Isolating Untrusted BIOS Components in Virtual Machines
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Firmware instructions, such as BIOS option ROMs, provided by external hardware devices pose a risk to computing device functionality due to potential malicious or harmful code, and existing trust enforcement methods like code review and digital signing require significant effort and may be circumvented.
Innovation Solution
Executing untrusted BIOS components in a low-privilege virtual machine managed by a trusted hypervisor, which isolates their execution and controls access to resources, reducing the risk of harm by limiting privileges and managing memory access.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If code review and digital signing are used to enforce trust in option ROMs, then security is improved, but the effort and complexity required increases significantly
Solution Approach 1:
The patent introduces a hypervisor as an intermediary layer between the option ROM and the host system. The hypervisor captures execution traces of the option ROM and compares them against expected behavior profiles, serving as a mediator that enforces security without requiring direct code review or digital signing verification by the system administrator.
Solution Approach 2:
The patent replaces manual code review and digital signing verification mechanisms with an automated trace-based verification system. Instead of mechanically reviewing code or verifying signatures, the system automatically captures execution traces and compares them against expected behavior, substituting manual security enforcement with automated behavioral analysis.
2Adaptability or versatility
If option ROMs are executed with full privileges, then functionality is improved, but the risk of harm from malicious code increases
Solution Approach 1:
The patent segments the execution environment by running option ROMs in isolated virtual machines rather than with full system privileges. Each option ROM executes in its own virtual machine instance, which is isolated from the host system and other option ROMs, allowing functionality to be maintained while limiting the impact of potential malicious code to only that specific virtual machine.
Solution Approach 2:
The hypervisor acts as an intermediary that manages the execution of option ROMs in virtual machines. It captures execution traces and verifies behavior against expected profiles, allowing option ROMs to execute with limited privileges in an isolated environment rather than with full system access, thus reducing harm risk while maintaining necessary functionality.
3Reliability
If untrusted BIOS components are executed in separate virtual machines, then system reliability is improved, but device complexity increases
Solution Approach 1:
The hypervisor serves multiple functions: it creates and manages virtual machines for untrusted option ROMs, captures execution traces, verifies behavior against expected profiles, and isolates harmful code. By consolidating these multiple security and management functions into a single hypervisor layer, the patent reduces overall system complexity compared to having separate mechanisms for each function.
Data Source
AI summary
An example non-transitory machine-readable medium includes instructions that cause a processor of a computing device to create a first virtual machine using a hypervisor, execute a trusted basic input/output system (BIOS) in the first virtual machine, create a second virtual machine using the hypervisor, and execute an untrusted BIOS component in the second virtual machine. The first virtual machine is executed with a greater privilege to access a resource of the computing device than the second virtual machine.