BIOS Tamper Protection via Interrupt-Driven Digest Verification
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Existing methods for securing a computing system's BIOS struggle to balance accessibility for upgrades with protection against unauthorized tampering, as moving BIOS storage onto the microprocessor die complicates updates and encryption-based solutions degrade system performance.
Innovation Solution
A system that includes a BIOS ROM with plaintext content partitions and encrypted message digests, a partition selector, and a tamper detector, which generates interrupts at prescribed intervals or event occurrences to verify the integrity of BIOS content by comparing decrypted and encrypted message digests, allowing operation only if they match.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If BIOS storage is moved onto the microprocessor die to protect it from tampering, then security is improved, but ease of upgrade is completely defeated because the BIOS is no longer physically accessible
Solution Approach 1:
The BIOS is divided into multiple content partitions, each with its own message digest. This segmentation allows the system to verify integrity of individual partitions without requiring complete BIOS re-verification, enabling selective updates while maintaining security.
Solution Approach 2:
The message digest verification mechanism extracts the essential security function from the entire BIOS content. By storing and verifying only the message digests rather than the complete BIOS, the system achieves tamper protection while allowing the BIOS to be updated through standard accessible methods.
2Reliability
If encryption is applied to BIOS contents to protect against tampering, then security is improved, but system performance is degraded due to the unacceptable number of decryption operations required each time BIOS is used
Solution Approach 1:
The patent extracts only the message digest (a small cryptographic hash) from the entire BIOS content for verification purposes. This extracted digest is what gets encrypted and stored, not the complete BIOS. During operation, only this small digest needs to be decrypted and verified, not the entire BIOS content, thus maintaining security while preserving system performance.
Solution Approach 2:
Instead of encrypting and verifying the entire BIOS content, the patent applies encryption only to the message digest portion. This partial action approach provides sufficient security protection while avoiding the performance penalty of decrypting large amounts of data during normal system operation.
3Reliability
If complete BIOS encryption is implemented to ensure security, then tamper protection is improved, but the complexity of BIOS verification and update operations increases significantly
Solution Approach 1:
The patent extracts the message digest from the BIOS content and applies encryption only to this extracted component. The verification process then only needs to compare the decrypted message digest against the stored encrypted version, dramatically simplifying the verification complexity compared to encrypting and verifying entire BIOS content.
Solution Approach 2:
The patent changes the parameter being protected from the entire BIOS content to just the message digest. This parameter change reduces the data size and complexity of encryption/decryption operations from megabytes to bytes, making the security mechanism practical for system implementation.
Data Source
AI summary
An apparatus including a ROM, a selector, and a detector. The ROM has partitions stored as plaintext, and encrypted digests, each comprising an encrypted version of a first digest associated with a corresponding one of the partitions. The selector selects one or more partitions responsive to an interrupt. The detector generates the interrupt at a combination of intervals and event occurrences, and accesses the one or more partitions and corresponding one or more encrypted digests upon assertion of the interrupt, and directs generation of one or more second digests corresponding to the one or more partitions and one or more decrypted digests corresponding to the one or more encrypted digests using the same algorithms and key used to generate the first digest and encrypted digests, and compares the second digests with the decrypted digests, and precludes the operation if the second digests and the decrypted digests are not pair wise equal.