BIOS Driver Public Key Extraction for OS Authentication
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
The manual intervention required to populate key databases with new drivers in information handling systems for authenticating signatures is impractical, especially when updating drivers across a broad set of servers in a computing enterprise.
Innovation Solution
An information handling system with a BIOS that authenticates the signature of a BIOS driver, extracts, and stores the vendor public key in a key database, enabling the operating system to authenticate signed operating system drivers using the corresponding private key.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Ease of operation
If manual intervention is used to populate key databases with new drivers, then security authentication is maintained, but the process becomes impractical for broad server updates
Solution Approach 1:
The vendor public key is embedded within the BIOS driver before distribution. This preliminary inclusion of the authentication key in the driver package eliminates the need for separate manual key population steps, allowing automated extraction and storage during the driver installation process itself.
Solution Approach 2:
The system automatically extracts the vendor public key from the BIOS driver and stores it in the key database without requiring manual intervention. The BIOS authentication process itself performs the key population, making the system self-sufficient for key management during driver updates.
2Productivity
If manual key population is required for each server, then authentication security is preserved, but productivity decreases across computing enterprises
Solution Approach 1:
The vendor public key is pre-embedded in the BIOS driver, enabling automated extraction and storage during driver installation. This eliminates the time-consuming manual key population process for each server, allowing simultaneous deployment across multiple servers without repetitive manual steps.
Solution Approach 2:
The automated extraction and storage of the vendor public key during BIOS driver installation eliminates manual intervention. The system performs key population automatically as part of the driver installation process, dramatically reducing the time required for enterprise-wide driver updates.
3Extent of automation
If public keys are embedded in BIOS drivers, then automated authentication becomes possible, but key security management becomes more complex
Solution Approach 1:
The vendor public key is extracted from the BIOS driver during the authentication process and stored separately in the key database. This separation allows the authentication system to function automatically while managing key storage independently, reducing the complexity of real-time key management during driver installation.
Data Source
AI summary
In accordance with these and other embodiments of the present disclosure, an information handling system may include a processor and a basic input/output system (BIOS) comprising a program of instructions executable by the processor and configured to cause the processor to initialize one or more information handling resources of the information handling system. The BIOS may be further configured to authenticate a signature of a BIOS driver associated with an information handling resource of the information handling system, and, in response to authenticating the signature of the BIOS driver, extracting a vendor public key from the BIOS driver and storing the vendor public key to a key database of the BIOS, wherein the vendor public key may be used by an operating system to authenticate one or more signed operating system drivers signed with a private key corresponding to the vendor public key.