BIOS Configuration Change Detection via Non-Volatile Logging
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Existing BIOS implementations lack secure mechanisms to detect and log short-term changes to configuration settings, allowing malicious actors to perpetrate attacks by resetting configurations after a reboot, thus removing traces of the attack.
Innovation Solution
Incorporating a BIOS program that initializes information handling resources and determines configuration changes during boot, storing indications of such changes in non-volatile memory to survive reboots and detect potential attacks.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Adaptability or versatility
If BIOS setup configuration is modified through traditional BIOS setup program, then configuration settings can be changed, but the changes are lost after reboot and cannot be detected
Solution Approach 1:
The system performs preliminary actions by measuring the BIOS setup configuration state during boot and storing the measurement result before any potential malicious changes occur. This establishes a baseline configuration state that can be compared against future changes, enabling detection of configuration modifications even though the BIOS setup program itself remains functional.
Solution Approach 2:
The patent introduces an intermediary mechanism (the measurement and storage system) between the BIOS setup configuration and the system state. This intermediary captures configuration changes during boot and preserves them in a way that survives reboots, acting as a mediator that bridges the gap between temporary BIOS setup changes and persistent system state.
2Ease of operation
If traditional BIOS setup is used without additional security mechanisms, then ease of operation is maintained, but security against malicious actors is compromised
Solution Approach 1:
The system implements feedback by measuring the BIOS setup configuration during boot and storing the measurement result. This creates a feedback loop where the configuration state is continuously monitored and compared, allowing the system to detect when malicious changes have occurred while maintaining the normal ease of operation for legitimate users.
Solution Approach 2:
The patent applies preliminary anti-action by establishing a baseline configuration measurement before malicious changes can occur. This preliminary measurement serves as a reference point that enables detection of subsequent malicious modifications, preventing the harmful effects of configuration changes from going undetected.
3Device complexity
If configuration changes are not logged persistently, then device complexity is reduced, but ability to detect and investigate attacks is limited
Solution Approach 1:
The patent extracts the essential configuration measurement function from the complex BIOS setup program and separates it into a distinct measurement and storage mechanism. This extraction allows the system to detect configuration changes without requiring the entire BIOS setup program to be redesigned, reducing the complexity increase while improving detection capability.
Solution Approach 2:
The system creates a copy of the configuration state measurement and stores it in a persistent manner. This copying mechanism preserves the configuration information across reboots without requiring the original BIOS setup program to be modified, enabling attack detection while keeping the complexity increase manageable.
Data Source
AI summary
An information handling system may include a processor and a basic input/output system (BIOS) comprising a program of instructions executable by the processor and configured to cause the processor to initialize one or more information handling resources of the information handling system. The BIOS may be further configured to, during a boot of the information handling system, determine whether a BIOS configuration change has been made during a current boot session of the information handling system, and responsive to determining that a BIOS configuration change has been made during the current boot session, store an indication of the BIOS configuration change to a non-volatile memory.