BIOS UEFI Hard Disk Authentication via Signed Identifier
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Automated Teller Machines (ATMs) are vulnerable to malware and eavesdropping due to their reliance on hard disks for booting, which can also fail or lack storage capacity, posing security risks during hard disk replacement.
Innovation Solution
Implementing a BIOS authentication method that verifies a signed identifier for the hard disk during boot, using a public-private key pair to ensure only authorized hard disks can boot the system, preventing unauthorized firmware or OS from loading.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If hard disk replacement is performed to address failure or capacity issues, then system reliability and functionality are improved, but security risks increase due to potential unauthorized access or malicious firmware installation
Solution Approach 1:
The system performs preliminary authentication of the hard disk before allowing the boot process to continue. A signed identifier is obtained from the hard disk during boot, and the system determines whether to proceed with boot processing based on verification of this identifier. This preliminary security check prevents unauthorized hard disks from being used, thereby addressing security risks while allowing legitimate hard disk replacements to improve reliability.
2Adaptability or versatility
If hard disk is used for booting to provide OS, then system functionality is maintained, but vulnerability to malware and eavesdropping increases
Solution Approach 1:
The signed identifier acts as an intermediary between the hard disk and the boot process. Instead of directly trusting the hard disk to provide legitimate OS, the system uses the signed identifier as a mediator to verify the hard disk's authenticity. This intermediary mechanism allows the system to maintain boot functionality from hard disk while protecting against malware, as the signed identifier provides a layer of verification that the hard disk contains authorized software.
3Ease of repair
If traditional hard disk replacement process is used, then hardware maintenance is achieved, but security procedures become complex requiring physical visits and password exchanges
Solution Approach 1:
The hard disk contains a signed identifier that enables self-verification during the boot process. When a hard disk is replaced, the new hard disk automatically provides its signed identifier, and the system autonomously determines whether to proceed with boot processing. This self-service mechanism eliminates the need for complex security procedures such as physical visits or password exchanges, thereby simplifying the repair process while maintaining security.
Data Source
AI summary
A Basic Input/Output System (BIOS)/Unified Extensible Firmware Interface (UEFI) on a Self-Service Terminal (SST) processes during a boot of the SST. When a new hard disk is detected as being present and an identifier for the new hard disk is missing from a whitelist, a signed hard disk identifier is verified from storage on the new hard disk. If the signed hard disk identifier is verified: the new hard disk is authenticated, the whitelist is updated to include the new hard disk identifier, a unique identifier for BIOS/UEFI and the new hard disk identifier are written to the storage of the new hard disk, and the boot process is permitted to continue for the SST.