CN115033933A - BIOS-based port management and control method and system - Google Patents

Abstract

The invention discloses a port management and control method and a system based on a BIOS (basic input output System). the port management and control at a BIOS layer is realized by a double-layer management and control method of the BIOS layer and an OS layer under the condition of lacking hardware or other mechanism support. The system of the invention only has the administrator to open or close the port in the BIOS layer, and the ordinary user can not change the port state under the unauthorized condition. After the BIOS layer closes the port, even an operating system administrator cannot open the port under the operating system, the BIOS layer is still required to open the port. When the hardware layer supports, directly pulling the corresponding GPIO control port through the hardware layer; when the hardware layer does not support, the BIOS layer port information transmission module collects the port information of the BIOS layer port control module, and reports the port information to the OS layer information receiving module through a unified communication interface between the BIOS and the operating system, so that the synchronization of the OS layer to the port control is realized.

Description

A BIOS-based port management and control method and system

technical field

The invention relates to the technical field of computer firmware, in particular to a BIOS-based port management and control method and system.

Background technique

BIOS (Basic Input Output System), the basic input and output system, is a startup program deployed on the motherboard ROM chip. The BIOS is responsible for the system self-checking program (POST, Power On Self Test) and the system self-starting program. It is the first program after the computer system is started. The BIOS is stored in the ROM (Read Only Memory) chip and can maintain the original settings even after a power failure.

At present, port control is an important means of preventing data leakage. Using the non-volatile feature of BIOS to close ports at the BIOS layer can effectively close the channel for data leakage and transmission at the bottom layer of the computer. However, at present, some domestic computers do not support BIOS port control. Even if the port is closed at the BIOS layer, it will still be opened at the OS (operating system) layer, that is, the onboard USB, SATA, network and other ports need to be controlled under the BIOS. Controls its function usage under the BIOS and OS, so there are loopholes in port management.

The existing BIOS port control method has two problems: first, some computers have device controllers that do not support port control through configuration registers; second, the hardware environment does not support BIOS control ports. Therefore, there is an urgent need for a port control method that is not affected by registers and hardware environments.

SUMMARY OF THE INVENTION

In view of this, the present invention provides a BIOS-based port control method and system, which is not affected by registers and hardware environment, and can realize port control through the configuration of the BIOS layer. In the absence of registers, the BIOS can still be used layer for port control.

In order to realize the above-mentioned purpose of the invention, the technical scheme of the present invention is:

A BIOS-based port control method is applied to a port control system comprising an OS layer information receiving module, an OS layer port control module, a BIOS layer port information transmission module, a BIOS layer port control module, a BIOS layer identity authentication module and a hardware layer, Specific steps include:

Step 1. Power on the computer and enter the BIOS configuration interface.

Step 2: The BIOS identity authentication module identifies the operator's identity authority and decides whether to grant the administrator authority.

Step 3: The administrator inputs a port control request, and the BIOS port control module receives and judges whether there is a corresponding register.

Step 4: The BIOS port information transmission module uses the unified communication interface between the BIOS and the operating system to report the port information to the OS layer information receiving module.

Step 5: The OS layer information receiving module receives the port information reported by the BIOS layer port information transmission module, and transmits the port information to the OS layer port control module.

Step 6: The OS layer port control module controls the corresponding port through the hardware layer according to the port information.

Further, the port management and control system further includes an OS layer identity authentication module.

Further, the administrator privileges are specifically:

When operating for the first-layer administrator, open the corresponding port control authority, and then select the port switch control in the configuration interface; when it is not the first-layer administrator, no port control authority is given; OS layer identity authentication module By identifying the identity of the second-level administrator, the second-level administrator is given the corresponding port management and control authority, and the second-level administrator has a higher priority than the first-level administrator.

Further, step 3 also includes:

When there is a corresponding register, directly configure the register to control the port; when there is no corresponding register, determine whether the hardware layer has hardware support; if there is hardware support, the BIOS port control module directly pulls or notifies the hardware layer to pull the corresponding GPIO Control the port; if there is no hardware support, go to step 4.

A BIOS-based port management and control system, aiming at the above method, includes an OS layer, a BIOS layer and a hardware layer.

OS layer includes OS layer information receiving module, OS layer port control module and OS layer identity authentication module; BIOS layer includes BIOS layer port information transmission module, BIOS layer port control module and BIOS layer identity authentication module; hardware layer includes CPU, port control module and port pull devices.

In the hardware layer:

The port controller is used to directly control the port; the port pulling device and the CPU together constitute the hardware support for the port, and under the control of the BIOS layer port control module, the corresponding GPIO is pulled to control the port.

In the BIOS layer:

The BIOS layer port control module is connected to the OS layer port control module, and the two are connected to the CPU and port controller of the hardware layer; the BIOS layer identity authentication module gives the first layer administrator the control of the corresponding port by identifying the first layer administrator identity At the same time, other users cannot control the port; the BIOS layer port control module configures the corresponding register for the port to control the port status; the BIOS layer port information transmission module obtains the port information collected by the BIOS layer port control module, and unifies it between the BIOS and the operating system The communication interface of the BIOS reports the information to the OS layer information receiving module; the BIOS port control module imposes control authority on the port to set the control authority scope of the OS layer on the port.

In the OS layer:

The OS layer information receiving module receives the port information reported by the BIOS layer, and issues instructions to the OS layer port control module according to the port information; the OS layer port control module opens or closes the port according to the issued instructions; the OS layer identity authentication module passes the identification The second-level administrator status is given to the second-level administrator to control the corresponding port. The second-level administrator has a higher priority than the first-level administrator.

Beneficial effects:

1. The present invention implements port management and control at the BIOS layer in the absence of hardware or other mechanism support through the double-layer management and control method of the BIOS layer and the OS layer.

2. In the system of the present invention, only the administrator can open or close the port at the BIOS layer, and ordinary users cannot change the state of the port without authorization. After the BIOS layer closes the port, even the operating system administrator cannot open the port under the operating system, and the BIOS layer still needs to open the port.

3. The system of the present invention directly pulls the corresponding GPIO control port through the hardware layer when the hardware layer supports it; when the hardware layer does not support it, the BIOS layer port information transmission module collects the port information of the BIOS layer port control module, and passes the BIOS and the operating system. The unified communication interface between them reports the information to the information receiving module of the OS layer, so as to realize the synchronization of the port control by the OS layer. Once the BIOS port is closed, it will immediately close or lock the port state synchronously, so that ordinary users cannot open the port and keep the port closed state consistent with the BIOS layer settings.

Description of drawings

FIG. 1 is a connection frame diagram of the BIOS layer, the OS layer and the hardware layer.

Figure 2 is a flow chart of the method of the present invention.

Detailed ways

The present invention will be described in detail below with reference to the accompanying drawings and embodiments.

As shown in FIG. 2 , the present invention proposes a BIOS-based port management and control method, and the specific steps include:

Step 1. Power on the computer and enter the BIOS configuration interface;

Step 2: The BIOS identity authentication module identifies the operator's identity authority. When it is operated by the first-layer administrator, the corresponding port control authority is opened, and then the port switch control can be selected in the configuration interface; when it is not the first-layer administrator When the administrator operates, the port management and control authority is not given; the OS layer identity authentication module grants the second-layer administrator the corresponding port control authority by identifying the second-layer administrator, and the second-layer administrator has a higher priority than the first-layer administrator;

Step 3: The administrator inputs a port control request, and the BIOS port control module receives and judges whether there is a corresponding register; when it exists, directly configure the register to realize the control of the port; when there is no corresponding register, judge whether the hardware layer has hardware support; If there is hardware support, the BIOS port control module directly pulls or notifies the hardware layer to pull the corresponding GPIO to control the port; if there is no hardware support, go to step 4;

Step 4, the BIOS port information transmission module uses the unified communication interface specification between the BIOS and the operating system, such as SMBIOS, to report the port information to the OS layer information receiving module; the state of the network in the port controller is described by a specific network state flag bit, There is no need to control the Port; the SATA controller in the port controller needs to control the PORT, and the Port status is represented by a specific Port status flag bit. When the entire controller is Disabled, the value of the Port Status is ignored; the USB in the port controller needs to Controlled to the PORT, the Port status is represented by a specific Port status flag bit, when the entire controller is Disabled, the value of the Port Status is ignored;

Step 5. Restart the computer to make the configurations from step 1 to step 4 take effect;

Step 6, the OS layer information receiving module receives the port information reported by the BIOS layer port information transmission module, and transmits the port information to the OS layer port control module;

Step 7: The OS layer port control module controls the corresponding port through the hardware layer according to the port information.

As shown in FIG. 1 , the present invention provides a BIOS-based port management and control system. When using switch options in the BIOS configuration interface to control ports such as USB, SATA, and network, it is realized by configuring the registers of its controller. For this type of register, both hardware and software solutions are provided.

In the hardware solution, the BIOS layer controls the electrical signal or clock signal of the port through the GPIO signal line, and directly pulls the GPIO or the BIOS layer tells the port to pull the device (such as TPCM card, EC and CPLD, etc.) through the corresponding interface to pull the corresponding port. GPIO to control access to the interface. After the signal is sent, restart the machine to take effect.

The software method implements port control. Without the support of the hardware environment, when the port cannot be controlled by other hardware methods such as registers or GPIO, the BIOS layer needs to use software methods, such as not enumerating and scanning the corresponding ports. In this case, the BIOS layer needs to transmit the corresponding port status to the OS layer through the unified communication interface between the BIOS and the operating system. The same type of controller is distinguished by the specific device number, function number and other identifiers, and different types of controllers are controlled by device type to distinguish. The communication process block follows a communication interface specification, such as SMBIOS (SMBIOS is a unified specification that motherboard or system manufacturers need to follow to display product management information in a standard format). After the OS layer receives the data, it judges the port state and then controls the port accordingly. The BIOS layer imposes port control authority on related devices to prevent the port from being controlled privately under the OS layer.

As shown in Figure 1, a BIOS-based port management and control system includes an OS layer, a BIOS layer and a hardware layer; the port controller includes USB, SATA and a network. The OS layer information receiving module, the OS layer port control module and the OS layer identity authentication module are set in the kernel space of the OS.

OS layer includes OS layer information receiving module, OS layer port control module and OS layer identity authentication module; BIOS layer includes BIOS layer port information transmission module, BIOS layer port control module and BIOS layer identity authentication module; hardware layer includes CPU, port control module server and port pull devices;

In the hardware layer:

The port controller is used to directly control the port; the port pulling device and the CPU together constitute the hardware support for the port, and under the control of the BIOS layer port control module, the corresponding GPIO is pulled to control the port;

In the BIOS layer:

The BIOS layer port control module is connected to the OS layer port control module, and the two are connected to the CPU and port controller of the hardware layer; the BIOS layer identity authentication module gives the first layer administrator the control of the corresponding port by identifying the first layer administrator identity At the same time, other users cannot control the port; the BIOS layer port control module configures the corresponding register for the port to control the port status; the BIOS layer port information transmission module obtains the port information collected by the BIOS layer port control module, and unifies it between the BIOS and the operating system The communication interface specification, such as SMBIOS, reports the information to the OS layer information receiving module; the BIOS port control module imposes control authority on the port to set the control authority scope of the OS layer on the port;

In the OS layer:

The OS layer information receiving module receives the port information reported by the BIOS layer, and issues instructions to the OS layer port control module according to the port information; the OS layer port control module opens or closes the port according to the issued instructions; the OS layer identity authentication module passes the identification The second-level administrator status is given to the second-level administrator to control the corresponding port. The second-level administrator has a higher priority than the first-level administrator.

To sum up, the above are only preferred embodiments of the present invention, and are not intended to limit the protection scope of the present invention. Any modification, equivalent replacement, improvement, etc. made within the spirit and principle of the present invention shall be included within the protection scope of the present invention.

Claims (5)

1. A port management and control method based on BIOS is characterized in that the method is applied to a port management and control system comprising an OS layer information receiving module, an OS layer port control module, a BIOS layer port information transmission module, a BIOS layer port control module, a BIOS layer identity authentication module and a hardware layer, and the specific steps comprise:

step one, electrifying a computer and entering a BIOS configuration interface;

step two, the BIOS identity authentication module identifies the identity authority of the operator and determines whether to give the administrator authority;

thirdly, an administrator inputs a port management and control request, and a BIOS port control module receives and judges whether a corresponding register exists or not;

fourthly, the BIOS port information transmission module reports the port information to an OS layer information receiving module by utilizing a unified communication interface between the BIOS and the operating system;

fifthly, the OS layer information receiving module receives the port information reported by the BIOS layer port information transmission module and transmits the port information to the OS layer port control module;

and step six, the port control module of the OS layer controls the corresponding port through the hardware layer according to the port information.

2. The method of claim 1, wherein the port management system further comprises an OS-level identity authentication module.

3. The method according to claims 1-2, wherein the administrator privileges are specifically:

when the operation is performed by a first-layer administrator, the corresponding port control authority is opened, and then the selection of port switch control can be performed on a configuration interface; when the operation is not performed by the first-layer administrator, the port management and control authority is not given; and the OS layer identity authentication module gives the control authority to a corresponding port of a second layer administrator by identifying the identity of the second layer administrator, wherein the priority of the second layer administrator is higher than that of the first layer administrator.

4. The method of claim 1, wherein step three further comprises:

when a corresponding register exists, the register is directly configured to realize the control of the port; when the corresponding register does not exist, judging whether the hardware layer has hardware support or not; if the hardware support exists, the BIOS port control module directly pulls or informs a hardware layer to pull a corresponding GPIO to control the port; and if the hardware support does not exist, entering the step four.

5. A BIOS based port management system comprising an OS layer, a BIOS layer and a hardware layer for the method of claims 1-4;

the OS layer comprises an OS layer information receiving module, an OS layer port control module and an OS layer identity authentication module; the BIOS layer comprises a BIOS layer port information transmission module, a BIOS layer port control module and a BIOS layer identity authentication module; the hardware layer comprises a CPU, a port controller and a port pulling device;

in the hardware layer:

the port controller is used for directly controlling the ports; the port pulling device and the CPU together form hardware support for the port, and pull the corresponding GPIO to control the port under the control of the port control module of the BIOS layer;

in the BIOS layer:

the BIOS layer port control module is connected with the OS layer port control module, and the BIOS layer port control module and the OS layer port control module are connected with a CPU and a port controller of a hardware layer; the BIOS layer identity authentication module gives control authority to a corresponding port of a first layer administrator by identifying the identity of the first layer administrator, and meanwhile, other users cannot control the port; the BIOS layer port control module controls the port state by configuring a corresponding register for the port; the BIOS layer port information transmission module acquires the port information collected by the BIOS layer port control module and reports the information to the OS layer information receiving module through a unified communication interface between the BIOS and the operating system; the BIOS port control module applies control authority to the port to set the control authority range of the OS layer to the port;

in the OS layer:

the OS layer information receiving module receives the port information reported by the BIOS layer and issues an instruction to the OS layer port control module according to the port information; the OS layer port control module performs opening or closing operation on the port according to the issued instruction; the OS layer identity authentication module gives the management and control authority of a corresponding port to a second layer administrator by identifying the identity of the second layer administrator, and the priority of the second layer administrator is higher than that of the first layer administrator.

Images