Modular BIOS Firmware Volumes for Selective Boot Path Execution

Resolve Bottlenecks,
Find Innovative SolutionsGenerate Solutions

Solution Overview

Problem

The increasing complexity of Basic Input/Output Systems (BIOS) in information handling systems leads to longer boot times and increased attack surfaces due to pre-boot feature sets and large amounts of BIOS code, which can be exploited for unauthorized access.

Innovation Solution

The BIOS is configured with multiple firmware volumes, each containing executable code for specific functionalities, allowing it to select and execute boot paths based on events or actions, minimizing the loading of unnecessary code and establishing trust chains for secure boot processes.

Engineering Contradictions & Design Principles

VSEngineering Contradiction Analysis

1Reliability

If pre-boot feature sets and advanced integrated devices are added to BIOS, then security and manageability are improved, but boot time increases

Engineering Contradiction:

ImprovesecurityVSAvoidboot time

Core Design Contradiction:

ReliabilityVSLoss of time

Solution Approach 1:

The BIOS is divided into multiple independent firmware volumes (e.g., FV1, FV2, FV3) that can be selectively loaded. Each volume contains specific functionality (security features, manageability features, basic boot functions). The system segments the monolithic BIOS into modular units that can be independently managed and loaded based on requirements.

Inventive Principle:

Principle #1Segmentation

Solution Approach 2:

The boot process dynamically selects which firmware volumes to load based on detected actions or events (e.g., keyboard presses, hardware presence). The system transitions from a static all-or-nothing boot approach to a dynamic selective loading approach, adapting the boot path based on real-time conditions.

Inventive Principle:

Principle #15Dynamics

2Adaptability or versatility

If more BIOS code and preboot applications are loaded, then functionality is improved, but attack surface increases

Engineering Contradiction:

ImprovefunctionalityVSAvoidattack surface

Core Design Contradiction:

Adaptability or versatilityVSObject-affected harmful factors

Solution Approach 1:

Specific firmware volumes are extracted and separated from the main BIOS image. Non-essential or potentially vulnerable code (such as Preboot Configuration Utility, advanced diagnostics) is taken out as separate optional volumes that are not automatically loaded, reducing the attack surface while maintaining functionality when needed.

Inventive Principle:

Principle #2Taking out (Extraction)

Solution Approach 2:

Different firmware volumes have different security trust levels assigned. The system applies local quality control by verifying trust chains for each volume independently and selectively loading only those with appropriate trust levels for the current boot context, rather than treating all BIOS code uniformly.

Inventive Principle:

Principle #3Local quality

3Adaptability or versatility

If comprehensive BIOS features are included, then system capability is improved, but code storage space increases

Engineering Contradiction:

Improvesystem capabilityVSAvoidcode storage space

Core Design Contradiction:

Adaptability or versatilityVSQuantity of substance

Solution Approach 1:

The firmware volume structure provides a universal framework that can accommodate multiple functionalities in a standardized format. Each firmware volume serves multiple purposes: it can be part of different boot paths, support multiple trust chain verification modes, and be selectively loaded for different operational contexts, maximizing the utility of stored code.

Inventive Principle:

Principle #6Universality (Multi-functionality)

Data Source

PatentUS11281471B2Systems and methods for minimizing boot time and minimizing unauthorized access and attack surface in basic input/output system

Publication Date: 2022.03.22 DELL PROD LP

AI summary

An information handling system may include a processor and a basic input/output system communicatively coupled to the processor and comprising a plurality of firmware volumes embodied in non-transitory computer readable media, each firmware volume comprising executable code for a respective functionality of the basic input/output system, wherein the basic input/output system is configured to, based on the presence or absence of an action or event associated with the basic input/output system, select a boot path for execution from a plurality of boot paths, each of the plurality of boot paths comprising a respective trust chain of a subset of the plurality of firmware volumes and execute the boot path selected.