BIOS Runtime Authentication for EFI System Partition Access
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Current information handling systems lack a standardized and secure mechanism for accessing the EFI System Partition (ESP), making them vulnerable to malicious code injection and compromising system security, even with SecureBoot features.
Innovation Solution
Implementing a BIOS with runtime services that authenticate and manage input/output requests to the system partition, using a protected access module and authenticated system partition access services to ensure secure access and prevent unauthorized access during both runtime and pre-boot modes.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Ease of operation
If operating systems are allowed to directly access the EFI System Partition (ESP), then ease of operation is improved, but system security deteriorates due to vulnerability to malicious code injection
Solution Approach 1:
The patent introduces a BIOS-mediated authentication layer as an intermediary between the operating system and the EFI System Partition. The BIOS runtime services authenticate I/O requests before granting access to the ESP, preventing direct unauthenticated access. This mediator verifies the legitimacy of access requests and blocks malicious code injection attempts while maintaining legitimate system operations.
2Object-affected harmful factors
If SecureBoot is implemented, then system security is improved, but security reliability deteriorates because SecureBoot is not guaranteed to run in operating system space across all operating systems
Solution Approach 1:
The patent implements authentication of I/O requests to the ESP before the operating system gains full control, during the BIOS runtime phase. This preliminary authentication action occurs prior to potential security vulnerabilities in the operating system space, ensuring that only authenticated requests can access the ESP regardless of which operating system is loaded or whether SecureBoot is active.
3Adaptability or versatility
If multiple access mechanisms are provided for different operating systems, then adaptability is improved, but device complexity increases due to lack of industry standard
Solution Approach 1:
The patent implements a universal BIOS-mediated authentication interface that works across different operating systems. Instead of providing separate access mechanisms for each OS, the system uses a single standardized authentication protocol through BIOS runtime services that all operating systems must go through to access the ESP, simplifying the access mechanism while maintaining broad compatibility.
Data Source
AI summary
In accordance with embodiments of the present disclosure, an information handling system may include a processor, a storage resource communicatively coupled to the processor, and a basic input/output system (BIOS) comprising a program of instructions executable by the processor and configured to cause the processor to initialize one or more information handling resources of the information handling system. The BIOS may be further configured to, during runtime of an operating system, receive an input/output request from the operating system to access a system partition instantiated on the storage resource, authenticate the input/output request, and responsive to authenticating the input/output request, provide a runtime service of the BIOS to complete the input/output request to the system partition.