Secured Boot Secrets Protection During OS Reboot
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
The incompatibility between Secure Boot and in-place operating system update mechanisms leads to a loss of security assurances when updating an operating system, forcing system administrators to choose between using Secure Boot and in-place updates, compromising the integrity of boot secrets.
Innovation Solution
A secured memory environment is used to store boot secrets, which are inaccessible to the operating system, allowing a new operating system to attest its integrity and provide security measurements during the boot process without compromising the secrets, even during in-place updates.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If Secure Boot is used to ensure system security, then security assurances are improved, but in-place operating system updates cannot be performed
Solution Approach 1:
The system separates boot secrets from the operating system by storing them in a protected memory region inaccessible to the OS. This segmentation allows the OS to be updated in-place while the secrets remain secure and intact, resolving the contradiction between Secure Boot security requirements and update capability.
Solution Approach 2:
A protected memory region acts as an intermediary between the Secure Boot process and the operating system. This intermediary stores secrets securely while allowing the OS to be updated without compromising secret integrity, enabling both security assurances and in-place updates.
2Reliability
If a full system reboot is performed to update the operating system, then security integrity is maintained, but system disruption increases
Solution Approach 1:
Boot secrets are preserved in a protected memory region before the operating system update occurs. This preliminary preservation of secrets enables the system to perform in-place updates without requiring a full reboot, reducing system disruption while maintaining security integrity through the protected secret storage.
3Ease of operation
If boot secrets are stored in accessible memory for OS use, then OS functionality is improved, but secret security deteriorates during updates
Solution Approach 1:
Memory is segmented into protected and accessible regions. Boot secrets are stored in the protected region that is inaccessible to the operating system, while the OS can still function normally by receiving necessary information through secure interfaces. This segmentation maintains both secret security and OS functionality during in-place updates.
Solution Approach 2:
Different memory regions have different access qualities - the protected region has restricted access for secret storage, while other regions have full access for OS operations. This local quality differentiation allows boot secrets to remain secure while the operating system maintains full functionality.
Data Source
AI summary
Protecting secured boot secrets while starting an operating system. Embodiments include identifying that a second operating system is to be started to replace a first operating system, and loading code of the second operating system in a protected portion of the system memory. The protected portion of the system memory is then unprotected, and processor state is set to initiate execution of the code of the second operating system, while using one or more secured boot secrets that were stored in the protected portion of the system memory by the first operation system to attest a security status of the second operating system. The portion of the system the memory is re-protected, including preventing access to the portion of the system memory by the second operating system.