BMC-Based BIOS Password Authentication for Server Security
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Traditional BIOS user privilege control methods in server computers lack security, making them vulnerable to hacking, as spy software can easily crack BIOS passwords and gain control privileges, potentially compromising all servers in a group sharing a global password set.
Innovation Solution
Implementing a Baseboard Management Controller (BMC) firmware to handle user privilege authentication instead of the system processor, with the BMC storing and encrypting passwords, preventing access by the BIOS and system processor, and using a keyboard driver to redirect input events to ensure secure password handling.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If BIOS reads and stores passwords in NVRAM for user authentication, then user privilege control is enabled, but passwords become vulnerable to cracking by spy software
Solution Approach 1:
The password authentication function is extracted from the BIOS system and relocated to a dedicated security chip. This separates the password storage and verification process from the main system processor, making it inaccessible to spy software that targets BIOS memory spaces.
Solution Approach 2:
A dedicated security chip acts as an intermediary between the user authentication request and the BIOS system. This chip handles all password-related operations independently, preventing direct access to password data by the main system or malicious software.
2Device complexity
If BIOS handles user authentication directly, then authentication process is simple, but system security is compromised
Solution Approach 1:
The authentication system is segmented into two independent components: a dedicated security chip for password management and the BIOS system for operational control. This segmentation allows each component to specialize in its function while maintaining overall system security.
Solution Approach 2:
The security chip serves as an intermediary authentication module that communicates with the BIOS through defined interfaces. This mediator approach maintains the simplicity of the BIOS while adding a layer of security without requiring complex integration.
3Speed
If passwords are stored in accessible memory for BIOS operations, then authentication speed is fast, but password theft becomes possible
Solution Approach 1:
Password storage is extracted from the main system memory to a dedicated security chip with isolated memory space. This extraction maintains fast authentication through direct chip access while preventing password theft by removing passwords from the accessible system memory space.
Solution Approach 2:
The security chip implements local quality by providing a specialized, isolated environment for password storage and processing. This localized security domain ensures that password operations occur in a controlled, secure space separate from the main system.
Data Source
AI summary
A method for securing BIOS passwords in a server computer under a BIOS user privilege control operation is disclosed. Said method comprises: a BIOS (Basic Input/Output System) of the server computer requesting a BMC (Baseboard Management Controller) to enter a password authentication mode for user privilege authentication; the BMC receiving passwords inputted by a user and comparing the inputted passwords with valid passwords, wherein the valid passwords are stored in the BMC; the BMC deciding an authentication result after the comparing the inputted passwords with the stored valid passwords and saving the authentication result; and the BMC exiting the password authentication mode and notifying the BIOS of the authentication result; wherein the BMC passes fake scan codes of key strings of the inputted passwords to the BIOS, such that the BIOS does not have access to the actual passwords.