Server starting method and server

Abstract

The application provides a server starting method and a server, which can be applied to the fields of information security and trusted computing technology. The method is applied to a baseboard management controller. The method comprises the following steps: in the case that the baseboard management controller is in a starting state, in response to a starting event of the server, acquiring first basic measurement information of a basic input and output system of the server, a random salt value and firmware information; wherein the first basic measurement information indicates that the basic input and output system as a whole is in a safe state; determining first to-be-verified measurement information based on first encrypted information obtained by encrypting the firmware information and the random salt value; in the case that the first to-be-verified measurement information is different from the first basic measurement information, performing abnormality detection on at least one functional module of the basic input and output system to obtain an abnormality detection result, and controlling the server to maintain an unstarted state; and in the case that the first to-be-verified measurement information is the same as the first basic measurement information, starting the server under the control of the baseboard management controller.

Description

Technical Field

[0001] This application relates to the fields of information security and trusted computing technology, specifically to a server startup method and a server. Background Technology

[0002] A server is a complex computing system that integrates core hardware such as a central processing unit (CPU), memory, storage devices, network interfaces, a basic input / output system (BIOS), and a baseboard management controller (BMC). Its startup process involves several key stages, including firmware loading, hardware initialization, and operating system booting. Security vulnerabilities in any of these stages can lead to malicious code injection, firmware tampering, or unauthorized acquisition of system privileges.

[0003] For example, during the server startup phase, if the BIOS code is tampered with or injected, the server often has difficulty detecting and implementing timely and effective measures, resulting in security risks during the server startup process. Summary of the Invention

[0004] In view of the above problems, this application provides a server startup method and a server.

[0005] According to a first aspect of this application, a server startup method is provided, applicable to a baseboard management controller in a server. The method includes: when the baseboard management controller is in a startup state, in response to a startup event for the server, acquiring first basic metric information, a random salt value, and firmware information for the server's basic input / output system; wherein the first basic metric information indicates that the basic input / output system as a whole is in a secure state; determining first metric information to be verified based on first encrypted information obtained by encrypting the firmware information and the random salt value; and if the first metric information to be verified is different from the first basic metric information, performing anomaly detection on at least one functional module of the basic input / output system, obtaining anomaly detection result, and controlling the server to remain in a non-startup state; and if the first metric information to be verified is the same as the first basic metric information, starting the server under the control of the baseboard management controller.

[0006] According to an embodiment of this application, the firmware information includes image information of the hardware programmable module of the basic input / output system; when the baseboard management controller is in a startup state; in response to a startup event for the server, acquiring first basic metric information, random salt value, and firmware information of the basic input / output system for the server, including: acquiring the first basic metric information and random salt value from a database deployed in the baseboard management controller; acquiring image information from a first storage area of ​​a predetermined memory, wherein the predetermined memory is a memory for the basic input / output system, and the first storage area is a storage area for storing image information of the hardware programmable module.

[0007] According to an embodiment of this application, when the first metric information to be verified differs from the first basic metric information, anomaly detection is performed on at least one functional module of the basic input / output system to obtain anomaly detection results. This includes: obtaining module address information for each of the at least one functional module from a second storage area of ​​a predetermined memory, based on the mapping relationship between the module name and module address information of the functional module; wherein the second storage area is a storage area used to store functional modules; obtaining second basic metric information for each of the at least one functional module from a database deployed within the baseboard management controller, the second basic metric information indicating that the functional module is in a secure state; and determining the anomaly detection results based on the difference between the second basic metric information for each of the at least one functional module and second encrypted information obtained by encrypting the module address information.

[0008] According to an embodiment of this application, determining an anomaly detection result based on the difference between the second basic metric information of each of at least one functional module and the second encrypted information obtained by encrypting the module address information includes: determining the verification order of at least one functional module based on the order of the at least one module address information in a predetermined memory; for each module address information, determining the second metric information to be verified based on the second encrypted information obtained by encrypting the module address information and a random salt value; if the second metric information to be verified is different from the second basic metric information, determining the module address information and the functional module corresponding to the module address information located after the module address information in the verification order as the abnormal functional module; and generating an anomaly detection result based on the abnormal functional module.

[0009] According to an embodiment of this application, determining the first measurement information to be verified based on the first encrypted information obtained by encrypting firmware information and a random salt value includes: encrypting the firmware information using a first encryption method to obtain the first encrypted information; and encrypting the information concatenated with the first encrypted information and the random salt value using a second encryption method to obtain the first measurement information to be verified.

[0010] Based on the second encrypted information obtained after encrypting the module address information and the random salt value, the second measurement information to be verified is determined, including: encrypting the module address information using the first encryption method to obtain the second encrypted information; encrypting the information after concatenating the second encrypted information and the random salt value using the second encryption method to obtain the second measurement information to be verified; wherein the first encryption method and the second encryption method are different.

[0011] According to an embodiment of this application, when the first measurement information to be verified is the same as the first basic measurement information, starting the server under the control of the substrate management controller includes: when the first measurement information to be verified is the same as the first basic measurement information, under the control of the substrate management controller, sending a first instruction for starting the basic input / output system and a second instruction for starting the server to the processor of the server, so that the processor executes the first instruction and the second instruction in sequence to start the server.

[0012] According to an embodiment of this application, first basic metric information is generated in the following manner: when the server is in a startup state, in response to receiving a successful transmission message, third encrypted information for the basic input / output system of the version to be installed is obtained from the upgrade tool, wherein the upgrade tool is used to obtain firmware information of the basic input / output system of the version to be installed and store the firmware information in a predetermined memory, and the third encrypted information is determined by the upgrade tool; the firmware information in the predetermined memory is encrypted to obtain fourth encrypted information; and if the third encrypted information and the fourth encrypted information are the same, the first basic metric information is determined based on one of the third encrypted information and the fourth encrypted information and a random salt value.

[0013] According to embodiments of this application, the upgrade tool includes one of the following: an upgrade tool encapsulated in the operating system of a server; or an upgrade tool deployed in an electronic device other than a server.

[0014] According to an embodiment of this application, the database deployed on the substrate management controller includes a persistent data partition, in which random salt values, first basic metric information, and second basic metric information are stored; when the substrate management controller performs a version update operation, the data in the persistent data partition maintains its original state.

[0015] A second aspect of this application provides a server, comprising: a basic input / output system; and a baseboard management controller configured to, when the baseboard management controller is in an active state, in response to a startup event for the server, acquire first basic metric information, a random salt value, and firmware information for the basic input / output system of the server; wherein the first basic metric information indicates that the basic input / output system as a whole is in a secure state; determine first metric information to be verified based on first encrypted information obtained by encrypting the firmware information and the random salt value; and, if the first metric information to be verified is different from the first basic metric information, perform anomaly detection on at least one functional module of the basic input / output system, obtain anomaly detection result, and control the server to remain in an inactive state; and, if the first metric information to be verified is the same as the first basic metric information, start the server under the control of the baseboard management controller.

[0016] In the above embodiments of this application, trusted computing for the BIOS is embedded into the BMC, which not only eliminates the need to modify the hardware circuitry but also facilitates subsequent upgrades to the trusted computing program. Furthermore, the first encrypted information, encrypted with firmware information, is used in conjunction with a random salt value to determine the first metric information to be verified. This secondary encryption method, which superimposes a random salt value, effectively avoids rainbow table attacks and improves the security of server startup. Moreover, if a security anomaly is found in the BIOS metric, further anomaly detection of each functional module of the BIOS can further identify the specific module causing the anomaly, facilitating rapid location and resolution of the anomaly. Attached Figure Description

[0017] The above-mentioned contents, other objects, features and advantages of this application will become clearer from the following description of embodiments with reference to the accompanying drawings, in which:

[0018] Figure 1 A flowchart of a server startup method according to an embodiment of this application is shown.

[0019] Figure 2 A flowchart of an anomaly detection method according to an embodiment of this application is shown.

[0020] Figure 3 The diagram illustrates a scenario where trust measurement and server startup are performed using secondary encryption according to an embodiment of this application.

[0021] Figure 4 A scene diagram illustrating the generation of first basic metric information according to an embodiment of this application is shown.

[0022] Figure 5 A schematic block diagram of a server according to an embodiment of this application is shown. Detailed Implementation

[0023] The embodiments of this application will now be described with reference to the accompanying drawings. However, it should be understood that these descriptions are exemplary only and are not intended to limit the scope of this application. In the following detailed description, numerous specific details are set forth to provide a thorough understanding of the embodiments of this application for ease of explanation. However, it will be apparent that one or more embodiments may be implemented without these specific details. Furthermore, descriptions of well-known structures and technologies are omitted in the following description to avoid unnecessarily obscuring the concepts of this application.

[0024] The terminology used herein is for the purpose of describing particular embodiments only and is not intended to limit the scope of this application. The terms “comprising,” “including,” etc., as used herein indicate the presence of the stated features, steps, operations, and / or components, but do not exclude the presence or addition of one or more other features, steps, operations, or components.

[0025] All terms used herein (including technical and scientific terms) have the meanings commonly understood by those skilled in the art, unless otherwise defined. It should be noted that the terms used herein are to be interpreted in a manner consistent with the context of this specification, and not in an idealized or overly rigid way.

[0026] When using expressions such as "at least one of A, B and C", they should generally be interpreted in accordance with the meaning that is commonly understood by those skilled in the art (e.g., "a system having at least one of A, B and C" should include, but is not limited to, a system having A alone, a system having B alone, a system having C alone, a system having A and B, a system having A and C, a system having B and C, and / or a system having A, B and C, etc.).

[0027] In a server, the BIOS is the lowest-level and most critical firmware program. After the server powers on, the BIOS starts before the operating system (OS), undertaking crucial tasks such as server hardware initialization and booting the operating system. It acts as a bridge between the server hardware system and the operating system. If a backdoor program is added to the BIOS, it can covertly obtain information about the server system, enabling destructive attacks. Such attacks on the BIOS are difficult for OS-level security software to detect, so it is essential to ensure the security and trustworthiness of the BIOS program during server startup.

[0028] In some examples, trusted computing can be used to ensure the security of the BIOS. For servers, trusted computing can use encryption techniques to perform step-by-step security measurements from power-on to OS startup, ensuring the security and trustworthiness of the server system. For instance, a Trusted Platform Module (TPM), supported by security modules in computing and communication systems, performs computations to improve the overall security of the system.

[0029] For example, with the BMC as the first component to power on and boot, the BMC's security core loads the Core Root of Trust for Measurement (CRTM) to build a root of trust. During the boot process, the BMC security firmware is first measured based on the root of trust, and if the measurement passes, it is extended to the Platform Configuration Register (PCR) of the TPM platform. Then, the BMC reads the BIOS image information out of band and calculates its hash value, comparing it with the BIOS baseline hash value pre-stored in the TPM to complete the trust measurement of the BIOS image information.

[0030] Alternatively, a trusted chip driver and middleware can be added to the BMC. The trusted chip driver enables communication between the BMC and the trusted chip; the trusted chip middleware provides API interfaces for calling trusted applications at higher layers and manages the services and resources provided by the trusted chip. In addition, a security management and control module and a security event alarm module are added to the BMC. The trusted chip middleware provides the trusted chip's services and resources to the trusted measurement root of the security management and control module. During server operation, it periodically or in real-time reads the server's BIOS code and data. Based on the measurement results, it checks the integrity of the BIOS code and data using policy data stored in the trusted chip. Once BIOS code integrity is detected as corrupted, an alarm is issued to the operations and maintenance personnel. Alternatively, the TPM2.0 chip can be used as a trusted storage medium, combined with an improved trusted BIOS conforming to the Unified Extensible Firmware Interface (UEFI) specification. Before the CPU powers on, the BMC reads the critical BIOS code and calls the TPM2.0's SM3 cryptographic hash algorithm for trusted measurement.

[0031] However, the above methods all rely heavily on the TPM chip, storing the encrypted base value of the BIOS image information into the TPM chip. Furthermore, this approach requires modifications to the server management board and motherboard hardware circuitry, leading to high server R&D and production costs. In addition, the encryption methods used in these methods are vulnerable to rainbow table attacks, making the BIOS image information easily tampered with. A rainbow table attack involves a backdoor program enumerating various encryption methods on the BIOS image information after obtaining it, then infiltrating the BMC (Browser Management Center) to find the base value. Simultaneously, it tampers with the base value stored in the BMC while modifying the BIOS image, thus evading trusted measurement.

[0032] To this end, this application provides a server startup method. When the baseboard management controller is in a startup state, in response to a startup event for the server, a first basic metric information, a random salt value, and firmware information for the basic input / output system of the server are obtained. The first basic metric information indicates that the basic input / output system as a whole is in a secure state. Based on the first encrypted information obtained by encrypting the firmware information and the random salt value, a first metric information to be verified is determined. If the first metric information to be verified differs from the first basic metric information, at least one functional module of the basic input / output system is subjected to anomaly detection to obtain an anomaly detection result, and the server is controlled to remain in a non-startup state. If the first metric information to be verified is the same as the first basic metric information, the server is started under the control of the baseboard management controller.

[0033] Figure 1 A flowchart of a server startup method according to an embodiment of this application is shown. Figure 1 As shown, the method includes operations S110~S140.

[0034] In operation S110, when the baseboard management controller is in the startup state, in response to the startup event for the server, the first basic measurement information, random salt value and firmware information of the basic input / output system for the server are acquired; wherein, the first basic measurement information indicates that the basic input / output system as a whole is in a safe state.

[0035] The server includes a baseboard management controller (BMC), which is the core control unit during the server startup process and is responsible for executing the logic related to measurement, verification and startup control in the above operations S110~S140.

[0036] After the server powers on, the BMC first performs a trust measurement, and if the trust measurement passes, it enters the startup state. In this embodiment, the BMC can employ various trust measurement methods, which are not limited here. Whether it's a server power-off restart or an operating system restart, the BMC starts before the BIOS. Therefore, when the BMC has completed the trust measurement and is in the startup state, the BMC is secure and trustworthy, and can perform the trust measurement work during the BIOS startup process.

[0037] Users can trigger the boot event by pressing the power button or via a remote boot command. When the BMC is in boot mode, it can detect the boot event via a local signal port or network interface. If the BMC detects a server boot event, it will interact with the Basic Input / Output System (BIOS) through its internal communication interface to obtain the BIOS's first basic metric information, random salt value, and firmware information.

[0038] The first basic metric information is the metric information that is pre-calculated and stored in the BMC secure storage area when the BIOS is not tampered with (that is, when the BIOS is in a secure state). For example, it can be a baseline value.

[0039] The random salt value can be a randomly generated value. For example, to ensure the comparability of two measurement information during a trusted measurement process, the random salt value can be randomly generated and stored in the secure storage area of ​​the BMC when the BIOS has not been tampered with. In the event of a boot event detection, the aforementioned first basic measurement information and the random salt value can be obtained simultaneously.

[0040] Firmware information includes information related to BIOS hardware parameter management, such as the image information of the BIOS's Hardware Programmable Module (HPM). The BIOS's Hardware Programmable Module (HPM) refers to a dynamically configurable hardware logic unit within the BIOS. Its functions can be adjusted through specific programming instructions or firmware updates. For example, the HPM can be a dedicated logic module responsible for hardware initialization timing control and peripheral interface protocol adaptation. Its operating parameters or logic flow can be flexibly modified according to server hardware configuration or functional requirements to adapt to different motherboard components or expansion devices. Image information refers to a complete binary data copy of the HPM in a specific state, containing all the code instructions, configuration parameters, and logic rules required for the module's current operation. For example, when the HPM completes initialization and is in a stable operating state, its corresponding binary data snapshot in memory or storage media is the image information. This image information can serve as the core object for BIOS integrity measurement, facilitating the subsequent generation of the first verification measurement information and comparison with pre-stored first basic measurement information.

[0041] In one embodiment, firmware information may be stored separately in a storage area or memory associated with the BIOS, so as to be stored separately from the first basic metric information stored in the BMC.

[0042] In operation S120, based on the first encrypted information obtained by encrypting the firmware information and the random salt value, the first measurement information to be verified is determined.

[0043] After obtaining the firmware information, BMC can encrypt the firmware information according to a preset encryption algorithm to obtain the first encrypted information. For example, the encryption operation can be a hash calculation, and the first encrypted information can be a hash value obtained by hashing the firmware information.

[0044] In one embodiment, the first encrypted information can be concatenated or mixed with a random salt value to generate the first measurement information to be verified. Alternatively, the information after the above concatenation or mixing process can be further encrypted to obtain the first measurement information to be verified.

[0045] After obtaining the first measurement information to be verified, BMC can compare the first measurement information to be verified with the pre-stored first basic measurement information bit by bit to determine whether the first measurement information to be verified is completely the same as the pre-stored first basic measurement information.

[0046] In operation S130, if the first measurement information to be verified is different from the first basic measurement information, anomaly detection is performed on at least one functional module of the basic input / output system, the anomaly detection result is obtained, and the server is controlled to remain in an unstarted state.

[0047] A BIOS may include at least one functional module, and each functional module may be used to implement some functions of the BIOS, such as initialization and interface management. Correspondingly, the functional module may include an initialization module and an interface module.

[0048] If the first metric to be verified differs from the first basic metric, it indicates that the BIOS may have been tampered with or corrupted. The BMC will immediately trigger an anomaly detection mechanism to determine the specific functional module causing the anomaly. The anomaly detection mechanism can perform independent metric verification on each functional module of the BIOS to obtain anomaly detection results indicating the abnormal functional module. For example, if the anomaly detection determines that the initialization module or interface module is abnormal, the anomaly detection result could be "Unauthorized code injection exists in the BIOS initialization module" or "Configuration parameters of the interface management module have been tampered with."

[0049] Meanwhile, the BMC can control the server to remain in a bootable state, effectively refusing to start the server and avoiding the security risks associated with a tampered BIOS. Furthermore, the BMC can generate alarm messages based on anomaly detection results and send them to the remote monitoring terminal, promptly notifying the administrator that the server has a BIOS anomaly and requires further security checks and repairs. Only after the abnormal functional module is repaired and passes the trust measurement again can the server be unbooted and continue the normal boot process.

[0050] In operation S140, if the first measurement information to be verified is the same as the first basic measurement information, the server is started under the control of the substrate management controller.

[0051] If the first metric to be verified is the same as the first basic metric, it means that the BIOS has passed the trusted metric and can start the server normally.

[0052] In the above embodiments of this application, trusted computing for the BIOS is embedded into the BMC, which not only eliminates the need to modify the hardware circuitry but also facilitates subsequent upgrades to the trusted computing program. Furthermore, the first encrypted information, encrypted with firmware information, is used in conjunction with a random salt value to determine the first metric information to be verified. This secondary encryption method, which superimposes a random salt value, effectively avoids rainbow table attacks and improves the security of server startup. Moreover, if a security anomaly is found in the BIOS metric, further anomaly detection of each functional module of the BIOS can further identify the specific module causing the anomaly, facilitating rapid location and resolution of the anomaly.

[0053] According to an embodiment of this application, the firmware information includes image information of the hardware programmable module of the basic input / output system; when the baseboard management controller is in a startup state; in response to a startup event for the server, acquiring first basic metric information, random salt value, and firmware information of the basic input / output system for the server, including: acquiring the first basic metric information and random salt value from a database deployed in the baseboard management controller; acquiring image information from a first storage area of ​​a predetermined memory, wherein the predetermined memory is a memory for the basic input / output system, and the first storage area is a storage area for storing image information of the hardware programmable module.

[0054] In this embodiment, the BIOS trust measurement is performed by software deployed within the BMC, and the BMC in the boot state is secure and trustworthy. Therefore, a dedicated database for BIOS trust measurement can be deployed within the BMC. This database can be one that enables fast data access operations within the limited hardware resources of the BMC, meeting the real-time requirements of the BIOS trust measurement process.

[0055] In some embodiments, the database can be a non-relational database, such as a database using Structured Query Language (SQL), also known as a NoSQL database. For example, the database could be a Remote Dictionary Server (Redis) database.

[0056] The database deployed within the BMC stores the initial basic measurement information preset by the BIOS at the factory. This information is then compared with the initial measurement information calculated in real time. The random salt value is a random number generated and stored by the BMC to enhance the uniqueness and security of the encryption process and prevent replay attacks. Access to the database can be restricted to BMC-only calls. Hardware-level access control policies prevent unauthorized external programs from tampering with or reading critical data in the database, further ensuring the security of the BIOS's trusted measurement process.

[0057] In another embodiment, the first basic metric information stored in the database within the BMC can also be dynamically updated. For example, if operation S140 determines that the first metric information to be verified is the same as the first basic metric information, it can be determined that the BIOS has not been tampered with (i.e., the BIOS is in a secure state). At this time, the BMC can generate a new random salt value and regenerate a new first basic metric information in the same way as the first basic metric information was generated. The new first basic metric information is then used to replace the original first basic metric information, thereby achieving dynamic updating of the first basic metric information within the BMC's secure storage area. This method of dynamically updating the salt value when the measurement passes can further improve the reliability of BIOS measurements.

[0058] In addition, the database can record log information such as the timestamp and result status (e.g., "passed" or "failed") for each trust measurement, so that administrators can conduct subsequent audits and troubleshooting. For example, the above information can be stored in the BMC's System Event Log (SEL log).

[0059] The designated memory can be a dedicated memory separate from the BMC (Browser Control Center) to prevent the integrity of BIOS data from being affected by the BMC's own operating state or potential failures. For example, when the BMC experiences a temporary failure due to software anomalies or hardware malfunctions, the dedicated memory can still ensure that the BIOS firmware information is not tampered with or lost, guaranteeing the reliability of the server boot process. Furthermore, this designated memory design can also achieve layered isolation of the server firmware, physically separating the core firmware information of the BIOS from the BMC's operational data, further reducing the risk of data cross-contamination.

[0060] For example, the predetermined memory could be flash memory for the BIOS, or simply BIOS Flash.

[0061] The pre-defined memory can employ read-only or write-protection mechanisms, allowing modification only by authorized programs in specific scenarios (such as BIOS updates). This physically prevents malicious code from illegally tampering with BIOS firmware information, providing a stable and secure source of basic data for BIOS trust measurement.

[0062] In one specific embodiment, the predetermined memory can be further divided into regions for storage. For example, the first storage region can be a storage region for storing HPM image information. Other regions can be divided according to the functional requirements of the BIOS.

[0063] In this embodiment, the BMC can achieve isolated access and calculation of data during the BIOS trust measurement process using only the database within the BMC and the BIOS-dedicated preset memory, thus eliminating hardware dependence and ensuring data security.

[0064] Figure 2 A flowchart of an anomaly detection method according to an embodiment of this application is shown. Figure 2 As shown, for operation S130, the anomaly detection method includes operations S231 to S233.

[0065] In operation S231, based on the mapping relationship between the module name and module address information of the functional modules, the module address information of at least one functional module is obtained from the second storage area of ​​the predetermined memory; wherein, the second storage area is a storage area used to store functional modules.

[0066] In operation S232, at least one second basic metric information for each functional module is obtained from a database deployed within the baseboard management controller. The second basic metric information indicates that the functional module is in a safe state.

[0067] In operation S233, the anomaly detection result is determined based on the difference between the second basic metric information of each of at least one functional module and the second encrypted information obtained by encrypting the module address information.

[0068] In addition to a first storage area for HPM mirroring information of the BIOS as a whole, the predetermined memory may also include a second storage area, which may sequentially store module address information of at least one functional module of the BIOS. For example, the second storage area may be a fixed root address (Boot Block) area.

[0069] Module address information represents the physical or logical storage location of a functional module in the second storage area, used to precisely locate the functional module's position in the predetermined memory. For example, in the case of multiple functional modules, the module address information for each functional module can be any address range from 0x00 to 0x20 in the second storage area, and this address range uniquely corresponds to the functional module's binary code and configuration data.

[0070] In one specific embodiment, the BMC pre-stores the mapping relationship between the module names and module address information of each functional module of the BIOS, so as to determine the corresponding functional module based on the mapping relationship. When an anomaly occurs in the reliability measurement of a certain module address information, an alarm can also be triggered through the above mapping relationship.

[0071] The second basic metric information is pre-calculated and stored in the BMC secure storage area when the BIOS is not tampered with, serving as a baseline reference for the security status of functional modules. Similar to the first encrypted information, after obtaining the module address information, the BMC can retrieve the binary string data of each functional module according to the module address information and encrypt it to obtain the second encrypted information.

[0072] Similar to the comparison between the first basic measurement information and the first measurement information to be verified (overall granularity), the comparison between the second basic measurement information and the second encrypted information is a measurement of each functional module of the BIOS at a finer granularity.

[0073] In one embodiment, if the second basic measurement information is the same as the second encryption information, it means that the functional module has passed the trust measurement; otherwise, if they are different, the functional module corresponding to the module address information is an abnormal module, and the anomaly detection result can be determined based on this.

[0074] In another embodiment, the second encrypted information can be further processed, such as concatenating information or re-encrypting it. Similarly, the predetermined second basic metric information is also information obtained after other processing. If the second basic metric information is the same as the information obtained after other processing of the second encrypted information, it indicates that the functional module has passed the trust metric; otherwise, if the two are different, the functional module corresponding to the module address information is an abnormal module, and the anomaly detection result can be determined based on this.

[0075] In another embodiment, different measurement strategies can be adopted for different functional modules. For example, for functional modules with higher security levels or more important functions, a strict comparison method with multiple encryption processes can be adopted (such as performing other operations on the second encrypted information as mentioned above); for functional modules with lower security levels or auxiliary functions, a basic direct comparison method can be adopted (directly comparing the second encrypted information with the second basic measurement information) to optimize startup efficiency while ensuring system security.

[0076] In the embodiments of this application, module address information enables more precise location and isolation of BIOS functional modules, avoiding the drawback of traditional overall measurement methods where a single functional module malfunction can cause the entire BIOS verification to fail without quickly locating the problem. Furthermore, the introduction of module address information provides a clear target for subsequent anomaly repair; maintenance personnel can quickly retrieve the corresponding backup module for replacement based on the address information of the malfunctioning module, further improving the reliability and maintainability of the server system.

[0077] In this embodiment, the second storage area for more granular functional modules of the BIOS is stored separately from the first storage area. This not only avoids mutual interference with HPM mirror information, but also allows for quick access to basic configurations during BIOS updates or fault recovery, thereby improving server maintenance efficiency.

[0078] For example, if the first measurement information determined based on the HPM image information of the first storage area differs from the first basic measurement information, the HPM image information in the predetermined memory may have been tampered with. In this case, the corresponding functional module can be located further based on the module address information of each functional module in the second storage area, instead of continuing to use the entire BIOS HPM image information of the first storage area as the investigation object. In this embodiment, this fine-grained measurement method not only shortens the fault location time but also allows for the individual repair or replacement of abnormal modules without affecting the operation of other normal functional modules.

[0079] For example, a BIOS may include at least one of the following functional modules: Initialization Module (INIT), which is the first core module executed after the BIOS starts up. It is responsible for the initialization of the BIOS code itself, the basic configuration of the motherboard chipset (northbridge / southbridge), and the establishment of the underlying environment for subsequent hardware detection and initialization.

[0080] The Non-Volatile RAM / Extended System Configuration Data Module (NVRAM / EscD) consists of two modules. NVRAM stores BIOS settings (such as boot order and hardware configuration) and retains them even when power is off. The EscD module manages extended system configuration data, records hardware resource allocation information, and ensures configuration consistency between the BIOS and hardware devices.

[0081] The Power-On Self Test Module (POST) is used to detect the connection status and availability of core hardware (CPU, memory, graphics card, keyboard, storage devices, etc.) after the server is powered on; after the test is passed, the hardware initialization process is triggered.

[0082] The Setup Server Module is the core module that provides BIOS configuration services. It supports the functional logic of the Setup interface, manages the reading, writing, and verification of configuration parameters, and ensures that modifications made to BIOS parameters by users or remote management tools are legal and valid.

[0083] The Runtime Server Module, or simply Runtime module, is a module that remains resident in memory after the operating system starts. It provides basic I / O services such as interrupt service routines (e.g., disk access, display control) and hardware resource queries, and provides an interface for the low-level interaction between the OS and the hardware.

[0084] The DIMM Configuration Module focuses on the initialization and configuration of memory (DIMM), detecting memory slots, capacity, and frequency, setting memory timings and refresh parameters, and ensuring memory compatibility with the motherboard chipset.

[0085] The Setup Client module, working in conjunction with the Setup Server module, provides interactive support for the BIOS configuration interface (local / remote), receives user operation commands (such as modifying the boot order or enabling virtualization), and synchronizes them to NVRAM storage.

[0086] The Remote Server Module interfaces with remote management interfaces such as BMC, and supports receiving remote configuration commands through the Intelligent Platform Management Interface (IPMI) and Redfish protocol to enable remote modification of BIOS parameters, intervention in the boot process, and other functions without physical contact with the device.

[0087] The Desktop Management Interface Data Module (DMIData) is used to collect hardware data such as motherboard model, CPU information, memory configuration, and system serial number.

[0088] The Green Personal Computer Module (Green PC) enables energy-saving functions such as CPU frequency reduction, fan speed adjustment, and sleep / wake-up.

[0089] The Interface Module manages the communication interface between the BIOS and hardware devices, enabling device enumeration, resource allocation, and protocol adaptation to ensure that the BIOS can correctly identify and control various peripherals.

[0090] The Advanced Configuration and Power Interface Table Module (ACPI Table) is used to build standard data tables and provide the OS with structured information such as hardware power management and device configuration, supporting the OS to implement functions such as dynamic power management and hot-plugging.

[0091] The ACPI Abstract Machine Language Module (ACPI AML) is used to parse the power management logic in the ACPI table, implement low-level control such as hardware status monitoring (e.g., temperature, voltage) and power mode switching, and adapt to the power management needs of different operating systems.

[0092] The Desktop Management Interface Code Module (DMIcode) provides the underlying code interface for accessing DMI data, enabling the construction, updating, and reading of DMI data tables. It ensures that the OS and management tools can obtain hardware information through standardized interfaces and is the core implementation module of DMI functionality.

[0093] The Virus Protection Module is used to scan critical areas such as the boot sector and BIOS firmware during the startup phase to detect malicious code injection or tampering.

[0094] The aforementioned functional modules interact with each other and have a specific startup sequence. Typically, subsequent functional modules will only start or operate if one module starts successfully. It is understandable that if one functional module malfunctions, subsequent functional modules may also malfunction. Therefore, each functional module can be verified based on a predetermined verification order.

[0095] According to a specific embodiment of this application, determining an anomaly detection result based on the difference between the second basic metric information of each of at least one functional module and the second encrypted information obtained by encrypting the module address information includes: determining the verification order of at least one functional module according to the order of the at least one module address information in a predetermined memory; for each module address information, determining the second metric information to be verified based on the second encrypted information obtained by encrypting the module address information and a random salt value; if the second metric information to be verified is different from the second basic metric information, determining the module address information and the functional module corresponding to the module address information located after the module address information in the verification order as the abnormal functional module; and generating an anomaly detection result based on the abnormal functional module.

[0096] For example, the second storage area of ​​the predetermined memory can arrange the module address information of multiple functional modules according to the loading order or logical dependency relationship of the functional modules. Thus, the order of at least one module address information in the predetermined memory can directly determine the verification order of at least one encryption module. For instance, it can be stored sequentially from the basic hardware driver module to the upper-layer application service module. The verification order can directly follow this storage order, ensuring layer-by-layer verification starting from the core module of system startup.

[0097] During the sequential verification of each functional module according to the verification order, the random salt value of the overall HPM mirror information can be reused. For example, the second encrypted information is concatenated with the random salt value, and then the concatenated information is encrypted to obtain the second measurement information. The presence of anomalies in the functional module is determined by comparing whether the second measurement information to be verified is the same as the second basic measurement information. If they differ, the functional module corresponding to the module address information and the module address information following the module address information in the verification order is identified as the abnormal functional module; and anomaly detection results are generated based on the abnormal functional module.

[0098] In another embodiment, the second encrypted information and the second basic measurement information can be directly compared according to the verification order. If the second basic measurement information and the second encrypted information are different, the module address information and the functional module corresponding to the module address information located after the module address information in the verification order are identified as abnormal functional modules; and an anomaly detection result is generated based on the abnormal functional modules.

[0099] In the embodiments of this application, multiple functional modules are verified sequentially according to the verification order. This ensures that if a preceding functional module fails verification, all subsequent functional modules that depend on that module can be quickly marked as abnormal without needing to verify them individually. This improves the efficiency of anomaly detection and avoids invalid subsequent verification steps.

[0100] According to embodiments of this application, determining first verification measurement information based on first encrypted information obtained by encrypting firmware information and a random salt value includes: encrypting firmware information using a first encryption method to obtain first encrypted information; encrypting the information concatenated with the first encrypted information and the random salt value using a second encryption method to obtain first verification measurement information; determining second verification measurement information based on second encrypted information obtained by encrypting module address information and a random salt value includes: encrypting module address information using the first encryption method to obtain second encrypted information; encrypting the information concatenated with the second encrypted information and the random salt value using the second encryption method to obtain second verification measurement information; wherein the first encryption method and the second encryption method are different.

[0101] The first and second encryption methods can be implemented using different encryption algorithms. For example, the first encryption method can use the 256-bit version of the Secure Hash Algorithm (SHA256), while the second encryption method can use the 512-bit version of the Secure Hash Algorithm (SHA512).

[0102] Figure 3 This diagram illustrates a scenario where trust measurement and server startup are performed using secondary encryption according to an embodiment of this application. Figure 3 As shown, this includes operations S301 to S308.

[0103] When operating S301, a startup event is triggered.

[0104] During operation of S302, the BMC uses SHA256 to perform a hash operation on the BIOS HPM image information to obtain the first encrypted information.

[0105] In operation S303, BMC retrieves a random salt value and the first basic metric information from the Redis database.

[0106] In operation S304, the first encrypted information and the information concatenated with the random salt value are subjected to SHA512 encryption operation to obtain the first measurement information to be verified.

[0107] In operation S305, check whether the first measurement information to be verified is the same as the first basic measurement information. If the first measurement information to be verified is the same as the first basic measurement information, execute operation S306; otherwise, execute operation S307.

[0108] When operating S306, the BMC controls the motherboard CPLD to power on the CPU.

[0109] When operating S307, the BMC controls the motherboard CPLD to prevent it from powering on the CPU.

[0110] Operation S308 has ended.

[0111] The relevant technology involves encrypting the BIOS code. Only if the baseline value remains unchanged can the reliability of the BIOS during trusted boot be ensured. If the baseline value of the BIOS image or code is forged by malicious programs, trusted boot can be bypassed, posing a significant security risk.

[0112] In the embodiments of this application, by employing different encryption methods for secondary encryption, it is difficult for backdoor programs targeting the BIOS to simultaneously tamper with the BIOS HPM image information and the first basic measurement information (and it is also difficult to simultaneously tamper with the module address information and the second basic measurement information), thereby improving the security of server startup, especially against rainbow table attacks, and greatly enhancing the security of the startup process.

[0113] In another embodiment, to further enhance the security of trusted metrics, the random salt value can be a 16-bit string obtained by encrypting the firmware information and / or the first encrypted information using a third encryption method. For example, the random salt values ​​in the first basic metric information, the second basic metric information, the first metric information to be verified, and the second metric information to be verified can all be obtained by encrypting the overall HPM image information.

[0114] For example, the third encryption method may differ from the first and second encryption methods. For instance, the third encryption method may be a stream cipher symmetric encryption algorithm (Alleged RC4, ARC4).

[0115] In another embodiment, considering that functional modules are only measured when there is an anomaly in the overall HPM image information, the random salt value generated based on the overall HPM image information may be obtained by a backdoor program. Therefore, a third encryption method can be used to encrypt the binary string obtained based on the module address information and / or the second encryption information to obtain random salt values ​​for each functional module (to facilitate the distinction between the random salt value determined based on the overall HPM image information, the above random salt value can be called the first random salt value, and the random salt value for each functional module can be called the second random salt value).

[0116] Therefore, by setting independent random salt values ​​for the overall HPM image and each functional module, a "dual-layer salt protection mechanism" is formed. When the overall HPM image is normal, the first random salt value ensures the integrity of basic measurement information; while when the overall HPM image is abnormal, the second random salt value is dynamically generated based on the module address information. Even if a backdoor program attempts to tamper with or obtain the salt value, it cannot crack the measurement verification of all modules through a single salt value because the salt value of each functional module is strongly bound to the module's own address information. This design retains the efficiency of overall measurement while adding a dynamic defense layer for the security risks of local modules, further compressing the attack space of backdoor programs and improving the anti-tampering capability of the trusted measurement process.

[0117] According to an embodiment of this application, when the first measurement information to be verified is the same as the first basic measurement information, starting the server under the control of the substrate management controller includes: when the first measurement information to be verified is the same as the first basic measurement information, under the control of the substrate management controller, sending a first instruction for starting the basic input / output system and a second instruction for starting the server to the processor of the server, so that the processor executes the first instruction and the second instruction in sequence to start the server.

[0118] BMC powers on the CPU using a Complex Programmable Logic Device (CPLD) to start the server.

[0119] For example, if the first metric to be verified is the same as the first basic metric, the BMC, under its own control, first sends a pre-boot signal to the CPLD to trigger the CPU to prepare to receive boot instructions. This signal can be seen as a preparatory instruction before booting. Then, the BMC sends a first instruction to the server's CPU via the CPLD to boot the Basic Input / Output System (BIOS), causing the processor to begin loading BIOS-related programs. Immediately afterwards, it sends a second instruction to boot the server, enabling the processor to continue the subsequent boot process after completing BIOS loading, such as loading the operating system, ultimately completing the server boot. Throughout this process, the CPLD precisely controls the CPU power-on sequence and the accurate transmission of instructions according to the BMC's instructions, ensuring the server can boot safely and stably.

[0120] The above explanation focuses on the measurement dimensions of the server startup process. To facilitate understanding of the process of generating the first basic measurement information before measurement, the following explanation will take the server startup process of updating the BIOS and generating the first basic measurement information as an example (it can be understood that the above operations S110~S140 can be regarded as the process of restarting the server after completing the BIOS update and shutting down).

[0121] According to an embodiment of this application, first basic metric information is generated in the following manner: when the server is in a startup state, in response to receiving a successful transmission message, third encrypted information for the basic input / output system of the version to be installed is obtained from the upgrade tool, wherein the upgrade tool is used to obtain firmware information of the basic input / output system of the version to be installed and store the firmware information in a predetermined memory, and the third encrypted information is determined by the upgrade tool; the firmware information in the predetermined memory is encrypted to obtain fourth encrypted information; and if the third encrypted information and the fourth encrypted information are the same, the first basic metric information is determined based on one of the third encrypted information and the fourth encrypted information and a random salt value.

[0122] Successful transmission information indicates that the upgrade tool has completely and accurately stored the firmware information of the BIOS version to be installed into the designated memory, triggering the subsequent process of generating the first basic measurement information. When the server is in the boot state and the BIOS is being updated, if successful transmission information is not received (or failed transmission information is received), it indicates that the firmware information transmission may have been interrupted, missing, or erroneous. In this case, the steps of obtaining the third encrypted information and subsequent encryption verification will not be executed to avoid generating invalid basic measurement information based on incomplete or erroneous firmware information.

[0123] For example, the upgrade tool can send a successful transfer message to the BMC by calling the predefined redfish interface of the BMC, in order to notify the BMCBIOS that the HPM image information has been uploaded.

[0124] The upgrade tool can be a tool specifically designed for BIOS upgrades and can be implemented using various tools. According to embodiments of this application, the upgrade tool includes one of the following: an upgrade tool encapsulated in the operating system of a server; or an upgrade tool deployed in an electronic device other than a server.

[0125] Upgrade tools can be dedicated firmware upgrade programs running on the server's local OS, or upgrade management platforms deployed on remote terminals and communicating with the server over a network (i.e., upgrade tools deployed on electronic devices other than servers). For example, local dedicated firmware upgrade programs are typically integrated into the server's management interface. Users can select the BIOS version to be installed through the interface, and the tool automatically retrieves firmware information from a specified path (such as local storage or a vendor server) and performs the storage operation. Remote upgrade tools, on the other hand, are suitable for multi-server cluster management scenarios. Administrators can push firmware information to the server currently updating its BIOS through a unified upgrade management platform, send a successful transmission message to the server after transmission is complete, and trigger subsequent measurement information generation. Regardless of the form used, upgrade tools must have the functions of acquiring, verifying, storing, and providing status feedback on firmware information to ensure the integrity of the firmware information and the reliability of the transmission process.

[0126] As the front-end execution entity for firmware information transmission and preprocessing, the upgrade tool is directly responsible for the acquisition, verification, and preliminary processing of firmware information. Therefore, in a BIOS update scenario, the upgrade tool performs integrity verification on the firmware information obtained from external sources (such as vendor servers or local storage) and generates third-party encrypted information based on the verification results to ensure that the firmware information subsequently transmitted to the BMC has not been tampered with.

[0127] After the firmware information is transmitted to the designated storage (upgrade tools based on the server can transmit via in-band, while remote upgrade tools based on electronic devices can upload via out-of-band), the BMC can retrieve the firmware information from the designated storage and encrypt it to generate a fourth encrypted message. This fourth encrypted message is then used to determine whether the firmware information currently received by the server is abnormal through trusted computing. If the third and fourth encrypted messages are the same, it means that the BIOS has not been tampered with during the upload process, and the next update can proceed. If they are different, it means that the BIOS has been tampered with during the upload process, and the BIOS upgrade will be directly aborted.

[0128] For example, if the third and fourth encrypted information are the same, one of the third and fourth encrypted information (both can be encrypted using SHA256) is concatenated with a random salt value, and the concatenated information is encrypted using SHA512 to obtain the first basic metric information.

[0129] In the embodiments of this application, by generating third encrypted information by the upgrade tool, generating fourth encrypted information by the BMC, and generating first basic measurement information when both are the same, the integrity and reliability of BIOS firmware information during transmission and storage can be effectively guaranteed. This ensures that only legitimate firmware information that has undergone strict verification can enter the update process, effectively reducing security risks such as abnormal startup and data leakage caused by malicious firmware.

[0130] Figure 4 A scene diagram illustrating the generation of first basic metric information according to an embodiment of this application is shown. Figure 4 As shown, this includes operations S401 to S406.

[0131] Operate the S401 to upload the BIOS HPM image information. Specifically, this can be done via an upgrade tool, either in-band or out-of-band.

[0132] Operation S402: The BMC uses SHA256 to perform a hash operation on the BIOS HPM image information to obtain the fourth encrypted information.

[0133] In step S403, determine whether the upload was successful. Specifically, the BMC can obtain the third encrypted information generated by the upgrade tool and determine whether the upload was successful by comparing the third encrypted information with the fourth encrypted information. If the third encrypted information and the fourth encrypted information are the same, execute step S404; otherwise, execute step S406.

[0134] Operation S404 generates a random salt value for the third encrypted information using the ARC4 algorithm and stores it in the BMC Redis database.

[0135] The S405 is used to encrypt the information concatenated with the third encryption information and the random salt value using the SHA512 algorithm, thereby obtaining the first basic metric information, which is then stored in the BMC Redis database.

[0136] Operation S406, end.

[0137] According to an embodiment of this application, the database deployed on the substrate management controller includes a persistent data partition, in which random salt values, first basic metric information, and second basic metric information are stored; when the substrate management controller performs a version update operation, the data in the persistent data partition maintains its original state.

[0138] For example, the database can be a Redis database in BMC, set in BMC Flash; by configuring the persistent data partition in the Redis database, as well as the storage path of the random salt, the first basic metric information and the second basic metric information, the data in the persistent data partition will not be erased when the BMC version is upgraded.

[0139] For example, the persistent data partition is stored independently of the system partition. When the BMC performs a version update, the firmware of its system partition is rewritten. During this process, the persistent data partition of the Redis database remains in a read-only protected state, and the information stored therein, such as the random salt value, remains unchanged. This ensures that subsequent BIOS trust measurements can still be performed based on the original random salt value and the corresponding basic measurement information, thus providing stable and reliable basic data support for the integrity verification of BIOS upgrades.

[0140] Figure 5 A schematic block diagram of a server according to an embodiment of this application is shown. Figure 5 As shown, the server may include a baseboard management controller (BMC) and a basic input / output system (BIOS).

[0141] A baseboard management controller is configured to, when the baseboard management controller is in an active state, in response to a startup event for the server, acquire first basic metric information, a random salt value, and firmware information for the basic input / output system of the server; wherein the first basic metric information indicates that the basic input / output system as a whole is in a secure state; determine first metric information to be verified based on first encrypted information obtained by encrypting the firmware information and the random salt value; and compare the first metric information to be verified with the first basic metric information. If the first metric information to be verified differs from the first basic metric information, perform anomaly detection on at least one functional module of the basic input / output system, obtain anomaly detection result, and control the server to remain in an inactive state; if the first metric information to be verified is the same as the first basic metric information, start the server under the control of the baseboard management controller.

[0142] The BMC is configured to perform functions similar to the server startup method described above, and will not be repeated here.

[0143] In some embodiments, the server may also include firmware such as a CPU and a preset memory to enable data access and trust measurement during the server startup process. For specific operations, please refer to the server startup method described above, which will not be repeated here.

[0144] According to embodiments of this application, program code for executing the computer programs provided in the embodiments of this application can be written in any combination of one or more programming languages. Specifically, these computational programs can be implemented using high-level procedural and / or object-oriented programming languages, and / or assembly / machine languages. Programming languages ​​include, but are not limited to, languages ​​such as Java, C++, Python, "C", or similar programming languages. The program code can be executed entirely on the user's computing device, partially on the user's device, partially on a remote computing device, or entirely on a remote computing device or server. In cases involving remote computing devices, the remote computing device can be connected to the user's computing device via any type of network, including a local area network (LAN) or a wide area network (WAN), or it can be connected to an external computing device (e.g., via the Internet using an Internet service provider).

[0145] The flowcharts and block diagrams in the accompanying drawings illustrate the architecture, functionality, and operation of possible implementations of systems, methods, and computer program products according to various embodiments of this application. In this regard, each block in a flowchart or block diagram may represent a module, segment, or portion of code containing one or more executable instructions for implementing a specified logical function. It should also be noted that in some alternative implementations, the functions indicated in the blocks may occur in a different order than those indicated in the drawings. For example, two consecutively indicated blocks may actually be executed substantially in parallel, and they may sometimes be executed in reverse order, depending on the functions involved. It should also be noted that each block in a block diagram or flowchart, and combinations of blocks in a block diagram or flowchart, may be implemented using a dedicated hardware-based system that performs the specified function or operation, or using a combination of dedicated hardware and computer instructions.

[0146] Those skilled in the art will understand that the features described in the various embodiments of this application can be combined and / or combined in various ways, even if such combinations or combinations are not explicitly described in this application. In particular, the features described in the various embodiments of this application can be combined and / or combined in various ways without departing from the spirit and teachings of this application. All such combinations and / or combinations fall within the scope of this application.

[0147] The embodiments of this application have been described above. However, these embodiments are merely illustrative and not intended to limit the scope of this application. Although various embodiments have been described above, this does not mean that the measures in the various embodiments cannot be used advantageously in combination. Without departing from the scope of this application, those skilled in the art can make various substitutions and modifications, all of which should fall within the scope of this application.

Claims

1. A server startup method, characterized in that, The method is applied to a baseboard management controller; the method includes: When the baseboard management controller is in the startup state, in response to a startup event for the server, it acquires first basic metric information, random salt value, and firmware information for the basic input / output system of the server; wherein, the first basic metric information indicates that the basic input / output system as a whole is in a secure state; Based on the first encrypted information obtained by encrypting the firmware information and the random salt value, the first metric information to be verified is determined; and If the first measurement information to be verified is different from the first basic measurement information, anomaly detection is performed on at least one functional module of the basic input / output system to obtain anomaly detection results, and the server is controlled to remain in an unstarted state. If the first measurement information to be verified is the same as the first basic measurement information, the server is started under the control of the substrate management controller.

2. The method according to claim 1, characterized in that, The firmware information includes the image information of the hardware programmable module of the basic input / output system; when the baseboard management controller is in the startup state, in response to a startup event for the server, the acquisition of the first basic metric information, random salt value, and firmware information of the basic input / output system for the server includes: The first basic metric information and the random salt value are obtained from the database deployed within the substrate management controller; The mirror information is obtained from a first storage area of ​​a predetermined memory, wherein the predetermined memory is a memory for the basic input / output system, and the first storage area is a storage area for storing the mirror information of the hardware programmable module.

3. The method according to claim 1, characterized in that, When the first metric information to be verified differs from the first basic metric information, anomaly detection is performed on at least one functional module of the basic input / output system to obtain anomaly detection results, including: Based on the mapping relationship between the module name and module address information of the functional modules, the module address information of at least one of the functional modules is obtained from the second storage area of ​​the predetermined memory; wherein, the second storage area is a storage area for storing the functional modules; From the database deployed in the baseboard management controller, obtain at least one second basic metric information for each of the functional modules, the second basic metric information indicating that the functional module is in a safe state; The anomaly detection result is determined based on the difference between the second basic metric information of each of the at least one of the functional modules and the second encrypted information obtained by encrypting the address information of the module.

4. The method according to claim 3, characterized in that, The step of determining the anomaly detection result based on the difference between the second basic metric information of at least one of the functional modules and the second encrypted information obtained by encrypting the module address information includes: The verification order of at least one of the functional modules is determined based on the order of the address information of at least one of the modules in the predetermined memory; For each of the module address information, based on the second encrypted information obtained after encrypting the module address information and the random salt value, the second verification measurement information is determined; If the second measurement information to be verified is different from the second basic measurement information, the functional modules corresponding to the module address information and the module address information located after the module address information in the verification order are identified as abnormal functional modules; and the abnormal detection result is generated based on the abnormal functional modules.

5. The method according to claim 1 or 4, characterized in that, The step of determining the first verification metric information based on the first encrypted information obtained by encrypting the firmware information and the random salt value includes: The firmware information is encrypted using a first encryption method to obtain the first encrypted information; the information obtained by concatenating the first encrypted information with the random salt value is encrypted using a second encryption method to obtain the first measurement information to be verified. Based on the second encrypted information obtained after encrypting the module address information and the random salt value, the second metric information to be verified is determined, including: The module address information is encrypted using the first encryption method to obtain the second encrypted information; the information concatenated with the random salt value is encrypted using the second encryption method to obtain the second verification measurement information. The first encryption method is different from the second encryption method.

6. The method according to claim 1, characterized in that, When the first measurement information to be verified is the same as the first basic measurement information, starting the server under the control of the substrate management controller includes: When the first measurement information to be verified is the same as the first basic measurement information, under the control of the baseboard management controller, a first instruction for starting the basic input / output system and a second instruction for starting the server are sent to the processor of the server, so that the processor executes the first instruction and the second instruction in sequence to start the server.

7. The method according to claim 1, characterized in that, The first basic metric information is generated in the following manner: When the server is in the startup state, in response to receiving a successful transmission message, the third encryption information for the basic input / output system of the version to be installed is obtained from the upgrade tool, wherein the upgrade tool is used to obtain the firmware information of the basic input / output system of the version to be installed and store the firmware information in a predetermined memory, and the third encryption information is determined by the upgrade tool. The firmware information in the predetermined memory is encrypted to obtain fourth encrypted information; and If the third encryption information is the same as the fourth encryption information, the first basic metric information is determined based on one of the third encryption information and the fourth encryption information, and the random salt value.

8. The method according to claim 7, characterized in that, The upgrade tool includes one of the following: an upgrade tool packaged in the operating system of the server; Upgrade tools deployed in electronic devices other than the server mentioned above.

9. The method according to claim 2 or 3, characterized in that, The database deployed on the substrate management controller includes a persistent data partition, in which the random salt value, the first basic metric information, and the second basic metric information are stored; when the substrate management controller performs a version update operation, the data in the persistent data partition remains in its original state.

10. A server, characterized in that, include: Basic Input / Output System; A baseboard management controller is configured to, in response to a startup event for a server, acquire first basic metric information, a random salt value, and firmware information for the basic input / output system of the server when the baseboard management controller is in a startup state; wherein the first basic metric information indicates that the basic input / output system is in a safe state overall. Based on the first encrypted information obtained by encrypting the firmware information and the random salt value, the first metric information to be verified is determined; and If the first metric information to be verified is different from the first basic metric information, anomaly detection is performed on at least one functional module of the basic input / output system to obtain anomaly detection result, and the server is controlled to remain in an inactive state; if the first metric information to be verified is the same as the first basic metric information, the server is started under the control of the baseboard management controller.

Images