BIOS Runtime Verification via External Hardware and TEE
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Current BIOS verification methods lack robust runtime integrity verification, making them vulnerable to security threats and integrity breaches, especially during the boot process.
Innovation Solution
A computing system that employs a secure verification software and an external hardware component to generate and verify integrity information of the BIOS at runtime using digital signatures and cryptographic keys, ensuring secure communication and validation without real-time memory access.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If traditional BIOS verification methods are used, then the system can boot and operate, but runtime integrity verification is insufficient making the system vulnerable to security threats
Solution Approach 1:
The patent implements preliminary integrity verification by computing cryptographic hashes of BIOS code sections before they are executed. The verification mechanism is established in advance through registration of BIOS sections with the TEE, which stores expected hash values. This preliminary action ensures that any integrity violations are detected before they can compromise system security.
Solution Approach 2:
The patent introduces a Trusted Execution Environment (TEE) as an intermediary component between the BIOS and the rest of the system. The TEE acts as a secure mediator that verifies BIOS integrity through cryptographic operations and communicates verification results to the system management mode. This intermediary provides a trusted layer that isolates the verification logic from potential attacks.
2Reliability
If comprehensive runtime verification is implemented, then security is enhanced, but system complexity increases
Solution Approach 1:
The patent divides the BIOS into multiple registerable sections, each with its own integrity verification. This segmentation allows the verification system to focus on specific code segments rather than treating the entire BIOS as a monolithic unit. The TEE maintains separate hash values for each section, enabling granular verification that reduces the computational burden compared to verifying the entire BIOS at once.
Solution Approach 2:
The patent creates a universal verification mechanism that operates across different BIOS sections and system states. The TEE-based verification system serves multiple functions: it verifies BIOS integrity during boot, monitors runtime modifications, and provides a standardized interface for integrity checking. This multi-functional approach consolidates what would otherwise require multiple separate verification systems.
3Reliability
If external hardware component is used for verification, then verification robustness is improved, but communication requirements increase
Solution Approach 1:
The patent uses the TEE as an intermediary that handles the complex cryptographic communication between the external verification hardware and the BIOS. The TEE manages key storage, performs hash computations, and communicates verification results through standardized interfaces. This intermediary approach shields the external hardware from the complexity of direct communication with the BIOS while maintaining robust verification capabilities.
Data Source
Figure 1
Figure 2
Figure 3
AI summary
Examples herein disclose a processor-based computing system. The system comprises at least one processor, a non-volatile memory comprising a basic input output system (BIOS), wherein the BIOS creates a data structure and sets up at least one verification software component executed by the processor, a controller communicatively linked to the at least one verification software component, and a memory comprising a system management memory coupled to the at least one processor and code which is executable by the processor-based system to cause the processor to validate the BIOS during a runtime of the processor-based system using the at least one verification software component and the controller