BIOS SMM Firmware Verification for Secure OS Provisioning
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Conventional computing devices face security vulnerabilities in BIOS and TPM devices, leading to increased costs due to the need for separate security subsystems to defend against malicious attacks during operating system provisioning.
Innovation Solution
An Information Handling System (IHS) with a BIOS processing system and memory system that executes instructions to authenticate and verify BIOS firmware in System Management Mode (SMM), retrieve and store subsets of firmware, and provide an operating system to complete initialization operations securely.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If conventional physical BIOS and TPM devices are used for operating system provisioning, then initialization operations can be performed, but security vulnerabilities arise requiring separate security subsystems which increases device complexity and cost
Solution Approach 1:
The patent combines the BIOS initialization functions and TPM security functions into a single integrated BIOS device. The BIOS device contains both the initialization code execution capabilities and the security authentication capabilities (including TPM functionality) within one unified component, eliminating the need for separate physical TPM devices and reducing overall system complexity while maintaining security requirements
Solution Approach 2:
The BIOS device is designed to perform multiple functions: it executes initialization code during system boot, stores and verifies firmware images, performs security authentication of the runtime image, and provides TPM-like security services. This multi-functional design consolidates what were previously separate components into a single universal device that handles both initialization and security tasks
2Reliability
If separate security subsystems are added to defend against malicious attacks on BIOS and TPM devices, then security is improved, but device complexity and costs increase
Solution Approach 1:
The BIOS device performs self-authentication by verifying the runtime image against stored authentication data within its own integrated security subsystems. The device uses its built-in TPM functionality to authenticate itself and the firmware it loads, eliminating the need for external security validation mechanisms and reducing overall system complexity
Solution Approach 2:
The integrated BIOS device acts as an intermediary between the hardware and the operating system, providing a trusted execution environment that mediates all security-critical operations. By embedding the security subsystem within the BIOS device itself, it serves as a single point of trust that simplifies the security architecture compared to having separate, distributed security components
Data Source
AI summary
A secure operating system provisioning system includes a resource system having resource device(s), an SCP device, and a BIOS coupled to the resource device(s) and the SCP device. The BIOS begins initialization operations, retrieves a first subset of BIOS firmware, enters a first SMM and uses the first subset of BIOS firmware to authenticate the resource device(s) before exiting the first SMM. The BIOS then enters a second SMM in response to an SMI from the SCP device and verifies a runtime image stored in the SCP device, retrieves a second subset of the BIOS firmware from the runtime image, and stores the second subset of the BIOS firmware in the BIOS before exiting the second SMM. The BIOS then uses the second subset of the BIOS firmware to provide an operating system for the resource system to complete the initialization operations.