Dual Boot Flash BIOS Protection Against Firmware Corruption

Resolve Bottlenecks,
Find Innovative SolutionsGenerate Solutions

Solution Overview

Problem

Computing devices are vulnerable to BIOS firmware corruption due to malicious operating systems that can overwrite boot flash memory, leading to downtime and potential security risks, especially when relying on a single 'golden' BIOS version.

Innovation Solution

Implementing a dual-boot flash device system where one device is active and locked, while the other is in standby with unlocked partitions for BIOS upgrades, allowing authentication and validation of new BIOS images before switching, thus preventing downgrade attacks and reducing downtime.

Engineering Contradictions & Design Principles

VSEngineering Contradiction Analysis

1Reliability

If a single 'golden' BIOS version is stored in boot flash memory, then the system has simple firmware management, but the system becomes vulnerable to malicious overwriting and corruption

Engineering Contradiction:

ImproveBIOS securityVSAvoidfirmware management

Core Design Contradiction:

ReliabilityVSDevice complexity

Solution Approach 1:

The patent divides the boot flash memory into multiple partitions: a first partition for storing the active BIOS image and a second partition for storing the standby BIOS image. This segmentation allows the system to maintain both a current and a backup BIOS version simultaneously, enabling recovery from corruption while keeping firmware management structured and controlled.

Inventive Principle:

Principle #1Segmentation

Solution Approach 2:

The patent implements preliminary actions by storing authentication signatures in protected regions before BIOS updates occur. The signature verification mechanism is pre-configured in the standby partition, allowing the system to validate new BIOS images before they become active, preventing malicious overwriting before it can compromise system security.

Inventive Principle:

Principle #10Preliminary action

2Productivity

If the operating system can directly overwrite boot flash memory, then BIOS updates can be performed quickly, but the system becomes vulnerable to malicious compromise

Engineering Contradiction:

ImproveBIOS update speedVSAvoidmalicious overwriting

Core Design Contradiction:

ProductivityVSObject-affected harmful factors

Solution Approach 1:

The patent introduces an intermediary authentication mechanism that mediates between the operating system and the boot flash memory. The BIOS bootloader acts as an intermediary that verifies authentication signatures before allowing any BIOS image to be executed, preventing direct malicious overwriting while still enabling legitimate rapid updates through the controlled update process.

Inventive Principle:

Principle #24Intermediary (Mediator)

Solution Approach 2:

The patent implements preliminary anti-action by pre-storing authentication signatures and configuring the bootloader to verify these signatures before executing any BIOS image. This pre-configured security measure prevents malicious overwriting by blocking unauthorized BIOS images before they can compromise the system, while allowing legitimate updates to proceed.

Inventive Principle:

Principle #9Preliminary anti-action

3Reliability

If multiple BIOS versions are stored for backup, then system recovery is possible, but the system becomes vulnerable to downgrade attacks

Engineering Contradiction:

Improvesystem recoveryVSAvoiddowngrade attacks

Core Design Contradiction:

ReliabilityVSObject-affected harmful factors

Solution Approach 1:

The patent implements feedback by having the bootloader continuously verify authentication signatures of the loaded BIOS image against the stored signature in the protected region. This verification feedback mechanism ensures that only authenticated BIOS versions can be executed, preventing downgrade attacks while maintaining the ability to recover from failures by loading authenticated backup versions.

Inventive Principle:

Principle #23Feedback

4Reliability

If protected range registers are used to prevent OS access to BIOS region, then BIOS security is improved, but update flexibility is reduced

Engineering Contradiction:

ImproveBIOS protectionVSAvoidupdate flexibility

Core Design Contradiction:

ReliabilityVSAdaptability or versatility

Solution Approach 1:

The patent implements dynamics by making the protection status of boot flash partitions changeable based on the update phase. During normal operation, the first partition is protected from OS access. During authorized update operations, the system dynamically switches to the second partition which is configured to accept updates, providing both security and update flexibility without requiring permanent changes to access control.

Inventive Principle:

Principle #15Dynamics

Data Source

PatentUS11436333B2Bios/bootloader protection

Publication Date: 2022.09.06 CISCO TECHNOLOGY INC

AI summary

Presented herein are methodologies for securing BIOS/bootloader function including booting a computer system from a BIOS image stored in a first boot flash device, detecting an indication of a pending BIOS upgrade, in response to detecting the indication of a pending BIOS upgrade, accessing an upgraded BIOS image stored on a second boot flash device, validating a version of the upgraded BIOS image, authenticating the upgraded BIOS image using a signature stored in a first region of the second boot flash device, when the version of the upgraded BIOS image is validated, and the upgraded BIOS image is authenticated, writing the signature to a second region of the second boot flash device that is different from the first region, locking the second region of the second boot flash device, and rebooting the computer system from the second boot flash device.