Secure BIOS Passthrough for NVMe Driver Authorization
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Conventional UEFI BIOS architectures provide global access to passthrough functionality, leading to security vulnerabilities as malicious drivers or applications can exploit this access to delete namespaces or perform unauthorized operations on NVMe/NVMe-oF storage devices.
Innovation Solution
Implementing a secure BIOS-enabled passthrough system that authenticates and authorizes BIOS drivers before allowing secondary access to computing device components, using a BIOS engine to manage access sessions and ensure only authorized drivers can perform administrator or security commands.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Adaptability or versatility
If global access to passthrough functionality is provided in conventional UEFI BIOS, then driver versatility and low-level control capability are improved, but system security deteriorates due to vulnerability to malicious drivers
Solution Approach 1:
The patent segments the previously global passthrough access into multiple authorized sessions, each with specific permissions. The BIOS engine divides access control into individual driver sessions, where each session is independently authorized based on driver identity and permissions, preventing malicious drivers from gaining global access while allowing legitimate drivers to function.
Solution Approach 2:
The BIOS engine acts as an intermediary between drivers and passthrough functionality. It mediates access by receiving session start requests from drivers, verifying their authorization, and managing their access permissions. This intermediary layer prevents direct global access while enabling controlled low-level operations for authorized drivers.
2Ease of operation
If passthrough protocols are published and available to all drivers, then ease of operation is improved, but security vulnerabilities increase due to potential exploitation by malicious applications
Solution Approach 1:
The patent applies local quality by providing different access permissions to different drivers based on their authorization status. Authorized drivers receive appropriate access rights for their specific functions, while unauthorized or malicious drivers are denied access. This localized permission approach maintains ease of operation for legitimate drivers while preventing security vulnerabilities.
3Reliability
If secondary access sessions are authenticated and authorized before granting passthrough access, then system security is improved, but device complexity increases due to additional authentication mechanisms
Solution Approach 1:
The BIOS engine performs self-service by automatically managing authentication and authorization for secondary access sessions. It autonomously receives session start requests, identifies drivers, determines authorization status, and grants or denies access without requiring external intervention. This self-service approach improves security while minimizing the complexity burden on external systems.
Data Source
AI summary
A secure Basic Input/Output System (BIOS)-enabled passthrough system includes a computing device having a computing device component, and a BIOS subsystem in the computing device that is coupled to the computing device component. The BIOS subsystem enables primary access to the computing device component to BIOS drivers. The BIOS subsystem may receive a secondary access session start request from a first BIOS driver to start a secondary access session to use secondary access to the computing device component, it retrieves a first BIOS driver identifier for the first BIOS driver based on the secondary access session start request, determines that the first BIOS driver identifier is a secondary-access-authorized BIOS driver identifier and, in response, begins the first secondary access session and may performs secondary access operation(s) on the computing device component in response to receiving secondary access command(s) from the first BIOS driver during the secondary access session.