Embedded Controller NVMe Key Management for OS-Runtime BIOS Updates
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Existing BIOS components stored in NVMe memory cannot be updated at operating system (OS) runtime without rebooting the information handling system (IHS), limiting the dynamic and modular updates of firmware due to the use of Replay Protected Memory Block (RPMB) keys that are locked by the BIOS and cannot be unlocked at OS runtime.
Innovation Solution
Implementing a distributed BIOS with a root of trust mechanism using an embedded controller (EC) to manage firmware keys, allowing updates to BIOS components stored in NVMe memory during OS runtime without rebooting, by leveraging secure interfaces for integrity and security.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If RPMB keys are locked by the BIOS for security, then security is improved, but the ability to update firmware at OS runtime without rebooting deteriorates
Solution Approach 1:
The key management functionality is segmented into a dedicated Key Management Service (KMS) that operates independently from the BIOS. This service can be invoked at different system states (pre-boot and OS runtime), allowing firmware updates to proceed without requiring a full reboot while maintaining security through controlled key access.
Solution Approach 2:
A Key Management Service acts as an intermediary between the locked RPMB keys and the firmware update process. This service manages the keys securely and enables update operations at OS runtime by coordinating key access without requiring the keys to be unlocked in the traditional sense, thus resolving the conflict between security and update capability.
2Speed
If BIOS components are stored in NVMe memory, then storage capacity and speed are improved, but the ability to update firmware without rebooting deteriorates due to locked keys
Solution Approach 1:
The system dynamically adapts its key management approach based on the system state. At pre-boot, traditional BIOS key management is used. At OS runtime, the Key Management Service is invoked to enable dynamic firmware updates without requiring system reboot, thus eliminating the time loss associated with reboots while maintaining NVMe storage performance.
Solution Approach 2:
The Key Management Service is established and configured in advance during system initialization, preparing the key management infrastructure before firmware update operations are needed. This preliminary setup enables subsequent firmware updates to proceed without rebooting, capturing the time benefit before update operations are initiated.
3Reliability
If a traditional BIOS key management system is used, then security control is improved, but firmware update flexibility and modularity deteriorates
Solution Approach 1:
The Key Management Service provides universal key management capabilities that function across different system states (pre-boot and OS runtime) and different firmware update scenarios. This multi-functional service maintains the security control of traditional BIOS key management while adding the versatility to perform updates at any system state, thus resolving the contradiction between security control and update flexibility.
Data Source
AI summary
A firmware management operation. The firmware management operation includes providing an information handling system with a distributed BIOS, the distributed BIOS including a BIOS component and a BIOS variable; identifying a processor environment installed on an information handling system from a plurality of processor environments; performing a firmware key management operation, the firmware key management operation managing a key when performing a distributed firmware management operation.