BIOS Security Agent for OS Application Boot Verification
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Existing security measures for information handling systems are insufficient in protecting operating system applications launched after the trusted boot process, as they fail to detect and prevent malicious attacks in pre-operating system environments such as custom shells.
Innovation Solution
Implementing a security agent within the Basic Input/Output System (BIOS) that extracts a list of files and their signatures from a boot manifest, verifies them against stored signatures, and aborts the boot process if verification fails, ensuring the integrity of the operating system and applications.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If traditional hardware security methods (UEFI verification, secure boot) are used to detect and prevent boot issues, then boot process security is improved, but security against malicious attacks in pre-operating system environments (custom shells, launcher applications) deteriorates
Solution Approach 1:
The patent implements signature verification of custom shell and launcher application files before they are executed during the boot process. The security agent retrieves expected signatures from a secure database and compares them against actual file signatures, preventing malicious code from executing even if it bypasses traditional UEFI secure boot mechanisms.
Solution Approach 2:
The patent introduces a security agent as an intermediary component between the boot process and custom shell/launcher applications. This security agent acts as a mediator that verifies file integrity through signature comparison, blocking malicious applications before they can compromise the system while allowing legitimate applications to execute.
2Reliability
If signature verification is performed on all boot process files, then security against malicious code is improved, but boot process complexity and execution time deteriorate
Solution Approach 1:
The patent applies signature verification selectively to specific high-risk files (custom shell and launcher applications) rather than all boot process files. This partial verification approach focuses security efforts on the most vulnerable components where malicious code is most likely to be introduced, reducing overall verification complexity while maintaining strong security.
Solution Approach 2:
The security agent automatically retrieves file signatures from a secure database, computes signatures of actual files, and performs verification without requiring manual intervention. The system self-manages the verification process, reducing operational complexity while maintaining comprehensive security checks on critical boot files.
Data Source
AI summary
An information handling system may include a processor and a basic input/output system communicatively coupled to the processor and embodied by executable instructions embodied in non-transitory computer readable media, the instructions configured to, when executed by the processor: extract from a boot manifest a list of files associated with operating system applications of the information handling system and respective signatures for each of the files; locate the files listed in the boot manifest on a partition of a storage resource accessible to the processor; attempt to verify signatures for each of the files as stored on the storage resource against their respective signatures set forth in the boot manifest; enable execution of a boot loader for the operating system and the operating system applications in response to successful verification of the signatures; and abort a boot process of the information handling system in response to unsuccessful verification of the signatures.