Embedded Hash Firmware Validation in Information Handling Systems
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Information handling systems face security vulnerabilities as they do not effectively detect tampering with firmware images during reboots, as existing update utilities strip signatures, leading to potential execution of corrupted or malicious firmware without verification.
Innovation Solution
A method and system for validating firmware images using an embedded hash, where a first hash is extracted from the image and replaced with an original data string to generate a second image for comparison, allowing for ongoing signature validation without modifying the update utility.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Ease of operation
If the signature is stripped from the firmware image during update, then the update utility can seamlessly store and execute the firmware, but the system loses the ability to verify firmware integrity on subsequent reboots
Solution Approach 1:
The patent extracts the verification function from the update utility itself and embeds it directly into the firmware image as a hash value. By taking out the signature verification capability and embedding it within the image, the system maintains verification ability without requiring the external update utility to retain or re-verify the signature during execution.
Solution Approach 2:
The firmware image performs self-verification by containing its own hash value embedded within it. During execution, the system extracts the embedded hash from the image and compares it against a independently calculated hash of the same image, allowing the firmware to verify its own integrity without external assistance from the update utility.
2Reliability
If the signature is retained in the firmware image, then firmware integrity can be verified on subsequent reboots, but the update utility cannot seamlessly store and execute the firmware
Solution Approach 1:
The patent extracts only the essential verification data (the hash of the original firmware) and embeds it within the image, rather than retaining the complete signature structure. This extraction allows the verification functionality to be preserved while removing the elements that would interfere with seamless update utility operation.
3Reliability
If the embedded hash verification is implemented, then continuous firmware validation is achieved, but the system complexity increases due to additional verification steps
Solution Approach 1:
The patent merges the verification data (hash value) directly into the firmware image structure itself. By combining the original firmware data with its verification hash in a single integrated image, the system eliminates the need for separate storage and management of signature files, thereby reducing overall system complexity despite adding verification capability.
Solution Approach 2:
The embedded hash verification mechanism is self-contained within the firmware image, requiring no external verification utilities or additional system components. The image carries its own verification data and performs self-checking, which simplifies the overall system architecture by eliminating dependency on external verification infrastructure.
Data Source
AI summary
A method, an information handling system (IHS) and a validation system for validating an image using an embedded hash. The method includes retrieving, via a controller, a first image from a first memory device and extracting a first hash from a first location within the first image. The first hash was previously generated using an original set of data that includes a first data string, and the first image includes the first hash inserted into the first location to replace the first data string. The method includes retrieving a copy of the first data string. The method further includes generating a second image by inserting the first data string into the first location from which the first hash was extracted such that the second image contains the original set of data. The method further includes validating the first image using the first hash and the second image.