CN114117444A - Hard disk binding starting method based on Initrd file system - Google Patents
Hard disk binding starting method based on Initrd file system Download PDFInfo
- Publication number
- CN114117444A CN114117444A CN202111292803.5A CN202111292803A CN114117444A CN 114117444 A CN114117444 A CN 114117444A CN 202111292803 A CN202111292803 A CN 202111292803A CN 114117444 A CN114117444 A CN 114117444A
- Authority
- CN
- China
- Prior art keywords
- hard disk
- serial number
- computer system
- authentication
- disk
- Prior art date
- Legal status (The legal status is an assumption and is not a legal conclusion. Google has not performed a legal analysis and makes no representation as to the accuracy of the status listed.)
- Pending
Links
Images
Classifications
-
- G—PHYSICS
- G06—COMPUTING OR CALCULATING; COUNTING
- G06F—ELECTRIC DIGITAL DATA PROCESSING
- G06F21/00—Security arrangements for protecting computers, components thereof, programs or data against unauthorised activity
- G06F21/50—Monitoring users, programs or devices to maintain the integrity of platforms, e.g. of processors, firmware or operating systems
- G06F21/57—Certifying or maintaining trusted computer platforms, e.g. secure boots or power-downs, version controls, system software checks, secure updates or assessing vulnerabilities
- G06F21/572—Secure firmware programming, e.g. of basic input output system [BIOS]
-
- G—PHYSICS
- G06—COMPUTING OR CALCULATING; COUNTING
- G06F—ELECTRIC DIGITAL DATA PROCESSING
- G06F21/00—Security arrangements for protecting computers, components thereof, programs or data against unauthorised activity
- G06F21/50—Monitoring users, programs or devices to maintain the integrity of platforms, e.g. of processors, firmware or operating systems
- G06F21/57—Certifying or maintaining trusted computer platforms, e.g. secure boots or power-downs, version controls, system software checks, secure updates or assessing vulnerabilities
- G06F21/575—Secure boot
-
- G—PHYSICS
- G06—COMPUTING OR CALCULATING; COUNTING
- G06F—ELECTRIC DIGITAL DATA PROCESSING
- G06F21/00—Security arrangements for protecting computers, components thereof, programs or data against unauthorised activity
- G06F21/70—Protecting specific internal or peripheral components, in which the protection of a component leads to protection of the entire computer
- G06F21/71—Protecting specific internal or peripheral components, in which the protection of a component leads to protection of the entire computer to assure secure computing or processing of information
- G06F21/73—Protecting specific internal or peripheral components, in which the protection of a component leads to protection of the entire computer to assure secure computing or processing of information by creating or determining hardware identification, e.g. serial numbers
-
- G—PHYSICS
- G06—COMPUTING OR CALCULATING; COUNTING
- G06F—ELECTRIC DIGITAL DATA PROCESSING
- G06F8/00—Arrangements for software engineering
- G06F8/60—Software deployment
- G06F8/61—Installation
- G06F8/63—Image based installation; Cloning; Build to order
Landscapes
- Engineering & Computer Science (AREA)
- Theoretical Computer Science (AREA)
- General Engineering & Computer Science (AREA)
- Software Systems (AREA)
- Computer Hardware Design (AREA)
- Computer Security & Cryptography (AREA)
- Physics & Mathematics (AREA)
- General Physics & Mathematics (AREA)
- Mathematical Physics (AREA)
- Stored Programmes (AREA)
Abstract
本发明提供了一种基于Initrd文件系统的硬盘绑定启动方法，包括：在计算机系统中写入唯一硬盘序列号；在Initrd文件系统中增加硬盘序列号的认证程序；启动所述计算机系统，所述认证程序进行硬盘序列号的认证，若所述认证程序认证的硬盘序列号与所述唯一硬盘序列号一致，则正常启动，若不一致，则关机。该方法弥补了硬盘绑定需要定制硬件进行额外辅助的问题，能够在在系统启动阶段就识别出风险点阻止异常启动情况，确保安全启动。
The invention provides a hard disk binding startup method based on the Initrd file system, comprising: writing a unique hard disk serial number in a computer system; adding an authentication program for the hard disk serial number in the Initrd file system; The authentication program performs the authentication of the hard disk serial number. If the hard disk serial number authenticated by the authentication program is consistent with the unique hard disk serial number, it will be started normally, and if not, it will be shut down. The method makes up for the problem that hard disk binding requires additional assistance from customized hardware, and can identify risk points during system startup to prevent abnormal startup and ensure safe startup.
Description
Technical Field
The invention relates to the technical field of information security, in particular to a hard disk binding starting method based on an Initrd file system.
Background
Computer security is always a hot spot of domestic and foreign research, and the secure start of a computer is the first step of using the computer, which is a more important defense line, and in reality, the situation of normally starting a system after a hard disk is replaced randomly exists, and personal information of a user cannot be effectively protected for computers produced in batches.
In order to solve the above problems, in the prior art, for example, in the application of industrial control equipment, there is a method for authorizing a hard disk matching a serial number by binding the serial number of the hard disk with a BIOS of a motherboard, so as to ensure safe start; the proposal also provides mutual binding of the BIOS, the mainboard and the hard disk, and the starting safety is ensured by judging whether the mainboard is matched with the BIOS, whether the hard disk is matched with the BIOS and whether the hard disk is matched with the mainboard.
However, both of the above two methods have problems because both of the above two methods need to perform the cooperative authentication based on the BIOS, and although the cooperative authentication scheme based on the BIOS can ensure the start-up safety of the computer and has higher security, the implementation is complicated, the BIOS or the motherboard needs to be customized for the hard disk, the corresponding technology needs to be matched with the motherboard and the BIOS, if the motherboard is replaced or the BIOS is updated, the corresponding motherboard and the BIOS need to be synchronously customized, and the universality is also reduced.
Therefore, for the problems in the prior art, it is necessary to provide a secure boot scheme for hard disk binding to solve the problem that additional assistance is required for hardware customization.
Disclosure of Invention
The invention provides a hard disk binding starting method based on an Initrd file system, which solves the problem that hard disk binding needs additional assistance of customized hardware, can identify a risk point to prevent abnormal starting at the system starting stage, and ensures safe starting.
In order to achieve the above and other related objects, the present invention provides a hard disk binding startup method based on an Initrd file system, including:
writing a unique hard disk serial number in the computer system;
adding an authentication program of a hard disk serial number in an Initrd file system;
and starting the computer system, authenticating the hard disk serial number by the authentication program, normally starting the computer system if the hard disk serial number authenticated by the authentication program is consistent with the unique hard disk serial number, and shutting down the computer system if the hard disk serial number authenticated by the authentication program is inconsistent with the unique hard disk serial number.
Preferably, the writing of the unique hard disk serial number in the computer system specifically includes:
selecting a partition in the computer system as a particular partition;
acquiring the disk number of the disk where the specific partition is located;
acquiring a unique serial number of a hard disk according to the disk partition of the disk where the specific partition is located;
and writing the unique serial number of the hard disk into a mark file.
Preferably, the authentication program performs authentication of the hard disk serial number, and specifically includes:
detecting whether the computer system has the mark file or not, if so, performing the next authentication, and if not, shutting down the computer system;
detecting whether the specific partition exists, if so, detecting the disk number of a disk where the specific partition is located, and acquiring a corresponding hard disk serial number according to the disk number; if not, shutting down the machine;
and judging whether the hard disk serial number is consistent with the unique hard disk serial number, if so, successfully authenticating, normally starting the computer system, and if not, failing to authenticate, and shutting down the computer system.
Preferably, the corresponding hard disk serial number is obtained according to the disk number through an hdparm command.
Preferably, the method further comprises testing the hard disk binding start method, and specifically comprises:
manufacturing a mirrored system of the computer system;
and installing the mirror image system and restarting the system for testing.
Preferably, the manufacturing of the mirror image system of the computer system specifically includes:
writing the technology for writing the unique hard disk serial number in the computer system and the authentication technology of the authentication program into a binary package;
writing the binary package to a computer system and manufacturing a mirrored system of the computer system.
Preferably, the testing specifically comprises:
installing the mirror system;
normally starting without replacing the hard disk, and checking whether the prompt message is normal;
replacing the hard disk with the mark file, and checking whether the mirror image system can be normally started;
and replacing the hard disk with the specific partition, and checking whether the mirror image system can be normally started.
Based on the same inventive concept, the present invention also provides an electronic device comprising a processor and a memory, wherein the memory stores a computer program, and the computer program realizes the method of any one of the above items when being executed by the processor.
Based on the same inventive concept, the present invention further provides a readable storage medium, in which a computer program is stored, and the computer program, when executed by a processor, implements the method of any one of the above.
In conclusion, the invention provides a hard disk binding starting method based on the Initrd file system, which solves the problem that the hard disk binding needs additional assistance of hardware customization, identifies the risk point to prevent the abnormal starting condition in the system starting stage, and ensures the safe starting; furthermore, the key mark information of the hard disk comprises the serial number and the partition condition of the hard disk, so that the authentication of the hard disk is enhanced; still further, the invention is convenient for managing and transplanting the binary package in the writing and authentication process of the hard disk serial number to other platforms.
Drawings
In order to more clearly illustrate the embodiments of the present invention or the technical solutions in the prior art, the drawings used in the description of the embodiments or the prior art will be briefly described below. It is obvious that the drawings in the following description are only some embodiments of the invention, and that for a person skilled in the art, other drawings can be derived from them without inventive effort.
Fig. 1 is a schematic diagram illustrating steps of a hard disk binding start method based on an Initrd file system according to an embodiment of the present invention;
fig. 2 is a schematic diagram illustrating an authentication flow in a hard disk binding and starting method based on the Initrd file system according to an embodiment of the present invention.
Detailed Description
The hard disk binding startup method based on the Initrd file system proposed by the present invention is further described in detail with reference to fig. 1-2 and the detailed description below. The advantages and features of the present invention will become more apparent from the following description. It is to be noted that the drawings are in a very simplified form and are all used in a non-precise scale for the purpose of facilitating and distinctly aiding in the description of the embodiments of the present invention. To make the objects, features and advantages of the present invention comprehensible, reference is made to the accompanying drawings. It should be understood that the structures, ratios, sizes, and the like shown in the drawings and described in the specification are only used for matching with the disclosure of the specification, so as to be understood and read by those skilled in the art, and are not used to limit the implementation conditions of the present invention, so that the present invention has no technical significance, and any structural modification, ratio relationship change or size adjustment should still fall within the scope of the present invention without affecting the efficacy and the achievable purpose of the present invention.
First, technical terms related to the present invention will be described.
initrd file system: refers to an initial root file system that is mounted into the system before the actual root file system is available. initrd is bound to the kernel and is loaded as part of the kernel boot process. The kernel will then load the module with this initrd file as part of its two-phase boot process, so that the real file system can be used later and the actual root file system mounted.
Hard disk binding: refers to the authentication of the unique identity of the hard disk firmware.
Referring to fig. 1, the present invention provides a hard disk binding startup method based on an Initrd file system, including the following steps:
and S100, writing the unique hard disk serial number into the computer system.
In this embodiment, as for step S100, specifically, based on an ARM/MIPS hardware platform and a software environment of a domestic standard kylin desktop operating system, writing a unique serial number into a hard disk is added in an installer, and the serial number is written into a designated file, so that the serial number is conveniently authenticated when the system is started.
The writing step comprises:
1) detecting whether the operating system uses a single disk or a double disk, and if the operating system uses a single disk, writing a subsequent hard disk serial number into a flag file, for example: (iv)/etc/HOMESILBLE; if it is a dual disc, another flag file is written, for example: /ete/HOMEDBLE.
2) Selecting a partition in the computer system as a particular partition;
3) acquiring the disk number of a disk where the specific partition (such as the HOME partition) is located;
4) acquiring a unique serial number of a hard disk according to the disk partition of the disk where the specific partition is located;
5) writing the unique serial number of the hard disk into a mark file to facilitate subsequent authentication;
s200, adding an authentication program of a hard disk serial number in an Initrd file system;
s300, starting the computer system, authenticating the hard disk serial number by the authentication program, normally starting if the hard disk serial number authenticated by the authentication program is consistent with the unique hard disk serial number, and shutting down if the hard disk serial number authenticated by the authentication program is inconsistent with the unique hard disk serial number.
In this embodiment, as for step S300, the serial number of the system hard disk authenticated in the initrd system includes a plurality of detailed steps, and the specific flow is as shown in fig. 2:
1) detecting and judging that the starting system is a mark file of a single disk or a double disk, if the mark file (such as/etc/HOMENGLE or/ete/HOMEDBLE) exists, giving related prompt information, continuing the next step, and if the mark file does not exist, shutting down the system after the prompt information;
2) judging whether the specific partition exists, if so, giving related prompt information and then carrying out next detection, and if not, shutting down the prompt information;
3) detecting the disk number of the disk where the specific partition (such as the HOME partition) is located when the system is started:
4) the hard disk serial number corresponding to the disk number is inquired through the hdparm command, which refers to the parameter for detecting, displaying and setting IDE or SCSI hard disk and is a common tool for testing the hard disk reading performance.
5) And comparing 4) whether the serial number read in the step is consistent with the serial number written in the mark file (/ etc/HOMESINGLE or/ete/HOMEDBLE) in the system, if the serial numbers are consistent, the hard disk is not replaced, the hard disk can be safely started, and if the serial numbers are not consistent, the information is prompted to be shut down.
In this embodiment, the method further includes testing the hard disk binding start method, and specifically includes:
1) manufacturing a mirrored system of the computer system;
2) and installing the mirror image system and restarting the system for testing.
In this embodiment, the manufacturing of the mirror system of the computer system specifically includes:
1) writing the technology for writing the unique hard disk serial number in the computer system and the authentication technology of the authentication program into a binary package;
2) writing the binary package to a computer system and manufacturing a mirrored system of the computer system.
In this embodiment, the testing specifically includes:
1) installing the mirror system;
2) normally starting without replacing the hard disk, checking whether the prompt message is normal, if normal, completing the first layer test, and performing the second layer test, if not, the technology of writing the unique hard disk serial number in the computer system or the authentication technology of the authentication program has problems.
Changing the hard disk with the mark file, checking whether the mirror system can be normally started, if the mirror system can be normally started, the technology of writing the unique hard disk serial number in the computer system or the authentication technology of the authentication program has problems, and if the mirror system can not be normally started, completing the second-layer test and carrying out a third-layer test;
and replacing the hard disk with the specific partition, checking whether the mirror system can be normally started, if the mirror system can be normally started, solving the problem in the technology of writing the unique hard disk serial number in the computer system or the authentication technology of the authentication program, and if the mirror system can not be normally started, completing the test of the third layer so as to complete the test of the method.
Based on the same inventive concept, the invention further provides an electronic device, which includes a processor and a memory, where the memory stores a computer program, and when the computer program is executed by the processor, the method for binding and starting a hard disk based on the Initrd file system is implemented.
The processor may be, in some embodiments, a Central Processing Unit (CPU), a controller, a microcontroller, a microprocessor (e.g., a GPU), or other data Processing chip. The processor is typically used to control the overall operation of the electronic device. In this embodiment, the processor is configured to run a program code stored in the memory or process data, for example, run a program code of the hard disk binding startup method based on the Initrd file system.
The memory includes at least one type of readable storage medium including a flash memory, a hard disk, a multimedia card, a card type memory (e.g., SD or DX memory, etc.), a Random Access Memory (RAM), a Static Random Access Memory (SRAM), a Read Only Memory (ROM), an Electrically Erasable Programmable Read Only Memory (EEPROM), a Programmable Read Only Memory (PROM), a magnetic memory, a magnetic disk, an optical disk, etc. In some embodiments, the storage may be an internal storage unit of the electronic device, such as a hard disk or a memory of the electronic device. In other embodiments, the memory may also be an external storage device of the electronic device, such as a plug-in hard disk, a Smart Media Card (SMC), a Secure Digital (SD) Card, a Flash memory Card (Flash Card), and the like provided on the electronic device. Of course, the memory may also include both internal and external memory units of the electronic device. In this embodiment, the memory is generally used to store an operating method installed in the electronic device and various types of application software, such as a program code of a hard disk binding start method based on the Initrd file system. In addition, the memory may also be used to temporarily store various types of data that have been output or are to be output.
Based on the same idea, the invention further provides a readable storage medium, in which a computer program is stored, and when the computer program is executed by a processor, the hard disk binding starting method based on the Initrd file system is implemented.
The invention has the advantages that the hard disk binding starting method based on the Initrd file system is provided, the problem that the hard disk binding needs additional assistance of hardware customization is solved, the risk point is identified in the system starting stage to prevent abnormal starting, and safe starting is ensured; furthermore, the key mark information of the hard disk comprises the serial number and the partition condition of the hard disk, so that the authentication of the hard disk is enhanced; still further, the invention is convenient for managing and transplanting the binary package in the writing and authentication process of the hard disk serial number to other platforms.
While the present invention has been described in detail with reference to the preferred embodiments, it should be understood that the above description should not be taken as limiting the invention. Various modifications and alterations to this invention will become apparent to those skilled in the art upon reading the foregoing description. Accordingly, the scope of the invention should be determined from the following claims.
Claims (9)
Priority Applications (1)
| Application Number | Priority Date | Filing Date | Title |
|---|---|---|---|
| CN202111292803.5A CN114117444A (en) | 2021-11-03 | 2021-11-03 | Hard disk binding starting method based on Initrd file system |
Applications Claiming Priority (1)
| Application Number | Priority Date | Filing Date | Title |
|---|---|---|---|
| CN202111292803.5A CN114117444A (en) | 2021-11-03 | 2021-11-03 | Hard disk binding starting method based on Initrd file system |
Publications (1)
| Publication Number | Publication Date |
|---|---|
| CN114117444A true CN114117444A (en) | 2022-03-01 |
Family
ID=80380401
Family Applications (1)
| Application Number | Title | Priority Date | Filing Date |
|---|---|---|---|
| CN202111292803.5A Pending CN114117444A (en) | 2021-11-03 | 2021-11-03 | Hard disk binding starting method based on Initrd file system |
Country Status (1)
| Country | Link |
|---|---|
| CN (1) | CN114117444A (en) |
Citations (12)
| Publication number | Priority date | Publication date | Assignee | Title |
|---|---|---|---|---|
| US20040049671A1 (en) * | 2002-09-10 | 2004-03-11 | Jareva Technologies, Inc. | System for managing boot-up of target computers |
| US20090037720A1 (en) * | 2007-07-31 | 2009-02-05 | Wistron Corp. | Hard Disk Security Method in a Computer System |
| CN102033822A (en) * | 2010-12-01 | 2011-04-27 | 北京同有飞骥科技股份有限公司 | Method for binding storage operating system and hardware system |
| CN102567042A (en) * | 2010-12-14 | 2012-07-11 | 国际商业机器公司 | Method and system for managing multiple software images with relocation of boot blocks |
| US8784195B1 (en) * | 2003-03-05 | 2014-07-22 | Bally Gaming, Inc. | Authentication system for gaming machines |
| CN105183388A (en) * | 2015-09-14 | 2015-12-23 | 北京华青融天技术有限责任公司 | Obtaining method, device and system for hardware physics serial number |
| CN105242986A (en) * | 2015-09-11 | 2016-01-13 | 金步国 | Method for backing up and restoring Windows operating system |
| CN107679425A (en) * | 2017-09-26 | 2018-02-09 | 天津麒麟信息技术有限公司 | A Trusted Boot Method Based on Joint Full Disk Encryption of Firmware and USBkey |
| US20190065213A1 (en) * | 2017-08-24 | 2019-02-28 | Vmware, Inc. | Virtual appliance supporting multiple instruction set architectures |
| US20200210163A1 (en) * | 2017-07-28 | 2020-07-02 | New H3C Information Technologies Co., Ltd. | Operating system installation |
| CN111666574A (en) * | 2020-06-11 | 2020-09-15 | 山东超越数控电子股份有限公司 | Method for binding BIOS (basic input output System), mainboard and hard disk mutually |
| CN112130930A (en) * | 2020-09-23 | 2020-12-25 | 平安科技（深圳）有限公司 | Mirror image system generation method, device, equipment and medium |
-
2021
- 2021-11-03 CN CN202111292803.5A patent/CN114117444A/en active Pending
Patent Citations (12)
| Publication number | Priority date | Publication date | Assignee | Title |
|---|---|---|---|---|
| US20040049671A1 (en) * | 2002-09-10 | 2004-03-11 | Jareva Technologies, Inc. | System for managing boot-up of target computers |
| US8784195B1 (en) * | 2003-03-05 | 2014-07-22 | Bally Gaming, Inc. | Authentication system for gaming machines |
| US20090037720A1 (en) * | 2007-07-31 | 2009-02-05 | Wistron Corp. | Hard Disk Security Method in a Computer System |
| CN102033822A (en) * | 2010-12-01 | 2011-04-27 | 北京同有飞骥科技股份有限公司 | Method for binding storage operating system and hardware system |
| CN102567042A (en) * | 2010-12-14 | 2012-07-11 | 国际商业机器公司 | Method and system for managing multiple software images with relocation of boot blocks |
| CN105242986A (en) * | 2015-09-11 | 2016-01-13 | 金步国 | Method for backing up and restoring Windows operating system |
| CN105183388A (en) * | 2015-09-14 | 2015-12-23 | 北京华青融天技术有限责任公司 | Obtaining method, device and system for hardware physics serial number |
| US20200210163A1 (en) * | 2017-07-28 | 2020-07-02 | New H3C Information Technologies Co., Ltd. | Operating system installation |
| US20190065213A1 (en) * | 2017-08-24 | 2019-02-28 | Vmware, Inc. | Virtual appliance supporting multiple instruction set architectures |
| CN107679425A (en) * | 2017-09-26 | 2018-02-09 | 天津麒麟信息技术有限公司 | A Trusted Boot Method Based on Joint Full Disk Encryption of Firmware and USBkey |
| CN111666574A (en) * | 2020-06-11 | 2020-09-15 | 山东超越数控电子股份有限公司 | Method for binding BIOS (basic input output System), mainboard and hard disk mutually |
| CN112130930A (en) * | 2020-09-23 | 2020-12-25 | 平安科技（深圳）有限公司 | Mirror image system generation method, device, equipment and medium |
Non-Patent Citations (1)
| Title |
|---|
| 徐欣;陈锦飞;: "基于Ukey和LiveOS的加密硬盘安全认证方案", 杭州电子科技大学学报(自然科学版), no. 06, 15 November 2016 (2016-11-15) * |
Similar Documents
| Publication | Publication Date | Title |
|---|---|---|
| CN101213557B (en) | Anti-hacker protection to limit installation of operating system and other software | |
| KR102788533B1 (en) | Electronic device performing firmware update based on user authentication and operating method thereof | |
| US20120117369A1 (en) | Platform boot with bridge support | |
| CN103718165A (en) | BIOS flash attack protection and notification | |
| US8788800B2 (en) | OS processing method, system and non-transitory computer readable storage medium thereof | |
| US20130091394A1 (en) | Data processing apparatus and validity verification method | |
| US20130124845A1 (en) | Embedded device and control method thereof | |
| US12271480B2 (en) | Information handling systems and related methods to prevent tampering and verify the integrity of non-volatile data stored within non-volatile memory | |
| WO2012031567A1 (en) | Fault tolerance method and device for file system | |
| CN108228486A (en) | The method for operating storage system | |
| US7047565B2 (en) | Method and system for capturing in-service date information | |
| CN103105783B (en) | embedded element and control method | |
| CN114117444A (en) | Hard disk binding starting method based on Initrd file system | |
| US7836219B1 (en) | System and method for authentication of embedded RAID on a host RAID card | |
| CN111783162B (en) | Data protection implementation method and device and computer equipment | |
| CN111258617B (en) | Electronic equipment | |
| WO2022231584A1 (en) | Concurrent execution and copy of updated basic input/output system instructions | |
| US7600132B1 (en) | System and method for authentication of embedded RAID on a motherboard | |
| CN112632482A (en) | Target application running method and device and storage medium | |
| CN114510751A (en) | A kind of hardware anti-replacement device and method based on processor security core | |
| CN112269998A (en) | Starting control method, system, equipment and storage medium of server | |
| TWM575145U (en) | System for preserving data | |
| CN115118413B (en) | TDS validity testing method and device, electronic equipment and storage medium | |
| US7502942B1 (en) | System and method for authentication of embedded raid on a motherboard having input/output processor | |
| CN117574352B (en) | Software and hardware combined anti-counterfeiting method, system, equipment and storage medium |
Legal Events
| Date | Code | Title | Description |
|---|---|---|---|
| PB01 | Publication | ||
| PB01 | Publication | ||
| SE01 | Entry into force of request for substantive examination | ||
| SE01 | Entry into force of request for substantive examination |