BIOS PCR Value Preview to Prevent Attestation Lockouts

Resolve Bottlenecks,
Find Innovative SolutionsGenerate Solutions

Solution Overview

Problem

In information handling systems, changes to BIOS settings can result in changes to PCR values, leading to platform attestation failures and prevention of system access, as the changes are not made visible to users before being written to the TPM, causing undesirable lockouts.

Innovation Solution

The BIOS firmware generates a first PCR value indicative of current BIOS settings and displays an alert to users when changes occur, allowing them to revert settings and prevent attestation failures by accessing a mapping of BIOS settings to PCR values, and sends alerts to network administrators.

Engineering Contradictions & Design Principles

VSEngineering Contradiction Analysis

1Adaptability or versatility

If BIOS settings are changed without user awareness, then platform configuration can be updated, but system access is prevented due to attestation failures

Engineering Contradiction:

ImproveBIOS settings update capabilityVSAvoidsystem access

Core Design Contradiction:

Adaptability or versatilityVSEase of operation

Solution Approach 1:

The BIOS firmware calculates the PCR value in advance before writing it to the TPM, and displays it to the user for review. This preliminary calculation and display action allows users to verify the configuration changes before they take effect, preventing unexpected lockouts while still enabling necessary BIOS updates.

Inventive Principle:

Principle #10Preliminary action

2Device complexity

If PCR changes are made transparently, then BIOS configuration is simplified, but users cannot detect potential security issues

Engineering Contradiction:

ImproveBIOS configuration processVSAvoidPCR change visibility

Core Design Contradiction:

Device complexityVSLoss of information

Solution Approach 1:

The BIOS firmware provides feedback to the user by displaying the calculated PCR value before writing it to the TPM. This feedback mechanism informs users about the configuration changes and their impact on platform attestation, enabling informed decision-making while maintaining a relatively simple BIOS configuration process.

Inventive Principle:

Principle #23Feedback

3Productivity

If automatic PCR writing is implemented, then BIOS settings are applied immediately, but administrators cannot review changes before they take effect

Engineering Contradiction:

ImproveBIOS settings application speedVSAvoidattestation failure prevention

Core Design Contradiction:

ProductivityVSReliability

Solution Approach 1:

The calculated PCR value serves as an intermediary between the BIOS settings and the TPM. Instead of directly writing to the TPM without review, the PCR value is first presented to the user as an intermediate step, allowing review and verification before the final commit, thus balancing speed and reliability.

Inventive Principle:

Principle #24Intermediary (Mediator)

Data Source

PatentUS9851985B2Platform configuration management using a basic input/output system (BIOS)

Publication Date: 2017.12.26 DELL PROD LP

AI summary

Methods and systems for platform configuration management may use a platform configuration register (PCR) stored on a trusted platform module (TPM) included with an information handling system. A basic input/output system (BIOS) may include instructions to generate a first PCR value based on BIOS settings while a user is operating the BIOS. When the first PCR value indicates a change from a previous PCR value stored in the PCR, an alert may be displayed to the user and sent to a network administrator. The BIOS may display an indication of a mapping of BIOS settings to the first PCR value.