Manageability Hardware Access via Encoded Memory Map Registers
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Computing systems are vulnerable to Permanent Denial-of-Service (PDoS) attacks and OS attacks due to unauthorized access to manageability hardware components, which can lead to hardware damage and increased costs from hardware replacement and downtime.
Innovation Solution
Implementing an authenticated access mechanism where the boot firmware engine encodes memory map registers of manageability hardware components with a random key, locking the bus configuration space to prevent unauthorized access, and only allowing verified OS components to access these components by reprogramming the memory map registers with proper addresses.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Ease of operation
If the bus configuration space of manageability hardware components is made accessible to the OS for normal operation, then the ease of operation is improved, but the security against unauthorized access and PDoS attacks deteriorates
Solution Approach 1:
The patent segments the bus configuration space access by creating distinct encoded address spaces for different OS components. Each authenticated component receives a unique encoded address space, preventing any single component from accessing the entire configuration space and thereby limiting the impact of potential attacks while maintaining necessary access for authorized components.
Solution Approach 2:
The patent introduces an authentication mechanism as an intermediary between OS components and the bus configuration space. This intermediary verifies the integrity and authority of OS components before granting access, acting as a security gatekeeper that prevents unauthorized access while allowing legitimate components to communicate with manageability hardware.
2Object-affected harmful factors
If the memory map registers are encoded with a random key to prevent unauthorized access, then the security is improved, but the device complexity increases
Solution Approach 1:
The patent changes the parameter of address representation by encoding memory map registers with random keys. This transformation converts plain addresses into encoded forms that are meaningless to unauthorized components, providing security through parameter transformation rather than through complex access control lists or permission systems.
3Reliability
If the bus configuration space is locked to prevent unauthorized modifications, then the reliability is improved, but the ease of operation for legitimate components deteriorates
Solution Approach 1:
The patent implements a dynamic access control system where the bus configuration space encoding is adjusted based on the authentication status of OS components. Authorized components receive decoded access to specific encoded address spaces, while unauthorized components encounter locked or meaningless addresses. This dynamic approach maintains reliability by default while enabling operation for legitimate components through authentication.
Data Source
AI summary
Examples include an authenticated access to manageability hardware components in a computing device. Some examples enumerate manageability hardware components connected to an operative system kernel of the computing device, the manageability hardware components comprising a bus configuration space and the bus configuration space comprising memory map registers. Some examples include encoding an address stored in the memory map registers of each of the manageability hardware components to produce encoded address to control unauthorized accesses and locks the bus configuration space of each manageability hardware component by setting a read-only attribute to the bus configuration space. Some examples reprogram, in response to a request for access of an authenticated OS component to a manageability hardware component, the memory map register of the requested manageability hardware component with an accessible address to provide the authenticated OS component with access to the manageability hardware component.