EFI下可信链建立关键技术研究与实现

《EFI下可信链建立关键技术研究与实现》由会员上传分享，免费在线阅读，更多相关内容在学术论文-天天文库。

1、北京交通大学硕士学位论文EFI下可信链建立关键技术研究与实现姓名：张海明申请学位级别：硕士专业：信息安全指导教师：韩臻20080601北京交通人学硕士学位论文ABSTRACTTheExtensibleFirmwareInterface(EFI)iSaspecificationthatdefinesasoftwareinterfacebetweenalloperatingsystemandplatformfirmware．EFIisintendedasasignificantlyimprovedreplacementoftheoldlegacyBIOSfirmwarei

2、nterfacehistoricallyusedbyallIBMPCcompatiblepersonalcomputers．TheEFIspecificationwasoriginallydevelopedbyIntel，andisnowmanagedbytheUnifiedEFIForumandisofficiallyknownasUnifiedEFI(UEFI)．EFIprovidesmoreextensibilityandcustomization．ComingwiththeincreaseofaaackagainstBIOS，implementationofs

3、afeBIOSbecomesextremelyurgent．EFIhavenotresolvedthesecurityrisk．BecausemostEFIcodeisimplementedbyClanguage，EFIismoreeasilytobedecoded．TheresearchinEFIsecurityisveryhotnow．Atpresent，mostsecurityresearchinEFIisconcernedwithtrusttransitionbasedonTPMmodule．ButTPMisnotwidelyusednow．Inthisthe

4、sis，USBKeyischosentomakeuptrustroot．ThecodebeforeEFIDXEisthetrusttransitionoriginpoint．ThebaseofimplementingsafeEFIisestablishingatrusttransitioninEFI．ThisthesisfocusesonresearchoftheloadingprocessofEFIdriversandapplications．AllEFIdriversandapplicationsareloadedbytheformofEFIImageinEFI．

5、TwoverificationschemesofEFIImagesareproposedinthisthesis．OneisEFlTrustListandtheotherisEmbeddingSigningMessagesinEFIImage．EFITrustListschemeneedsafilethatcontainstrustedEFIImages’informationsuchasthepathandthehashvalue．Thefileshouldbestoredinthesystem．WhenanEFIImageneedstobeloaded，itsin

6、tegritywillbechecked．First，itslegitimatehashvaluewillbefoundintheTrustedListFilebyitspath．Then，itsactualhashvaluewillbecalculated．Ifthetwohashvaluesarethesame，theintegrityoftheEFIImageisverified．IntheschemeofembeddingsigningmessagesinEFIImage，theEFIImage’Shashvaluewillbecalculatedandthe

7、nbesigned。ThesignaturewillbeembededintheEFIImageitself．WhencheckinganEFIImage，thesignaturewillbedecodedandthenthehashvalueCanbeusedtocheck．Aftercompareingthetwoschemesall—around，EFITrustListSchemeischosenandimplementedinthisthesis．Inthisthesis，theentrypointoftheEFIImageislocate