A password processing method, device and equipment of a basic input / output system and a medium

Abstract

This invention relates to the technical field of Basic Input / Output Systems (PIS), and particularly to a method, apparatus, device, and medium for cryptographic processing of PIS. The method includes: storing the PIS public key in a read-only area of ​​the flash memory of a baseboard management controller (BMC), which cannot be modified during normal operation, effectively preventing attackers from replacing the public key or destroying the encrypted private key; storing a standard encrypted password hash in a read-write area of ​​the BMC's flash memory; decrypting both via the BMC to obtain the original, standard password hash saved during setup; and then comparing the hash to be verified in a memory area monitored by the BMC with the standard password hash to determine whether password verification has passed. By transferring the encryption and storage mechanism of the PIS password from the motherboard's PIS flash memory to the flash memory of a separate BMC, the security of the password is greatly improved.

Description

Technical Field

[0001] This invention relates to the technical field of basic input / output systems, and in particular to a cryptographic processing method, apparatus, device, and medium for basic input / output systems. Background Technology

[0002] The BIOS (Basic Input Output System) password is a core and important security feature of the BIOS itself, used to protect the computer startup and BIOS settings from unauthorized access.

[0003] In related technologies, the BIOS password is hashed and stored in the BIOS Flash memory. Alternatively, the BIOS password, after hash encryption, is directly stored in a specific area of ​​the BIOS Flash memory. During verification, the user-entered password is processed in the same way and compared with the stored hash value, resulting in relatively low security.

[0004] It is evident that improving BIOS password security is a problem that needs to be addressed by those skilled in the art. Summary of the Invention

[0005] The purpose of this application is to provide a method, apparatus, device, and medium for password processing in a basic input / output system, which can improve BIOS password security.

[0006] Firstly, a cryptographic processing method for a basic input / output system is provided, including:

[0007] When the baseboard management controller detects that there is a hash to be verified in the memory area, the hash to be verified is read; wherein, the hash to be verified is the hash of the password to be verified input by the user and stored in the memory area of ​​the baseboard management controller after the basic input / output system performs a hash calculation.

[0008] The basic input / output system cryptographic public key is read from the read-only area of ​​the flash memory of the baseboard management controller, and the standard encrypted password hash is read from the read-write area of ​​the flash memory of the baseboard management controller.

[0009] The baseboard management controller performs a decryption operation on the standard encrypted password hash and the basic input / output system password public key.

[0010] To verify the password, it is necessary to determine whether the standard password hash obtained from decryption matches the hash to be verified.

[0011] In a preferred embodiment, this application can be further configured such that, before reading the hash to be verified, when the baseboard management controller detects the presence of a hash to be verified in the memory region, the following additional steps are included:

[0012] The basic input / output system performs a hash calculation on the password to be verified input by the user to obtain the hash to be verified.

[0013] The hash to be verified is written into the memory area of ​​the baseboard management controller via the basic input / output system.

[0014] In a preferred embodiment, this application can be further configured to: before performing a hash calculation on the user-input password to be verified through the basic input / output system to obtain the hash to be verified, the application further includes:

[0015] The length of the user's plaintext password and the mask features of the user's plaintext password are obtained through the flash memory of the basic input / output system.

[0016] The password to be verified is verified based on the length of the user password plaintext and the masking features of the user password plaintext.

[0017] If the verification passes, the step of performing a hash calculation on the user-input password to be verified through the basic input / output system to obtain the hash to be verified is then executed.

[0018] In a preferred embodiment, this application may be further configured such that, after the baseboard management controller performs a decryption operation on the standard cryptographic hash and the Basic Input / Output System public key, it also includes:

[0019] If the standard cryptographic hash can be obtained, then proceed with the step of determining whether the standard cryptographic hash obtained by decryption is consistent with the hash to be verified;

[0020] If the standard password hash cannot be obtained, a first hint message is generated.

[0021] In a preferred embodiment, this application can be further configured such that, before reading the hash to be verified, when the baseboard management controller detects the presence of a hash to be verified in the memory region, the following additional steps are included:

[0022] The standard password hash is obtained by hashing the plaintext user password input by the user through the basic input / output system.

[0023] The standard cryptographic hash is written to the memory area of ​​the baseboard management controller through the basic input / output system;

[0024] When the standard password hash is detected in the memory region by the baseboard management controller, the standard password hash is read.

[0025] The basic input / output system password encryption private key is read from the read-only area of ​​the flash memory of the baseboard management controller through the baseboard management controller;

[0026] The baseboard management controller encrypts the basic input / output system password encryption private key and the standard password hash.

[0027] The standard encryption password hash obtained by encryption is written into the read / write area of ​​the flash memory of the substrate management controller.

[0028] In a preferred embodiment, this application can be further configured such that, after encrypting the basic input / output system password encryption private key and the standard password hash via the baseboard management controller, it also includes:

[0029] If the standard encrypted password hash can be obtained, then the step of writing the encrypted standard encrypted password hash into the read / write area of ​​the flash memory of the baseboard management controller is performed.

[0030] If the standard encrypted password hash cannot be obtained, a second prompt message is generated.

[0031] In a preferred example, this application can be further configured to include, before hashing the plaintext user password input by the user via a basic input / output system to obtain a standard password hash, the following:

[0032] Generate a Basic Input / Output System (PIOS) private key and a Basic Input / Output System (PIOS) public key;

[0033] The basic input / output system password private key is encrypted using the baseboard management controller to obtain the basic input / output system password encryption private key;

[0034] The basic input / output system password encryption private key and the basic input / output system password public key are written into the read-only area of ​​the flash memory of the baseboard management controller.

[0035] Secondly, a cryptographic processing apparatus for a basic input / output system is provided, comprising:

[0036] The first reading module is used to read the hash to be verified when the baseboard management controller detects that there is a hash to be verified in the memory area; wherein, the hash to be verified is the hash of the password to be verified input by the user and stored in the memory area of ​​the baseboard management controller after the basic input / output system performs a hash calculation.

[0037] The second reading module is used to read the Basic Input / Output System public key from the read-only area of ​​the flash memory of the baseboard management controller, and to read the standard encrypted password hash from the read-write area of ​​the flash memory of the baseboard management controller.

[0038] The decryption module is used to perform decryption operations on the standard encrypted password hash and the basic input / output system password public key through the baseboard management controller;

[0039] The verification module is used to determine whether the standard password hash obtained by decryption is consistent with the hash to be verified, so as to realize password verification.

[0040] Thirdly, an electronic device is provided, including a memory for storing a computer program and a processor for executing the computer program to implement a cryptographic processing method for a basic input / output system as described in any of the first aspects.

[0041] Fourthly, a computer-readable storage medium is provided on which a computer program is stored, which, when executed by a processor, implements a cryptographic processing method for a basic input / output system as described in any of the first aspects.

[0042] Fifthly, a computer program product is provided, including a computer program or instructions that, when executed by a processor, implement a cryptographic processing method for a basic input / output system as described in any of the first aspects.

[0043] In summary, the basic input / output system (BIOS) password processing method provided in this application has the following beneficial technical effects: the BIOS password public key is stored in the read-only area of ​​the flash memory of the baseboard management controller (BMC), which cannot be modified during normal device operation, effectively preventing attackers from replacing the public key or destroying the encrypted private key; the standard encrypted password hash is stored in the read-write area of ​​the BMC's flash memory; then, the BMC decrypts both to obtain the original standard password hash saved during setup; subsequently, the hash to be verified in the memory area monitored by the BMC is compared with the standard password hash to determine whether password verification has passed. By transferring the encryption and storage mechanism of the BIOS password from the motherboard's BIOS flash memory to the independent flash memory of the BMC, the password security is greatly improved.

[0044] In addition, this application also provides a cryptographic processing apparatus, device and medium for a basic input / output system, all of which have the aforementioned beneficial technical effects. Attached Figure Description

[0045] To more clearly illustrate the embodiments of the present invention, the accompanying drawings used in the embodiments will be briefly introduced below. Obviously, the drawings described below are only some embodiments of the present invention. For those skilled in the art, other drawings can be obtained based on these drawings without creative effort.

[0046] Figure 1 A structural diagram of a cryptographic processing architecture for a basic input / output system provided in an embodiment of the present invention;

[0047] Figure 2 A flowchart illustrating a cryptographic processing method for a basic input / output system provided in an embodiment of the present invention;

[0048] Figure 3 A flowchart for setting a user password is provided as an embodiment of the present invention;

[0049] Figure 4 A flowchart for BIOS password verification is provided as an embodiment of the present invention;

[0050] Figure 5 A structural diagram of a cryptographic processing device for a basic input / output system provided in an embodiment of the present invention;

[0051] Figure 6 This is a structural diagram of an electronic device provided in an embodiment of the present invention. Detailed Implementation

[0052] The technical solutions of the embodiments of the present invention will be clearly and completely described below with reference to the accompanying drawings. Obviously, the described embodiments are only some embodiments of the present invention, and not all embodiments. Based on the embodiments of the present invention, all other embodiments obtained by those of ordinary skill in the art without creative effort are within the protection scope of the present invention.

[0053] It should be noted that, in the optional embodiments of this application, the data related to object information, when applied to specific products or technologies, requires the permission or consent of the object. Furthermore, the collection, use, and processing of this data must comply with the relevant laws, regulations, and standards of the relevant countries and regions. In other words, if the embodiments of this application involve data related to an object, it must be obtained with the permission and consent of the object, the permission and consent of relevant departments, and in accordance with the relevant laws, regulations, and standards of the country and region. If the embodiments involve personal information, the acquisition of all personal information requires the consent of the individual. If sensitive information is involved, the separate consent of the information subject is required. The embodiments also need to be implemented with the permission and consent of the object.

[0054] The terms "comprising" and "having," and any variations thereof, in the specification and accompanying drawings of this invention are intended to cover non-exclusive inclusion. For example, a process, method, system, product, or apparatus that includes a series of steps or units is not limited to the steps or units listed, but may include steps or units not listed.

[0055] Traditional BIOS password management schemes mostly store password information in the motherboard's BIOS Flash memory after simple encryption or hashing. Storing passwords in BIOS Flash makes them visible to the CPU and operating system, making them vulnerable to malware attacks. Simple hash encryption algorithms are easily cracked. Therefore, this storage method exposes the system to attacks at the operating system level and even the physical layer. Attackers can exploit operating system vulnerabilities to escalate privileges and access the underlying hardware, making it relatively easy to extract or crack the BIOS Flash password information.

[0056] On the other hand, modern servers are generally equipped with a Baseboard Management Controller (BMC) for advanced out-of-band management functions. As an independently operating subsystem, the BMC has its own processor, memory, and flash storage, offering superior security isolation compared to the main system. Furthermore, to meet increasing security requirements, many BMC chips integrate hardware encryption / decryption modules, enabling secure key generation and storage, and efficient execution of encryption operations. This provides a new hardware foundation for enhancing the security level of BIOS passwords.

[0057] However, in existing technologies, BIOS password management and BMC security capabilities are usually separate. How to effectively utilize the inherent hardware security features and isolation of the BMC to reconstruct and strengthen the BIOS password storage and encryption / decryption mechanisms, thereby building a more secure and reliable BIOS password security management mechanism, is a problem that urgently needs to be researched and solved.

[0058] To enable those skilled in the art to better understand the present invention, some terms will be further described in detail below.

[0059] The BIOS is a set of programs embedded in the ROM chip on the computer's motherboard. It is responsible for performing hardware self-tests and initializations during computer startup and for loading the operating system. BIOS Setup is the interface for users to configure hardware parameters and set system passwords.

[0060] UEFI (Unified Extensible Firmware Interface) is a type of BIOS.

[0061] The BMC is a dedicated microprocessor on the server motherboard used to independently monitor and manage hardware status, providing functions such as remote control and fault diagnosis.

[0062] BMC Encryption / Decryption Module: A dedicated hardware or firmware unit integrated within the BMC to perform encryption algorithms (such as RSA, AES). It typically provides key generation, storage (within a secure area), and encryption / decryption functions, offering higher security than pure software implementations.

[0063] Public and private keys: A pair of keys used in asymmetric encryption algorithms (such as RSA). The public key can be made public and used to encrypt data; the private key must be kept strictly secret and used to decrypt data encrypted with the corresponding public key.

[0064] Hash (hash value): A data digest of any length (such as a user-entered password) that is mapped to a fixed length using a one-way hash function (such as SHA-256).

[0065] PCIe (PCI Express, High-Speed ​​Serial Computer Expansion Bus Standard) is used to connect the motherboard to high-performance peripherals such as graphics cards, solid-state drives, and network cards.

[0066] MMIO (Memory-Mapped I / O) is a mechanism for communication between the CPU and hardware devices (such as the BMC). The CPU performs read and write operations on the device by accessing a specific physical memory address (which is mapped to the device's register), just like accessing memory.

[0067] Flash memory: A type of non-volatile memory that retains data even after power is lost. BMC Flash is used to store the BMC's own firmware, configuration data, logs, and other information. It is typically divided into read-only and read-write areas. Read-only area: This is the area of ​​Flash that cannot be written to or modified in normal operating mode. It is typically used to store core firmware code, fixed certificates and public keys, etc., to prevent tampering by malicious software. Read-write area: This is the area of ​​Flash that can be read and written by the BMC firmware. It is used to store runtime configuration, user data, etc.

[0068] To enable those skilled in the art to better understand the present invention, the present invention will be further described in detail below with reference to the accompanying drawings and specific embodiments.

[0069] Next, we will describe in detail the password processing method, apparatus, device and medium of a basic input / output system provided by the embodiments of the present invention. The aim is to provide a secure storage and encryption / decryption method for BIOS passwords, which aims to reduce the security problems of BIOS passwords stored in the motherboard BIOS Flash chip being vulnerable to malicious software attacks and simple HASH algorithms being easily cracked in the prior art, and further improve the security of BIOS passwords.

[0070] See Figure 1 , Figure 1 This application provides a basic input / output system cryptographic processing architecture, including: a main processor (CPU), BIOS Flash, a BMC (containing a hardware encryption / decryption module), BMC Flash memory, and a shared MMIO communication interface connecting the BIOS and BMC. BIOS password setting and verification requests are initiated by the main BIOS, while core password storage, encryption, decryption, and comparison operations are all completed in the secure environment of the BMC. The main BIOS includes a CPU and BIOS Flash. The BIOS firmware / BIOS is run via the CPU.

[0071] This application provides a method, such as Figure 2 As shown, the method provided in this application embodiment can be executed by an electronic device, and the method includes:

[0072] S101. When the baseboard management controller detects that there is a hash to be verified in the memory area, read the hash to be verified; wherein, the hash to be verified is the hash of the password to be verified entered by the user and stored in the memory area of ​​the BMC after the basic input / output system performs a hash calculation.

[0073] In this embodiment of the application, when the BMC driver detects new data (Hash_To_Check) in the memory region (MMIO region), it will read the data and obtain the hash to be verified.

[0074] In some embodiments, when the baseboard management controller detects that a hash to be verified exists in the memory area, before reading the hash to be verified, the method further includes: performing a hash calculation on the user-input password to be verified through the basic input / output system to obtain the hash to be verified; and writing the hash to be verified into the memory area of ​​the baseboard management controller through the basic input / output system.

[0075] Specifically, the BIOS performs a hash calculation on the password entered by the user to obtain the hash Hash_To_Check. The BIOS then writes Hash_To_Check to a shared MMIO memory area pre-agreed with the BMC.

[0076] S102, Read the basic input / output system cryptographic public key from the read-only area of ​​the flash memory of the baseboard management controller through the baseboard management controller, and read the standard encrypted password hash from the read-write area of ​​the flash memory of the baseboard management controller;

[0077] In this embodiment, the BMC reads the BIOS password public key Pub_Key_BiosPwd from the read-only area of ​​the Flash, and reads the previously stored standard encrypted password hash Encrypted_Hash from the read-write area of ​​the Flash.

[0078] S103. Decrypt the standard encrypted password hash and the basic input / output system password public key through the baseboard management controller;

[0079] BMC sends the standard encrypted password hash Encrypted_Hash and Pub_Key_BiosPwd into the encryption / decryption module, performs the decryption operation, and obtains the original password hash Hash_Stored_Original / hash input that was saved during setup.

[0080] S104. Determine whether the standard password hash obtained from decryption and the hash to be verified are consistent in order to achieve password verification.

[0081] BMC compares whether Hash_To_Check and Hash_Stored_Original are completely identical.

[0082] Furthermore, the result can be returned to the BIOS via MMIO. If the result matches, the user is allowed to enter BIOS Setup; if it fails, access is denied and an incorrect password message may be displayed.

[0083] As can be seen, in this embodiment, the basic input / output system (BIOS) password public key is stored in the read-only area of ​​the flash memory of the baseboard management controller (BMDC), which cannot be modified during normal device operation, effectively preventing attackers from replacing the public key or destroying the encrypted private key. The standard encrypted password hash is stored in the read-write area of ​​the BMDC's flash memory. The BMDC then decrypts both to obtain the original, standard password hash saved during setup. Furthermore, the hash to be verified in the memory area monitored by the BMDC is compared with the standard password hash to determine whether password verification has passed. By transferring the BIOS password encryption and storage mechanism from the motherboard's BIOS flash memory to the independent flash memory of the BMDC, password security is greatly improved.

[0084] One possible implementation of this application embodiment includes, before performing hash calculation on the user-input password to be verified through the Basic Input / Output System (PIS) to obtain the hash to be verified, the method further includes: obtaining the length of the user's plaintext password and the mask features of the user's plaintext password through the flash memory of the PIS; verifying the password to be verified based on the length of the user's plaintext password and the mask features of the user's plaintext password; and if the verification passes, performing hash calculation on the user-input password to be verified through the PIS to obtain the hash to be verified.

[0085] When a user enters their password through the BIOS interface, they may accidentally enter the wrong length (e.g., only 8 characters out of a 20-character password) or enter characters that clearly do not conform to the rules (e.g., special symbols are entered when the password only contains letters and numbers). In this case, executing the entire method would increase latency. In this embodiment, to save computing resources and improve response speed, an early verification mechanism can be implemented.

[0086] During password initialization, the length of the user's plaintext password and its feature mask are stored in the BIOS Flash. The feature mask refers to the type of one or more characters and / or one or more characters included in the user's plaintext password, such as numbers, letters, special characters, etc. If both the length requirement and the mask feature are met, subsequent steps are executed; otherwise, failure is returned directly.

[0087] As can be seen, in this embodiment of the application, the efficiency of password verification can be improved by adding an early verification mechanism.

[0088] One possible implementation of this application embodiment, after the baseboard management controller performs decryption operations on the standard encrypted password hash and the BIOS password public key, further includes: if the standard password hash can be obtained, then performing a step to determine whether the decrypted standard password hash and the hash to be verified are consistent; if the standard password hash cannot be obtained, then generating a first prompt message.

[0089] The BMC includes an encryption / decryption module that performs decryption upon receiving the standard encrypted password hash and the BIOS public key. If the encryption / decryption module malfunctions during decryption, resulting in a hash that does not meet the format requirements or cannot be decrypted, the standard password hash cannot be obtained. In this case, a first message is generated to indicate decryption failure, notifying technical personnel to troubleshoot and resolve the issue, thus improving the user experience.

[0090] One possible implementation of the embodiments of this application further includes:

[0091] S21. Generate the Basic Input / Output System (PIOS) cryptographic private key and the PIOS cryptographic public key;

[0092] In one feasible approach, a tool is used to generate a pair of asymmetric encryption keys: a BIOS password encryption private key (Pri_Key_BiosPwd) and a BIOS password encryption public key (Pub_Key_BiosPwd).

[0093] In another possible implementation, a key pair update mechanism is triggered when a user logs in a certain number of times, reaching a preset threshold. Specifically, this involves: the BIOS generating a true random number R1 (length ≥ 128 bits) and sending it to the BMC in plaintext; the BMC receiving R1 and generating another random number R2; and calculating T = HMAC(K_bmc, R1||R2). Here, "||" indicates concatenation, K_bmc represents a permanent secret key within the BMC, and the BMC uses T as a random seed to generate an asymmetric key.

[0094] S22. The basic input / output system password private key is encrypted through the baseboard management controller to obtain the basic input / output system password encryption private key;

[0095] In this embodiment, the BMC dedicated tool uses the BMC's hardware encryption / decryption module to encrypt the BIOS password private key Pri_Key_BiosPwd, generating the encrypted private key Encrypted_Pri_Key as the BIOS password encryption private key.

[0096] S23. Write the basic input / output system password encryption private key and the basic input / output system password public key into the read-only area of ​​the flash memory of the baseboard management controller.

[0097] The BIOS public key (Pub_Key_BiosPwd) is directly written into the read-only area of ​​the BMC Flash to prevent tampering. The BIOS encryption private key is also written into the read-only area of ​​the BMC Flash to prevent tampering.

[0098] As can be seen, in this embodiment, the private key always exists in the hardware encryption / decryption module in the form of being protected by the BMC hardware key. Even if the BIOS password encryption private key Encrypted_Pri_Key is extracted from the Flash, it cannot be decrypted without the specific BMC hardware. The public key can be publicly read and used for verification.

[0099] Furthermore, after S23, it may include: S31-S36, wherein:

[0100] S31. The user-input plaintext password is hashed using the basic input / output system to obtain the standard password hash.

[0101] Users can enter the BIOS Setup interface and enter a new password (in plaintext) in the password setting option.

[0102] The BIOS firmware applies a secure hash algorithm (such as SHA-256) to the plaintext password entered by the user, generating a standard password hash, Hash_Input. Understandably, the BIOS firmware is burned into the BIOS flash, and the CPU reads the BIOS firmware and executes the code via the SPI interface.

[0103] S32. Write the standard password hash to the memory area of ​​the baseboard management controller through the basic input / output system;

[0104] The BIOS writes the standard password hash Hash_Input to a shared MMIO memory region pre-agreed with the BMC via PCIe MMIO.

[0105] S33. When the standard password hash is detected in the memory area by the baseboard management controller, read the standard password hash.

[0106] S34. Read the basic input / output system password encryption private key from the read-only area of ​​the flash memory of the baseboard management controller through the baseboard management controller;

[0107] S35. The basic input / output system password encryption private key and the standard password hash are encrypted using the baseboard management controller.

[0108] When the BMC driver detects new data (Hash_Input) in the MMIO area, it reads the data. Then, the BMC reads the BIOS password encryption private key Encrypted_Pri_Key from the read-only area of ​​the Flash and sends it to the encryption / decryption module along with Hash_Input. The encryption / decryption module first decrypts Encrypted_Pri_Key, and then performs an encryption operation with Hash_Input to generate the encrypted standard password hash Encrypted_Hash.

[0109] S36. Write the standard encryption password hash obtained by encryption into the read / write area of ​​the flash memory of the baseboard management controller through the baseboard management controller.

[0110] BMC writes the standard encrypted password hash Encrypted_Hash into the read / write area of ​​BMC Flash.

[0111] Furthermore, the operation status returned by MMIO can be sent to the BIOS, and the BIOS will notify the user that the password has been set successfully upon receiving the success status.

[0112] Furthermore, the basic input / output system password encryption private key and the standard password hash are encrypted using the baseboard management controller. Then, the process further includes: if the standard encrypted password hash can be obtained, writing the encrypted standard encrypted password hash into the read / write area of ​​the baseboard management controller's flash memory; if the standard encrypted password hash cannot be obtained, generating a second prompt message. The second prompt message indicates that encryption failed, allowing technicians to maintain the encryption / decryption module promptly and improving the user experience.

[0113] Based on any of the above embodiments, this invention considers that the BMC is an independent management unit of the server, possessing hardware encryption / decryption modules and hardware-level security features such as independent power supply, physical isolation, and secure storage areas, providing a higher level of security protection for BIOS passwords. Therefore, the encryption and storage mechanism of the BIOS password is transferred from the motherboard BIOS Flash to an independent BMC Flash. Simultaneously, an asymmetric encryption algorithm is used to store the private and public keys separately. The lifecycle of the private key is entirely managed within the BMC hardware encryption / decryption module and never appears in plaintext form in the BMC's general-purpose memory or Flash, fundamentally eliminating the risk of key leakage and further enhancing the security of the BIOS password. The encrypted public key is stored in a read-only area of ​​the BMC Flash and cannot be modified during normal device operation, effectively preventing attackers from replacing the public key or destroying the encrypted private key.

[0114] Based on any of the above embodiments, the BIOS password processing method provided in this application includes: a user setting password process and a BIOS password verification process.

[0115] For the process of setting a password, see [link to relevant documentation]. Figure 3 This includes: setting the Basic Input / Output System (BIOS) password; the BIOS calculating a hash; the BIOS writing the hash to a shared memory-mapped input / output (RAMI / O); the baseboard management controller (BMC) reading the hash from the RAMI / O; the BMC reading the hash from the RAMI / O; if encryption is successful, determining whether the BMC has obtained the encrypted hash; if so, writing the encrypted hash to the BMC's flash memory; returning success by writing to the RAMI / O; if not, returning failure by writing to the RAMI / O; and the BIOS prompting customer information based on the different statuses.

[0116] For the BIOS password verification process, see [link / reference]. Figure 4This includes: Basic Input / Output System (BIOS) password verification. The BIOS calculates the input password hash; the BIOS writes the hash to a shared memory-mapped input / output (MMO); the baseboard management controller (BMC) reads the hash from the MMO; the BMC reads the BIOS public key and sends it along with the previously encrypted hash to the encryption / decryption module; if decryption is successful, the BMC checks if it has obtained the hash of the original password; if not, it returns failure by writing to the MMO; if so, it compares the hash of the original password with the hash read from the MMO; if they match, it returns success by writing to the MMO, otherwise it returns failure; the BIOS prompts the client with information based on the different statuses.

[0117] One possible implementation of this application's embodiments involves restricting access to sensitive configurations corresponding to the user's permissions after successful BIOS password verification. During user access, the content of each operation performed by the user in the BIOS and operating system is recorded, including but not limited to: operation type, target address, and execution time. Furthermore, based on the user's historical access behavior, the content of each operation performed during the current access is examined to determine if it is an abnormal operation. If so, a prompt message is generated, the user's access permissions are revoked, and a permission review request is sent to the technical personnel's client for review.

[0118] The following describes a device provided by an embodiment of this application. The device described below can be referred to in correspondence with the method described above. The device of this embodiment is installed in an electronic device. Figure 5 , Figure 5 This is a structural block diagram of an apparatus according to one embodiment of this application, comprising:

[0119] The first reading module 210 is used to read the hash to be verified when the baseboard management controller detects that there is a hash to be verified in the memory area; wherein, the hash to be verified is the hash of the password to be verified input by the user and stored in the memory area of ​​the BMC after the basic input / output system performs a hash calculation.

[0120] The second reading module 220 is used to read the basic input / output system cryptographic public key from the read-only area of ​​the flash memory of the baseboard management controller and to read the standard encrypted password hash from the read-write area of ​​the flash memory of the baseboard management controller.

[0121] Decryption module 230 is used to perform decryption operations on standard encrypted password hash and basic input / output system password public key through the baseboard management controller;

[0122] The verification module 240 is used to determine whether the standard password hash obtained by decryption and the hash to be verified are consistent, so as to realize password verification.

[0123] One possible approach also includes:

[0124] The hash calculation module is used to perform hash calculation on the password to be verified input by the user through the basic input / output system to obtain the hash to be verified.

[0125] The first write module is used to write the hash to be verified into the memory area of ​​the baseboard management controller through the basic input / output system.

[0126] One possible approach also includes:

[0127] The initial verification module is used to obtain the length of the user password plaintext and the mask features of the user password plaintext through the flash memory of the basic input / output system;

[0128] The password to be verified is verified based on the length of the user password plaintext and the masking features of the user password plaintext.

[0129] If the verification passes, the step of performing a hash calculation on the user-input password to be verified through the basic input / output system to obtain the hash to be verified is then executed.

[0130] In one feasible approach, if the standard password hash can be obtained, the verification module 240 is triggered.

[0131] If the standard password hash cannot be obtained, the first prompt module is triggered to generate the first prompt message.

[0132] One possible approach also includes:

[0133] The password setting module is used to perform hash calculations on the plaintext user password input by the user through the basic input / output system to obtain a standard password hash.

[0134] The standard cryptographic hash is written to the memory area of ​​the baseboard management controller through the basic input / output system;

[0135] When the standard password hash is detected in the memory region by the baseboard management controller, the standard password hash is read.

[0136] The basic input / output system password encryption private key is read from the read-only area of ​​the flash memory of the baseboard management controller through the baseboard management controller;

[0137] The baseboard management controller encrypts the basic input / output system password encryption private key and the standard password hash.

[0138] The standard encryption password hash obtained by encryption is written into the read / write area of ​​the flash memory of the substrate management controller.

[0139] In one possible implementation, the password setting module is also used for:

[0140] If the standard encrypted password hash can be obtained, then the step of writing the encrypted standard encrypted password hash into the read / write area of ​​the flash memory of the baseboard management controller is performed.

[0141] If the standard encrypted password hash cannot be obtained, a second prompt message is generated.

[0142] One possible approach also includes:

[0143] The key pair generation module is used to generate the Basic Input / Output System (PIOS) private key and the PIOS public key.

[0144] An encryption module is used to encrypt the basic input / output system password private key through the baseboard management controller to obtain the basic input / output system password encryption private key;

[0145] The second writing module is used to write the basic input / output system password encryption private key and the basic input / output system password public key into the read-only area of ​​the flash memory of the baseboard management controller.

[0146] Figure 6 A structural diagram of an electronic device provided in an embodiment of the present invention, such as... Figure 6 As shown, the electronic device includes: a memory 60 for storing computer programs;

[0147] The processor 61 is configured to perform the steps of the method as described in the above embodiments when executing a computer program.

[0148] The electronic devices provided in this embodiment may include, but are not limited to, smartphones, tablets, laptops or desktop computers, servers, etc.

[0149] The processor 61 may include one or more processing cores, such as a quad-core processor or an octa-core processor. The processor 61 may be implemented using at least one hardware form selected from Digital Signal Processing (DSP), Field-Programmable Gate Array (FPGA), and Programmable Logic Array (PLA). The processor 61 may also include a main processor and a coprocessor. The main processor, also known as the Central Processing Unit (CPU), is used to process data in the wake-up state; the coprocessor is a low-power processor used to process data in the standby state. In some embodiments, the processor 61 may integrate a Graphics Processing Unit (GPU), which is responsible for rendering and drawing the content to be displayed on the screen. In some embodiments, the processor 61 may also include an Artificial Intelligence (AI) processor, which handles computational operations related to machine learning.

[0150] The memory 60 may include one or more computer-readable storage media, which may be non-transitory. The memory 60 may also include high-speed random access memory and non-volatile memory, such as one or more disk storage devices or flash memory devices. In this embodiment, the memory 60 is used to store at least the following computer program 601, which, after being loaded and executed by the processor 61, is capable of implementing the relevant steps of the method disclosed in any of the foregoing embodiments. In addition, the resources stored in the memory 60 may also include an operating system 602 and data 603, etc., and the storage method may be temporary storage or permanent storage. The operating system 602 may include Windows, Unix, Linux, etc.

[0151] In some embodiments, the electronic device may further include a display screen 62, an input / output interface 63, a communication interface 64, a power supply 65, and a communication bus 66.

[0152] Those skilled in the art will understand that Figure 6 The structures shown do not constitute a limitation on electronic devices and may include more or fewer components than those shown.

[0153] It is understood that if the methods in the above embodiments are implemented as software functional units and sold or used as independent products, they can be stored in a computer-readable storage medium. Based on this understanding, the technical solution of the present invention, in essence, or the part that contributes to the current technology, or all or part of the technical solution, can be embodied in the form of a software product. This computer software product is stored in a storage medium and executes all or part of the steps of the methods in the various embodiments of the present invention. The aforementioned storage medium includes: USB flash drives, portable hard drives, read-only memory (ROM), random access memory (RAM), electrically erasable programmable ROM, registers, hard disks, removable disks, CD-ROMs, magnetic disks, or optical disks, and other media capable of storing program code.

[0154] Based on this, embodiments of the present invention also provide a computer-readable storage medium storing a computer program, which, when executed by a processor, implements the steps of the cryptographic processing method of the basic input / output system described above.

[0155] Based on this, embodiments of the present invention also provide a computer program product, including a computer program / instruction, which, when executed by a processor, implements the steps of the cryptographic processing method of the basic input / output system described above.

[0156] The foregoing has provided a detailed description of a cryptographic processing method, apparatus, device, and medium for a basic input / output system according to embodiments of the present invention. The various embodiments are described in a progressive manner, with each embodiment focusing on its differences from other embodiments. Similar or identical parts between embodiments can be referred to interchangeably. For the apparatus disclosed in the embodiments, since it corresponds to the method disclosed in the embodiments, the description is relatively simple; relevant parts can be referred to in the method section.

[0157] Those skilled in the art will further recognize that the units and algorithm steps of the various examples described in conjunction with the embodiments disclosed herein can be implemented in electronic hardware, computer software, or a combination of both. To clearly illustrate the interchangeability of hardware and software, the components and steps of the various examples have been generally described in terms of functionality in the foregoing description. Whether these functions are implemented in hardware or software depends on the specific application and design constraints of the technical solution. Those skilled in the art can use different methods to implement the described functions for each specific application, but such implementations should not be considered beyond the scope of this invention.

[0158] The foregoing has provided a detailed description of the cryptographic processing method, apparatus, device, and medium for a basic input / output system provided by this invention. Specific examples have been used to illustrate the principles and implementation methods of this invention. The descriptions of the embodiments above are merely for the purpose of helping to understand the method and core ideas of this invention. It should be noted that those skilled in the art can make various improvements and modifications to this invention without departing from its principles, and these improvements and modifications also fall within the protection scope of the claims of this invention.

Claims

1. A cryptographic processing method for a basic input / output system, characterized in that, include: When the baseboard management controller detects that there is a hash to be verified in the memory area, the hash to be verified is read; wherein, the hash to be verified is the hash of the password to be verified input by the user and stored in the memory area of ​​the baseboard management controller after the basic input / output system performs a hash calculation. The basic input / output system cryptographic public key is read from the read-only area of ​​the flash memory of the baseboard management controller, and the standard encrypted password hash is read from the read-write area of ​​the flash memory of the baseboard management controller. The baseboard management controller performs a decryption operation on the standard encrypted password hash and the basic input / output system password public key. To verify the password, it is necessary to determine whether the standard password hash obtained from decryption matches the hash to be verified.

2. The cryptographic processing method for a basic input / output system according to claim 1, characterized in that, When the baseboard management controller detects the presence of a hash to be verified in the memory region, before reading the hash to be verified, the process further includes: The basic input / output system is used to perform a hash calculation on the password to be verified input by the user to obtain the hash to be verified. The hash to be verified is written into the memory area of ​​the baseboard management controller via the basic input / output system.

3. The cryptographic processing method for a basic input / output system according to claim 2, characterized in that, Before performing hash calculation on the user-input password to be verified through the basic input / output system to obtain the hash to be verified, the following steps are also included: The length of the user's plaintext password and the mask features of the user's plaintext password are obtained through the flash memory of the basic input / output system. The password to be verified is verified based on the length of the user password plaintext and the masking features of the user password plaintext. If the verification passes, the step of performing a hash calculation on the user-input password to be verified through the basic input / output system to obtain the hash to be verified is then executed.

4. The cryptographic processing method for a basic input / output system according to claim 1, characterized in that, After the baseboard management controller performs decryption operations on the standard encrypted password hash and the basic input / output system public key, the method further includes: If the standard cryptographic hash can be obtained, then proceed with the step of determining whether the standard cryptographic hash obtained by decryption is consistent with the hash to be verified; If the standard password hash cannot be obtained, a first hint message is generated.

5. The cryptographic processing method for a basic input / output system according to claim 1, characterized in that, When the baseboard management controller detects the presence of a hash to be verified in the memory region, before reading the hash to be verified, the process further includes: The standard password hash is obtained by hashing the plaintext user password input by the user through the basic input / output system. The standard cryptographic hash is written to the memory area of ​​the baseboard management controller through the basic input / output system; When the standard password hash is detected in the memory region by the baseboard management controller, the standard password hash is read. The basic input / output system password encryption private key is read from the read-only area of ​​the flash memory of the baseboard management controller through the baseboard management controller; The baseboard management controller encrypts the basic input / output system password encryption private key and the standard password hash. The standard encryption password hash obtained by encryption is written into the read / write area of ​​the flash memory of the substrate management controller.

6. The cryptographic processing method for a basic input / output system according to claim 5, characterized in that, After the baseboard management controller encrypts the basic input / output system password encryption private key and the standard password hash, the method further includes: If the standard encrypted password hash can be obtained, then the step of writing the encrypted standard encrypted password hash into the read / write area of ​​the flash memory of the baseboard management controller is performed. If the standard encrypted password hash cannot be obtained, a second prompt message is generated.

7. The cryptographic processing method for a basic input / output system according to claim 5, characterized in that, Before obtaining the standard password hash by hashing the plaintext user password entered by the user through the basic input / output system, the following steps are also included: Generate a Basic Input / Output System (PIOS) private key and a Basic Input / Output System (PIOS) public key; The basic input / output system password private key is encrypted using the baseboard management controller to obtain the basic input / output system password encryption private key; The basic input / output system password encryption private key and the basic input / output system password public key are written into the read-only area of ​​the flash memory of the baseboard management controller.

8. A cryptographic processing apparatus for a basic input / output system, characterized in that, include: The first reading module is used to read the hash to be verified when the baseboard management controller detects that there is a hash to be verified in the memory area; wherein, the hash to be verified is the hash of the password to be verified input by the user and stored in the memory area of ​​the baseboard management controller after the basic input / output system performs a hash calculation. The second reading module is used to read the Basic Input / Output System public key from the read-only area of ​​the flash memory of the baseboard management controller, and to read the standard encrypted password hash from the read-write area of ​​the flash memory of the baseboard management controller. The decryption module is used to perform decryption operations on the standard encrypted password hash and the basic input / output system password public key through the baseboard management controller; The verification module is used to determine whether the standard password hash obtained by decryption is consistent with the hash to be verified, so as to realize password verification.

9. An electronic device, characterized in that, include: Memory, used to store computer programs; A processor for executing the computer program to implement the steps of the cryptographic processing method of the basic input / output system as described in any one of claims 1 to 7.

10. A computer-readable storage medium, characterized in that, The computer-readable storage medium stores a computer program that, when executed by a processor, implements the steps of the cryptographic processing method of the basic input / output system as described in any one of claims 1 to 7.

Images