BIOS Boot Code Verification and Restoration via Region Segmentation
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Existing methods for verifying and restoring BIOS software are limited, especially for regions that are rewritten after startup, leading to failed signature verification when setting values are changed, and there is a need to ensure verification can occur even when boot code settings are rewritten.
Innovation Solution
An information processing apparatus with separate verification units for distinct verification ranges and a restoration unit that uses a second boot code to restore the first boot code, ensuring verification and restoration can occur without rewriting specific regions after startup.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If the entire range of BIOS is set as a verification range, then signature verification can detect unauthorized alterations, but verification fails when setting value regions are rewritten after startup
Solution Approach 1:
The BIOS is divided into multiple regions with different verification treatments. The patent segments the BIOS into a setting value region (which may be rewritten) and other regions (which should not be altered). By applying segmentation, the system can verify non-setting regions while allowing setting regions to be updated, thus resolving the contradiction between detecting unauthorized alterations and accommodating legitimate updates.
Solution Approach 2:
Different verification strategies are applied to different regions of the BIOS. The patent implements local quality by making the verification range dynamic - excluding setting value regions from verification when they are updated, while verifying other regions. This allows the system to maintain high verification reliability for critical regions while ensuring operational flexibility for configurable regions.
2Adaptability or versatility
If BIOS setting regions are allowed to be rewritten after startup, then system adaptability is improved, but signature verification cannot distinguish between authorized and unauthorized alterations
Solution Approach 1:
The patent applies preliminary action by recording the original hash value of the BIOS setting region before any rewriting occurs. This pre-recorded hash serves as a reference point that allows the system to later determine whether changes to setting regions are authorized (by comparing against the recorded hash) or unauthorized. This resolves the contradiction by enabling adaptability through rewriting while maintaining reliability through hash comparison.
Solution Approach 2:
The system implements feedback by continuously monitoring and comparing the current BIOS hash against the recorded original hash. When setting values are rewritten, the system provides feedback by detecting whether the change is authorized through hash comparison. This feedback mechanism allows the system to maintain both adaptability (allowing rewrites) and reliability (detecting unauthorized changes).
Data Source
AI summary
An apparatus comprising: a unit configured to verify whether a first region that specifies a verification range of a first boot code and a second region that specifies a verification range of a second boot code have been altered; a unit configured to, when the first region has not been altered, verify whether the first boot code has been altered; a unit configured to, when the first boot code has been altered and the second region has not been altered, verify whether the second boot code has been altered; and a unit configured to, when the second boot code has not been altered, restore the first boot code using the second boot code, wherein the first and second regions are regions that are not rewritten after a start of the apparatus.