BIOS ROM Tamper Detection via Randomized Check Intervals
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Existing methods for securing a Basic Input/Output System (BIOS) in computing systems face challenges in balancing accessibility for upgrades with the need to protect against unauthorized tampering, as moving BIOS storage onto the microprocessor die complicates upgrades and encryption methods degrade system performance.
Innovation Solution
A technique involving a BIOS ROM with plaintext contents and an encrypted message digest, combined with a tamper detection mechanism using a microprocessor, JTAG control chain, and a fuse to randomly vary check intervals and disable unauthorized access, ensuring the BIOS remains secure without degrading system performance.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If BIOS storage is moved onto the microprocessor die, then protection from tampering is improved, but ease of upgrade deteriorates
Solution Approach 1:
The invention separates BIOS storage into two locations: a secure, tamper-proof location (microprocessor die or ROM) for the actual BIOS contents, and a separate, accessible location (EPROM or EEPROM) for storing an encrypted digest. This segmentation allows the BIOS to remain protected while enabling easy upgrades through digest replacement without requiring physical access to the microprocessor die.
2Reliability
If encryption of BIOS contents is applied, then protection from tampering is improved, but system performance deteriorates
Solution Approach 1:
The invention extracts only the essential security verification element (the digest) and encrypts it, rather than encrypting the entire BIOS contents. This extraction approach minimizes the amount of data requiring decryption operations, thereby maintaining system performance while still providing cryptographic protection against tampering.
Solution Approach 2:
Instead of applying full encryption to all BIOS contents (excessive action), the invention applies encryption only to the digest portion (partial action). This selective encryption provides sufficient security protection while avoiding the performance degradation that would result from decrypting large amounts of BIOS data during system operation.
3Ease of operation
If JTAG access is enabled for programming, then ease of upgrade is improved, but vulnerability to unauthorized tampering increases
Solution Approach 1:
The invention implements a fuse mechanism that is blown during legitimate manufacturing or authorized upgrade processes. This preliminary action permanently disables further JTAG access, preventing any subsequent unauthorized tampering attempts while having already accomplished the necessary programming or upgrade operations.
Solution Approach 2:
The invention converts the potential harm of JTAG access (unauthorized tampering) into a benefit by using the same JTAG interface for legitimate programming purposes, then permanently disabling it through fuse blowing. The JTAG interface serves its useful purpose during authorized operations, and its subsequent disablement prevents harmful unauthorized access.
Data Source
Figure 1~2
Figure 3
Figure 4
AI summary
An apparatus is provided for protecting a basic input/output system (BIOS) in a computing system. The apparatus includes a BIOS read only memory (ROM), a tamper detector, a random number generator, a JTAG control chain, a fuse, and an access controller. The BIOS ROM includes BIOS contents stored as plaintext, and an encrypted message digest, where the encrypted message digest has an encrypted version of a first message digest that corresponds to the BIOS contents. The tamper detector is operatively coupled to the BIOS ROM, and is configured to generate a BIOS check interrupt at a combination of prescribed intervals and event occurrences, and is configured to access the BIOS contents and the encrypted message digest upon assertion of the BIOS check interrupt, and is configured to direct a microprocessor to generate a second message digest corresponding to the BIOS contents and a decrypted message digest corresponding to the encrypted message digest, and is configured to compare the second message digest with the decrypted message digest, and is configured to preclude the operation of the microprocessor if the second message digest and the decrypted message digest are not equal. The random number generator disposed within the microprocessor, and generates a random number at completion of a current BIOS check, which is employed to set a following prescribed interval, whereby the prescribed intervals are randomly varied. The JTAG control chain is configured to program the combination of prescribed intervals and event occurrences within tamper detection microcode storage. The fuse is configured to indicate whether programming of the combination of prescribed intervals and event occurrences is to be disabled. The access control element is coupled to the fuse and the JTAG control chain, and is configured to determine a state of the fuse, and is configured to direct the JTAG control chain to disable programming of the combination of prescribed intervals and event occurrences if the fuse is blown.