Embedded Controller Firmware Recovery via Isolated Memory
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Malware attacks on system firmware used for startup in computing systems can compromise their integrity, leading to unauthorized access and operations, and existing recovery methods are labor-intensive, costly, and may not always have a valid external storage device available for recovery.
Innovation Solution
Implementing a secondary non-volatile memory that stores a 'golden copy' of system firmware, isolated from the processor, which can be used by an embedded controller to restore compromised firmware, reducing the risk of corruption during the restoration process and eliminating the need for external storage.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If system firmware is stored in non-volatile memory accessible by the processor, then the firmware can be executed to startup the computing system, but the firmware becomes vulnerable to malware attacks and compromise
Solution Approach 1:
The patent segments the firmware storage into two separate non-volatile memory devices: a first non-volatile memory device that stores the primary system firmware and a second non-volatile memory device that stores a protected copy of the firmware. This segmentation isolates the firmware into separate storage locations, allowing one to serve as a backup while the other is vulnerable, thereby addressing the vulnerability issue while maintaining executability.
Solution Approach 2:
The patent introduces an embedded controller as an intermediary component that manages the firmware storage and recovery process. The embedded controller is coupled to both non-volatile memory devices and contains execution logic to determine whether the firmware in the first memory device is compromised and to restore it from the second memory device if necessary. This intermediary provides a controlled mechanism for firmware protection and recovery without requiring external intervention.
2Ease of repair
If firmware recovery is performed using external storage devices, then compromised firmware can be restored, but the process becomes labor-intensive and requires external resources that may not be available
Solution Approach 1:
The patent implements preliminary action by pre-storing a copy of the system firmware in a second non-volatile memory device during the manufacturing or initialization phase. This protected copy is prepared in advance as a backup, so that when firmware compromise occurs during operation, the recovery process can immediately use the pre-stored copy without requiring external storage devices or manual intervention. The embedded controller's execution logic is also configured in advance to automatically detect compromise and initiate restoration from the pre-stored copy.
3Reliability
If a secondary non-volatile memory is added to store a protected firmware copy, then firmware recovery becomes possible without external storage, but the device complexity increases
Solution Approach 1:
The patent applies universality by designing the second non-volatile memory device to serve multiple functions: it acts as a protected storage location for the firmware copy, serves as a backup repository for recovery operations, and functions as part of the overall firmware integrity verification system through the embedded controller. This multi-functionality justifies the addition of the second memory device by providing comprehensive firmware protection and recovery capabilities within the system itself, eliminating the need for external storage devices.
Data Source
AI summary
In a state of a system in which a processor of the system is not accessing a first memory, a controller in the system determines whether system boot code from the first memory in the system is compromised, wherein the first memory is accessible by the processor and the controller over a bus. In response to determining that the system boot code is compromised, the controller retrieves system boot code from a second memory in the computing device to replace the system boot code in the first memory, where the second memory is electrically isolated from the bus and is inaccessible by the processor.