Program file security verification method and device during startup, equipment and medium

Abstract

The invention relates to the technical field of security verification, and discloses a program file security verification method and device during startup, equipment and a medium, and the method comprises the following steps: generating a hash value of a to-be-loaded program file by utilizing preset external equipment to obtain a first hash value, judging whether a pre-received startup instruction is an emergency startup instruction by utilizing a BIOS (Basic Input / Output System) of a preset mainboard, and if yes, starting the program file; if yes, white list hash value verification is carried out on the basis of a preset emergency white list to obtain a first verification result, if not, the program file is read through a BIOS of a preset mainboard, program file hash value verification is carried out on the basis of the read program file to obtain a second verification result, and if the first verification result is verification passing, or the program file hash value verification is carried out on the basis of the read program file to obtain the second verification result; and if the second verification result is that the verification is passed, generating a startup instruction, and executing a startup program by utilizing the BIOS according to the startup instruction. And the security of program file verification during startup is improved.

Description

Methods, devices, equipment and media for security verification of program files during startup Technical Field

[0001] This invention relates to the field of security verification technology, and in particular to a method, apparatus, device, and medium for security verification of program files at startup. Background Technology

[0002] During the computer motherboard boot process, the secure loading of program files (such as bootloaders, EFI programs, etc.) is a crucial step in ensuring stable system operation and resisting malicious attacks. Currently, mainstream motherboard boot verification solutions have many shortcomings in terms of security, efficiency, and compatibility.

[0003] In some technologies, when motherboards or external devices perform hash value calculations on program files, there is often an issue of incomplete data reading. The calculation is performed only on the core code segment of the program file, ignoring critical parts such as the file header and data area. This results in the hash value failing to fully reflect the true information of the program file. Furthermore, the hash calculation process lacks a secondary verification mechanism. If data reading errors or algorithm execution anomalies occur, it directly leads to hash value calculation deviations, affecting the accuracy of subsequent consistency checks and making it difficult to effectively identify tampered program files. Some solutions may still generate boot commands even when verification fails, leading to the loading and execution of insecure programs. Moreover, the boot commands lack a secure signature mechanism, making them susceptible to malicious tampering and compromising the legitimacy of command execution. Additionally, the branch processing logic for successful and failed verifications is chaotic, and the reasons for prohibiting boot are not recorded in detail, hindering subsequent troubleshooting and problem localization. Summary of the Invention

[0004] This invention provides a method, apparatus, computer device, and medium for verifying program files at startup, in order to solve the problem of low security in existing program file security verification methods at startup on the market.

[0005] In a first aspect, a method for security verification of program files during boot is provided, comprising: generating a hash value of a program file to be loaded using a preset external device to obtain a first hash value; determining whether a pre-received boot command is an emergency boot command using the BIOS of a preset motherboard; if so, performing a whitelist hash value verification based on a preset emergency whitelist to obtain a first verification result; if not, reading the program file through the BIOS of the preset motherboard and performing a program file hash value verification based on the read program file to obtain a second verification result; if the first verification result is a successful verification, or the second verification result is a successful verification, generating a boot command and executing the boot program according to the boot command using the BIOS.

[0006] Secondly, a program file security verification device is provided at startup, including: a hash generation module, used to generate a hash value of the program file to be loaded using a preset external device to obtain a first hash value; and an instruction judgment module, used to determine whether a pre-received startup instruction is an emergency startup instruction using the BIOS of a preset motherboard.

[0007] The whitelist hash verification module is used to verify the whitelist hash value based on a preset emergency whitelist to obtain a first verification result; the program file hash verification module is used to read the program file through the preset motherboard BIOS and verify the program file hash value based on the read program file to obtain a second verification result; the boot execution module is used to generate a boot command and use the BIOS to execute the boot program according to the boot command.

[0008] Thirdly, a computer device is provided, including a memory, a processor, and a computer program stored in the memory and executable on the processor, wherein the processor executes the computer program to implement the steps of the above-described boot-time program file security verification method.

[0009] Fourthly, a computer-readable storage medium is provided, which stores a computer program that, when executed by a processor, implements the steps of the above-described boot-time program file security verification method.

[0010] In the aforementioned scheme implemented by the boot-time program file security verification method, apparatus, computer equipment, and storage medium, a hash value of the program file to be loaded can be generated using a preset external device to obtain a first hash value. The BIOS of a preset motherboard then determines whether the pre-received boot command is an emergency boot command. If so, a whitelist hash value verification is performed based on a preset emergency whitelist to obtain a first verification result. If not, the program file is read through the BIOS of the preset motherboard, and a program file hash value verification is performed based on the read program file to obtain a second verification result. If either the first or second verification result is successful, a boot command is generated, and the BIOS executes the boot program according to the boot command. This improves the security of boot-time program file verification. Attached Figure Description

[0011] To more clearly illustrate the technical solutions of the embodiments of the present invention, the drawings used in the description of the embodiments of the present invention will be briefly introduced below. Obviously, the drawings described below are only some embodiments of the present invention. For those skilled in the art, other drawings can be obtained based on these drawings without creative effort.

[0012] Figure 1 is a schematic diagram of an application environment for a boot-up program file security verification method according to an embodiment of the present invention; Figure 2 is a flowchart of a boot-up program file security verification method according to an embodiment of the present invention; Figure 3 is a structural schematic diagram of a boot-up program file security verification device according to an embodiment of the present invention; Figure 4 is a structural schematic diagram of a computer device according to an embodiment of the present invention; Figure 5 is another structural schematic diagram of a computer device according to an embodiment of the present invention. Detailed Implementation

[0013] The technical solutions of the embodiments of the present invention will be clearly and completely described below with reference to the accompanying drawings. Obviously, the described embodiments are only some, not all, of the embodiments of the present invention. Based on the embodiments of the present invention, all other embodiments obtained by those skilled in the art without creative effort are within the scope of protection of the present invention.

[0014] The boot-time program file security verification method provided in this invention can be applied in the application environment shown in Figure 1, where the client communicates with the server via a network. The server can use the client to generate a hash value of the program file to be loaded using a preset external device, obtaining a first hash value. The server then uses the BIOS of a preset motherboard to determine whether the pre-received boot command is an emergency boot command. If so, it performs a whitelist hash value verification based on a preset emergency whitelist, obtaining a first verification result. If not, it reads the program file through the BIOS of the preset motherboard and performs a program file hash value verification based on the read program file, obtaining a second verification result. If either the first or second verification result is successful, a boot command is generated, and the BIOS executes the boot program according to the boot command. This improves the security of boot-time program file verification. The client can be, but is not limited to, various personal computers, laptops, smartphones, tablets, and portable wearable devices. The server can be implemented using a standalone server or a server cluster consisting of multiple servers. The invention will be described in detail below through specific embodiments.

[0015] Please refer to Figure 2, which is a flowchart of a program file security verification method at startup provided by an embodiment of the present invention, including the following steps: S1, using a preset external device to generate a hash value of the program file to be loaded, and obtain a first hash value.

[0016] In this embodiment of the invention, the external device may refer to a USB flash drive, MCU, or other host computer.

[0017] In detail, the MCU refers to a microcontroller unit, which is a small computer system that integrates a processor core, memory, input / output interfaces and other functions.

[0018] In this embodiment of the invention, generating a hash value for a program file to be loaded using a preset external device to obtain a first hash value includes: reading the program file using a preset storage medium in the external device; reading the complete binary data of the program file byte by byte; performing a hash calculation on the complete binary data using a preset hash algorithm to obtain an initial hash value; performing a secondary verification on the initial hash value through a secondary calculation; confirming the initial hash value based on the verification result to obtain the first hash value.

[0019] In detail, the storage medium may include locally encrypted Flash, dedicated storage chips, etc.

[0020] Specifically, the program files may include the BootLoader and other EFI programs.

[0021] In detail, the BootLoader refers to the boot program that the BIOS (Basic Input / Output System) will load during the motherboard boot process, and it is a key component in the system startup process.

[0022] In detail, the step-by-step reading of the complete binary data of the program file means reading its entire content byte by byte in binary format, without omitting any data segments (including the file header, program code, data area, and all other parts). This complete reading method ensures that subsequent hash calculations can cover all the information in the file, avoiding inaccurate hash value calculations due to missing data.

[0023] In detail, the secondary calculation to verify the initial hash value and confirm the initial hash value based on the verification result to obtain the first hash value is to avoid errors that may occur during the first calculation (such as data reading errors, algorithm execution abnormalities, etc.). The external device performs SHA512 hash calculation again on the complete binary data of the same program file to obtain the secondary calculation result. This result is compared with the initial hash value. If they match, the initial hash value is confirmed to be accurate and is determined as the first hash value; if they do not match, the calculation process is repeated until a consistent and reliable first hash value is obtained, and it is stored in the secure storage area of ​​the external device for subsequent comparison with the hash value transmitted by the motherboard.

[0024] By using a preset external device to generate a hash value for the program file to be loaded, the first hash value can be obtained, which can improve the efficiency of subsequent consistency verification.

[0025] S2. Use the default BIOS settings on the motherboard to determine whether the pre-received power-on command is an emergency power-on command.

[0026] If so, then execute S3 to perform whitelist hash value verification based on the preset emergency whitelist and obtain the first verification result.

[0027] In this embodiment of the invention, the step of verifying the whitelist hash value based on the preset emergency whitelist to obtain a first verification result includes: obtaining the emergency whitelist stored in the preset motherboard using the BIOS; extracting the hash values ​​contained in the emergency whitelist to obtain a whitelist hash value set; determining whether the first hash value matches the hash value in the whitelist hash value set; if they match, confirming that the emergency whitelist verification is successful and confirming that the first verification result is verified; if they do not match, confirming that the first verification result is verified unsuccessfully.

[0028] In detail, the step of using the BIOS to obtain the emergency whitelist stored in the preset motherboard can be achieved by the BIOS actively accessing a secure storage area (such as the encrypted partition of the motherboard's SPI Flash) specifically for storing the emergency whitelist, and reading the emergency whitelist through a decryption operation.

[0029] Specifically, if the first hash value does not match the hash value in the whitelist hash value set, it indicates that the program file to be loaded is not within the emergency allowable range and poses a security risk. At this time, the motherboard activates a hardware alarm mechanism (such as a buzzer sounding, indicator light flashing, etc.) and sends a boot prohibition command to the BIOS. After receiving the command, the BIOS stops the boot process to prevent unsafe programs from loading and running.

[0030] If not, then execute S4, read the program file through the preset motherboard BIOS, and perform program file hash value verification based on the read program file to obtain a second verification result.

[0031] In this embodiment of the invention, when it is determined that the pre-received power-on command is not an emergency power-on command, it indicates that there is no emergency power-on requirement, and the normal verification process is executed.

[0032] In this embodiment of the invention, the step of verifying the hash value of the read program file to obtain a second verification result includes: calculating the hash value of the program file using the BIOS to obtain a second hash value; converting the format of the second hash value based on a preset serial communication protocol to obtain a converted hash value; transmitting the converted hash value to the external device using a pre-built communication interface; parsing the format of the converted hash value using the external device based on the serial communication protocol to obtain a parsed hash value; determining whether the parsed hash value is consistent with the first hash value; if consistent, confirming that the second verification result is a consistency check passed; if inconsistent, confirming that the second verification result is a consistency check failed.

[0033] In this embodiment of the invention, after verifying the hash value of the read program file to obtain a second verification result, the method further includes: sending a pre-generated random key to the BIOS via encrypted communication using the external device; obtaining the current timestamp using the BIOS, and generating a first session key based on the current timestamp and the random key; encrypting the second hash value using the first session key to obtain an encrypted hash value; sending the encrypted hash value and the current timestamp to the external device via serial communication; generating a second session key using the external device based on the random key and the current timestamp; decrypting the encrypted hash value using the second session key to obtain a decrypted hash value; performing a consistency check on the decrypted hash value and the first hash value to obtain a consistency check result; determining whether the decrypted hash value is consistent with the first hash value based on the consistency check result; if they are consistent, confirming that the hash value transmission and calculation are correct; if they are inconsistent, recording the number of errors using the external device, and when the number of errors reaches a preset number, activating a hardware locking mechanism, pausing the BIOS boot process and illuminating an alarm indicator light, requiring a physical reset to unlock.

[0034] Specifically, the preset number of times can be 3.

[0035] In detail, the step of sending a pre-generated random key to the BIOS via encrypted communication using the external device can be achieved through a hardware-encrypted serial port protocol or a dedicated encryption interface to securely transmit the random key to the motherboard's BIOS. This step ensures that the random key is not leaked during transmission, laying a secure foundation for subsequent encrypted hash value transmission.

[0036] In detail, the generation of the first session key based on the current timestamp and the random key is achieved by generating the first session key using a preset key derivation algorithm (such as HMAC-SHA256). The introduction of a timestamp in the generation of the session key ensures that the key for each communication is time-sensitive and unique, reducing the risk of key reuse and cracking.

[0037] In detail, encrypting the second hash value using the first session key can be done using a symmetric encryption algorithm.

[0038] In this embodiment of the invention, by using the BIOS of the preset motherboard to determine whether the pre-received power-on command is an emergency power-on command, the security verification efficiency in emergency power-on situations can be improved.

[0039] In detail, the format conversion of the second hash value based on the preset serial communication protocol is to convert the second hash value into data that conforms to the format of the serial communication protocol.

[0040] In detail, the pre-built communication interface can be constructed by interconnecting the INTEL PCH UART0 with the COM interface of an external device.

[0041] In detail, the INTEL PCH UART0 is the Universal Asynchronous Receiver / Transmitter (UART) interface integrated into the Intel Platform Controller Hub (PCH), which plays an important role in computer data transmission and communication.

[0042] S5. Determine whether both the first verification result and the second verification result are verified successfully.

[0043] S6. If the first verification result is not a successful verification, or if the second verification result is not a successful verification, a waiting command is sent to the motherboard.

[0044] S7. If the first verification result is successful, or the second verification result is successful, a boot command is generated, and the BIOS executes the boot program according to the boot command. In this embodiment of the invention, generating the boot command includes: performing security verification on the program file and the external device according to the verification result and a preset manufacturer whitelist to obtain a verification result; determining whether the verification result is a successful security verification; if the verification result is not a successful security verification, sending a wait command to the motherboard; if the verification result is a successful security verification, calling the boot command template built into the BIOS to generate a boot command to be signed; and using the hardware encryption module built into the BIOS to sign the boot command to be signed with a preset BIOS private key to obtain the boot command.

[0045] In this embodiment of the invention, the step of performing security verification on the program file and the external device based on the verification result and a preset manufacturer whitelist to obtain the verification result includes: obtaining the manufacturer ID of the external device; determining whether the manufacturer ID is in the manufacturer whitelist; if the manufacturer ID is in the manufacturer whitelist, then confirming that the verification result is a successful security verification; if the manufacturer ID is not in the manufacturer whitelist, then confirming that the verification result is a failed security verification.

[0046] In this embodiment of the invention, by performing security verification on the program file and the external device based on the verification result and a preset manufacturer whitelist, the verification result can be used to determine whether the external device is from a designated manufacturer, thus preventing devices from unknown sources from causing damage to the computer.

[0047] As can be seen, in the above scheme, the first hash value of the program file to be loaded is generated using a preset external device: the complete binary data of the program is read from its storage medium, the initial hash value is calculated using the SHA512 algorithm, and confirmed by secondary verification, which can improve the efficiency of subsequent verification. Next, the motherboard BIOS determines whether the boot command is an emergency command: if so, it performs an emergency whitelist verification, retrieves the emergency whitelist from the motherboard's secure storage area, extracts the hash value set, compares it with the first hash value, and if they match, the system boots; if they do not match, a hardware alarm is activated and boot is prohibited; if not, the BIOS reads the program file and calculates the second hash value. Subsequently, the external device sends a random key to the BIOS via encrypted communication. The BIOS combines the current timestamp to generate a first session key, encrypts the second hash value, and sends the encrypted hash value and timestamp to the external device via serial port; the external device generates a second session key, decrypts it, and verifies its consistency with the first hash value. At the same time, based on serial communication verification: the BIOS converts the second hash value according to the protocol and transmits it to the external device via a preset interface. The external device parses it and compares it with the first hash value. Finally, manufacturer whitelist verification is combined: it checks whether the external device manufacturer ID is in the whitelist to confirm the security status. Finally, the boot command is generated only when the verification is successful, and the BIOS executes the boot process; otherwise, the motherboard enters a loop waiting state, which improves the efficiency of program file security verification during boot.

[0048] It should be understood that the sequence number of each step in the above embodiments does not imply the order of execution. The execution order of each process should be determined by its function and internal logic, and should not constitute any limitation on the implementation process of the embodiments of the present invention.

[0049] In one embodiment, a boot-time program file security verification device is provided, which corresponds one-to-one with the boot-time program file security verification method in the above embodiments. As shown in Figure 3, the boot-time program file security verification device includes a hash generation module 101, an instruction judgment module 102, a whitelist hash verification module 103, a program file hash verification module 104, and a boot execution module 105. The detailed descriptions of each functional module are as follows: The hash generation module 101 is used to generate a hash value of the program file to be loaded using a preset external device to obtain a first hash value; the instruction judgment module 102 is used to determine whether a pre-received boot instruction is an emergency boot instruction using the BIOS of a preset motherboard.

[0050] The whitelist hash verification module 103 is used to perform whitelist hash value verification based on a preset emergency whitelist to obtain a first verification result; the program file hash verification module 104 is used to read the program file through the preset motherboard BIOS and perform program file hash value verification based on the read program file to obtain a second verification result; the boot execution module 105 is used to generate a boot command and use the BIOS to execute the boot program according to the boot command.

[0051] In one embodiment, when the hash generation module 101 performs the step of generating a hash value for the program file to be loaded using a preset external device to obtain a first hash value, it is specifically configured to: read the program file using a preset storage medium in the external device; read the complete binary data of the program file byte by byte; perform hash calculation on the complete binary data using a preset hash algorithm to obtain an initial hash value; perform a second verification on the initial hash value through a second calculation, and confirm the initial hash value based on the verification result to obtain the first hash value.

[0052] In one embodiment, the whitelist hash verification module 103, when performing the whitelist hash value verification based on the preset emergency whitelist to obtain the first verification result, is specifically configured to: obtain the emergency whitelist stored in the preset motherboard using the BIOS; extract the hash values ​​contained in the emergency whitelist to obtain a whitelist hash value set; determine whether the first hash value matches the hash value in the whitelist hash value set; if they match, confirm that the emergency whitelist verification is successful and confirm that the first verification result is verified; if they do not match, confirm that the first verification result is verified unsuccessfully.

[0053] In one embodiment, the instruction judgment module 102, when executing the program file hash value verification based on the read program file and obtaining a second verification result, specifically performs the following steps: calculating the hash value of the program file using the BIOS to obtain a second hash value; converting the format of the second hash value based on a preset serial communication protocol to obtain a converted hash value; transmitting the converted hash value to the external device based on a pre-built communication interface; parsing the format of the converted hash value using the external device based on the serial communication protocol to obtain a parsed hash value; determining whether the parsed hash value is consistent with the first hash value; if consistent, confirming that the second verification result is a consistency verification passed; if inconsistent, confirming that the second verification result is a consistency verification failed.

[0054] In one embodiment, after executing the program file hash verification based on the read program file to obtain a second verification result, the program file hash verification module 104 is further configured to: send a pre-generated random key to the BIOS using the external device via encrypted communication; obtain the current timestamp using the BIOS, and generate a first session key based on the current timestamp and the random key; encrypt the second hash value using the first session key to obtain an encrypted hash value; send the encrypted hash value and the current timestamp to the external device via serial communication; generate a second session key using the external device based on the random key and the current timestamp; decrypt the encrypted hash value using the second session key to obtain a decrypted hash value; perform a consistency check on the decrypted hash value and the first hash value to obtain a consistency check result; determine whether the decrypted hash value is consistent with the first hash value based on the consistency check result; if they are consistent, confirm that the hash value transmission and calculation are correct; if they are inconsistent, record the number of errors using the external device, and when the number of errors reaches a preset number, activate a hardware locking mechanism to pause the BIOS. The power-on process will illuminate the alarm indicator light, and the lock needs to be released through a physical reset.

[0055] In one embodiment, the boot execution module 105, when executing the boot command generation, specifically performs the following: performs security verification on the program file and the external device based on the verification result and a preset manufacturer whitelist, and obtains a verification result; determines whether the verification result is a successful security verification; if the verification result is not a successful security verification, sends a waiting command to the motherboard; if the verification result is a successful security verification, calls the boot command template built into the BIOS to generate a boot command to be signed; and uses the hardware encryption module built into the BIOS to sign the boot command to be signed using a preset BIOS private key to obtain the boot command.

[0056] In one embodiment, the boot execution module 105, when performing the security verification of the program file and the external device based on the verification result and a preset manufacturer whitelist, specifically performs the following steps: obtaining the manufacturer ID of the external device; determining whether the manufacturer ID is in the manufacturer whitelist; if the manufacturer ID is in the manufacturer whitelist, confirming that the verification result is a successful security verification; if the manufacturer ID is not in the manufacturer whitelist, confirming that the verification result is a failed security verification.

[0057] This invention provides a program file security verification device during boot. It utilizes a preset external device to generate a first hash value for the program file to be loaded: The complete binary data of the program is read from its storage medium, and the initial hash value is calculated using the SHA512 algorithm. This initial hash value is then verified through secondary checks, improving the efficiency of subsequent verification. Next, the motherboard BIOS determines whether the boot command is an emergency command. If so, it performs an emergency whitelist check, retrieves the emergency whitelist from the motherboard's secure storage area, extracts the hash value set, and compares it with the first hash value. If they match, booting occurs; otherwise, a hardware alarm is triggered and booting is disabled. If not, the BIOS reads the program file and calculates a second hash value. Subsequently, the external device sends a random key to the BIOS via encrypted communication. The BIOS combines this with the current timestamp to generate a first session key, encrypts the second hash value, and sends the encrypted hash value and timestamp to the external device via a serial port. The external device generates a second session key, decrypts it, and verifies its consistency with the first hash value. Simultaneously, based on serial communication verification: the BIOS converts the second hash value according to the protocol and transmits it to the external device via a preset interface. The external device parses the hash value and compares it with the first hash value. Furthermore, manufacturer whitelist verification is performed: checking if the external device manufacturer ID is on the whitelist confirms the security status. Finally, a boot command is generated only when verification is successful, and the BIOS executes the boot process; otherwise, the motherboard enters a loop waiting state, improving the efficiency of program file security verification during boot.

[0058] Specific limitations regarding the boot-time program file security verification device can be found in the above section on the limitations of the boot-time program file security verification method, and will not be repeated here. Each module in the aforementioned boot-time program file security verification device can be implemented entirely or partially through software, hardware, or a combination thereof. These modules can be embedded in the processor of the computer device in hardware form or independent of it, or stored in the memory of the computer device in software form, so that the processor can call and execute the corresponding operations of each module.

[0059] In one embodiment, a computer device is provided, which may be a server, and its internal structure diagram is shown in Figure 4. The computer device includes a processor, memory, a network interface, and a database connected via a system bus. The processor provides computing and control capabilities. The memory includes non-volatile and / or volatile storage media and internal memory. The non-volatile storage media stores an operating system, computer programs, and a database. The internal memory provides an environment for the operation of the operating system and computer programs in the non-volatile storage media. The network interface is used to communicate with external clients via a network connection. When the computer program is executed by the processor, it implements the functions or steps of a boot-time program file security verification method on the server side.

[0060] In one embodiment, a computer device is provided, which can be a client, and its internal structure can be as shown in Figure 5. The computer device includes a processor, memory, network interface, display screen, and input device connected via a system bus. The processor provides computing and control capabilities. The memory includes a non-volatile storage medium and internal memory. The non-volatile storage medium stores an operating system and computer programs. The internal memory provides an environment for the operation of the operating system and computer programs in the non-volatile storage medium. The network interface of the computer device is used for communication with an external server via a network connection. When the computer program is executed by the processor, it implements the client-side functions or steps of a boot-time program file security verification method. In one embodiment, a computer device is provided, including a memory, a processor, and a computer program stored in the memory and executable on the processor. When the processor executes the computer program, it performs the following steps: generating a hash value of the program file to be loaded using a preset external device to obtain a first hash value; determining whether a pre-received boot command is an emergency boot command using the BIOS of a preset motherboard; if so, performing a whitelist hash value verification based on a preset emergency whitelist to obtain a first verification result; if not, reading the program file through the BIOS of the preset motherboard and performing a program file hash value verification based on the read program file to obtain a second verification result; if the first verification result is a pass verification, or the second verification result is a pass verification, generating a boot command and executing the boot program according to the boot command using the BIOS.

[0061] In one embodiment, a computer-readable storage medium is provided, on which a computer program is stored. When the computer program is executed by a processor, it performs the following steps: generating a hash value of a program file to be loaded using a preset external device to obtain a first hash value; determining whether a pre-received boot command is an emergency boot command using the BIOS of a preset motherboard; if so, performing a whitelist hash value verification based on a preset emergency whitelist to obtain a first verification result; if not, reading the program file through the BIOS of the preset motherboard and performing a program file hash value verification based on the read program file to obtain a second verification result; if the first verification result is a pass verification, or the second verification result is a pass verification, generating a boot command and executing the boot program according to the boot command using the BIOS.

[0062] It should be noted that the functions or steps that can be implemented by the computer-readable storage medium or computer device described above can be referred to the relevant descriptions on the server side and client side in the foregoing method embodiments. To avoid repetition, they will not be described one by one here.

[0063] Those skilled in the art will understand that all or part of the processes in the methods of the above embodiments can be implemented by a computer program instructing related hardware. The computer program can be stored in a non-volatile computer-readable storage medium. When executed, the computer program can include the processes of the embodiments of the above methods. Any references to memory, storage, databases, or other media used in the embodiments provided in this application can include non-volatile and / or volatile memory. Non-volatile memory may include read-only memory (ROM), programmable ROM (PROM), electrically programmable ROM (EPROM), electrically erasable programmable ROM (EEPROM), or flash memory. Volatile memory may include random access memory (RAM) or external cache memory. By way of illustration and not limitation, RAM is available in a variety of forms, such as static RAM (SRAM), dynamic RAM (DRAM), synchronous DRAM (SDRAM), dual data rate SDRAM (DDRSDRAM), enhanced SDRAM (ESDRAM), synchronous link DRAM (SLDRAM), RAMbus direct RAM (RDRAM), direct memory bus dynamic RAM (DRDRAM), and memory bus dynamic RAM (RDRAM), etc.

[0064] Those skilled in the art will clearly understand that, for the sake of convenience and brevity, the above-described division of functional units and modules is used as an example. In practical applications, the above functions can be assigned to different functional units and modules as needed, that is, the internal structure of the device can be divided into different functional units or modules to complete all or part of the functions described above.

[0065] Finally, it should be noted that if any software tools or components not belonging to this company appear in the embodiments of the application, they are merely illustrative examples and do not represent actual use. The embodiments described above are only used to illustrate the technical solutions of the present invention, and not to limit them; although the present invention has been described in detail with reference to the foregoing embodiments, those skilled in the art should understand that modifications can still be made to the technical solutions described in the foregoing embodiments, or equivalent substitutions can be made to some of the technical features; and these modifications or substitutions do not cause the essence of the corresponding technical solutions to deviate from the spirit and scope of the technical solutions of the embodiments of the present invention, and should all be included within the protection scope of the present invention.

Claims

1. A method for verifying program file security during startup, characterized in that, include: The hash value of the program file to be loaded is generated using a preset external device, and the first hash value is obtained; The system uses the motherboard's BIOS to determine whether a pre-received power-on command is an emergency power-on command. If yes, then the whitelist hash value is verified based on the preset emergency whitelist to obtain the first verification result; if no, then the program file is read through the preset motherboard BIOS, and the program file hash value is verified based on the read program file to obtain the second verification result. If the first verification result is successful, or if the second verification result is successful, a boot command is generated, and the BIOS executes the boot program according to the boot command.

2. The boot-time program file security verification method as described in claim 1, characterized in that, The step of generating a hash value for a program file to be loaded using a preset external device to obtain a first hash value includes: reading the program file using a preset storage medium in the external device; reading the complete binary data of the program file byte by byte; performing a hash calculation on the complete binary data using a preset hash algorithm to obtain an initial hash value; performing a second verification on the initial hash value through a second calculation, and confirming the initial hash value based on the verification result to obtain the first hash value.

3. The boot-time program file security verification method as described in claim 1, characterized in that, The step of verifying the whitelist hash value based on the preset emergency whitelist to obtain the first verification result includes: obtaining the emergency whitelist stored in the preset motherboard using the BIOS; extracting the hash values ​​contained in the emergency whitelist to obtain a whitelist hash value set; determining whether the first hash value matches the hash value in the whitelist hash value set; if they match, the emergency whitelist verification is confirmed to be successful, and the first verification result is confirmed to be verified; if they do not match, the first verification result is confirmed to be verified as failed.

4. The boot-time program file security verification method as described in claim 1, characterized in that, The step of verifying the hash value of the read program file to obtain a second verification result includes: calculating the hash value of the program file using the BIOS to obtain a second hash value; converting the format of the second hash value based on a preset serial communication protocol to obtain a converted hash value; transmitting the converted hash value to the external device via a pre-built communication interface; parsing the converted hash value using the external device based on the serial communication protocol to obtain a parsed hash value; determining whether the parsed hash value is consistent with the first hash value; if consistent, confirming that the second verification result is a consistency check passed; if inconsistent, confirming that the second verification result is a consistency check failed.

5. The boot-time program file security verification method as described in claim 1, characterized in that, After verifying the hash value of the read program file to obtain a second verification result, the method further includes: sending a pre-generated random key to the BIOS via encrypted communication using the external device; obtaining the current timestamp using the BIOS, and generating a first session key based on the current timestamp and the random key; encrypting the second hash value using the first session key to obtain an encrypted hash value; sending the encrypted hash value and the current timestamp to the external device via serial communication; generating a second session key using the external device based on the random key and the current timestamp; decrypting the encrypted hash value using the second session key to obtain a decrypted hash value; performing a consistency check on the decrypted hash value and the first hash value to obtain a consistency check result; determining whether the decrypted hash value is consistent with the first hash value based on the consistency check result; if they are consistent, confirming that the hash value transmission and calculation are correct; if they are inconsistent, recording the number of errors using the external device, and when the number of errors reaches a preset number, activating a hardware locking mechanism, pausing the BIOS boot process and illuminating the alarm indicator light, requiring a physical reset to unlock.

6. The boot-time program file security verification method as described in claim 1, characterized in that, The process of generating the boot command includes: performing security verification on the program file and the external device based on the verification result and a preset manufacturer whitelist, and obtaining a verification result; determining whether the verification result is a successful security verification; if the verification result is a failed security verification, sending a wait command to the motherboard; if the verification result is a successful security verification, calling the boot command template built into the BIOS to generate a boot command to be signed; and using the hardware encryption module built into the BIOS to sign the boot command to be signed with a preset BIOS private key to obtain the boot command.

7. The boot-time program file security verification method as described in claim 6, characterized in that, The step of performing security verification on the program file and the external device based on the verification result and a preset manufacturer whitelist to obtain the verification result includes: obtaining the manufacturer ID of the external device; determining whether the manufacturer ID is in the manufacturer whitelist; if the manufacturer ID is in the manufacturer whitelist, then confirming that the verification result is a successful security verification; if the manufacturer ID is not in the manufacturer whitelist, then confirming that the verification result is a failed security verification.

8. A program file security verification device at startup, characterized in that, include: The hash generation module is used to generate the hash value of the program file to be loaded using a preset external device, and obtain the first hash value; The instruction judgment module is used to determine whether a pre-received boot instruction is an emergency boot instruction using the preset motherboard BIOS. The whitelist hash verification module is used to perform whitelist hash value verification based on a preset emergency whitelist to obtain the first verification result; The program file hash verification module is used to read the program file through the BIOS of the preset motherboard, and to perform program file hash value verification based on the read program file to obtain a second verification result; The boot execution module is used to generate boot instructions and execute the boot program according to the boot instructions by the BIOS.

9. A computer device comprising a memory, a processor, and a computer program stored in the memory and executable on the processor, characterized in that, When the processor executes the computer program, it implements the boot-time program file security verification method as described in any one of claims 1 to 7.

10. A computer-readable storage medium storing a computer program, characterized in that, When the computer program is executed by the processor, it implements the boot-time program file security verification method as described in any one of claims 1 to 7.

Images