TWI436280B - Authentication method for accessing profile of basic input/output system - Google Patents

Description

Access authentication method for accessing basic input/output system settings

The present invention relates to a computer system, and more particularly to an authentication method for accessing a basic input/output system setting in a computer system.

The Basic Input/Output System (BIOS) is the first code loaded by the computer at boot time. It has initialization and detection hardware and peripheral devices, and guides the computer to load the operating system after completing the above work. (Operating System, OS) features. The PROFILE content in the BIOS includes many parameters, such as the device number corresponding to each hardware and peripheral device, and whether the device is enabled or not, or the operating frequency of the Central Processing Unit (CPU). Even the boot screen and the trademark of the computer manufacturer or brand, etc., will be loaded as the basis for initialization when the BIOS starts executing.

Since the current BIOS and its configuration files are currently stored in Flash Memory or Electrically-Erasable Programmable Read-Only Memory (EEPROM), users can easily Update the contents of the BIOS. For example, in the operating system, the new profile or firmware code is written to the BIOS through the application software to support new hardware and correct old errors.

However, BIOS profiles are often not expected to be arbitrarily accessed by the average user. For example, a computer vendor may not want the logo pattern in the profile to be changed. Or, the computer vendor may not want the user to enable the function of the high-priced computer in the low-cost computer model by modifying the BIOS profile. If the parameters in the configuration file are incorrect, such as exceeding the limit of the hardware itself, or enabling the hardware that does not exist, it will increase the instability of the system during execution, and even cause the computer or device to be unable to use normally.

The present invention provides an authentication method for accessing a setting of a basic input/output system to prevent an illegal application from accessing a profile of a basic input/output system.

An authentication method for accessing settings of a basic input/output system includes the following steps. First, the same first fixed key and second fixed key are respectively configured in the basic input/output system and the application. The first random number key is then generated by the embedded controller. The first security key is then calculated using the first random number key and the first fixed key. Furthermore, the first random key is provided to the application as a second random number key through the management interface. And, the second security key is calculated by the application by using the second random key and the second fixed key. In addition, if the application wants to store a customized setting data into the basic input/output system, the application encrypts the customized setting data by using the second security key to obtain the first encrypted data, and through the management interface. The first encrypted data is transmitted to the basic input/output system. The first encrypted data is decrypted by the basic input/output system using the first security key to obtain customized configuration data. If the basic input/output system successfully decrypts the first encrypted data, the basic input/output system stores the customized setting data.

Based on the above, the present invention provides an authentication method for accessing a setting of a basic input/output system, so that when an application wants to store setting data in a basic input/output system, the setting data is transmitted to the management interface through an management interface in an encrypted manner. Basic input and output system. Whether the basic I/O system will legally access the authentication application. The basic input and output system will store this setting data when the verification is successful.

The above described features and advantages of the present invention will be more apparent from the following description.

FIG. 1 is a block diagram of a device of a computer. Referring to FIG. 1, the central processing unit 101, the read-only memory unit 103, the embedded controller 104, the storage unit 105, and the memory unit 106 are all connected to the chip set unit 102, and communicate and exchange information through the wafer set unit 102. The storage unit 105 can be a bootable storage device such as a disk drive, a CD player, or a flash drive. The memory unit 106 can be a random access memory (RAM). Generally, after the power of the computer is turned on, the basic input/output system (Basic Input/Output System, hereinafter referred to as BIOS) firmware code 1031 stored in the read-only memory unit 103 is started to be read and executed. Since then, the BIOS has been in operation.

The BIOS controls the embedded controller 104 to read the profile (PROFILE) stored in the embedded controller 104, and then the BIOS initializes various important hardware components (eg, the embedded controller 104, etc.) according to the contents of the profile. And perform Power On Self Test (POST) to diagnose and ensure that these devices work correctly. After the POST has completed its work, the BIOS will then cause the system to read the operating system code 1051 stored on the storage unit 105. Since then, the operating system has been operational. After entering the operating system environment, the manufacturer can access the contents of the BIOS configuration file through the legitimate application (tool program) in the operating system.

FIG. 2 is a flow chart showing an authentication method for setting a BIOS for accessing the computer device of FIG. 1 according to an embodiment of the invention. Referring to FIG. 2, in step S201, the same first fixed key and second fixed key are respectively configured in the BIOS and the application. This fixed key can be configured in the BIOS by the manufacturer during the manufacturing process. Only legitimate applications of the manufacturer have the same fixed key.

In step S202, the embedded controller generates a first random number key each time the electronic device (for example, a computer) is turned on. Alternatively, the embedded controller can generate the first random number key during the initialization phase after the embedded controller is powered on. Since the embedded controller randomly determines the first random number key, the first random number key generated by the embedded controller after each boot is unpredictable. In step S203, the first security key is calculated by using the first random number key and the first fixed key. In step S204, the BIOS provides the first random key to the legitimate application as a second random number key through the management interface. In step S205, the second security key is calculated by the application using the second random key provided by the BIOS and the second fixed key of the BIOS. The application will save this second security key for authentication and encryption when accessing the BIOS settings later.

In step S206, if the application wants to store a customized setting data (for example, a system configuration setting value) into the BIOS, the application encrypts the customized setting data by using the second security key to obtain the first An encrypted data and a first encrypted data transmitted to the BIOS through the management interface. In step S207, the first encrypted data is decrypted by the BIOS using the first security key to obtain customized configuration data. Finally, in step S208, if the BIOS successfully decrypts the first encrypted data, the BIOS stores the customized setting data.

FIG. 3 is a timing diagram showing a method of authenticating an access BIOS setting according to an exemplary embodiment of the invention. Referring to FIG. 3, the application 300 is a legal program that has been authorized by the manufacturer or the brand. Therefore, a second fixed key is pre-configured in the application 300, and the second fixed key is configured in the BIOS 302. The first fixed key is the same. In this embodiment, the first and second fixed key lengths of 16 bytes (Byte) fixed key content may be determined according to manufacturing requirements, for example, "88740de3-3f73-4028-bfbe-1c3108a52968" .

First, the embedded controller 303 randomly generates the first random number key each time the computer is turned on (step S301). The first random number key may be generated by the embedded controller 303 to capture a random function by calculating a time function in the system or a voltage value of a capacitor. This random number can be an ideal random number or a non-ideal random number. However, the invention is not limited to the above. The first random key is only calculated/generated once after the power of the computer system is turned on until the power is turned off. If the computer is rebooted, in order to improve security, the first random key will be recalculated/generated once.

The application 300 will request the management interface 301 of the operating system to receive the random key (step S302). The management interface 301 is a communication interface between the application 300 and the BIOS 302, such as an application programming interface (API) of Microsoft Corporation's Windows Management Instrumentation (WMI). . The application 301 must access the BIOS 302 through this management interface 301. After the management interface 301 receives the request from the application 300, the request is forwarded to the BIOS 302 (step S303). After the BIOS 302 receives this request, the BIOS 302 transmits the first fixed key to the embedded controller 303 (step S304). Then, the embedded controller 303 calculates the first security key by using the received first fixed key and the first random number key generated by itself in step S301 (step S305).

After obtaining the first security key, the embedded controller 303 transmits the first security key to the BIOS 302 (step S306). The BIOS 302 retains the first security key and transmits a notification to the management interface 301 notifying that the random key has been obtained (step S307). The management interface 301 then forwards the notification application 300 to obtain the hash key (step S308). Then, the application 300 transmits a request to acquire the first random number key through the management interface 301 (steps S309, S310). After receiving this request, the BIOS 302 requests the embedded controller 303 to provide the first random number key (step S311).

After receiving the request, the embedded controller 303 returns the first random key to the BIOS 302 (step S312), and deletes the first random key after transmitting the first random key to the BIOS 302 (step S313). . The BIOS 302 then transmits the first random key to the application 300 through the management interface 301 (steps S314, S315), and deletes the first random key after transmitting the first random key to the application 300 (step S316). . After receiving the first random key, the application 300 uses the second random key as the second random key, and uses the second random key and the second fixed key to calculate the second security key. (Step S317). So far, the application 300 and the BIOS 302 have completed the initialization phase of the security key.

The steps (steps S301 to S317) described above need only be performed once after the power is turned on until the power is turned off (or restarted). Steps S301 to S317 may be performed before the application 300 is to access the BIOS configuration file for the first time, or may be executed before the application 300 is started, but the present invention is not limited to the above.

Referring to FIG. 3, when the application 300 wants to store the customized setting data into the BIOS 302, the application 300 encrypts the customized setting data by using the second security key to obtain the first encrypted data (step S320). This customized setting data may include hardware setting parameters (configuration parameters) of the computer and/or boot screen files. Next, the application 300 outputs the first encrypted material to the management interface 301 (step S321). The management interface 301 outputs the first encrypted material to the BIOS 302 in accordance with the transfer request of the application 300 (step S322). Therefore, the application 300 can transmit the first encrypted data to the BIOS 302 through the management interface 301.

After receiving the first encrypted data, the BIOS 302 performs an authentication operation (step S323). In this embodiment, the BIOS 302 first decrypts the first encrypted material using the first security key. After decryption, an error detection method, such as Cyclic Redundancy Check (CRC) or Message-Digest Algorithm (MD5), is used to detect whether the first encrypted data is successfully decrypted. If the BIOS 302 can successfully decrypt the first encrypted data by using the first security key, it indicates that the verification is successful, that is, the second security key used for encryption is consistent with the first security key used for decryption (or identical. On the other hand, if the decryption of the first encrypted data fails, the verification fails, so the BIOS 302 will reject the access (step S323). After the verification is successful, the BIOS 302 then transmits the customized configuration data decrypted in step S323 to the embedded controller 303, and controls the embedded controller 303 to store the customized configuration data (step S324). After receiving the customized setting data and the control command of the BIOS 302, the embedded controller 303 stores the customized setting data in the memory location corresponding to the setting data (step S325).

The above embodiment is to calculate the first security key by the embedded controller 303. In other embodiments, the operation of computing the first security key may be performed by the BIOS 302. For example, the BIOS 302 can read the first random number key to the embedded controller 303, and then calculate the first security key using the first fixed key and the first random number key. After calculating the first random number key and the first security key, the BIOS 302 transmits the first random number key to the application 300 through the management interface 301.

Those skilled in the art can implement the above steps S305, S317, S320 by any encryption method. For example, FIG. 4 is a schematic diagram of a data flow generated by the application 300 to generate a second security key SKEY2 and a first encrypted data ECPDATA1 according to an exemplary embodiment of the present invention. Please refer to, first, the application 300 performs step S317 in FIG. 3, that is, the second fixed key FKEY2 and the second random number key RKEY2 are transmitted through a one-way function (for example, the hash function 501) as shown in FIG. Second security key SKEY2. The hash function 501 is a one-way transfer function that converts input parameters into output parameters, but it is extremely difficult to inversely calculate input parameters using output parameters. In the present embodiment, the hash function 501 may be the first secure hash algorithm (SHA-1), but the present invention is not limited to the above. The above teaching of calculating the second security key SKEY2 by the hash function 501 can also be analogized to step S305 of FIG.

Then, if the application 300 wants to store the customized setting data PRODATA in the BIOS 302, the application 300 mutually exclusive ORs the customized setting data PRODATA and the second security key SKEY2 (Exclusive OR, XOR) 502. And get the first transient data TMP1. Then, the application 300 performs a Rotate Right (ROR) operation 503 on the first transient data TMP1 to obtain a first encrypted data ECPDATA1. For example, the first transient data TMP1 is rotated right by 7 bits. Both the exclusive OR operation 502 and the right-handed calculation 503 are for increasing the complexity of the encrypted data, however the present invention is not limited to the use of the two-function operation.

Those skilled in the art can implement the above step S323 by any decryption method. For example, FIG. 5 is a schematic diagram showing the data stream of the BOIS 302 decrypting the first encrypted data ECPDATA1 according to an exemplary embodiment of the present invention. The flow of decryption shown in FIG. 5 is a flow corresponding to the encryption shown in FIG. Referring to FIG. 5, the first encrypted data ECPDATA1 is first subjected to a Rotate Left (ROL) operation 601 (eg, left-handed 7 bits) to obtain a second transient data TMP2. Next, the second transient data TMP2 and the first security key SKEY1 are mutually exclusive ORed 602 to obtain the customized setting data PRODATA. The present invention is not limited to the operation using the two functions, but the decryption operation must correspond to the encrypted operation step to be able to solve the correct data content.

FIG. 6 is a timing chart showing the action of the application 300 reading the setting of the BIOS 302 through the management interface 301 according to an embodiment of the invention. Referring to FIG. 6, first, the application 300 transmits a read request for the current BIOS 302 setting data to the BIOS 302 through the management interface 301 (steps S701, S702). Next, the BIOS 302 verifies the read request (step S703). In the present embodiment, the read request is similarly encrypted in the application 300 using the second security key, as in the encryption mode described in FIG. The method of verification is as described in the embodiment of FIG. 3, and will not be described here.

For example, if the application 300 wants to read system configuration data from the BIOS 302, the application 300 encrypts the "read information" using the second security key SKEY2 to obtain the second encrypted data, and transmits it through the management interface 302. The second encrypted data is sent to the BIOS 302. The content of the above "read information" may be a read instruction code, a read address of a system setting data, and/or an identification code of a system setting data.

The BIOS 302 decrypts the second encrypted data using the first security key SKEY1 in step S703 to obtain the "read information". If the verification fails in step S703, the BIOS 302 rejects the access. If the BIOS 302 checks that the second security key matches the first security key, that is, the BIOS 302 successfully decrypts the second encrypted data, the BIOS 302 requests the embedded controller 303 to read the system setting data according to the read information. Step S704). After receiving the read request, the embedded controller 303 reads the system setting data according to the read demand (step S705), and then returns the system setting data to the BIOS 302 (step S706). The BIOS 302 transmits the system setting data to the application 300 through the management interface 301 (steps S707, S708).

In summary, the present invention provides an authentication method for accessing a BIOS setting, which generates a security key by using a key pre-configured in the BIOS and the authorized terminal and another key randomly generated each time the device is booted. The setting data transmitted through the management interface of the operating system and using this security key as the authentication. This method makes it impossible for other unauthorized applications in the operating system to easily access or edit the BIOS settings, and also cannot read the BIOS settings through the management interface, thereby ensuring that the system is not unstable due to BIOS settings. The situation.

Although the present invention has been disclosed in the above embodiments, it is not intended to limit the invention, and any one of ordinary skill in the art can make some modifications and refinements without departing from the spirit and scope of the invention. The scope of the invention is defined by the scope of the appended claims.

101. . . Central processor unit

102. . . Chipset unit

103. . . Read only memory unit

1031. . . Basic input and output system firmware code

104. . . Embedded controller

105. . . Storage unit

1051. . . Operating system code

106. . . Memory unit

300. . . application

301. . . Management interface

302. . . Basic input and output system

303. . . Embedded controller

501. . . Hash function

502, 602. . . Mutual exclusion or operation

503. . . Right-handed operation

601. . . Left-handed operation

S201 to S208, S301 to S317, S320 to S325, and S701 to S708. . . step

ECPDATA1. . . First encrypted data

FKEY2. . . Fixed key

PRODATA. . . Customized setting data

RKEY2. . . Random key

SKEY2, SKEY1. . . Security key

TMP1, TMP2. . . Transient data

FIG. 1 is a block diagram of a device of a computer.

FIG. 2 is a flow chart showing an authentication method for accessing a setting of a basic input/output system according to an embodiment of the invention.

FIG. 3 is a timing diagram showing an authentication method for accessing settings of a basic input/output system according to an exemplary embodiment of the present invention.

FIG. 4 is a schematic diagram showing a data flow for generating a first encrypted data on an application side according to an exemplary embodiment of the present invention.

FIG. 5 is a schematic diagram of a data stream for decrypting a first encrypted data at a basic input/output terminal according to an exemplary embodiment of the present invention.

FIG. 6 is a timing diagram showing an operation of an application transmitting a read request and a second security key to a basic input/output system through a management interface according to an embodiment of the invention.

S201~S208. . . step

Claims (10)

An authentication method for accessing a setting of a basic input/output system includes: respectively configuring a same first fixed key and a second fixed key in a basic input output system and an application; generated by an embedded controller a first random number key; using the first random number key and the first fixed key to calculate a first security key; providing the first random number key to the application as a a second random number key; the application uses the second random number key and the second fixed key to calculate a second security key; if the application wants to store a customized setting data into the The basic input/output system, the application uses the second security key to encrypt the customized setting data to obtain a first encrypted data, and transmits the first encrypted data to the basic input and output through the management interface. a system; the first encrypted data is decrypted by the basic input/output system using the first security key to obtain the customized setting data; and if the basic input/output system successfully decrypts The first encryption information, the basic input output system storing the customized configuration information. The authentication method of claim 1, wherein the step of encrypting the customized setting data comprises: mutually exclusiveizing or computing the customized setting data with the second security key; Obtaining a first transient data; and performing a right-hand operation on the first transient data to obtain the first encrypted data. The authentication method of claim 1, wherein the step of decrypting the first encrypted data comprises: performing a left-handed operation on the first encrypted data to obtain a second transient data; The second transient data is mutually exclusive or operated with the first security key to obtain the customized configuration data. The authentication method of claim 1, further comprising: if the application wants to read a system setting data from the basic input/output system, the application uses the second security key pair to read The information is encrypted to obtain a second encrypted data, and the second encrypted data is transmitted to the basic input/output system through the management interface; the basic encrypted output system uses the first security key to decrypt the second encrypted data Obtaining the read information; and if the basic input/output system successfully decrypts the second encrypted data, the basic input/output system reads the system setting data according to the read information, and transmits the system setting data through the management interface. Give the app. The authentication method of claim 1, wherein the management interface is an application interface of a window management specification. The authentication method of claim 1, further comprising: deleting the first random number key after the application obtains the second random number key. The authentication method of claim 1, wherein the step of calculating the first security key by using the first random number key and the first fixed key comprises: transmitting by the basic input output system Transmitting the first fixed key to the embedded controller; calculating, by the embedded controller, the first security key according to the first random number key and the first fixed key; Transmitting to the basic input/output system; and after the basic input/output system transmits the first random number key to the application, the embedded controller and the basic input/output system delete the first random number key. The authentication method of claim 1, wherein the step of calculating the first security key by using the first random number key and the first fixed key, and the utilizing the second random number The step of calculating the second security key by the key and the second fixed key is to calculate the first security key and the second security key using a one-way function. The authentication method of claim 8, wherein the one-way function is a hash function. The authentication method of claim 1, wherein the step of storing the customized setting data by the basic input/output system comprises: storing, by the basic input/output system, the customized setting data to the embedded control Device.