Management Controller BIOS Integrity Verification
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Existing information handling systems lack effective integrity enforcement after BIOS code is loaded into system memory, making them vulnerable to attacks like buffer overflow and race conditions during the boot process.
Innovation Solution
A management controller is used to verify the integrity of BIOS firmware and driver integrity tables using public and private keys, ensuring secure execution by performing power sequencing only if integrity is verified, and continuously monitoring for security breaches during the boot process.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If BIOS code is loaded into system memory for execution, then the boot process can proceed, but the BIOS code becomes vulnerable to modification and attacks
Solution Approach 1:
The patent applies preliminary action by computing and storing hash values of BIOS code segments in a table stored in flash memory before the BIOS code is loaded into system memory. This pre-computed integrity reference allows the management controller to verify the loaded code against the stored hash, detecting any modifications or attacks that occur after loading.
Solution Approach 2:
The patent introduces a management controller as an intermediary component that independently verifies BIOS code integrity. The management controller uses stored hash values to check the loaded BIOS code, acting as a security mediator between the BIOS loading process and the CPU execution, thereby preventing unauthorized code execution without interfering with normal boot operations.
2Ease of manufacture
If traditional BIOS security mechanisms are used, then flash storage protection is enforced, but no integrity enforcement exists after BIOS is loaded to memory
Solution Approach 1:
The patent segments the BIOS code into multiple executable segments and computes individual hash values for each segment. The driver integrity table stores hash values for each segment separately, allowing granular verification of specific code portions. This segmentation enables targeted integrity checking without requiring verification of the entire BIOS image at once.
Solution Approach 2:
The system implements self-service security by having the BIOS code itself provide the means for its own verification. The hash values are stored within the BIOS image in flash memory, and the management controller uses these self-provided references to verify integrity, eliminating the need for external security hardware or complex verification protocols.
Data Source
AI summary
A method may include a management controller verifying integrity of firmware of the management controller using a public key and verifying integrity of a driver integrity table using the public key, wherein the driver integrity table sets forth a plurality of entries, each entry comprising identifying information for an executable module of the BIOS and a hash of executable code of such executable module signed by a private key, wherein the driver integrity table is signed by the private key and wherein the private key is associated with the public key. The method may further include performing, by the management controller, power sequencing of the information handling system to begin execution of the BIOS if integrity of the firmware and integrity of the driver integrity table are verified.