A UEFI BIOS Function Domain Control Method and System

Abstract

The application relates to a UEFI BIOS function domain control method and system, which comprises the following steps: S1, in the operating system running stage, an operating system module generates a domain control strategy of a BIOS function domain through a domain control strategy configuration tool; S2, the operating system module writes the domain control strategy into a trusted MCU chip; S3, in the operating system starting process, after the mainboard is powered on, a UEFI BIOS firmware module reads the domain control strategy from the trusted MCU chip, and controls the corresponding BIOS function domain according to the domain control strategy. The domain control strategy configuration tool realizes the unified configuration of the BIOS function domain in the operating system running stage; in the operating system starting process, the domain control strategy is read from the trusted MCU chip, and the corresponding BIOS function domain is controlled, so that the BIOS function management across operating systems is realized, and the security and reliability of the firmware configuration are improved.

Description

Technical Field

[0001] This invention belongs to the field of computer technology, and in particular relates to a UEFI BIOS functional domain control method and system. Background Technology

[0002] As the demands for computer platform management increase, enterprise users typically need to uniformly configure and control various functions in computer firmware, such as controlling the start and stop of external device interfaces, restricting external boot devices, configuring network boot policies, and controlling the usage status of specific hardware devices. These functions are usually managed by the Basic Input / Output System (BIOS) or Unified Extensible Firmware Interface (UEFI), and the corresponding configuration options are provided through the BIOS Setup interface.

[0003] In existing technologies, BIOS function control is typically implemented in the following ways: First, users can manually modify configuration options in the BIOS Setup interface, such as enabling or disabling USB ports, network boot, or external devices. Second, the firmware configuration can be changed by the operating system calling the UEFI Runtime Service interface during runtime or by modifying BIOS variables through specific management tools. Third, on some platforms, firmware configurations can be modified through the platform management controller or remote management module.

[0004] However, the existing technologies still have some shortcomings. First, configuration through the BIOS Setup interface usually requires manual operation, which is not conducive to large-scale device management and automated control. Second, the way the operating system directly modifies BIOS variables usually depends on specific operating system interfaces, resulting in poor compatibility between different operating systems. At the same time, the lack of a unified security control mechanism makes it easy for unauthorized software to modify firmware configurations. Third, existing solutions usually configure single functions, such as controlling USB or network boot separately, and lack a control mechanism that can uniformly manage BIOS functions at the domain level.

[0005] Furthermore, in existing technologies, BIOS configurations are typically stored directly in firmware variables or motherboard memory. There is a lack of an independent security control node between the operating system and the firmware, making it difficult to achieve policy authentication, version management, and policy rollback in abnormal situations. As a result, there are certain deficiencies in platform security and management reliability. Summary of the Invention

[0006] To address the aforementioned technical problems, this invention provides a UEFI BIOS functional domain control method and system.

[0007] The technical solution adopted in this invention is: Firstly, a UEFI BIOS functional domain control method is provided, applied to a UEFI BIOS functional domain control system. The UEFI BIOS functional domain control system includes an operating system module, a domain controller policy configuration tool, a trusted MCU chip, and a UEFI BIOS firmware module. The method includes: S1, During the operating system runtime phase, the operating system module generates the domain control policy for the BIOS functional domain through the domain control policy configuration tool; S2, The operating system module writes the domain control policy into the trusted MCU chip; S3: During the operating system startup process, after the motherboard is powered on, the UEFI BIOS firmware module reads the domain control policy from the trusted MCU chip and performs control operations on the corresponding BIOS function domains according to the domain control policy.

[0008] Furthermore, the domain control policy includes the function domain identifier and function domain control information of the BIOS function domain.

[0009] Furthermore, step S2 includes the following: The trusted MCU chip authenticates and verifies the integrity of the written domain control policy through a pre-built hardware security algorithm; If the authentication and integrity verification pass, the trusted MCU chip will store the domain control policy in its internal policy storage area; If the authentication and integrity verification fails, the trusted MCU chip will send a verification failure message to the operating system module.

[0010] Furthermore, in S3, during the operating system boot process, after the motherboard powers on, the UEFI BIOS firmware module reads the domain control policy from the trusted MCU chip and performs control operations on the corresponding BIOS function domains according to the domain control policy, including: S3.1 During the operating system startup process, after the motherboard is powered on, the UEFI BIOS firmware module reads the domain control policy stored in the trusted MCU chip through the motherboard interface; S3.2, the UEFI BIOS firmware module parses the domain control policy in the driver execution environment DXE stage to obtain the functional domain identifier and functional domain control information; S3.3, the UEFI BIOS firmware module determines the target BIOS function domain based on the function domain identifier; S3.4, the UEFI BIOS firmware module performs control operations on the target BIOS function domain based on the function domain control information.

[0011] Furthermore, step S3.1 is followed by: The UEFI BIOS firmware module verifies the integrity of domain controller policies through a pre-built hardware security algorithm; If the integrity verification fails, the UEFI BIOS firmware module discards the domain controller policy and uses the preset default BIOS configuration to control the BIOS functional domain. If the integrity verification passes, proceed to step S3.2.

[0012] Furthermore, the methods also include: When the UEFI BIOS firmware module controls the target BIOS function domain according to the function domain control information, the BIOS Setup interface receives the user's BIOS configuration. The UEFI BIOS firmware module discards user BIOS configurations based on the principle of maximizing the priority of the preset domain controller policy.

[0013] Furthermore, step S3.4 includes the following: The operating system module records the policy execution status after the target BIOS function domain performs control operations. The UEFI BIOS firmware module records the policy execution status after the target BIOS functional domain performs control operations; After the operating system has finished booting, the operating system module or UEFI BIOS firmware module sends the policy execution status to the trusted MCU chip. The trusted MCU chip then marks the corresponding domain control policy as an effective policy based on the policy execution status.

[0014] Furthermore, the methods also include: When the operating system fails to start consecutively, the operating system module detects the number of startup failures and determines whether the number of startup failures has reached the startup failure threshold. If the number of startup failures has not reached the startup failure threshold, then continue to step S3.4; If the number of startup failures reaches the startup failure threshold, the operating system module sends a policy failure message to the trusted MCU chip. The trusted MCU chip determines that the current domain controller policy is invalid based on the policy failure information, and retrieves the previous version of the domain controller policy from the policy storage area, and uses the previous version of the domain controller policy as the current domain controller policy.

[0015] Secondly, a UEFI BIOS functional domain control system is provided, including: Operating system module, domain controller policy configuration tool, trusted MCU chip, and UEFI BIOS firmware module; The operating system module is used to generate domain control policies for BIOS functional domains through the domain control policy configuration tool during the operating system runtime phase. The operating system module is also used to write domain control policies into a trusted MCU chip; The UEFI BIOS firmware module is used to read the domain control policy from the trusted MCU chip after the motherboard is powered on during the operating system startup process, and to control the corresponding BIOS function domains according to the domain control policy.

[0016] The beneficial effects achieved by this invention are as follows: S1, During the operating system runtime phase, the operating system module generates the domain control policy for the BIOS functional domains through the domain control policy configuration tool; S2, The operating system module writes the domain control policy into the trusted MCU chip; S3, During the operating system startup process, after the motherboard is powered on, the UEFI BIOS firmware module reads the domain control policy from the trusted MCU chip and performs control operations on the corresponding BIOS functional domains according to the domain control policy. The domain controller policy configuration tool enables unified configuration of BIOS functional domains during the operating system runtime. During the operating system startup process, the UEFI BIOS firmware module reads the domain control policy from the trusted MCU chip and performs control operations on the corresponding BIOS function domains, thereby realizing cross-operating system BIOS function management and improving the security and reliability of firmware configuration. The trusted MCU chip acts as a security control node between the operating system and UEFI BIOS. It uses hardware security algorithms to authenticate and verify the integrity of domain control policies, preventing unauthorized software from modifying domain control policies. When the number of operating system startup failures reaches the startup failure threshold, the trusted MCU chip uses the previous version of the domain control policy as the current domain control policy, thus realizing policy rollback in the event of startup anomalies. Attached Figure Description

[0017] Figure 1 This is a flowchart of the UEFI BIOS functional domain control method of the present invention; Figure 2 This is a flowchart illustrating the control operations of BIOS functional domains according to domain control policies in this invention. Figure 3 This is a global flowchart of the UEFI BIOS functional domain control method of the present invention; Figure 4 This is a structural diagram of the UEFI BIOS functional domain control system of the present invention. Detailed Implementation

[0018] The present invention will be further described below with reference to the accompanying drawings. The following embodiments are only used to more clearly illustrate the technical solution of the present invention, and should not be used to limit the scope of protection of the present invention.

[0019] like Figure 1 As shown, this embodiment of the invention provides a UEFI BIOS functional domain control method, including: S1, During the operating system runtime phase, the operating system module generates the domain control policy for the BIOS functional domain through the domain control policy configuration tool; In this embodiment, during the operating system runtime phase, the user can set and edit the domain control policy of the BIOS functional domain on the domain control policy configuration tool. The BIOS functional domain includes different types, such as hardware device initialization, driver loading, boot device enumeration, and BIOS Setup options. Specifically, the BIOS functional domain can be a USB domain, a Preboot Execution Environment (PXE) domain, or a Boot domain, etc. The operating system module deployed within the operating system obtains the domain control policy; the domain control policy includes the function domain identifier and function domain control information of the BIOS function domain. The function domain identifier is used to uniquely identify the corresponding BIOS function domain, and the function domain control information is used to describe the control requirements of the BIOS function domain.

[0020] S2, The operating system module writes the domain control policy into the trusted MCU chip; In this embodiment, the operating system module accesses the trusted MCU chip through the motherboard interface and writes the domain control policy into the trusted MCU chip.

[0021] S3: During the operating system startup process, after the motherboard is powered on, the UEFI BIOS firmware module reads the domain control policy from the trusted MCU chip and performs control operations on the corresponding BIOS function domains according to the domain control policy.

[0022] In this embodiment, the operating system startup process is from the motherboard power-on to the operating system entry process. Generally, after the motherboard power-on sequence is completed, the UEFI loads and starts up, and then the operating system is loaded to achieve startup. like Figure 2 The diagram shown is a flowchart illustrating the control operations of BIOS functional domains according to domain controller policies, including: S3.1 During the operating system startup process, after the motherboard is powered on, the UEFI BIOS firmware module reads the domain control policy stored in the trusted MCU chip through the motherboard interface; S3.2, the UEFI BIOS firmware module parses the domain control policy in the driver execution environment DXE stage to obtain the functional domain identifier and functional domain control information;

[0023] The Driver Execution Environment (DXE) stage is the most crucial stage in the UEFI BIOS firmware module startup process.

[0024] S3.3, the UEFI BIOS firmware module determines the target BIOS function domain based on the function domain identifier; S3.4, the UEFI BIOS firmware module performs control operations on the target BIOS function domain based on the function domain control information.

[0025] The target BIOS function domain is exemplified by the USB domain, PXE domain, or Boot domain. The control operation for the USB domain is to disable the USB controller and hide the USB BIOS options; The control operation for the PXE domain is to disable the PXE driver; The control operation for the Boot domain is to prevent external device startup.

[0026] Preferred, combined Figure 1 In the embodiments shown, and in some embodiments of the present invention, step S2 is followed by: The trusted MCU chip authenticates and verifies the integrity of the written domain control policy through a pre-built hardware security algorithm; If the authentication and integrity verification pass, the trusted MCU chip will store the domain control policy in its internal policy storage area; If the authentication and integrity verification fails, the trusted MCU chip will send a verification failure message to the operating system module.

[0027] Preferred, combined Figure 2 In the embodiments shown, and in some embodiments of the present invention, the method further includes the following after step S3.1: The UEFI BIOS firmware module verifies the integrity of domain controller policies through a pre-built hardware security algorithm; If the integrity verification fails, the UEFI BIOS firmware module discards the domain controller policy and uses the preset default BIOS configuration to control the BIOS functional domain. If the integrity verification passes, proceed to step S3.2.

[0028] Preferred, combined Figure 1 and Figure 2 In the embodiments shown, and in some embodiments of the present invention, the method further includes: When the UEFI BIOS firmware module controls the target BIOS function domain according to the function domain control information, the BIOS Setup interface receives the user's BIOS configuration. The UEFI BIOS firmware module discards user BIOS configurations based on the principle of maximizing the priority of the preset domain controller policy.

[0029] Preferred, combined Figure 2In the embodiments shown, and in some embodiments of the present invention, step S3.4 further includes the following: The operating system module records the policy execution status after the target BIOS function domain performs control operations. The UEFI BIOS firmware module records the policy execution status after the target BIOS functional domain performs control operations; After the operating system has finished booting, the operating system module or UEFI BIOS firmware module sends the policy execution status to the trusted MCU chip. The trusted MCU chip then marks the corresponding domain control policy as an effective policy based on the policy execution status.

[0030] Preferred, combined Figure 2 In the embodiments shown, and in some embodiments of the present invention, the method further includes: When the operating system fails to start consecutively, the operating system module detects the number of startup failures and determines whether the number of startup failures has reached the startup failure threshold. If the number of startup failures has not reached the startup failure threshold, then continue to step S3.4; If the number of startup failures reaches the startup failure threshold, the operating system module sends a policy failure message to the trusted MCU chip. The trusted MCU chip determines that the current domain controller policy is invalid based on the policy failure information, and retrieves the previous version of the domain controller policy from the policy storage area, and uses the previous version of the domain controller policy as the current domain controller policy.

[0031] Combining the UEFI BIOS functional domain control methods in all the above embodiments, through Figure 3 The global flowchart of the UEFI BIOS function domain control method shown is described in detail, and the steps include: 301. During the operating system runtime phase, the operating system module generates the domain control policy for the BIOS functional domain through the domain control policy configuration tool; 302, The operating system module writes the domain control policy into the trusted MCU chip; 303, the trusted MCU chip uses a pre-built hardware security algorithm to authenticate and verify the integrity of the written domain control policy; If the authentication and integrity verification pass, proceed to step 305; if the authentication and integrity verification fail, proceed to step 304. 304, the trusted MCU chip reports a verification failure to the operating system module; 305, The trusted MCU chip stores the domain control policy in its internal policy storage area; 306. During the operating system startup process, after the motherboard is powered on, the UEFI BIOS firmware module reads the domain control policy stored in the trusted MCU chip through the motherboard interface. 307. The UEFI BIOS firmware module performs integrity verification of domain controller policies through a pre-built hardware security algorithm. If the integrity verification fails, proceed to step 308; if the integrity verification passes, proceed to step 309. 308. The UEFI BIOS firmware module discards the domain controller policy and uses the preset default BIOS configuration to control the BIOS function domains. 309. The UEFI BIOS firmware module parses the domain controller policy during the driver execution environment DXE stage to obtain the functional domain identifier and functional domain control information. 310. The UEFI BIOS firmware module determines the target BIOS function domain based on the function domain identifier and performs control operations on the target BIOS function domain based on the function domain control information. 311. After the operating system has finished booting, the operating system module or UEFI BIOS firmware module sends the policy execution status to the trusted MCU chip. The trusted MCU chip marks the corresponding domain control policy as an effective policy based on the policy execution status. 312. When the operating system fails to start consecutively, the operating system module detects the number of startup failures and determines whether the number of startup failures has reached the startup failure threshold. If the number of startup failures has not reached the startup failure threshold, proceed to step 310; if the number of startup failures has reached the startup failure threshold, proceed to step 313. 313. The operating system module sends policy failure information to the trusted MCU chip. The trusted MCU chip determines that the current domain control policy is invalid based on the policy failure information, and retrieves the previous version of the domain control policy from the policy storage area, and uses the previous version of the domain control policy as the current domain control policy.

[0032] The UEFI BIOS functional domain control method has been fully described in the above embodiments. The following embodiments will illustrate the structural composition of the UEFI BIOS functional domain control system.

[0033] like Figure 4 As shown, this embodiment of the invention provides a UEFI BIOS functional domain control system, including: Operating system module 401, domain controller policy configuration tool 402, trusted MCU chip 403, and UEFI BIOS firmware module 404; Operating system module 401 is used to generate domain control policies for BIOS functional domains through domain control policy configuration tool 402 during the operating system runtime phase. The operating system module 401 is also used to write domain control policies into the trusted MCU chip 403; The UEFI BIOS firmware module 404 is used to read the domain control policy from the trusted MCU chip 403 after the motherboard is powered on during the operating system startup process, and to control the corresponding BIOS function domains according to the domain control policy.

[0034] In summary, the beneficial effects achieved by the UEFI BIOS functional domain control method and system described above are as follows: The domain controller policy configuration tool enables unified configuration of BIOS functional domains during the operating system runtime. During the operating system startup process, the UEFI BIOS firmware module reads the domain control policy from the trusted MCU chip and performs control operations on the corresponding BIOS function domains, thereby realizing cross-operating system BIOS function management and improving the security and reliability of firmware configuration. The trusted MCU chip acts as a security control node between the operating system and UEFI BIOS. It uses hardware security algorithms to authenticate and verify the integrity of domain control policies, preventing unauthorized software from modifying domain control policies. When the number of operating system startup failures reaches the startup failure threshold, the trusted MCU chip uses the previous version of the domain control policy as the current domain control policy, thus realizing policy rollback in the event of startup anomalies.

[0035] Those skilled in the art will understand that embodiments of the present invention can be provided as methods, systems, or computer program products. Therefore, the present invention can take the form of a completely hardware embodiment, a completely software embodiment, or an embodiment combining software and hardware aspects. Furthermore, the present invention can take the form of a computer program product embodied on one or more computer-usable storage media (including, but not limited to, disk storage, CD-ROM, optical storage, etc.) containing computer-usable program code.

[0036] This invention is described with reference to flowchart illustrations and / or block diagrams of methods, apparatus (systems), and computer program products according to embodiments of the invention. It will be understood that each block of the flowchart illustrations and / or block diagrams, and combinations of blocks in the flowchart illustrations and / or block diagrams, can be implemented by computer program instructions. These computer program instructions can be provided to a processor of a general-purpose computer, special-purpose computer, embedded processor, or other programmable data processing apparatus to produce a machine, such that the instructions, which execute via the processor of the computer or other programmable data processing apparatus, generate instructions for implementing the flowchart illustrations and / or block diagrams. Figure 1 One or more processes and / or boxes Figure 1 A device that provides the functions specified in one or more boxes.

[0037] These computer program instructions may also be stored in a computer-readable storage medium that can direct a computer or other programmable data processing device to function in a particular manner, such that the instructions stored in the computer-readable storage medium produce an article of manufacture including instruction means, which are implemented in a process Figure 1 One or more processes and / or boxes Figure 1 The function specified in one or more boxes.

[0038] These computer program instructions may also be loaded onto a computer or other programmable data processing equipment to cause a series of operational steps to be performed on the computer or other programmable equipment to produce a computer-implemented process, thereby providing instructions that execute on the computer or other programmable equipment for implementing the process. Figure 1 One or more processes and / or boxes Figure 1 The steps of the function specified in one or more boxes.

[0039] The above are merely embodiments of the present invention and are not intended to limit the present invention. Any modifications, equivalent substitutions, improvements, etc., made within the spirit and principles of the present invention are included within the scope of the claims of the present invention pending approval.

Claims

1. A UEFI BIOS functional domain control method, characterized in that, This method is applied to UEFI BIOS functional domain control systems, which include an operating system module, domain controller policy configuration tools, a trusted MCU chip, and a UEFI BIOS firmware module. S1. During the operating system runtime phase, the operating system module generates the domain control policy for the BIOS functional domain through the domain control policy configuration tool. The BIOS functional domain is either the USB domain, the PXE domain, or the Boot domain. S2, The operating system module writes the domain control policy into the trusted MCU chip; S3, during the operating system boot process, after the motherboard powers on, the UEFI BIOS firmware module reads the domain control policy from the trusted MCU chip and performs control operations on the corresponding BIOS function domains according to the domain control policy, including: S3.1 During the operating system startup process, after the motherboard is powered on, the UEFI BIOS firmware module reads the domain control policy stored in the trusted MCU chip through the motherboard interface; S3.2, the UEFI BIOS firmware module parses the domain control policy in the driver execution environment DXE stage to obtain the functional domain identifier and functional domain control information; S3.3, the UEFI BIOS firmware module determines the target BIOS function domain based on the function domain identifier; S3.4, the UEFI BIOS firmware module performs control operations on the target BIOS function domain according to the function domain control information; the control operation for the target BIOS function domain that is the USB domain is to disable the USB controller and hide the USB BIOS option; the control operation for the target BIOS function domain that is the PXE domain is to disable the PXE driver; the control operation for the target BIOS function domain that is the Boot domain is to disable external boot devices.

2. The UEFI BIOS functional domain control method according to claim 1, characterized in that, Domain control policies include the function domain identifiers and function domain control information of BIOS function domains.

3. The UEFI BIOS functional domain control method according to claim 1, characterized in that, Step S2 is followed by: The trusted MCU chip authenticates and verifies the integrity of the written domain control policy through a pre-built hardware security algorithm; If the authentication and integrity verification pass, the trusted MCU chip will store the domain control policy in its internal policy storage area; If the authentication and integrity verification fails, the trusted MCU chip will send a verification failure message to the operating system module.

4. The UEFI BIOS functional domain control method according to claim 1, characterized in that, Step S3.1 is followed by: The UEFI BIOS firmware module verifies the integrity of domain controller policies through a pre-built hardware security algorithm; If the integrity verification fails, the UEFI BIOS firmware module discards the domain controller policy and uses the preset default BIOS configuration to control the BIOS functional domain. If the integrity verification passes, proceed to step S3.

2.

5. The UEFI BIOS functional domain control method according to claim 1, characterized in that, The method also includes: When the UEFI BIOS firmware module controls the target BIOS function domain according to the function domain control information, the BIOSSetup interface receives the user's BIOS configuration. The UEFI BIOS firmware module discards user BIOS configurations based on the principle of maximizing the priority of the preset domain controller policy.

6. The UEFI BIOS functional domain control method according to claim 1, characterized in that, Step S3.4 is followed by: The operating system module records the policy execution status after the target BIOS function domain performs control operations. The UEFI BIOS firmware module records the policy execution status after the target BIOS functional domain performs control operations; After the operating system has finished booting, the operating system module or UEFI BIOS firmware module sends the policy execution status to the trusted MCU chip. The trusted MCU chip then marks the corresponding domain control policy as an effective policy based on the policy execution status.

7. The UEFI BIOS functional domain control method according to claim 6, characterized in that, The method also includes: When the operating system fails to start consecutively, the operating system module detects the number of startup failures and determines whether the number of startup failures has reached the startup failure threshold. If the number of startup failures has not reached the startup failure threshold, then continue to step S3.4; If the number of startup failures reaches the startup failure threshold, the operating system module sends a policy failure message to the trusted MCU chip. The trusted MCU chip determines that the current domain controller policy is invalid based on the policy failure information, and retrieves the previous version of the domain controller policy from the policy storage area, and uses the previous version of the domain controller policy as the current domain controller policy.

8. A UEFI BIOS functional domain control system, characterized in that, include: Operating system module, domain controller policy configuration tool, trusted MCU chip, and UEFI BIOS firmware module; The operating system module is used to generate domain control policies for BIOS functional domains through the domain control policy configuration tool during the operating system runtime phase. The BIOS functional domains are USB domain, PXE domain, or Boot domain. The operating system module is also used to write domain control policies into a trusted MCU chip; The UEFI BIOS firmware module is used to read the domain control policy stored in the trusted MCU chip through the motherboard interface after the motherboard is powered on during the operating system startup process. During the DXE stage of the driver execution environment, the domain controller policy is parsed to obtain the functional domain identifier and functional domain control information; the target BIOS functional domain is determined based on the functional domain identifier; control operations are performed on the target BIOS functional domain based on the functional domain control information; if the target BIOS functional domain is the USB domain, the control operation is to disable the USB controller and hide the USB BIOS option; if the target BIOS functional domain is the PXE domain, the control operation is to disable the PXE driver; if the target BIOS functional domain is the Boot domain, the control operation is to disable external boot devices.

Images