BIOS Service Processor Secure Interface Key Segmentation
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Current information handling systems face security and performance issues due to the disabling of high-speed communication interfaces at runtime, which affects secure and efficient communication between the BIOS and the service processor, particularly during system events that require large data transfer.
Innovation Solution
Implementing a secure high-speed communication interface that generates a secret key for encryption and hash-based message authentication, allowing the interface to remain enabled after power-on self-test, using a symmetric key for encryption and a hash-based message authentication code key for verification, ensuring secure and efficient data transfer between the BIOS and the service processor.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If the high-speed communication interface is disabled at runtime to ensure security, then security is improved, but communication speed and efficiency between BIOS and service processor deteriorate
Solution Approach 1:
The secret key is segmented into two distinct parts: a symmetric key for encryption/decryption and a hash-based message authentication code (HMAC) key for verification. This segmentation allows the system to apply different cryptographic operations for different security purposes, enabling both secure communication and efficient verification over the high-speed interface.
Solution Approach 2:
Cryptographic primitives (symmetric key and HMAC key) are introduced as intermediaries to mediate communication between BIOS and service processor. These cryptographic mechanisms enable secure data transfer without requiring the interface to be disabled, thus maintaining both security and communication speed.
2Reliability
If encryption and verification mechanisms are implemented, then security is improved, but computational overhead and processing time increase
Solution Approach 1:
The system changes the cryptographic parameters by using a symmetric key for encryption/decryption and a separate HMAC key for verification. This parameter separation optimizes the cryptographic process by allowing parallel computation of encryption and verification operations, reducing overall processing time while maintaining strong security.
Solution Approach 2:
The secret key (including both symmetric and HMAC keys) is generated and exchanged during the power-on self-test phase before normal system operation begins. This preliminary action ensures that cryptographic materials are ready in advance, avoiding any processing delays during runtime operations.
Data Source
AI summary
An information handling system includes a BIOS and a service processor. The BIOS may generate, during a POST, a secret key that includes a symmetric key and a HMAC key and transmits the secret key to the service processor via an high-speed communication interface. After the POST, the BIOS transmits an SMI message that includes an encrypted message and a first hash value of the encrypted message. The encrypted message is encrypted using the symmetric key and the first hash value of the encrypted message is calculated using the HMAC key. The service processor calculate a second hash value of encrypted message based on the HMAC key and verify the encrypted message by comparing the first hash value and the second hash value. After a successful verification, the service processor decrypts the encrypted message and transmits a response to the BIOS.