Secure Information Transfer via BIOS Control Switching
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Existing methods for securely transferring confidential information between a server and a PC via a network are vulnerable to malicious software like spyware and key loggers, and suffer from performance and usability issues due to the need for special hardware and time constraints in switching between operating system and BIOS modes.
Innovation Solution
A method and apparatus that securely transfer encrypted information by switching the PC from operating system control to BIOS control for decryption and processing, allowing safe handling of confidential data without special hardware, and enabling efficient handling of large volumes of data without performance degradation.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If SSL encryption is used for secure data transmission, then security against wiretapping and alteration is improved, but vulnerability to malicious software like spyware and key loggers remains
Solution Approach 1:
The patent segments the authentication process into two distinct phases: SSL-based secure transmission phase (under OS control) and decryption/processing phase (under BIOS control). This segmentation isolates the vulnerable decryption operation from the OS environment where malicious software operates, thereby resolving the contradiction between maintaining SSL security while preventing spyware attacks.
Solution Approach 2:
The patent introduces BIOS as an intermediary layer between the SSL encrypted data and the OS. The BIOS temporarily takes control of the system to perform decryption and processing of authentication information, then returns control to the OS. This intermediary approach allows secure handling of sensitive data without exposing it to malicious software in the OS environment.
2Reliability
If special hardware like smart cards is used for secure key storage, then security against information leakage is improved, but device complexity and cost increase
Solution Approach 1:
The patent extracts the security-critical decryption and processing operations from the OS environment and relocates them to the BIOS layer. This extraction eliminates the need for special hardware like smart cards or secure elements, as the BIOS itself provides a protected execution environment that is inaccessible to malicious software. The solution uses existing system resources (BIOS firmware) rather than adding specialized hardware components.
Solution Approach 2:
The patent uses temporary, volatile memory space allocated in the BIOS environment for storing decryption keys and processing data. This temporary storage space exists only during the brief period when BIOS controls the system, and is automatically cleared when control returns to the OS. This approach replaces expensive persistent secure storage hardware with inexpensive, temporary software-based storage that achieves the same security goal.
3Reliability
If the system switches between OS and BIOS control for secure processing, then security against malicious software is improved, but processing time and system performance may deteriorate
Solution Approach 1:
The patent implements periodic switching between OS and BIOS control, where the system operates under OS control for most tasks, periodically switches to BIOS control for security-critical operations (authentication processing), then returns to OS control. This periodic action minimizes the time spent in BIOS mode to only when necessary, thereby reducing performance impact while maintaining security.
Solution Approach 2:
The patent optimizes the BIOS control phase to complete decryption and processing operations as quickly as possible, minimizing the duration of BIOS control. By rushing through the security-critical operations efficiently and returning control to the OS immediately afterward, the patent reduces the time loss associated with mode switching while maintaining the security benefits of isolated processing.
Data Source
AI summary
Methods and apparatus are provided for securely inputting highly confidential information, exchanging the information via a network, and securely reflecting the information in a computer, without the information being stolen by malicious software. Upon a transfer of encrypted information from a server to a computer, the transferred information is stored in a memory of the computer and the computer is switched to a suspended state and immediately thereafter returns to the previous state to be shifted to under the control of a BIOS. The information stored in the memory is decrypted and processed there. Processing information generated based on the processed information is then encrypted and it is transferred to the server after the computer is switched to under the control of the operating system.