BIOS Boot-Path Hashing for Secure Flow Verification
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Existing information handling systems lack efficient methods to track and debug system boot phase failures, relying on coarse fault detection and time-consuming manual debugging, which is costly and unsatisfactory for users.
Innovation Solution
Implementing a function progress hash generator to create a path hash for each system boot process, storing it in NVRAM, and generating a boot path hash table to facilitate rapid identification of boot paths, enabling off-host or on-host debugging of boot failures.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Measurement precision
If traditional coarse fault detection methods are used during system boot, then the system can detect boot failures, but the debugging process becomes time-consuming and costly requiring manual intervention
Solution Approach 1:
The system performs preliminary actions by calculating and storing hash values of boot process paths during normal operation. When a boot failure occurs, the pre-stored hash values enable immediate identification of the failed boot path without requiring time-consuming manual debugging, thus resolving the contradiction between detection precision and debugging time
Solution Approach 2:
The patent creates a digital copy (hash value) of the boot process path that can be quickly compared against stored reference values. This copying approach allows rapid identification of boot failures without needing to re-execute or manually trace through the entire boot process, thereby reducing debugging time while maintaining high detection precision
2Measurement precision
If detailed tracking of each boot process is implemented, then boot path identification becomes precise, but system complexity increases
Solution Approach 1:
The patent replaces complex mechanical or manual tracking systems with a computational hash-based approach. Instead of implementing intricate tracking mechanisms for each boot process, the system uses hash functions to generate compact representations of boot paths, achieving precise identification while minimizing system complexity through mathematical substitution
Solution Approach 2:
The system transforms the complex boot process path information into a simplified parameter (hash value) that retains the essential identification characteristics. This parameter transformation allows precise boot path identification while reducing the complexity of storing and comparing entire process sequences, as hash values are compact and computationally efficient
Data Source
AI summary
An information handling system includes a memory device and a BIOS. The BIOS executes a plurality of processes to boot the information handling system. Each process has a unique identifier (ID). When the BIOS executes a first process, the BIOS calculates a first hash value of a first ID of the first process and stores the first hash value to the memory device. Each time the BIOS executes a second process, the BIOS calculates a second hash value of the path hash value and a second ID of the second process and stores the second hash value to the memory device. After the boot of the information handling system is completed, the path hash value identifies a boot path of the processes for the boot of the information handling system. The BIOS further determines whether the boot path is a secure boot path based upon the path hash value.