BIOS Action Requests with Kernel-Driver Cryptographic Authorization

Resolve Bottlenecks,
Find Innovative SolutionsGenerate Solutions

Solution Overview

Problem

Computing devices lack a secure method for the Basic Input/Output System (BIOS) to determine whether a process is trusted or malicious, allowing unauthorized access and potential manipulation of BIOS settings, which can compromise device security.

Innovation Solution

A cryptographic key exchange mechanism involving a controller and kernel driver is implemented to authenticate and authorize BIOS actions, ensuring only authorized applications can modify settings or access privileged BIOS capabilities, using cryptographic keys generated at boot time and verified through a secure key exchange protocol.

Engineering Contradictions & Design Principles

VSEngineering Contradiction Analysis

1Reliability

If traditional BIOS access methods are used, then ease of operation is improved, but security is worsened due to lack of authentication mechanisms

Engineering Contradiction:

ImproveBIOS securityVSAvoidauthentication mechanism complexity

Core Design Contradiction:

ReliabilityVSDevice complexity

Solution Approach 1:

The system performs preliminary authentication by verifying the calling process identity and cryptographic signature before allowing BIOS access. The kernel driver authenticates the application and signs the action request in advance, ensuring that only authorized processes can modify BIOS settings without adding runtime complexity.

Inventive Principle:

Principle #10Preliminary action

Solution Approach 2:

The kernel driver acts as an intermediary between the application and BIOS, mediating all BIOS access requests. It verifies process identity, signs requests cryptographically, and forwards authenticated commands to the BIOS, thereby securing BIOS access without requiring direct application-BIOS communication.

Inventive Principle:

Principle #24Intermediary (Mediator)

2Reliability

If cryptographic authentication is implemented, then BIOS security is improved, but device complexity increases due to key management requirements

Engineering Contradiction:

Improveauthorized access controlVSAvoidkey exchange protocol complexity

Core Design Contradiction:

ReliabilityVSDevice complexity

Solution Approach 1:

The system uses self-service authentication where the kernel driver automatically verifies the calling process identity and generates cryptographic signatures without external intervention. The BIOS itself participates in the authentication by verifying signatures against pre-stored public keys, eliminating the need for external key management infrastructure.

Inventive Principle:

Principle #25Self-service

3Object-affected harmful factors

If process authentication is required, then security against malicious processes is improved, but ease of operation deteriorates due to additional verification steps

Engineering Contradiction:

Improveprotection against malicious processesVSAvoidBIOS access convenience

Core Design Contradiction:

Object-affected harmful factorsVSEase of operation

Solution Approach 1:

The patent replaces mechanical authentication methods (such as password prompts or physical switches) with cryptographic verification. The kernel driver automatically performs cryptographic signature verification and process identity authentication, providing secure access control without requiring user intervention or disrupting the operational flow.

Inventive Principle:

Principle #28Mechanics substitution (Replace mechanical system)

Data Source

PatentUS12406063B2BIOS action request for authorized application

Publication Date: 2025.09.02 HEWLETT PACKARD DEVELOPMENT COMPANY LP

AI summary

Systems and methods are provided for a computing device with a basic input/output system (BIOS) comprising BIOS settings that are to be changed by BIOS actions. An application may request a BIOS action to change a BIOS setting. Using a received key from the BIOS, a processor of the computing device may implement a kernel driver to sign the request from the application in response to determining that the application is authorized to request the BIOS action. Further, the BIOS may perform the BIOS action without requiring an administrative password upon receiving the signed action request from the kernel driver.