BIOS Boot Source Isolation for External Storage Security
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Information handling systems face security risks when booting from external storage resources, as they can be vulnerable to malicious programs and data transfer.
Innovation Solution
The system employs a BIOS that determines if it is booting from an external storage resource and can disable specific information handling resources during the boot session to mitigate these risks, using hardware-specific locking registers or I/O traps when necessary, with user-configurable settings to manage resource access.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Adaptability or versatility
If the system allows booting from external storage resources, then system versatility and user convenience are improved, but security vulnerability increases due to potential malicious programs and data transfer
Solution Approach 1:
The system segments information handling resources into isolated groups that can be selectively enabled or disabled based on boot source. When booting from external storage, only minimal necessary resources are enabled, while other resources are isolated to prevent malicious access. This segmentation allows the system to maintain versatility in boot options while reducing security vulnerabilities through resource isolation.
Solution Approach 2:
The system dynamically adjusts resource accessibility based on the detected boot source. During external storage boot, the system automatically isolates certain information handling resources that may not be needed for basic boot operations, thereby reducing the attack surface. This dynamic adjustment maintains system versatility while adapting security measures to the specific boot context.
2Object-affected harmful factors
If the system isolates information handling resources during external boot, then security is improved, but system functionality may be degraded
Solution Approach 1:
The system applies partial isolation actions during external boot by selectively disabling only those information handling resources that are not essential for basic boot operations. Critical resources remain accessible to ensure system functionality, while non-essential resources are isolated to reduce security threats. This partial action approach maintains necessary functionality while achieving security improvement.
Solution Approach 2:
The system automatically determines the boot source and self-adjusts resource isolation settings without requiring user intervention. This self-service mechanism ensures that security measures are applied appropriately based on the actual boot context, maintaining system functionality while reducing security threats through automated resource management.
3Object-affected harmful factors
If the system disables information handling resources during external boot, then malicious data transfer is prevented, but user access to resources is restricted
Solution Approach 1:
The system preemptively isolates information handling resources before malicious code can execute during external boot. By disabling potential attack vectors in advance, the system prevents malicious data transfer while maintaining ease of operation for legitimate boot scenarios. This preliminary protective action ensures security without unnecessarily restricting user access to essential resources.
Data Source
Figure 1~2
AI summary
An information handling system may include a processor, at least one information handling resource, at least one external port configured to receive an external information handling resource and couple the external information handling resource to the processor, and a basic input/output system. The basis input/output system may comprise a program of instructions executable by the processor and configured to cause the processor to determine whether a current boot session of the information handling system was initiated by a boot from an external storage resource coupled to the at least one external port, and in response to a determination that the current boot session of the information handling system was initiated by a boot from an external storage resource coupled to the at least one external port, disable one or more of the at least one information handling resource for the current boot session.