- I-Secure Boot ithembele ku-UEFI, uhlelo oluyinhloko (i-PK, i-KEK) kanye nezizindalwazi (i-DB, i-DBX) ukuqinisekisa ukuthi i-firmware ethembekile kanye nama-bootloader kuphela asebenzayo.
- Ukuphelelwa yisikhathi kwezitifiketi zika-2011 ngo-2026 kudinga ukubuyekeza okhiye kanye nezizindalwazi ukuze kulondolozwe ukuvikelwa kwebhuthi ku-Windows naku-Linux.
- Ukuqina kwe-firmware kuhlanganisa i-Secure Boot nezibuyekezo ezisayiniwe, izimpande zokwethenjwa kwehadiwe, ukubethela, kanye nokuqapha okuqhubekayo.
- Izixazululo ezifana ne-FirmGuard kanye nabalingani bezinhlelo ezifakiwe abangochwepheshe zisiza ukuphathwa okukude, ukuthuthela ku-UEFI, kanye nokuqaliswa kwezintambo zokuqalisa ezivikelekile.
Kumakhompyutha amaningi namadivayisi, i-firmware iqala buthule njalo uma ucindezela inkinobho yokuvula, kodwa ukuthembeka kwakho konke okunye—noma ubuthakathaka bayo—kuncike kuleso sikhathi. Iyini i-firmware futhi isetshenziselwani ? Ukuhlanganiswa kwe-Secure Boot, i-UEFI, kanye ne-firmware hardening eqinile kwenza umehluko omkhulu phakathi kwesistimu engamelana nokuhlaselwa okukhulu kanye nesistimu engase yonakaliswe yi-USB drive elula enonya.
Kulesi sihloko, sizobheka izindlela zokuxazulula izinkinga bese sichaza, ngokuthula kodwa ngokuqondile, ukuthi iyini i-Secure Boot, ukuthi ihlobene kanjani ne-firmware ye-UEFI, ukuthi yiziphi izinkinga eziphakamayo ngezitifiketi eziphelelwa yisikhathi ngo-2026 , nokuthi konke lokhu kuhambisana kanjani nokuphepha ku-Windows, Linux, kanye nezinhlelo ezifakiwe. Uzobona nezixazululo ezithuthukisiwe njengokuphathwa kwe-BIOS okude, ukuqapha ubuqotho, kanye nendima yabalingani abangochwepheshe lapho izinto ziba nzima.
Iyini i-Secure Boot futhi kungani ibaluleke kangaka?
I-Secure Boot iyisici sokuphepha esakhelwe ku-firmware ye-UEFI esilawula ukuthi iyiphi isofthiwe engasebenza phakathi nezigaba zokuqala zokuqalisa. Umsebenzi wayo ulula ukuwusho kodwa kunzima ukuwusebenzisa ngempumelelo: ukuqinisekisa ukuthi ikhodi esayiniwe nethembekile kuphela (ama-bootloaders, abashayeli be-UEFI, izinhlelo zokusebenza ze-EFI) iyaqaliswa kanye nokuvimba noma iyiphi i-binary engahambisani nezinqubomgomo ezichazwe ku-firmware.
Empeleni, i-firmware ye-UEFI iqhathanisa isiginesha yedijithali yekhodi ezoyisebenzisa ngokumelene nochungechunge lwezitifiketi kanye nohlu lwesiginesha olugcinwe ngaphakathi. Uma isiginesha sifana nesitifiketi esivunyelwe noma i-hash kusizindalwazi esithembekile (DB) , leyo ngxenye iyayenza; ngaphandle kwalokho, iyavinjelwa. Lokhu kuhloswe ukuvimbela ukwenziwa kwama-bootkit kanye ne-malware ezama ukuduna inqubo yokuqalisa.
I-Secure Boot yavela ngezinga elikhulu nge-Windows 8, lapho izinsongo ezazilayisha ngaphambi kokuba uhlelo lokusebenza luqale ukwanda. Imodeli iqukethe uchungechunge lokwethembana : i-firmware ye-UEFI ngokwayo iqinisekisa amamojula ayo angaphakathi (njenge-Option ROMs), bese ihlola i-bootloader (isibonelo, i-Windows Boot Manager noma i-shim/GRUB ku-Linux), futhi kuphela uma konke kwamukelwa lapho idedela khona ukulawula kuleyo bootloader, okubuye kuqinisekise i-kernel kanye nezinye izinto ezimbili.
Isihluthulelo ukuthi ukwethenjwa kwe-Secure Boot kuchazwa yinqubomgomo ye-firmware esethwe efektri . Le nqubomgomo ivezwa ngokhiye kanye nomuthi wedathabheyisi: ukhiye weplatifomu oza kuqala kunabo bonke abanye, ama-KEK agunyaza izinguquko, kanye nohlu olubili, i-DB ne-DBX, olulawula ukuthi yini evunyelwe nokuthi yini evinjelwe. Ukuphatha kahle le ecosystem kubaluleke njengokuvumela inketho ye-Secure Boot kumenyu ye -Windows 11.
Isakhiwo esiyinhloko: i-PK, i-KEK, i-DB ne-DBX
Ingqikithi ye-Secure Boot iwuhlu lwezihluthulelo kanye nezizindalwazi zesiginesha . Ukuyiqonda kubalulekile kunoma yiliphi isu lokuqinisa, kokubili ezindaweni zasekhaya futhi, ikakhulukazi, ebhizinisini noma engqalasizinda ebalulekile.
Phezulu kukhona i -Platform Key (PK) , evame ukukhiqizwa futhi iphathwe ngumenzi wehadiwe. Le khiye iyigunya eliphelele: noma ngubani onayo angashintsha zonke ezinye izinto ze-Secure Boot, ngakho-ke ukuyibeka engcupheni iketanga lonke lokuthembana. Ezinye izinhlangano zishintsha i-PK ezenzakalelayo ngeyazo ukuze zilawule ipulatifomu.
Izinga elilodwa ngezansi yi -Key Exchange Keys (KEKs) , egunyaza izibuyekezo kudathabheyisi ye-DB ne-DBX. Ngokuvamile kukhona i-Microsoft KEK, eyodwa noma ngaphezulu evela kumkhiqizi wehadiwe, futhi, ezindaweni zezinkampani, ama-KEK enhlangano uqobo. Noma yiliphi ibhizinisi eline-KEK elivumelekile lingangeza noma lihoxise izitifiketi kanye nama-hashe ohlwini lwe-Secure Boot.
Isizindalwazi sesiginesha esivunyelwe (i-DB) sigcina izitifiketi kanye nama-hashes ama-binary angasetshenziswa yi-firmware ngesikhathi sokuqalisa. Lokhu kufaka phakathi izitifiketi ezivela ku-Microsoft, i-OEM, kanye, uma kusebenza, nenkampani ephethe izimoto. Lapho i-firmware ihlaziya i-bootloader noma i-Option ROM, ifuna okufanayo ku-DB ukuze inqume ukuthi izoyilayisha yini.
Ngakolunye uhlangothi, kukhona isizindalwazi sesiginesha esihoxisiwe (i-DBX) , esiqukethe ama-binary nezitifiketi okungafanele zibhekwe njengeziphephile. I-Microsoft ibuyekeza i-DBX njalo ukuze ingasebenzi ama-bootloader asengozini (njengoba kubonakala ekuhlaselweni kwe-BootHole) noma izingxenye eziye zabonakala zingaphephile. Ukugcina i-DBX isesikhathini kubalulekile ekuvimbeleni i-binary esayiniwe kodwa esiphelelwe yisikhathi ukuthi ingahlali iyindawo yokungena.
Izitifiketi ze-Secure Boot eziphelelwa yisikhathi ngo-2026
Kusukela kwethulwa i-Secure Boot, cishe wonke amakhompyutha ahambisana ne-Windows afake isethi evamile yezitifiketi ze-Microsoft ku-KEK kanye ne-DB . Inkinga ukuthi ezinye zalezi zitifiketi zakhishwa ngo-2011 futhi sezisondele osukwini lwazo lokuphelelwa yisikhathi, okunomthelela oqondile ekuvikelweni kwe-boot kumadivayisi ayizigidi.
Ngokukhethekile, izitifiketi ezifana ne- Microsoft Corporation KEK CA 2011 , i-Microsoft Windows Production PCA 2011 , noma i-Microsoft UEFI CA 2011 zinezinsuku zokuphelelwa yisikhathi phakathi kukaJuni no-Okthoba 2026. Ngayinye igcwalisa indima ehlukile: ukusayina izibuyekezo ze-DB ne-DBX, i-Windows loader, ama-bootloader ezinkampani zangaphandle, noma ama-Option ROM omkhiqizi wezinkampani zangaphandle.
Ukuqinisekisa ukuphepha okuqhubekayo, iMicrosoft ikhiphe izitifiketi ezintsha ngo-2023 ezithatha indawo yalezo zango-2011 : isibonelo, iMicrosoft Corporation KEK 2K CA 2023 esikhundleni se-KEK yokuqala, iWindows UEFI CA 2023 ye-bootloader yesistimu, kanye nezitifiketi ezibuyekeziwe zamasignesha esicelo se-EFI kanye nama-ROM enketho yomuntu wesithathu.
Le nkampani iphatha ngokuyisisekelo ukubuyekezwa kwalezi zitifiketi engxenyeni enkulu ye-ecosystem ye-Windows, njengoba nje isabalalisa amanye ama-patch okuphepha. Ama-OEM aphinde akhiphe izibuyekezo ze-firmware uma kudingeka ukuze kufakwe izitifiketi ezintsha noma kulungiswe izilungiselelo ze-Secure Boot.
Uma idivayisi ingawatholi okhiye abasha ngaphambi kokuba abamanje baphelelwe yisikhathi, izoqhubeka nokuqalisa futhi ithole izibuyekezo ze-Windows ngokujwayelekile, kodwa ngeke isakwazi ukusebenzisa izindlela ezithile zokunciphisa isigaba sokuqalisa : ngeke ithole izinguquko ezithile ku-Windows Boot Manager, izibuyekezo ze-DB/DBX, noma ama-patches obuthakathaka obusanda kutholwa obusezingeni eliphansi.
Umphumela wokuphelelwa yisikhathi kwesitifiketi kanye nezenzo ezidingekayo
Ukuphelelwa yisikhathi kwezitifiketi zika-2011 akusho ukuthi ikhompyutha yakho izoyeka ukuvula, kodwa kancane kancane kunciphisa ikhono lesistimu lokuzivikela ezinsongweni ezithinta isikhathi sokuqalisa . Lokhu kungaba nemiphumela ezimweni ezifana nokuqina kwe-BitLocker noma ukusetshenziswa kwama-bootloader ezinkampani zangaphandle athembele kuchungechunge lwe-Secure Boot lokwethenjwa.
Ukuze kuncishiswe izingozi, iMicrosoft itusa futhi, ezimweni eziningi, yenza inqubo yokuvuselela izitifiketi ze-KEK ne-DB ibe ngo-2023 ngokuzenzakalela . Abaphathi be-IT kanye nezikhulu zokuphepha kufanele baqinisekise ukuthi amadivayisi abo athole lezi zibuyekezo, ikakhulukazi ezinhlotsheni eziningi ezinazo ihadiwe endala noma i-firmware engasabuyekezwa njalo.
Ukubizelwa esenzweni kucacile: buyekeza isimo se-Secure Boot kuhlobo ngalunye lwedivayisi , thola ukuthi izitifiketi ezindala ziyasetshenziswa yini bese uhlela ukuthuthukiswa, bese ulandela iziqondiso zokuvumela i-Secure Boot ngemuva kokubuyekeza i-BIOS . Ezindaweni ezilawulwayo, kuvame ukudingeka ukuthi ubheke imibhalo ethile yomenzi noma ulandele "i-Windows Secure Boot Key Creation and Management Guidance" ukuze uhlanganise kahle okhiye abasha enkambisweni yokufakwa.
Kwezinye izimo, ikakhulukazi lapho okhiye be-PK, KEK, noma be-DB benziwe ngokwezifiso ngezitifiketi zenhlangano uqobo, isibuyekezo singadinga izinyathelo ezenziwe ngesandla kanye nokuhlolwa okucophelelayo ukuze kugwenywe ukukhubaza ama-bootloader asemthethweni angakasayinwa kabusha ngokhiye bamanje. Iphutha lokuhlanganisa lapha lingabangela ukuthi izinhlelo zihluleke ukuqala ngemuva kokusetshenziswa kwe-patch yokuphepha.
I-Secure Boot ne-Linux: uchungechunge lokuthembela, i-shim ne-GRUB2
Ezinhlelweni ze-Linux, inqubo iyafana, kodwa inezici zayo ezithile. Ukusabalalisa okuningi kwesimanje kuncike engxenyeni ebizwa ngokuthi i-shim , i-bootloader encane esayinwe yi-Microsoft evumela i-firmware ye-UEFI ukuthi iyamukele ngaphandle kwebhokisi. I-Shim isebenza njengebhuloho: i-firmware iyilayisha ngenxa yesiginesha ye-Microsoft, futhi kusukela lapho, i-shim iqinisekisa i-GRUB2 kanye ne-kernel isebenzisa okhiye abakhethekile bokusabalalisa.
Indlela yokusebenza evamile ku-Linux ene-Secure Boot imi kanje: i-UEFI iqinisekisa i-shim, i-shim iqinisekisa i-GRUB2, futhi i-GRUB2 iqinisekisa i-kernel . Isigaba ngasinye sincike ekusayinweni kwedijithali kanye nenqubomgomo eyinhloko ehlala ngaphakathi kwe-shim ngokwayo kanye nasezindabeni ze-Secure Boot. Lokhu kuqinisekisa ukuthi umenzi wehadiwe akadingi ukwazi okhiye bokusatshalaliswa ngakunye kusengaphambili, ngenkathi esalawula ukuthi iyiphi i-kernel engayiqalisa.
Kulo mongo, izinto ezifanayo esizibonile ngaphambilini zisabalulekile: i-PK ilawula ukuthi ubani ongashintsha ukucushwa kwe-Secure Boot yomhlaba wonke ku-firmware, ama-KEK anquma ukuthi ubani ongabuyekeza i-DB ne-DBX, i-DB iqoqa okhiye abasekelwayo (kufaka phakathi labo abadingekayo ku-shim), kanye ne-DBX igcina ukuhoxiswa okukhiya ama-binary asengozini.
Imodeli inikeza izinzuzo zokusebenzisana, kodwa inezela ubunzima bokusebenza. Isibonelo, lapho kuvela ubuthakathaka obubalulekile kuma-shims noma ku-GRUB2, kuyadingeka ukuvuselela ngokushesha i-bootloader ethintekile, futhi, ngesikhathi esifanayo, usabalalise okufakiwe kwe-DBX okuhoxisa izinguqulo ezindala . Uma i-oda lingalungile, ungagcina unezinhlelo ezisadinga i-shim endala ukuze iqalise, noma ngabe i-binary yayo ihoxisiwe.
Umphumela uba ukuthi ukuphathwa kahle kwama-signature e-DBX kanye ne-Linux bootloader kuba umsebenzi obucayi, ikakhulukazi ezindaweni lapho ukusatshalaliswa okuningana, izinguqulo ze-LTS kanye nesofthiwe yangaphandle ehlanganyela ekuqaliseni (isibonelo, abaphathi bokubethela noma ama-hypervisor) kuhambisana khona.
Lokho i-Secure Boot ekuvikelayo… nalokho engakuvikeli.
I-Secure Boot yakhelwe ukuvimba ukuhlaselwa okuqondiswe ezigabeni zokuqala zokuqalisa . Lokhu kufaka phakathi ama-bootkit aguqula i-bootloader ukuze ilayishe umthwalo wayo, ama-kernel athathelwe indawo yizinguqulo ezinonya, ama-Option ROM aqanjiwe asebenza ngaphambi kwesistimu yokusebenza, kanye nama-binary e-EFI alethwa ukuze athole ukuphikelela.
Ngokudinga ukuthi ingxenye ngayinye yochungechunge lwe-boot isayinwe futhi iqinisekiswe, indawo yokuhlasela yanoma ubani ozama "ukufihla" ngaphansi kwesistimu yokusebenza incishiswa kakhulu. I-bootloader esengozini ingakhubaza i-telemetry, igweme ukuhlolwa kobuqotho, noma ama-rootkit ezitshalo ngaphambi kokuba amathuluzi okuphepha asebenze. I-Secure Boot izama ukuvala leyo ndlela.
Futhi ikhawulela kancane izinketho zomhlaseli onokufinyelela ngokomzimba: ukuqala nje kusuka kudrayivu ye-USB ngeshaja ephazamisekile akusanele, ngoba i-firmware izokwenqaba ama-binary angasayinwanga ngezitifiketi ezisekelwayo . Lokhu akusho ukuthi ukuphepha ngokomzimba akusabalulekile, kodwa kuphakamisa izinga kulabo abahlose ukulimaza idivayisi ngokusebenzisa ukushiyeka kokuphepha.
Kodwa-ke, i-Secure Boot inemikhawulo ecacile. Ayivikeli ekubuthakathakeni ngaphakathi kohlelo lokusebenza uqobo , futhi ayivimbeli umsebenzisi onamalungelo aphezulu ekusebenziseni kabi imisebenzi esemthethweni ukuze abangele umonakalo. Ayivimbeli futhi ukuhlaselwa kwenethiwekhi, ukuxhashazwa kwezinsizakalo, noma ukulungiselelwa okungalungile kungqimba yohlelo lokusebenza.
Ngaphezu kwalokho, umlando ubonisa ukuthi iketanga lama-boot ngokwalo lingaba sengozini. I-Shim ne-GRUB2 ziye zabhekana nokwehluleka okukhulu , njengesigameko esidumile se-BootHole, lapho iphutha ekuhlaziyweni kokucushwa kwe-GRUB2 livumele ukuphathwa kwenqubo yama-boot ngaphandle kokwenza isiginesha ingasebenzi. Impendulo kulezi zigameko kube ukubuyekeza ama-binary nokususa izinguqulo ezingavikelekile nge-DBX, okuphinde kugqamise ukubaluleka kokugcinwa kwe-Secure Boot esebenzayo.
Izinselele zokuqalisa, ukuqinisa, kanye nokulungisa
Izinkinga eziningi nge-Secure Boot aziveli ekuhlaselweni okuyinkimbinkimbi, kodwa zivela kumadivayisi ane-firmware esiphelelwe yisikhathi, uhlu lwe-DBX oluphelelwe yisikhathi, noma okhiye abangakahlolwa kusukela ihadiwe yathunyelwa . Ngamanye amazwi, kusukela ekunganakwa kokusebenza okuqongelelayo ngokuhamba kwesikhathi.
Ezimweni eziningi, isinyathelo sokuqala sokuthuthukisa silula njengokusebenzisa ngokuhlelekile izibuyekezo ze-UEFI/BIOS ezikhishwe umenzi . Lezi zibuyekezo azilungisi nje amaphutha, kodwa zingafaka nezici zokuphepha ezintsha, ukuthuthukiswa kokuphathwa kwezihluthulelo, kanye nama-patches obuthakathaka ku-firmware uqobo.
Esinye isici esibalulekile ukuhlanzeka okubalulekile . Izinhlangano ezithembele kuphela kukhiye be-OEM kanye ne-Microsoft PK kanye ne-KEK zithembele ngokuphelele kushejuli yalaba bathengisi, kuyilapho labo abaphatha okhiye babo bedinga uhlu olucacile: ukuthi ubani osayina ukhiye ngamunye, ukuthi uphelelwa nini yisikhathi, nokuthi uhlelo lokushintshanisa luyini. Ukulahlekelwa ukulawula le mephu kuyindlela yokuphazamiseka ekuqaleni.
Ama-DB nama-DBX adinga ukubhekwa okukhethekile. I-DBX engakabuyekezwa ezinyangeni eziningi cishe iqukethe izimpahla ezimbili esezivele zimenyezelwe njengezingaphephile . Ngakolunye uhlangothi, isibuyekezo esingahlolwanga kahle singaphula ukuhambisana nezinguqulo ezindala ze-shim noma i-GRUB2. Ngakho-ke, izinkampani eziningi zihlanganisa izinguquko ze-DB/DBX emjikelezweni wazo ojwayelekile wokuphathwa koshintsho, zizenza zihlolwe ngaphambilini ezindaweni zokulinganisa.
Ezinhlanganweni ezinkulu, kuvame kakhulu ukuhlanganisa i-Secure Boot nezilinganiso zokuqalisa ezilinganisiwe kanye nokusekelwa kwe-TPM . Lokhu kurekhoda ama-hashes esigaba ngasinye sokuqalisa ku-TPM, okuvumela ukuqinisekiswa okukude ukuthi uhlelo luqalise kabusha ngenhlanganisela eyaziwayo negunyaziwe ye-firmware, i-bootloader, kanye ne-kernel.
Ngale kokuqalisa kabusha: ukuvikela i-firmware kuzo zonke izigaba
Noma ngabe i-Secure Boot inamandla kangakanani, ayanele ngokwayo. Ukuphepha kwe-Firmware kuyinqubo eqhubekayo ehlanganisa ukucushwa, izibuyekezo, ukuqapha, kanye nokuphendula ezigamekweni. Umqondo ukwakha izendlalelo zokuvikela eziqinisanayo.
Isici esibalulekile izibuyekezo ze-firmware ezivikelekile . Akusizi ngalutho ukuthembela ku-Secure Boot uma sivumela i-firmware ukuthi ikhanye kunoma iyiphi indawo ngaphandle kokuqinisekiswa kwesiginesha, ukuvikelwa ekuhlaselweni kwe-downgrade, noma indlela yokutakula uma kwenzeka yehluleka. Izibuyekezo kumele zisayinwe ngedijithali, zisetshenziswe ngokulandela inqubo eqinile, futhi, ngokufanele, zifake ukuvikelwa ekubuyeleni ezinguqulweni ezisengozini.
Kunconywa futhi ukusebenzisa ihadiwe yokuphepha etholakalayo: izimpande zehadiwe zokwethenjwa, izindawo zokugcina izikhiye ezivikelekile, i-TPM, i-TrustZone, amamojula avikelekile angaphandle ... Lezi zingxenye zikuvumela ukuthi uhlukanise izimfihlo ze-cryptographic futhi zenze kube nzima kakhulu kumhlaseli onokufinyelela ngokomzimba ukukhipha okhiye noma ukuguqula ikhodi ngaphandle kokutholwa.
Ngokuphathelene nedatha, inhlanganisela ye -verified boot kanye nokubethela kolwazi olubucayi kuyisinyathelo esibalulekile phambili. Uma idivayisi isebenzisa i-Secure Boot ukuqinisekisa ukuthi isebenzisa i-firmware ethembekile kuphela, ingaxhumanisa ukuqedwa kwedatha kuleso simo esiqinisekisiwe. Ngale ndlela, noma ngabe othile ukopisha imemori, ngeke akwazi ukufinyelela okuqukethwe ngaphandle kokuthi akwazi ukuphinda akhiqize ukulandelana okufanayo kwe-boot okusemthethweni.
Lo mjikelezo uqedwa ngezindlela zokuvikela isikhathi sokusebenza: ukuhlolwa kwenkumbulo njalo kanye nobuqotho be-firmware, iziqaphi, amalogi emicimbi yokuphepha ahlobene nokwehluleka kokuqalisa noma imizamo yokuguqula, kanye nokuvimba izixhumi zokulungisa amaphutha, ukufundwa okuvikelwe kwememori yohlelo, kanye nezilawuli zokufinyelela zehadiwe ezifanele.
I-FirmGuard kanye nokuphathwa kwe-BIOS/UEFI okude
Ezindaweni zebhizinisi kanye nabahlinzeki bezinsizakalo abaphethwe, ukuphatha ukucushwa kwe-firmware kudivayisi ngayinye kuwukuchitha isikhathi kanye nomthombo wamaphutha. Yilapho izixazululo ezifana ne- FirmGuard zingena khona, zinikeza ipulatifomu ephakathi nendawo yokuvikela, ukulungisa, ukuqapha, kanye nokubuyekeza i-firmware ye-BIOS/UEFI kude.
Esinye sezici zayo ezibalulekile yikhono lokumisa kude izinketho ezibalulekile ze-BIOS/UEFI (SecureConfig) . Lokhu kuvumela abaphathi ukuthi bavule i-Secure Boot ngokuhlelekile, balungise amapharamitha okuphepha, bakhubaze ukuqala kumadivayisi angagunyaziwe, noma basebenzise amathempulethi okucushwa aqinisiwe ngaphandle kokuya ngokoqobo endaweni ngayinye yokusebenza.
Ngaphezu kwalokho, i-FirmGuard ihlanganisa ukuqapha okuqhubekayo kobuqotho be-firmware (i-SecureCheck) . Ipulatifomu iqapha izinguquko ze-BIOS/UEFI, ibona izinguquko ezingalindelekile, futhi ixwayise lapho okuthile kukhomba emisebenzini enobungozi engaba khona noma izinguquko zokucushwa ezingagunyaziwe. Endaweni lapho i-firmware iyinto ekhangayo ngokwengeziwe, lokhu kubonakala kubaluleke kakhulu.
Kumasistimu asebenza kumodi ye-BIOS yakudala, i-FirmGuard ingeza ingxenye yesithathu, i-SecureSense, ekwazi ukuhlonza amasistimu asasebenzisa i-BIOS yakudala futhi ikwazi ukuthuthela ku-UEFI—isinyathelo esibalulekile sokusebenzisa i-Secure Boot nezinye izici zokuphepha zesimanje. Kusukela embonweni webhizinisi noma we-MSP, lokhu kusho ukusuka ohlelweni olungafani nolunzima ukuluphatha uye kolufanayo noluvikelekile.
Uma zizonke, lezi zinhlobo zezixazululo azigcini nje ngokunciphisa ingozi yokuhlaselwa yi-firmware, kodwa futhi zinikeza inani elicacile elengeziwe kubahlinzeki bezinsizakalo abaphethwe , abangazihlukanisa ngokunikeza izinga elengeziwe lokuvikelwa ngaphansi kwe-hood futhi, ngeshwa, bathuthukise imingcele yabo ngokwenza imisebenzi eyayisetshenziswa ngesandla futhi ibiza kakhulu ngaphambilini.
I-Firmware kanye ne-Secure Boot ezinhlelweni ezifakiwe
Ngaphandle kwama-PC namaseva, ukuphepha kwe-firmware kubalulekile kumadivayisi afakiwe: abalawuli bezimboni, imishini yezokwelapha, izinto zikagesi zabathengi, izimoto , nokunye okuningi. Lapha, ukwehluleka akugcini nje ngokulahlekelwa idatha kodwa kuvame ukubangela izingozi zokuphepha ngokomzimba kanye nesibopho somthetho.
Abasebenzisi bokugcina balawa madivayisi ngokuvamile abazi ukuthi i-firmware esengozini iyasebenza. Kodwa-ke, lezi zigameko zingokoqobo kakhulu: kube nokubuyiswa okukhulu kwamadivayisi ezokwelapha ngenxa yezinkinga zokuphepha , njengecala elaziwayo lama-pacemaker okwadingeka abuyekezwe noma ashintshwe ngenxa yengozi yokuhlaselwa kude. Lezi zimo zithinta ukwethenjwa, imali engenayo, kanye nedumela labakhiqizi.
Uma i-firmware yedivayisi efakiwe isengozini, imiphumela ingaba mibi kakhulu: ukulahlekelwa ukwethenjwa kwamakhasimende, ukubizwa kabusha okubizayo, ukubambezeleka kwezitifiketi (ukunakekelwa kwempilo, izimoto, izimboni), umthelela esithombeni somkhiqizo, kanye, ngezinye izikhathi, ukuphazamiseka kokusebenza kwengqalasizinda ebalulekile.
Kulezi zimo, i-Secure Boot ibaluleke kakhulu. Ukusebenzisa uchungechunge lokuthembela oluvela ku-byte yokuqala esetshenzisiwe kuqinisekisa ukuthi i-firmware esayinwe ngumenzi (noma igunya elithembekile) kuphela elingaqalwa. Ukusuka lapho, isigaba ngasinye senqubo yokuqalisa singaqinisekisa okulandelayo: i-bootloader yokuqala, i-bootloader yesibili, i-firmware yohlelo lokusebenza, i-kernel yesistimu yokusebenza efakiwe, njalo njalo.
Kodwa-ke, ukufaka i-Secure Boot kumadivayisi afakiwe akuyona into encane. Kudinga ukwesekwa kwehadiwe ukuze kugcinwe ngokuphephile okhiye , ingxenye yekhodi engaguquki ukuze isebenze njengempande yokwethenjwa, kanye nenqubo yokukhiqiza ekwazi ukwenza ngezifiso idivayisi ngayinye ngokhiye nezitifiketi zayo ngaphandle kokuzidalula. Kumapulatifomu alinganiselwe kakhulu, kungadingeka ukusebenzisa ama-bootloader avikelekile ngokwezifiso, nazo zonke izici zokusebenza ezihambisanayo, ukusetshenziswa kwezinsiza, kanye nezinselele zezindleko.
Izendlalelo ezengeziwe ze-firmware eqinile ngempela
Ukuze kuvikelwe i-firmware eqinile, kudingeka izendlalelo eziningi. Eyokuqala yi-Secure Boot, kodwa kumele ihambisane nezindlela zokuvuselela ezivikelekile, isitoreji esivikelekile, izivikelo zesikhathi sokusebenza, kanye nemikhuba emihle yokuhlela.
Ngokuphathelene nezibuyekezo, zonke izithombe ze-firmware kanye nesofthiwe esezingeni eliphansi kufanele zisayinwe ngedijithali futhi, ngokufanelekile, zivikelwe ekwehleni . Izibuyekezo ezisebenza emoyeni (i-OTA) noma zendawo kufanele ziqinisekise isiginesha ngaphambi kokwamukela izinguquko, kanye nezinhlelo zesikhashana (amakhophi e-firmware ayisipele, izindlela zokubuyisa ezivikelekile) kufanele zibe khona ukuze kugwenywe izinhlelo ezingasetshenziswa ngemva kokwehluleka, kulandelwa imikhuba emihle yokuvuselelwa kokuphepha kwesofthiwe.
Isitoreji esiphephile sidlala enye indima ebalulekile. Ama-MCU esimanje, ama-SoC ane-TrustZone, ama-TPM, noma izinto ezivikelekile ezinikezelwe zivumela ukuvikelwa kwezihluthulelo nedatha ebucayi ukuze ngisho nomuntu onokufinyelela ngokomzimba angakwazi ukuzikhipha ngaphandle kokushiya umkhondo noma ngaphandle komzamo omkhulu. Ukuxhumanisa ukufinyelela kulezi zimfihlo nempumelelo ye-Secure Boot kunezela isendlalelo esengeziwe sokuqinisekisa.
Ngesikhathi sokusebenza, kubalulekile ukuhlanganisa ukuhlolwa kobuqotho okwenziwa njalo, iziqaphi, ukuvikelwa kwememori (i-MPU, i-MMU, i-lockstep), izingodo zemizamo yokuqalisa ehlulekile noma izinguquko ze-firmware ezisolisayo, futhi emikhiqizweni ebaluleke kakhulu, ngisho nezinzwa zokuphazamisa ezibonakalayo.
Okokugcina, akukho kulokhu okusebenza kahle uma inhlangano ingazamukeli izindlela zokuthuthukisa eziphephile kanye nokuphathwa kobuthakathaka : ukuhlaziywa kwezinsongo, ukwakheka okugxile ekuphepheni, ukubuyekezwa kwekhodi, ukuhlolwa kokungena, izinqubo ezicacile zokuphendula ezigamekweni, kanye nomjikelezo wokuphila lapho ukuphepha nekhwalithi kuhambisana khona. I-Firmware ayikwazi ukubhekwa njengento ebhalwe kanye futhi yakhohlwa.
Ukubaluleka kokuba nabalingani abangochwepheshe ku-firmware kanye nokuphepha
Uma sibheka konke esikubonile, kulula ukuqonda ukuthi kungani izinkampani eziningi ziphendukela ezinhlelweni ezikhethekile ezifakiwe kanye nabalingani bezokuphepha kwe-cyber lapho kudingeka baqinise ukuvikelwa kwe-Secure Boot kanye ne-firmware. Ukwazi ukuthi ungahlela kanjani akwanele: udinga ukwazi kahle ihadiwe, i-cryptography, izinqubo zezimboni, imithethonqubo, kanye nayo yonke imvelo yokuhlasela nokuzivikela.
Umlingani omuhle uletha ulwazi olusebenzayo lokuthuthukisa ama-bootloader, abashayeli, izinhlelo ezihlanganisiwe eziyinkimbinkimbi, izindlela zokubethela, kanye nabalawuli behadiwe , okuvumela ukwakheka kwezixazululo zokuphepha ezihlanganiswe ngempela nomkhiqizo, hhayi izengezo zomzuzu wokugcina ezisebenza kuphela ekwenzeni kube nzima ukugcinwa.
Ngokuvamile zifaka phakathi izincwadi zokudlala namathuluzi aqinisekisiwe : amamojula okuqalisa avikelekile angasetshenziswa kabusha, izikripthi zokuphatha okhiye nezitifiketi, iziqondiso zokuqinisa i-firmware, amapayipi e-CI afaka ukusayina kwe-binary kanye nokuqinisekiswa okuzenzakalelayo, njalo njalo. Lokhu kusindisa isikhathi futhi kunciphisa amathuba okwenza amaphutha abaqalayo abizayo.
Isici sokuphepha kwe-inthanethi sibaluleke ngokulinganayo. Amaqembu ahlala enolwazi olusha ngobuthakathaka obusha, ukuhlaselwa kweziteshi eziseceleni, amaphutha kuma-stack e-IoT athandwayo , kanye nemikhuba emihle yokuklama evikelekile kusiza ukufaka ukuphepha kusukela esigabeni sokwakha, kunokuzama ukukulungisa ekugcineni. Ngokuvamile asebenza ngomqondo "wokuphepha ngokuklama", enza imodeli yokusongela kanye nokubuyekezwa kwengozi kusukela esigabeni sezidingo.
Uma lowo mlingani esekelwa yizitifiketi ze-ISO ezifanele (ISO 9001, ISO 13485, ISO 26262, njll.) , unesiqinisekiso esengeziwe sokuthi izinqubo zabo ziyahlolwa futhi zihlelekile. Akukhona nje ukuthi bayazi ukuthi yini okudingeka yenziwe, kodwa ukuthi banezinqubo ezisemthethweni kanye nokulandelelwa, into ebaluleke kakhulu emikhakheni elawulwayo njengokunakekelwa kwempilo noma kwezimoto.
Futhi kukhona into yokugcina, engenabo ubuchwepheshe kodwa ebaluleke ngokulinganayo: ukuxhumana nozwela . Umlingani omuhle akafiki ekhuluma ngendlela engaqondakali noma izixazululo eziphoqelelayo ezingenakwenzeka ukuhambisana nezinsuku zakho zokugcina noma isabelomali. Bayalalela imikhawulo yakho, bachaze izinketho ngokucacile, futhi balungise indlela yabo yokuthola ibhalansi phakathi kokuphepha, izindleko, kanye nesikhathi sokumaketha. Kumaphrojekthi e-firmware kanye ne-Secure Boot, lowo muzwa wokuba sekhasini elifanayo wenza umehluko omkhulu.
Ngamafuphi, ukusebenzisa i-Secure Boot nokuqinisa i-firmware kuhilela ukuhlanganisa isisekelo sobuchwepheshe esiqinile (i-UEFI, ukuhlelwa kwezihluthulelo, izitifiketi ezivuselelwe, amafayela e-DB/DBX agciniwe), ukusebenza okuhlelekile (izibuyekezo ze-firmware, ukuphathwa kwezihluthulelo, ukuqaliswa okulinganisiwe, ukuqapha), kanye, uma kudingeka, ukwesekwa okuvela kuzixazululo ezikhethekile kanye nabalingani abakwazi ukubhekana nobuthakathaka bangaphakathi. Uma konke lokhu kwenziwa kahle, uhlelo luqala ngenqubo yokuqalisa ethembekile eqinisa noma yiziphi izinyathelo zokuphepha ezilandelayo, kusukela ku-kernel kuya kuzinhlelo zokusebenza ezisezingeni eliphezulu.
