOS has changed. If it has changed, it is necessary to obtain the new platform firmware manifest area address.

[0044] Step 4: Clear the data in the platform firmware manifest area address in the security module.

[0045] Step 5: Unconfigure the security module.

[0046] Step 6: Update the BIOS image file to the server.

[0047] Step 7: Configure the new platform firmware manifest region address for the security module.

[0048] Step 8: Lock the security module, meaning it will no longer accept new platform firmware manifest area addresses. If the platform firmware manifest area address needs to be updated, steps 4-7 need to be executed again.

[0049] The aforementioned technologies require an assessment each time a new BIOS version is released, to determine if the new version will affect the platform firmware manifest area address in the BIOS flash memory. If the platform firmware manifest area address changes, the new address needs to be obtained and saved. Furthermore, maintenance personnel will need to perform additional data clearing, deconfiguration, and reconfiguration operations.

[0050] In summary, different server platforms and different BIOS versions of the same platform may have different platform firmware manifest area addresses. A database needs to be established to specifically store the mapping between the platform firmware manifest area addresses used by the security module for verification and the server. Furthermore, the BIOS update process adds data clearing, deconfiguring, and reconfiguration operations for the platform firmware manifest area addresses by the security module, increasing maintenance costs and the risk of server problems. Moreover, data clearing operations for the platform firmware manifest area addresses are critical functions of the security module; allowing these operations to be performed by maintenance personnel could affect the security module's functionality and cause unnecessary losses.

[0051] In view of the above, according to the embodiments of this disclosure, a system startup method embodiment is provided. It should be noted that the steps shown in the flowcharts of the accompanying drawings can be executed in a computer system such as a set of computer-executable instructions. Furthermore, although a logical order is shown in the flowcharts, in some cases, the steps shown or described may be executed in a different order than that shown here.

[0052] This embodiment provides a system startup method that can be used in the aforementioned security module. Figure 1 This is a flowchart illustrating a first system startup method according to an embodiment of the present disclosure, as shown below. Figure 1 As shown, the process includes the following steps:

[0053] Step S101: Locate the target identifier in the target area where the image file is stored in the basic input / output system.

[0054] It should be noted that when signing a BIOS image file, the signing platform first obtains the platform firmware manifest area of ​​the BIOS image file from the BIOS flash memory layout. Then, it writes a target identifier into the platform firmware manifest area. Specifically, the target identifier can be written at the starting address of the platform firmware manifest area of ​​the image file, so that the corresponding platform firmware manifest area can be determined based on the target identifier. Of course, in actual operation, the target identifier can also be written in other locations within the platform firmware manifest area of ​​the image file; there is no limitation on the writing position of the target identifier within the platform firmware manifest area.

[0055] Specifically, the target identifier consists of a preset identifier and a target character. The preset identifier is used to determine the location of the platform firmware manifest area in the image file, and the target character is a relatively long random number.

[0056] It's worth noting that, considering image files primarily use binary data, if a regular identifier, such as 0x55, is used as the target identifier, the image file itself may already contain many 0x55s. Therefore, the shorter the target identifier, the easier it is to find data in the image file that matches it. Thus, to avoid overlap between normal image file data and the target identifier, a longer string can be added to the default identifier to create the target identifier.

[0057] For example, if we take the ASCII code of PFMSTART "0x50 0x46 0x4D 0x53 0x54 0x41 0x52 0x54" as the default identifier and "0xB3 0xDD 0x53 0x90 0x64 0xAE 0x26 0xD9" as the target character, then the target identifier will be "0x50 0x46 0x4D 0x53 0x54 0x41 0x52 0x54 0xB3 0xDD 0x53 0x90 0x64 0xAE 0x26 0xD9". If "0x50 0x46 0x4D 0x53 0x54 0x41 0x52 0x54 0xB3 0xDD 0x53 0x90 0x64 0xAE 0x26 0xD9" is found in the target area of ​​the BIOS storage image file, then the area corresponding to this target identifier is determined to be the platform firmware manifest area.

[0058] Step S102: Determine the first platform firmware manifest area based on the found target identifier.

[0059] Specifically, the structural information of the platform firmware manifest area can be obtained, and the platform firmware manifest area can be determined based on the structural information and the target identifier.

[0060] For example, based on the structural information of the platform firmware manifest area, we know that the target identifier is written at the beginning of the platform firmware manifest area. The data size of the platform firmware manifest area can then be used to determine the first platform firmware manifest area.

[0061] For example, if the target identifier is written at the beginning of the platform firmware manifest area, and the data size of the platform firmware manifest area is 128 bits, then the 128-bit data area starting from the target identifier can be determined as the first platform firmware manifest area.

[0062] Step S103: Determine the first information address of the first information to be protected and the first verification information used to verify the first information to be protected in the first platform firmware manifest area.

[0063] Specifically, the structural information of the platform firmware manifest area includes the target identifier and the write location of the firmware manifest area information within the platform firmware manifest area. The firmware manifest area information includes the information address of the information to be protected and the verification information used to verify the information to be protected. Therefore, based on the structural information of the platform firmware manifest area, the first information address of the first information to be protected and the first verification information used to verify the first information to be protected can be determined in the first platform firmware manifest area.

[0064] It should be noted that the first information address includes the start address and end address of the first information to be protected.

[0065] It should be noted that the first verification information can be the first key hash message authentication code of the information to be protected in the original image file. The first verification information is obtained by performing a hash operation on the information to be protected in the original image file.

[0066] Step S104: Obtain the first information to be protected based on the first information address.

[0067] It's important to note that the BIOS image file is typically stored in the BIOS flash memory. Different areas of the image file serve different functions. In the BIOS flash memory layout, the target area storing the image file is usually abstracted into a BIOS read-only area, a BIOS read-write area, and a platform firmware manifest area. The BIOS read-only area is the area that needs protection from the security module, the BIOS read-write area is the area that does not need protection from the security module, and the platform firmware manifest area stores information needed by the security module for verification. Therefore, the first information to be protected can be found in the BIOS read-only area of ​​the target area based on the first information address.

[0068] Step S105: Verify the first information to be protected based on the first verification information to obtain the first information verification result.

[0069] Specifically, the verification algorithm used to generate the first verification information is determined, and the first information to be protected is processed based on this algorithm to obtain the verification information of the first information to be protected. The first verification information is then verified against the verification information of the first information to be protected. If the first verification information and the verification information of the first information to be protected are the same, the verification result of the first information is determined to be successful. If the first verification information and the verification information of the first information to be protected are different, the verification result of the first information is determined to be unsuccessful.

[0070] Step S106: If the first information verification result is successful, store the first area address of the first platform firmware manifest area and start the basic input / output system.

[0071] Specifically, if the first information verification result is successful, the first region address of the first platform firmware manifest region is stored in the storage area of ​​the secure region. The flash memory area of ​​the BIOS is released, and the BIOS is started.

[0072] Furthermore, if the first information verification result is that the verification fails, the next target identifier is queried in the target area, and the above steps S101 to S105 are repeated until all locations in the target area have been searched or the first information to be protected has been verified.

[0073] The system startup method provided in this embodiment involves a security module that searches for a target identifier in the target area where the image file of the Basic Input / Output System (BIOS) is stored, and then determines the first platform firmware manifest area based on the target identifier. Therefore, the security module is unaffected by the different location of the platform firmware manifest areas on different service platforms; even when facing different service platforms, it can still find the corresponding first platform firmware manifest area from the BIOS image file based on the target identifier. Furthermore, it can determine the first information address and first verification information of the first information to be protected from the first platform firmware manifest area, verify the first information to be protected, and start the BIOS upon successful verification. Therefore, it effectively reduces the work of maintaining a set of security module adaptation code for each service platform, ensuring that all service platforms use the same version of the security module, thus simplifying the process of configuring the security module to verify server firmware.

[0074] In some optional implementations, step S105 above, which verifies the first information to be protected based on the first verification information to obtain the first information verification result, includes:

[0075] Step a1: Identify the target certificate chain in the firmware manifest area of ​​the first platform.

[0076] Step a2: Verify the validity of the first information to be protected based on the target certificate chain.

[0077] Step a3: If the first information to be protected is valid, then the first information to be protected is verified based on the first verification information to obtain the first information verification result.

[0078] It should be noted that when the signing platform signs the original image file, it writes a target certificate chain (also known as a Certificate Chain) into the platform firmware manifest area of ​​the original image file. This target certificate chain is used by the security module to verify the validity (also known as legitimacy) of the image file or the first piece of information to be protected. If the first piece of information to be protected is valid, it is verified based on the first verification information to obtain the first information verification result. If the first piece of information to be protected is invalid, the system continues to search for the next target identifier in the target area and repeats steps S101 to S105 until all locations in the target area have been searched or the first piece of information to be protected has passed verification.

[0079] The system startup method provided in this embodiment determines the target certificate chain in the first platform firmware manifest area. If the first information to be protected is verified to be valid based on the target certificate chain, then the first information to be protected is verified based on the first verification information to obtain the first information verification result. Therefore, it can avoid verifying invalid first information to be protected, thereby ensuring the security when finally starting the basic input / output system and preventing the server's data security from being threatened.

[0080] In some optional implementations, step S105 above, which verifies the first information to be protected based on the first verification information to obtain the first information verification result, includes:

[0081] Step b1: Determine the second verification information of the target identifier in the first platform firmware manifest area.

[0082] Step b2: Verify the target identifier based on the second verification information to obtain the identifier verification result.

[0083] Step b3: If the identifier verification result is successful, then the first information to be protected is verified based on the first verification information to obtain the first information verification result.

[0084] It should be noted that when the signing platform signs the original image file, it writes the target identifier and a second verification message for the target identifier simultaneously in the platform firmware manifest area of ​​the original image file. This second verification message is used by the security module to verify whether the structural information in the platform firmware manifest area is trusted.

[0085] Specifically, the verification algorithm used to generate the second verification information is determined. Based on this algorithm, the target identifier is processed to obtain the verification information of the target identifier. The second verification information is then verified against the verification information of the target identifier. If the second verification information is the same as the verification information of the target identifier, the identifier verification result is determined to be successful. If the second verification information is different from the verification information of the target identifier, the identifier verification result is determined to be unsuccessful.

[0086] Optionally, the second verification information is a key hash message authentication code, which can be obtained by hashing the target identifier.

[0087] Furthermore, if the identifier verification result is a failure, it indicates that the structural information in the first platform firmware manifest area has been tampered with or is not trusted, and the security module will not verify the current first information to be protected.

[0088] Furthermore, if the identifier verification result is that the verification fails, the next target identifier is queried in the target area, and the above steps S101 to S105 are repeated until all locations in the target area have been searched or the first information to be protected has been verified.

[0089] It should be noted that in practice, the target certificate chain can be verified first, followed by the target identifier. Alternatively, the target identifier can be verified first, followed by the target certificate chain. If either the target certificate chain or the target identifier fails verification, the current first piece of information to be protected is not verified, and the search continues for the next target identifier in the target area. Only when both the target certificate chain and the target identifier pass verification is the first piece of information to be protected verified based on the first verification information, thus obtaining the first information verification result.

[0090] The system startup method provided in this embodiment determines the second verification information of the target identifier in the firmware manifest area of ​​the first platform. If the target identifier is verified to be valid based on the second verification information, the first information to be protected is then verified based on the first verification information to obtain the first information verification result. Therefore, it can avoid verifying the first information to be protected, which may pose a risk, thereby ensuring the security when the basic input / output system is finally started and preventing the server's data security from being threatened.

[0091] In some optional implementations, the step S101 above, which involves searching for the target identifier in the target area where the image file is stored in the basic input / output system, includes:

[0092] Step c1: Obtain the second region address of the second platform firmware manifest region stored last time.

[0093] Step c2: Determine the firmware manifest region of the second platform based on the second region address.

[0094] Step c3: Determine the second information address of the second information to be protected and the third verification information used to verify the second information to be protected in the second platform firmware manifest area.

[0095] Step c4: Obtain the second information to be protected based on the second information address.

[0096] Step c5: Verify the second information to be protected based on the third verification information to obtain the verification result of the second information.

[0097] Step c6: If the second information verification result is that the verification fails, then search for the target identifier in the target area.

[0098] Furthermore, if the second information verification result is successful, the second region address of the second platform firmware manifest region is stored in the target region, and the basic input / output system is started.

[0099] It should be noted that when the security module powers on for the first time, it does not know the region address of the platform firmware region and will automatically search for the target identifier in the target region. At this time, the security module will store an initial value for the platform firmware region, such as 0xFFFFFFFF. The security module will then start searching for the target identifier from the beginning address of the target address. If the target identifier is found, and the platform firmware manifest region is obtained, the security module will verify the information to be protected based on the information address and verification information of the information to be protected in the platform firmware manifest region. If the verification passes, the security module will store the region address of the corresponding platform firmware manifest region that passed the verification.

[0100] When the security module powers on again, if there is previously verified information to be protected that passed verification, it will prioritize using the region address of the platform firmware manifest area corresponding to the information verified during the previous power-on. The second platform firmware manifest area is determined based on the previous region address. Within this second platform firmware manifest area, the second information address and third verification information of the second information to be protected are determined for verification. If the verification passes, the region address of the platform firmware manifest area stored in the security module remains unchanged. If the verification fails, the security module searches for the target identifier in the target area.

[0101] The system startup method provided in this embodiment involves the security module first obtaining the second region address of the previously stored second platform firmware manifest region. Then, it determines the second platform firmware manifest region based on the second region address. Within the second platform firmware manifest region, it identifies the second information address of the second information to be protected and the third verification information to verify the second information to be protected. If the verification fails, it searches for the target identifier in the target region. Therefore, this reduces the verification process of the basic input / output system and improves verification efficiency.

[0102] In some optional implementations, the step c2 above, which determines the second platform firmware manifest region based on the second region address, includes: obtaining the length of the target region; if the second region address is less than or equal to the length, then determining the second platform firmware manifest region based on the second region address.

[0103] Furthermore, if the address of the second region is greater than the length of the target region, the target identifier is searched again in the target region.

[0104] The system startup method provided in this embodiment determines the second platform firmware manifest area based on the second area address only if the second area address is less than or equal to the length of the target area. Therefore, verification errors can be avoided.

[0105] In some optional implementations, the step c6 above, which involves searching for the target identifier in the target region, includes searching for the target identifier in other regions of the target region, where other regions include regions of the target region other than the second platform firmware manifest region.

[0106] The system startup method provided in this embodiment searches for the target identifier in the target area other than the second platform firmware manifest area. Therefore, it can avoid verifying the same data to be protected, thereby improving verification efficiency.

[0107] In some optional implementations, the system startup method of this disclosure further includes: if the target identifier is not found in the target area, then the startup of the basic input / output system is disabled.

[0108] For example, such as Figure 2 As shown, the following describes a specific application of the system boot method applicable to security modules. This method executes the following steps after the security module needs to be powered on or the BIOS image file has been updated:

[0109] Step S201: Read the second region address of the second platform firmware manifest area, assign it to the first address parameter, and set the second address parameter to the starting address of the target region.

[0110] For example, set the second address parameter to 0.

[0111] It should be noted that the first address parameter represents the region address of the platform firmware manifest area stored during the last power-on of the security module.

[0112] Step S202: Determine whether the address of the second region is greater than the length of the target region. If yes, proceed to step S203; otherwise, proceed to step S204.

[0113] Step S203: Update the first address parameter to the initial address, and then execute step S206.

[0114] Optionally, the initial address is 0xfffffff.

[0115] Step S204: Determine the second information address and third verification information of the second information to be protected in the second platform firmware list area, obtain the second information to be protected based on the second information address, and verify the second information to be protected based on the third verification information.

[0116] Step S205: Determine whether the second information to be protected has passed the verification. If yes, proceed to step S213; otherwise, proceed to step S206.

[0117] Step S206: Starting from the second address parameter, search for the target identifier backward in the target region.

[0118] It should be noted that the second address parameter represents the region address of the currently searched platform firmware manifest region, and it will be updated as the region address of the searched platform firmware manifest region changes.

[0119] Step S207: Determine whether the target identifier has been found. If so, proceed to step S209; otherwise, proceed to step S208.

[0120] Step S208: Record the error code, disable the basic input / output system from starting, and the process ends.

[0121] Step S209: Determine whether the values ​​of the first address parameter and the second address parameter are the same. If they are, update the value of the second address parameter and return to step S206. Otherwise, execute step S210.

[0122] Understandably, if the values ​​of the first address parameter and the second address parameter are the same, it indicates that the current platform firmware manifest area has already been verified and does not need to be verified again.

[0123] Step S210: Determine the first information address and first verification information of the first information to be protected in the first platform firmware list area corresponding to the current second address parameter, obtain the first information to be protected based on the first information address, and verify the first information to be protected based on the first verification information.

[0124] Step S211: Determine whether the first information to be protected has passed the verification. If yes, proceed to step S212. Otherwise, update the value of the second address parameter and return to step S206.

[0125] Step S212: Update the value of the second information address to the storage area of ​​the security module.

[0126] Step S213: Release the flash memory of the basic input / output system, start the basic input / output system, and the process ends.

[0127] This embodiment also provides another system startup method, which can be used in a signature platform. Figure 3 This is a flowchart illustrating another system startup method according to an embodiment of the present disclosure, such as... Figure 3 As shown, the process includes the following steps:

[0128] Step S301: Obtain the original image file of the basic input / output system, the region address of the platform firmware manifest area, and the platform firmware manifest information. The original image file includes information to be protected, and the platform firmware manifest information includes the information address of the information to be protected in the original image file and the first verification information used to verify the information to be protected.

[0129] Specifically, when a signature platform is required for signing, the BIOS provides a raw image file, which includes the information to be protected and the BIOS flash memory layout. For example... Figure 4 As shown, in the flash memory layout of a BIOS, the target area for storing the image file is typically abstracted into a BIOS read-only area, a BIOS read-write area, and a platform firmware manifest area. The BIOS read-only area is the area that needs protection from the security module, the BIOS read-write area is the area that does not need protection from the security module, and the platform firmware manifest area stores the information required by the security module for verification.

[0130] Specifically, the information address of the information to be protected includes the starting address and the ending address of the information to be protected.

[0131] Specifically, the first verification information is the key hash message authentication code, which is obtained by performing a hash operation on the information to be protected.

[0132] Step S302: Write the target identifier and platform firmware manifest information into the platform firmware manifest area of ​​the original image file based on the region address to obtain the target image file; wherein, the target identifier is used by the security module to determine the platform firmware manifest area in the target image file, so that the security module can extract the platform firmware manifest information from the platform firmware manifest area; the platform firmware manifest information is used by the security module to determine and verify the information to be protected in the target image file, and start the basic input / output system if the verification is successful.

[0133] Specifically, the structural information of the platform firmware manifest area can be further obtained. This structural information defines the target identifier, the address information of the information to be protected, and the write position of the first verification information within the platform firmware manifest area. To facilitate the security module's search for the target identifier to determine the platform firmware manifest area in the image file, the write position of the target identifier can be the starting position of the platform firmware manifest area.

[0134] The system startup method provided in this embodiment involves a signing platform writing a target identifier and platform firmware manifest information into the platform firmware manifest area of ​​the original image file based on the area address of the platform firmware manifest area to obtain the target image file. Therefore, the security module is unaffected by the different area locations of the platform firmware manifest areas on different service platforms. Even when facing different service platforms, it can find the corresponding first platform firmware manifest area from the image file of the Basic Input / Output System (BIOS) based on the target identifier. Furthermore, it can determine the information address of the information to be protected and the first verification information from the first platform firmware manifest area to verify the information to be protected, and start the BIOS when the verification passes. Therefore, it effectively reduces the work of maintaining a set of security module adaptation code for each service platform, ensuring that all service platforms use the same version of the security module, thus simplifying the process of configuring the security module to verify the server firmware.

[0135] In some optional implementations, the target image file includes an in-band image file and an out-of-band image file. Therefore, step S302 above, which involves writing the target identifier and platform firmware manifest information into the platform firmware manifest area of ​​the original image file based on the region address to obtain the target image file, includes:

[0136] Step d1 involves performing an in-band signature on the information to be protected in the original image file to obtain the first image file.

[0137] Step d2: Write the target identifier and platform firmware manifest information into the platform firmware manifest area of ​​the first image file based on the region address to obtain the second image file.

[0138] Step d3: Write the target certificate chain into the platform firmware manifest area of ​​the second image file based on the region address to obtain the in-band image file.

[0139] Step d4: Based on the in-band signature information, platform firmware manifest information, target identifier, and target certificate chain, perform out-of-band signature on the in-band image file to obtain the out-of-band image file.

[0140] Specifically, the signature platform pre-stores the key information for BIOS in-band signing, the key information for the security module to verify the validity of the information to be protected, and the key information for BMC out-of-band signing.

[0141] Optionally, the key information for the in-band signature can use a key for an asymmetric encryption algorithm (Rivest-Shamir-Adleman, or RSA). The key information used by the security module to verify the validity of the information to be protected can use a 384 key for Elliptic Curve Cryptography (ECC). The key information for the BMC's out-of-band signature can use a key for an asymmetric encryption algorithm (Rivest-Shamir-Adleman, or RSA).

[0142] like Figure 5 As shown, the signing platform performs in-band signing on the information to be protected in the original image file based on the BIOS in-band signing key information (e.g., RSA key) and the RSA algorithm to obtain a first image file. The first image file contains the in-band signing information (also known as the inband sign) and the information to be protected. Based on the structure information and region address of the platform firmware manifest region, the signing platform writes the target identifier and platform firmware manifest information into the platform firmware manifest region of the first image file to obtain a second image file. The region address is obtained through the flash memory layout in the original image file. The second image file includes the information to be protected, the in-band signing information, the target identifier, and the platform firmware manifest information. Then, based on the key information used by the security module to verify the validity of the information to be protected (e.g., ECC 384 key), the in-band signing information, the target identifier, and the key information, the signing platform requests a target certificate chain from the security authentication system (i.e., generates a target certificate chain using the ECC algorithm). And according to the structure information of the platform firmware manifest region, the target certificate chain is written into the platform firmware manifest region to obtain a third image file. The third image file includes the information to be protected, the in-band signature information, the target identifier, the platform firmware manifest information, and the target certificate chain. Then, the signing platform performs an out-of-band signature on the in-band image file based on the BMC out-of-band signature key information (e.g., an RSA key), the in-band signature information, the platform firmware manifest information, the target identifier, the target certificate chain, and the RSA algorithm, to obtain an out-of-band image file. The out-of-band image file includes the information to be protected, the in-band signature information, the target identifier, the platform firmware manifest information, the target certificate chain, and the out-of-band signature information.

[0143] Furthermore, the target image file also includes a first message digest of the in-band image file and a second message digest of the out-of-band image file. Step S302 above, which involves writing the target identifier and platform firmware manifest information into the platform firmware manifest area of ​​the original image file based on the region address to obtain the target image file, further includes: determining the first message digest based on the in-band image file; and determining the second message digest based on the out-of-band image file.

[0144] The system startup method provided in this embodiment involves a signing platform performing an in-band signature on the information to be protected in the original image file to obtain a first image file. Then, based on the region address, a target identifier and platform firmware manifest information are written into the platform firmware manifest area of ​​the first image file to obtain a second image file. A target certificate chain is then written into the platform firmware manifest area of ​​the second image file based on the region address to obtain an in-band image file. Finally, based on the signature information from the in-band signature, the platform firmware manifest information, the target identifier, and the target certificate chain, the in-band image file is performed with an out-of-band signature to obtain an out-of-band image file. Therefore, this method avoids the leakage of Basic Input / Output System (BIOS) data when the security module verifies the BIOS image file or starts the BIOS, thereby ensuring the secure startup of the BIOS.

[0145] Furthermore, such as Figure 6 As shown, the structure information in the platform firmware manifest area declares the target identifier, target certificate chain, second verification information of the target identifier, platform firmware manifest, zero-filled portions of the platform firmware manifest area, and the writing positions of each piece of information in the platform firmware manifest area. The platform firmware manifest includes the starting address of the information to be protected, the ending address of the information to be protected, and the first verification information. When the signing platform signs the original image file, it can be based on... Figure 6 The platform firmware manifest area shown here signs the original image file to obtain the target image file.

[0146] It should be noted that the data size of the platform firmware manifest area can be defined as 128 bits. That is, the platform firmware manifest area consists of 128 bits of information such as the target identifier, target certificate chain, and platform firmware manifest. In addition, the total length of the platform firmware manifest area will be zero-padded (also known as padding) to be an integer multiple of 128 bits to ensure that the total length of the platform's fixed manifest area is an integer multiple of 128 bits, which facilitates related flash memory operations.

[0147] In addition, such as Figure 4As shown, the platform firmware manifest area includes the information addresses, information lengths, and corresponding first verification information for multiple pieces of information to be protected. Each piece of information, including its address, length, and first verification information, forms a set. For example, the first information address, length, and first verification information for the first piece of information to be protected; the first information address, length, and first verification information for the second piece of information to be protected; and the first information address, length, and first verification information for the nth piece of information to be protected. Then, based on the first information address, length, and first verification information of the first piece of information to be protected, the first piece of information to be protected can be read from the first read-only area of ​​the original BIOS image file. Similarly, based on the first information address, length, and first verification information of the nth piece of information to be protected, the nth piece of information to be protected can be read from the nth read-only area of ​​the original BIOS image file.

[0148] In some optional implementations, a second image file is obtained by writing a target identifier and platform firmware manifest information into the platform firmware manifest area of ​​the first image file based on the region address, including: obtaining second verification information of the target identifier; and writing the target identifier, second verification information, and platform firmware manifest information into the platform firmware manifest area of ​​the first image file based on the region address to obtain the second image file.

[0149] Optionally, the second verification information is a key hash message authentication code, which can be obtained by hashing the target identifier.

[0150] The system startup method provided in this embodiment involves the signing platform writing a target identifier and platform firmware manifest information into the platform firmware manifest area of ​​the first image file based on the region address, and further writing second verification information for the target identifier. Therefore, the security module can verify whether the structural information of the platform firmware manifest area is trusted based on the second verification information in the image file, thus ensuring the security of the Basic Input / Output System startup.

[0151] In some optional implementations, the target certificate chain is written into the platform firmware manifest area of ​​the second image file based on the region address to obtain an in-band image file. This includes: obtaining key information used by the security module to verify the validity of the information to be protected; applying for a target certificate chain from the security authentication system based on the signature information, platform firmware manifest information, target identifier, and key information; and writing the target certificate chain into the platform firmware manifest area of ​​the second image file based on the region address to obtain an in-band image file.

[0152] The system startup method provided in this embodiment, based on the key information, in-band signature information, platform firmware manifest information, and target identifier used by the security module to verify the validity of the information to be protected, requests a target certificate chain from the security authentication system and writes it into the platform firmware manifest area of ​​the second image file. Therefore, the security module can verify the validity of the image file or the information to be protected through the target certificate chain in the platform firmware manifest area of ​​the image file.

[0153] In some optional implementations, the system startup method of this disclosure further includes: obtaining a preset identifier and a target character, wherein the target character corresponds to the platform firmware manifest area; and obtaining a target identifier based on the preset identifier and the target character.

[0154] Specifically, the target identifier is obtained by concatenating the preset identifier with the target character.

[0155] It's worth noting that the default identifier is used to determine the location of the platform firmware manifest area within the image file. Also, considering that image files primarily use binary data, if a regular identifier, such as 0x55, is used as the target identifier, the image file itself may already contain many 0x55s. Therefore, the shorter the target identifier, the easier it is to find data in the image file that matches it. Thus, to avoid overlap between normal image file data and the target identifier, a longer target string is added to the default identifier to create the final target identifier.

[0156] The system startup method provided in this embodiment obtains a target identifier based on a preset identifier and target characters corresponding to the platform firmware manifest area. Therefore, it can identify the platform firmware manifest area while avoiding overlap between the target identifier and other data in the image file.

[0157] It is worth noting that the technical concept of the system boot method disclosed herein is as follows: When the signing platform signs the BIOS image file, it first obtains the region address of the platform firmware manifest area in the BIOS image file from the BIOS flash memory layout, and writes the target identifier (e.g., at the starting address of the platform firmware manifest area) into the platform firmware manifest area. Upon power-up, the security module first analyzes the contents of the area storing the BIOS image file, searches for the target identifier to obtain the region address of the platform firmware manifest area, and verifies the information to be protected based on the information address of the information to be protected stored in the platform firmware manifest area and the first verification information. If the verification passes, the BIOS is booted, and the corresponding region address of the platform firmware manifest area is written into the storage area of ​​the security module for use by the BIOS upon the next power-up.

[0158] Compared to related technologies, the system startup method disclosed herein does not require establishing a mapping between the region address of the platform firmware manifest area to be verified by the database storage security module and the server, depending on the service platform. Furthermore, when changes in the BIOS flash memory layout cause changes in the region address of the platform firmware manifest area, data clearing, deconfiguration, and reconfiguration operations are not required, reducing the operational steps for maintenance personnel. Moreover, operation permissions for data clearing, deconfiguration, and reconfiguration of the security module are centralized within the security management platform, reducing the risk of security module failure.

[0159] Understandably, the system startup method disclosed herein eliminates the need for security modules to determine the platform firmware manifest area by searching for target identifiers. Therefore, it eliminates the possibility of attacks that could modify the region address of the platform firmware manifest area through data clearing, deconfiguration, and reconfiguration operations. Furthermore, it resolves the dependency of the original security module on different service platforms, reducing the workload of maintaining a separate security module adaptation code for each service platform, and ensuring that all service platforms use the same version of the security module.

[0160] This embodiment also provides a system startup device for implementing the above embodiments and preferred embodiments; details already described will not be repeated. As used below, the term "module" can refer to a combination of software and / or hardware that performs a predetermined function. Although the devices described in the following embodiments are preferably implemented in software, hardware implementations, or a combination of software and hardware, are also possible and contemplated.

[0161] This embodiment provides a system startup device, such as... Figure 7 As shown, it includes:

[0162] The identifier lookup module 701 is used to look up the target identifier in the target area where the image file of the basic input / output system is stored.

[0163] The manifest area determination module 702 is used to determine the first platform firmware manifest area based on the found target identifier;

[0164] The verification information query module 703 is used to determine the first information address of the first information to be protected and the first verification information for verifying the first information to be protected in the first platform firmware list area;

[0165] The protection information acquisition module 704 is used to acquire the first information to be protected based on the first information address;

[0166] The protection information verification module 705 is used to verify the first information to be protected based on the first verification information to obtain the first information verification result;

[0167] The target system startup module 706 is used to store the first area address of the first platform firmware manifest area and start the basic input / output system if the first information verification result is successful.

[0168] In some optional implementations, the protection information verification module 705 includes:

[0169] The certificate chain query unit is used to determine the target certificate chain in the firmware manifest area of ​​the first platform.

[0170] The verification and authorization unit is used to verify the validity of the first information to be protected based on the target certificate chain.

[0171] The first information verification unit is used to verify the first information to be protected based on the first verification information if the first information to be protected is valid, and to obtain the first information verification result.

[0172] In some optional implementations, the protection information verification module 705 further includes:

[0173] The verification information acquisition unit is used to determine the second verification information of the target identifier in the first platform firmware manifest area;

[0174] The identifier verification unit is used to verify the target identifier based on the second verification information and obtain the identifier verification result;

[0175] The second information verification unit is used to verify the first information to be protected based on the first verification information if the identifier verification result is successful, and to obtain the first information verification result.

[0176] In some alternative implementations, the identifier lookup module 701 includes:

[0177] The region address acquisition unit is used to acquire the second region address of the second platform firmware manifest region stored last time.

[0178] The manifest area determination unit is used to determine the second platform firmware manifest area based on the second area address;

[0179] The verification information query unit is used to determine the second information address of the second information to be protected in the second platform firmware list area, and the third verification information for verifying the second information to be protected.

[0180] A protection information acquisition unit is used to acquire second information to be protected based on a second information address;

[0181] The third information verification unit is used to verify the second information to be protected based on the third verification information, and obtain the second information verification result;

[0182] The identifier lookup unit is used to search for the target identifier in the target area if the second information verification result is that the verification fails.

[0183] In some optional implementations, the inventory area determination unit includes:

[0184] The region length acquisition sub-unit is used to obtain the length of the target region;

[0185] The manifest area determination sub-unit is used to determine the second platform firmware manifest area based on the second area address if the second area address is less than or equal to the length.

[0186] In some optional implementations, the identifier lookup unit includes:

[0187] The identifier lookup subunit is used to look up the target identifier in other areas of the target area. Other areas include areas in the target area other than the second platform firmware manifest area.

[0188] In some optional embodiments, the system startup apparatus of this disclosure further includes:

[0189] The system disables the startup module, which prevents the basic input / output system from starting if the target identifier is not found in the target area.

[0190] Further functional descriptions of the above modules and units are the same as those in the corresponding embodiments described above, and will not be repeated here.

[0191] In this embodiment, the system startup device is presented in the form of a functional unit. Here, a unit refers to an ASIC (Application Specific Integrated Circuit) circuit, a processor and memory that execute one or more software or fixed programs, and / or other devices that can provide the above functions.

[0192] This embodiment also provides another system startup device for implementing the above embodiments and preferred embodiments, which will not be repeated hereafter. As used below, the term "module" can be a combination of software and / or hardware that implements a predetermined function. Although the device described in the following embodiments is preferably implemented in software, hardware implementation, or a combination of software and hardware, is also possible and contemplated.

[0193] This embodiment provides another system startup device, suitable for signature platforms, such as... Figure 8 As shown, it includes:

[0194] The image information acquisition module 801 is used to acquire the original image file of the basic input / output system, the area address of the platform firmware manifest area, and the platform firmware manifest information. The original image file includes information to be protected, and the platform firmware manifest information includes the information address of the information to be protected in the original image file and the first verification information used to verify the information to be protected.

[0195] The manifest information writing module 802 is used to write the target identifier and platform firmware manifest information into the platform firmware manifest area of ​​the original image file based on the region address to obtain the target image file. The target identifier is used by the security module to determine the platform firmware manifest area in the target image file so that the security module can extract the platform firmware manifest information from the platform firmware manifest area. The platform firmware manifest information is used by the security module to determine and verify the information to be protected in the target image file, and to start the basic input / output system if the verification is successful.

[0196] In some optional implementations, the target image file includes an in-band image file and an out-of-band image file; the manifest information writing module 802 includes:

[0197] The first signing unit is used to perform in-band signing on the information to be protected in the original image file to obtain the first image file;

[0198] The second signature unit is used to write the target identifier and platform firmware manifest information into the platform firmware manifest area of ​​the first image file based on the region address to obtain the second image file;

[0199] The third signing unit is used to write the target certificate chain into the platform firmware manifest area of ​​the second image file based on the region address to obtain the in-band image file;

[0200] The fourth signing unit is used to perform out-of-band signing on the in-band image file based on the in-band signature information, platform firmware manifest information, target identifier, and target certificate chain to obtain an out-of-band image file.

[0201] In some alternative implementations, the second signature unit includes:

[0202] The identification information acquisition subunit is used to acquire the second verification information of the target identifier;

[0203] The second signature subunit is used to write the target identifier, second verification information, and platform firmware manifest information into the platform firmware manifest area of ​​the first image file based on the region address, so as to obtain the second image file.

[0204] In some alternative implementations, the third signature unit includes:

[0205] The key information acquisition subunit is used to acquire the key information used by the security module to verify the validity of the information to be protected;

[0206] The certificate chain application subunit is used to apply for a target certificate chain from the security authentication system based on signature information, platform firmware manifest information, target identifier, and key information.

[0207] The certificate chain writing subunit is used to write the target certificate chain into the platform firmware manifest area of ​​the second image file based on the region address to obtain the in-band image file.

[0208] In some optional embodiments, the system startup apparatus of this disclosure further includes:

[0209] The identification information acquisition module is used to acquire preset identifiers and target characters, with the target characters corresponding to the platform firmware manifest area.

[0210] The identifier acquisition module is used to obtain the target identifier based on the preset identifier and the target character.

[0211] Further functional descriptions of the above modules and units are the same as those in the corresponding embodiments described above, and will not be repeated here.

[0212] In this embodiment, the system startup device is presented in the form of a functional unit. Here, a unit refers to an ASIC (Application Specific Integrated Circuit) circuit, a processor and memory that execute one or more software or fixed programs, and / or other devices that can provide the above functions.

[0213] This disclosure also provides a computer device having the above-described features. Figure 7 and / or Figure 8 The system startup device shown.

[0214] Please see Figure 9 , Figure 9 This is a structural block diagram of a computer device provided in an optional embodiment of this disclosure, such as... Figure 9As shown, the computer device includes one or more processors 901, memory 902, and interfaces for connecting the components, including high-speed interfaces and low-speed interfaces. The components communicate with each other via different buses and can be mounted on a common motherboard or otherwise installed as needed. The processors can process instructions executed within the computer device, including instructions stored in or on memory to display graphical information of a GUI on external input / output devices (such as display devices coupled to the interfaces). In some alternative implementations, multiple processors and / or multiple buses can be used with multiple memories and multiple memory modules, if desired. Similarly, multiple computer devices can be connected, each providing some of the necessary operations (e.g., as a server array, a group of blade servers, or a multiprocessor system). Figure 9 Take the 901 processor as an example.

[0215] Processor 901 may be a central processing unit, a network processor, or a combination thereof. Processor 901 may further include a hardware chip. The hardware chip may be an application-specific integrated circuit (ASIC), a programmable logic device (PLD), or a combination thereof. The programmable logic device may be a complex programmable logic device (CAMP), a field-programmable gate array (FPGA), a general-purpose array logic (GDA), or any combination thereof.

[0216] The memory 902 stores instructions executable by at least one processor 901 to cause at least one processor 901 to perform the method shown in the above embodiments.

[0217] The memory 902 may include a program storage area and a data storage area. The program storage area may store the operating system and applications required for at least one function; the data storage area may store data created based on the use of the computer device. Furthermore, the memory 902 may include high-speed random access memory and may also include non-transitory memory, such as at least one disk storage device, flash memory device, or other non-transitory solid-state storage device. In some alternative embodiments, the memory 902 may optionally include memory remotely located relative to the processor 901, and these remote memories can be connected to the computer device via a network. Examples of such networks include, but are not limited to, the Internet, intranets, local area networks, mobile communication networks, and combinations thereof.

[0218] The memory 902 may include volatile memory, such as random access memory; the memory may also include non-volatile memory, such as flash memory, hard disk or solid-state drive; the memory 902 may also include a combination of the above types of memory.

[0219] The computer device also includes a communication interface 903 for communicating with other devices or communication networks.

[0220] This disclosure also provides a computer-readable storage medium in which the methods described in this disclosure can be implemented in hardware or firmware, or implemented as recordable on a storage medium, or implemented as computer code originally stored on a remote storage medium or a non-transitory machine-readable storage medium and subsequently stored on a local storage medium after being downloaded over a network. Thus, the methods described herein can be processed by software stored on a storage medium using a general-purpose computer, a dedicated processor, or programmable or dedicated hardware. The storage medium may be a magnetic disk, optical disk, read-only memory, random access memory, flash memory, hard disk, or solid-state drive, etc.; further, the storage medium may also include combinations of the above types of memory. It is understood that computers, processors, microprocessor controllers, or programmable hardware include storage components capable of storing or receiving software or computer code that, when accessed and executed by the computer, processor, or hardware, implements the methods shown in the above embodiments.

[0221] A portion of this disclosure can be applied to computer program products, such as computer program instructions, which, when executed by a computer, can invoke or provide methods and / or technical solutions according to this disclosure through the operation of the computer. Those skilled in the art will understand that the forms in which computer program instructions exist in a computer-readable medium include, but are not limited to, source files, executable files, and installation package files. Accordingly, the ways in which computer program instructions are executed by a computer include, but are not limited to: the computer directly executing the instructions; the computer compiling the instructions and then executing the corresponding compiled program; the computer reading and executing the instructions; or the computer reading and installing the instructions and then executing the corresponding installed program. Here, the computer-readable medium can be any available computer-readable storage medium or communication medium accessible to a computer.

[0222] Although embodiments of the present disclosure have been described in conjunction with the accompanying drawings, those skilled in the art can make various modifications and variations without departing from the spirit and scope of the present disclosure, and such modifications and variations all fall within the scope defined by the appended claims.

Claims

1. A system startup method, characterized by, The method is suitable for a security module, and the method comprises: finding a target identifier in a target area where a basic input output system stores an image file; determining a first platform firmware inventory area based on the found target identifier; determining a first information address of first to-be-protected information and first check information for checking the first to-be-protected information in the first platform firmware inventory area; acquiring the first to-be-protected information based on the first information address; checking the first to-be-protected information based on the first check information to obtain a first information check result; if the first information check result is a check pass, storing a first area address of the first platform firmware inventory area and starting the basic input output system.

2. The system startup method of claim 1, wherein, The checking the first to-be-protected information based on the first check information to obtain a first information check result comprises: determining a target certificate chain in the first platform firmware inventory area; verifying validity of the first to-be-protected information based on the target certificate chain; if the first to-be-protected information is valid, checking the first to-be-protected information based on the first check information to obtain the first information check result.

3. The system booting method according to claim 1, wherein The checking the first to-be-protected information based on the first check information to obtain a first information check result comprises: determining second check information of the target identifier in the first platform firmware inventory area; checking the target identifier based on the second check information to obtain an identifier check result; if the identifier check result is a check pass, checking the first to-be-protected information based on the first check information to obtain the first information check result.

4. The system booting method according to claim 1, wherein The finding a target identifier in a target area where a basic input output system stores an image file comprises: acquiring a second area address of a second platform firmware inventory area stored last time; determining the second platform firmware inventory area based on the second area address; determining a second information address of second to-be-protected information and third check information for checking the second to-be-protected information in the second platform firmware inventory area; acquiring the second to-be-protected information based on the second information address; checking the second to-be-protected information based on the third check information to obtain a second information check result; if the second information check result is a check fail, finding the target identifier in the target area.

5. The system startup method of claim 4, wherein, The determining the second platform firmware inventory area based on the second area address comprises: acquiring a length of the target area; if the second area address is less than or equal to the length, determining the second platform firmware inventory area based on the second area address.

6. The system booting method according to claim 4, wherein The finding the target identifier in the target area comprises: finding the target identifier in other areas in the target area, wherein the other areas include areas in the target area other than the second platform firmware inventory area.

7. The system booting method according to claim 1, wherein The method further comprises: if the target identifier is not found in the target area, prohibiting the basic input output system from starting.

8. A system startup method characterized by comprising: The method is suitable for a signature platform, and the method comprises: obtaining an original image file of a basic input and output system, a region address of a platform firmware inventory region, and platform firmware inventory information, wherein the original image file comprises to-be-protected information, and the platform firmware inventory information comprises an information address of the to-be-protected information in the original image file and first verification information used for verifying the to-be-protected information; writing a target identifier and the platform firmware inventory information into the platform firmware inventory region of the original image file based on the region address to obtain a target image file, wherein the target identifier is used for a security module to determine the platform firmware inventory region in the target image file, so that the security module extracts the platform firmware inventory information from the platform firmware inventory region, and the platform firmware inventory information is used for the security module to determine and verify the to-be-protected information in the target image file and to start the basic input and output system if the verification is passed.

9. The system booting method according to claim 8, wherein, The target image file comprises an in-band image file and an out-of-band image file; and the writing of the target identifier and the platform firmware inventory information into the platform firmware inventory region of the original image file based on the region address to obtain the target image file comprises: performing in-band signing on the to-be-protected information in the original image file to obtain a first image file; writing the target identifier and the platform firmware inventory information into the platform firmware inventory region of the first image file based on the region address to obtain a second image file; writing a target certificate chain into the platform firmware inventory region of the second image file based on the region address to obtain the in-band image file; performing out-of-band signing on the in-band image file based on signature information of the in-band signing, the platform firmware inventory information, the target identifier, and the target certificate chain to obtain the out-of-band image file.

10. The system booting method according to claim 9, wherein, The writing of the target identifier and the platform firmware inventory information into the platform firmware inventory region of the first image file based on the region address to obtain the second image file comprises: obtaining second verification information of the target identifier; writing the target identifier, the second verification information, and the platform firmware inventory information into the platform firmware inventory region of the first image file based on the region address to obtain the second image file.

11. The system booting method according to claim 9, wherein The writing of the target certificate chain into the platform firmware inventory region of the second image file based on the region address to obtain the in-band image file comprises: obtaining key information used by the security module to verify validity of the to-be-protected information; applying, to a security authentication system, for the target certificate chain based on the signature information, the platform firmware inventory information, the target identifier, and the key information; writing the target certificate chain into the platform firmware inventory region of the second image file based on the region address to obtain the in-band image file.

12. The system booting method of claim 8, wherein, The method further comprises: obtaining a preset identifier and target characters corresponding to the platform firmware inventory region. The target identifier is obtained based on the preset identifier and the target character.

13. A system startup apparatus, comprising: The device comprises: An identifier searching module, configured to search for a target identifier in a target area where a basic input output system stores an image file; An inventory area determining module, configured to determine a first platform firmware inventory area based on the target identifier searched for; A verification information querying module, configured to determine a first information address of first to-be-protected information and first verification information for verifying the first to-be-protected information in the first platform firmware inventory area; A protected information obtaining module, configured to obtain the first to-be-protected information based on the first information address; A protected information verifying module, configured to verify the first to-be-protected information based on the first verification information to obtain a first information verification result; A target system starting module, configured to store a first area address of the first platform firmware inventory area and start the basic input output system if the first information verification result is verified.

14. A system startup apparatus, comprising: The device comprises: An image information obtaining module, configured to obtain an original image file of a basic input output system, an area address of a platform firmware inventory area, and platform firmware inventory information, wherein the original image file comprises to-be-protected information, and the platform firmware inventory information comprises an information address of to-be-protected information in the original image file and first verification information for verifying the to-be-protected information; An inventory information writing module, configured to write a target identifier and the platform firmware inventory information in the platform firmware inventory area of the original image file based on the area address to obtain a target image file, wherein the target identifier is used for a security module to determine a platform firmware inventory area in the target image file, so that the security module extracts the platform firmware inventory information from the platform firmware inventory area; and the platform firmware inventory information is used for the security module to determine and verify to-be-protected information in the target image file, and start the basic input output system if the verification is passed.

15. A computer device, comprising: Comprise: A memory and a processor, which are communicatively connected with each other, and the memory stores computer instructions, and the processor executes the computer instructions to perform the system starting method in any one of claims 1 to 7 and / or perform the system starting method in any one of claims 8 to 12.

16. A computer-readable storage medium, characterized in that, The computer readable storage medium stores computer instructions, and the computer instructions are used to make a computer execute the system starting method in any one of claims 1 to 7 and / or execute the system starting method in any one of claims 8 to 12.

17. A computer program product, characterised in that, Comprise computer instructions, and the computer instructions are used to make a computer execute the system starting method in any one of claims 1 to 7 and / or execute the system starting method in any one of claims 8 to 12.

Images