A method for protecting and clearing BIOS password through GPIO

Abstract

The application discloses a method for protecting and clearing BIOS password through GPIO, and relates to the technical field of computer information security. The method is based on UEFI EDKII architecture, and detects the level state of the motherboard GPIO during BIOS operation: when it indicates to clear the password, the BIOS password variable in the NVRAM is searched and emptied in the DXE stage, the BIOS option setting is reserved while the password is cleared, and the administrator password or the user password can be cleared respectively; when it indicates to protect the password, the password is read in the PEI stage, and the same structure HOB is created for backup, and the password is written back to the NVRAM in the last DXE stage, so that the password is not cleared after the CMOS clear pin is short-circuited or the CMOS battery is removed. The application can selectively clear and protect the password without opening the case, is simple to operate, and is convenient for cross-platform transplantation.

Description

Technical Field

[0001] This invention relates to the field of computer information security technology, and in particular to a method for protecting and clearing BIOS passwords using GPIO. Background Technology

[0002] The Basic Input Output System (BIOS) is a set of programs embedded in the flash memory chip on the computer motherboard, responsible for hardware initialization and operating system booting when the computer is turned on. To prevent unauthorized users from modifying BIOS settings or starting the computer, current BIOSes generally provide administrator and user password settings, and the passwords are usually stored in the non-volatile memory area NVRAM of the flash memory.

[0003] When a user forgets their BIOS password, the common way to clear the password in existing technology is to open the computer case, remove the CMOS battery on the motherboard, or short-circuit the CMOS clear pin (CLEAR_CMOS PIN) on the motherboard to reset the stored password data.

[0004] However, the above methods for clearing passwords have at least the following drawbacks: First, they are cumbersome, requiring opening the computer case and accessing the motherboard hardware; second, clearing the password also clears the user-set BIOS options, requiring the user to reconfigure; third, they cannot distinguish between administrator and user passwords, clearing both simultaneously without selective clearing, and some methods require knowledge of previously set passwords; fourth, current computers cannot protect BIOS passwords, and anyone with access to the internal hardware can clear the password using the aforementioned hardware reset method, compromising password security.

[0005] Therefore, how to selectively clear the BIOS password without opening the computer case or affecting the BIOS option settings, and how to protect the BIOS password from being cleared by hardware reset, have become technical problems that urgently need to be solved in this field. Summary of the Invention

[0006] In view of the above-mentioned defects in the existing technology, the present invention provides a method for protecting and clearing BIOS password through GPIO, which can selectively clear BIOS password while retaining BIOS option settings, and can protect BIOS password from being cleared by hardware reset.

[0007] This invention provides a method for protecting and clearing BIOS passwords using GPIO, applicable to computers employing the UEFI EDK II architecture. The BIOS password of this computer is stored in the non-volatile memory area NVRAM of flash memory. The method includes: during BIOS operation, detecting the voltage level of the general-purpose input / output (GPIO) interfaces on the motherboard; when the GPIO voltage level indicates that the password needs to be cleared, during the UEFI DXE phase, using the GetVariable function to search for a BIOS password variable in the NVRAM, clearing the found BIOS password variable, and writing it back to the NVRAM, thereby clearing the BIOS password while retaining BIOS options. The configuration is as follows: When the GPIO level indicates a protection password, during the PEI phase of UEFI, the BIOS password stored in the NVRAM is read using the GetVariable function, a HOB with the same data structure as the BIOS password is created, and the read BIOS password is saved in the HOB. During the DXE phase, the password structure is obtained using the GetVariable function, and the BIOS password saved in the HOB is written back to the NVRAM. The write-back operation is performed at the end of the DXE phase to ensure that the BIOS password is not cleared when the CMOS clear pin is shorted or the CMOS battery is removed.

[0008] Preferably, the level state of the GPIO is controlled by a physical button or jumper on the motherboard, and the user can select to perform a password clearing operation or a password protection operation by operating the physical button or the jumper.

[0009] Preferably, the password clearing operation further includes: before clearing the found BIOS password variables, selecting the password type to be cleared, the password type including administrator password and user password; clearing only the password variables corresponding to the selected password type and writing them back to the NVRAM.

[0010] Preferably, each time the computer is powered on, the BIOS detects whether the level state of the GPIO indicates a protection password when running to the PEI stage, and detects whether the level state of the GPIO indicates a clear password when running to the DXE stage.

[0011] Preferably, the HOB is created during the PEI phase and is used to transmit the BIOS password between the PEI phase and the DXE phase.

[0012] The present invention also provides a computer device, including a motherboard, wherein the motherboard is provided with flash memory and general purpose input / output interface (GPIO), wherein the non-volatile memory area (NVRAM) of the flash memory stores BIOS option settings and BIOS password, and the GPIO is used to provide a level state indicating whether to clear the password or protect the password; the BIOS of the computer device is configured to perform the above method during operation.

[0013] Compared with the prior art, the beneficial effects of the present invention include: (1) The BIOS password can be cleared without opening the case. The operation can be completed on the desktop by using physical buttons or jumpers on the motherboard, which is simple and quick. (2) Clearing the password only clears the password variable; the BIOS option settings are not affected, and the user does not need to reconfigure. (3) Users can choose to clear the administrator password or the user password separately, which provides high flexibility; (4) By backing up the password in the PEI stage and writing back the password in the final stage of the DXE stage, the password is not cleared after shorting the CMOS clear pin or removing the CMOS battery, thus improving the security of the password. (5) The method is based on the EDKII open-source architecture, with a simple code flow, which is easy to port between different hardware platforms; (6) This method can also be used to protect password options in the Setup user interface: the GPIO status is checked, and the status is used to determine whether to clear 'a' when the user changes the password. If the status is high, the password clearing function in the BIOS setup operation will return directly, thus preventing the password from being cleared. Attached Figure Description

[0014] Figure 1 This is a schematic diagram of the overall process of the method of the present invention; Figure 2 This is a flowchart of clearing the BIOS password in an embodiment of the present invention; Figure 3 This is a flowchart illustrating the protection of the BIOS password in an embodiment of the present invention. Detailed Implementation

[0015] The technical solutions of the embodiments of the present invention will be clearly and completely described below with reference to the accompanying drawings. Obviously, the described embodiments are only some embodiments of the present invention, and not all embodiments. Based on the embodiments of the present invention, all other embodiments obtained by those skilled in the art without creative effort are within the scope of protection of the present invention.

[0016] This invention is based on the EDKII open-source architecture of UEFI (Unified Extensible Firmware Interface). In the EDKII architecture, BIOS option settings and user passwords are mostly stored in a region of Flash memory, namely the non-volatile memory area NVRAM. As a non-volatile storage device, Flash memory will not lose or corrupt its stored data unless the chip is damaged. In the BIOS user interface, the administrator password and user password set by the user are stored in NVRAM, and their creation, modification, and deletion operations are implemented in the user interface. The UEFI boot process includes the Pre-EFI Initialization (PEI) stage and the Driver Execution Environment (DXE) stage. This invention utilizes the execution timing of these stages and the characteristic of HOBs (Hand-Off Blocks) to transfer data between the PEI and DXE stages to achieve password protection and clearing.

[0017] like Figure 1 As shown, after the computer powers on, the BIOS starts. During the PEI and DXE stages, the BIOS checks the GPIO levels on the motherboard and determines the appropriate operation based on these levels: when the GPIO level indicates a password protection setting, the password protection process is executed; when the GPIO level indicates a password clearing setting, the password clearing process is executed; and when the GPIO level does not indicate any operation, the normal startup process is executed. The GPIO levels are controlled by physical buttons or jumpers on the motherboard. In certain models, this can be combined with hardware to implement desktop button selection, allowing users to select the desired operation type at startup without opening the computer case, making operation simpler and more convenient.

[0018] Example 1: As Figure 2 As shown, the process of clearing the BIOS password in this embodiment includes the following steps: Step S101: The computer is powered on and the BIOS is booted; Step S102: The BIOS runs to the UEFI DXE stage; Step S103: Detect the level state of GPIO and determine whether the GPIO state indicates clear password; if yes, proceed to step S104; if no, proceed to the normal startup process. Step S104: Locate the BIOS password variable in NVRAM using the GetVariable function; Step S105: Select the type of password to be cleared. You can choose to clear the administrator password, user password, or all passwords. This step allows users to clear the administrator password or user password separately according to their actual needs, without having to clear both types of passwords at the same time. Step S106: Clear the selected password variables and write the cleared result back to NVRAM; Step S107: The password storage area is cleared, while the BIOS option settings stored in NVRAM remain unchanged; Step S108: The computer starts normally, and no password is required to enter the BIOS user interface thereafter.

[0019] The above clearing operation only clears and writes back the password variable, and does not involve the storage area where the BIOS option settings are located. Therefore, while clearing the password, the user's BIOS option settings are completely preserved, overcoming the defect in the prior art that removing the CMOS battery or shorting the clear pin will clear the BIOS settings at the same time.

[0020] Example 2: Figure 3 As shown, the process for protecting the BIOS password in this embodiment utilizes the phased characteristics of UEFI and includes the following steps: Step S201: The computer is powered on and the BIOS is booted; Step S202: The BIOS runs to the UEFI PEI stage; Step S203: Detect the level state of GPIO and determine whether the GPIO state indicates a protection password; if yes, proceed to step S204; if no, the BIOS directly enters the DXE stage to execute the normal boot process. Step S204: During the PEI stage, the BIOS password stored in NVRAM is read using the GetVariable function; Step S205: Create a HOB with the same data structure as the BIOS password in the PEI stage, and save the read BIOS password into the HOB; since the HOB can transfer data between the PEI stage and the DXE stage, the password data is thus securely backed up to a memory area accessible in subsequent stages. Step S206: BIOS enters the DXE stage; Step S207: Obtain the cryptographic structure using the GetVariable function during the DXE stage; Step S208: Write back the password data stored in the HOB to the NVRAM. The function that performs this write-back operation should ensure that it runs in the last stage of the DXE stage to ensure that the password data can still be restored from the HOB to the NVRAM after the CMOS data is cleared by hardware reset. Step S209: After the protection is activated, the BIOS password will not be cleared regardless of whether the CLEAR_CMOS pin is shorted or the CMOS battery is removed.

[0021] Through the above mechanism, even if someone opens the computer case and attempts to clear the password using a hardware reset, the password data stored in the HOB will still be rewritten back to NVRAM during the final stage of DXE each time the computer is powered on, thus achieving effective protection of the BIOS password.

[0022] It should be noted that, in this document, relational terms such as "first" and "second" are used only to distinguish one entity or operation from another, and do not necessarily require or imply any such actual relationship or order between these entities or operations. The terms "comprising," "including," or any other variations thereof are intended to cover non-exclusive inclusion, such that a process, method, article, or apparatus that comprises a list of elements includes not only those elements but also other elements not expressly listed, or elements inherent to such process, method, article, or apparatus.

[0023] This invention is based on the EDKII architecture, an open-source UEFI firmware development framework. Therefore, the method described in this invention can be easily ported to different hardware platforms. Those skilled in the art should understand that various changes and modifications can be made to the above embodiments without departing from the concept of this invention, such as changing the GPIO triggering method or adjusting the password type selection method. All such changes and modifications fall within the protection scope of this invention.

Claims

1. A method for protecting and clearing BIOS passwords via GPIO, applied to a computer using a UEFI EDKII architecture, wherein the password for the computer's Basic Input / Output System (BIOS) is stored in the non-volatile memory area NVRAM of flash memory, characterized in that... The method includes: During BIOS operation, the level status of the general purpose input / output (GPIO) interfaces on the motherboard is detected; When the level state of the GPIO indicates that the password should be cleared, a password clearing operation is performed. The password clearing operation includes: in the DXE stage of the UEFI driver execution environment, using the GetVariable function to search for the BIOS password variable in the NVRAM, clearing the found BIOS password variable and writing it back to the NVRAM, so as to retain the BIOS option settings while clearing the BIOS password. When the level state of the GPIO indicates a protection password, a password protection operation is performed. The password protection operation includes: in the UEFI pre-initialization PEI stage, reading the BIOS password stored in the NVRAM through the GetVariable function, creating a HOB with the same data structure as the BIOS password, and saving the read BIOS password into the HOB; in the DXE stage, obtaining the password structure through the GetVariable function, and writing back the BIOS password saved in the HOB to the NVRAM, wherein the write-back operation is performed in the last stage of the DXE stage to ensure that the BIOS password is not cleared when the CMOS clear pin is shorted or the CMOS battery is removed.

2. The method according to claim 1, characterized in that, The level state of the GPIO is controlled by a physical button or jumper on the motherboard. The user can select to perform the password clearing operation or the password protection operation by operating the physical button or the jumper.

3. The method according to claim 1, characterized in that, The password clearing operation further includes: before clearing the found BIOS password variables, selecting the password type to be cleared, the password type including administrator password and user password; clearing only the password variables corresponding to the selected password type and writing them back to the NVRAM.

4. The method according to claim 1, characterized in that, Each time the computer is powered on, the BIOS checks whether the level state of the GPIO indicates a protection password when it reaches the PEI stage, and checks whether the level state of the GPIO indicates a clear password when it reaches the DXE stage.

5. The method according to claim 1, characterized in that, The HOB is created during the PEI phase and is used to transmit the BIOS password between the PEI phase and the DXE phase.

6. The method according to any one of claims 1 to 5, characterized in that, The password clearing operation and the password protection operation are implemented based on the EDKII open-source architecture and can be ported to different hardware platforms.

7. A computer device, characterized in that, The device includes a motherboard having flash memory and general purpose input / output (GPIO) interfaces. The flash memory's non-volatile memory area (NVRAM) stores BIOS option settings and a BIOS password. The GPIO interfaces are used to provide a level state indicating whether to clear or protect the password. The computer device's basic input / output system (BIOS) is configured to perform the method described in any one of claims 1 to 6 during operation.

Images