BIOS Module Signature Verification for Secure Boot
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Conventional systems without a TPM cannot immediately detect software alterations, allowing malicious alterations to go undetected until the BIOS or OS has operated, compromising security.
Innovation Solution
A multi-function peripheral with embedded controller and software modules that perform signature verification during activation, ensuring each module is authentic before proceeding, thereby detecting alterations in real-time and preventing insecure operation.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Device complexity
If verification processing for alteration is executed after activation of application completes in systems without TPM, then device complexity is reduced, but security reliability deteriorates because alterations cannot be detected immediately
Solution Approach 1:
The patent applies preliminary action by performing alteration verification processing immediately after BIOS activation and before application activation. The verification unit checks whether the BIOS has been altered before the application runs, ensuring that security verification occurs in advance rather than after application completion, thus preventing malicious alterations from executing.
2Reliability
If TPM is used to achieve immediate alteration detection during activation, then security reliability is improved, but device complexity increases due to additional hardware requirements
Solution Approach 1:
The patent extracts the verification function from the TPM hardware and implements it as a separate verification unit within the BIOS itself. This allows immediate alteration detection during activation without requiring external TPM hardware, as the verification capability is built into the BIOS structure with dedicated verification units that can autonomously check for alterations.
Solution Approach 2:
The BIOS is designed with multi-functionality, serving both as the system initialization program and as the alteration verification system. The verification unit within the BIOS performs both the standard BIOS functions and the additional security verification function, eliminating the need for separate dedicated hardware and reducing overall device complexity while maintaining security reliability.
3Ease of operation
If verification processing is performed after BIOS has operated to a certain degree, then ease of operation is improved, but security reliability deteriorates because altered applications can run
Solution Approach 1:
The patent performs verification processing as a preliminary action immediately after BIOS activation, before any applications are activated. This ensures that the system operates securely from the start by preventing altered applications from running, while still maintaining ease of operation through automated verification that does not require user intervention.
Data Source
Figure 1
Figure 2A
Figure 2B
AI summary
The present information processing apparatus sequentially activates a plurality of modules after the activation of a boot program. Each module uses verification information for verifying a signature of the module to be activated next to detect alteration of the module that is next to be activated, and activates the module to be activated next in a case where verification of the signature succeeds. Furthermore, each module holds in advance the verification information and its own signature.