Firmware Authentication via Digital Signature Hash Verification

Solution Overview

Problem

Information handling systems face security risks due to compromised firmware, which can lead to unauthorized access, data corruption, or denial of service, as existing authentication methods are inadequate in ensuring the integrity of firmware.

Innovation Solution

Implementing a digital signature authentication process using asymmetric encryption, where a hash value of the firmware is encrypted with a private key and decrypted with a public key to verify its authenticity before allowing the system to boot, thereby preventing unauthorized firmware from initiating the boot process.

Engineering Contradictions & Design Principles

VSEngineering Contradiction Analysis

1Reliability

If firmware authentication is implemented using digital signatures and asymmetric encryption, then firmware integrity and security are improved, but system complexity and authentication processing time increase

Engineering Contradiction:

Improvefirmware integrityVSAvoidauthentication system complexity

Core Design Contradiction:

ReliabilityVSDevice complexity

Solution Approach 1:

The patent applies preliminary action by pre-computing and storing the hash value of the firmware image in the authentication device before the firmware is actually loaded and executed. This allows the authentication mechanism to be prepared in advance, reducing real-time processing complexity during system boot while maintaining strong security verification capabilities.

Inventive Principle:

Principle #10Preliminary action

Solution Approach 2:

The patent introduces a hash value as an intermediary element that simplifies the authentication process. Instead of directly comparing entire firmware images or managing complex encryption key pairs during runtime, the system uses a computed hash value as a compact representative that can be efficiently stored and verified, reducing the computational and storage burden while maintaining integrity verification.

Inventive Principle:

Principle #24Intermediary (Mediator)

2Reliability

If firmware authentication is implemented using digital signatures and asymmetric encryption, then firmware integrity and security are improved, but authentication processing time increases

Engineering Contradiction:

Improvefirmware integrityVSAvoidauthentication processing time

Core Design Contradiction:

ReliabilityVSLoss of time

Solution Approach 1:

The patent applies preliminary action by pre-computing and storing the hash value of the firmware image in the authentication device before the firmware is actually loaded and executed. This allows the authentication mechanism to be prepared in advance, reducing real-time processing complexity during system boot while maintaining strong security verification capabilities.

Inventive Principle:

Principle #10Preliminary action

Solution Approach 2:

The patent uses a hash value as a compact copy or representation of the entire firmware image. This hash copy can be efficiently stored in limited memory resources and quickly compared during authentication, avoiding the need to process or store the complete firmware binary while maintaining verification integrity.

Inventive Principle:

Principle #26Copying

3Quantity of substance

If hash values are stored in limited memory resources of the authentication device, then memory usage is optimized, but security vulnerability increases if hash values are compromised

Engineering Contradiction:

Improvememory resource usageVSAvoidsecurity vulnerability

Core Design Contradiction:

Quantity of substanceVSObject-affected harmful factors

Solution Approach 1:

The patent uses a hash value as a compact copy or representation of the entire firmware image. This hash copy can be efficiently stored in limited memory resources and quickly compared during authentication, avoiding the need to process or store the complete firmware binary while maintaining verification integrity.

Inventive Principle:

Principle #26Copying

Solution Approach 2:

The patent transforms the firmware verification problem from comparing entire firmware images to comparing compact hash values. This parameter transformation changes the verification data from large binary firmware to small fixed-size hash representations, optimizing memory usage while maintaining security through cryptographic hash functions that are computationally infeasible to reverse or collide.

Inventive Principle:

Principle #35Parameter changes

Data Source

PatentUS12045351B2System and method of authenticating firmware

Publication Date: 2024.07.23 DELL PROD LP

AI summary

In one or more embodiments, one or more systems, one or more methods, and/or one or more processes may: receive firmware of an integrated circuit (IC) of an information handling system; receive a digital signature of the firmware, where the digital signature includes an encrypted hash value, encrypted with a private encryption key; determine a first hash value of the firmware; decrypt the encrypted hash value, via a public encryption key associated with the private encryption key, to obtain a second hash value; determine if the first hash value matches the second hash value; if so, permit the information handling system to boot an operating system; and if not, prevent, by the authentication device, the information handling system from booting the operating system.