I/O Trap Protocol for Secured UEFI Hardware Access
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Conventional UEFI BIOS implementations lack a secure authentication method to prevent unauthorized drivers from accessing I/O ports, leading to potential downtime and the need for physical motherboard replacement.
Innovation Solution
An I/O trap protocol is installed during the system management mode (SMM) phase of the UEFI boot sequence, which provides an authentication callback function to handle I/O trap events, determining whether the access is from an approved driver and restoring original data if not, thereby preventing unauthorized modifications.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Adaptability or versatility
If CMOS registers and I/O addresses are made accessible to drivers during pre-boot and runtime, then driver functionality and system flexibility are improved, but security vulnerabilities increase allowing unauthorized modules to modify data
Solution Approach 1:
The patent introduces an intermediary authentication mechanism between drivers and CMOS registers. The authentication callback function acts as a mediator that verifies driver authorization before allowing access to I/O addresses, thus maintaining driver functionality while preventing unauthorized modifications to critical data
Solution Approach 2:
The patent implements preliminary authentication action by checking driver authorization status before allowing any I/O access. The authentication callback function is invoked in advance to verify whether a driver is authorized to access specific I/O addresses, preventing unauthorized access before it can occur
2Adaptability or versatility
If I/O addresses are made read/write accessible to all drivers, then system flexibility is improved, but system stability deteriorates due to unauthorized modifications requiring physical motherboard replacement
Solution Approach 1:
The authentication callback function serves as a mediator between drivers and I/O addresses. It maintains system flexibility by allowing authorized drivers to access I/O addresses while protecting system stability by blocking unauthorized access that could cause crashes requiring physical motherboard replacement
Solution Approach 2:
The patent applies preliminary anti-action by implementing an authentication check before allowing I/O access. This preventive measure stops unauthorized modifications before they can occur, avoiding system instability and the need for physical motherboard replacement
3Reliability
If an authentication protocol is implemented for I/O access, then data security is improved, but device complexity increases
Solution Approach 1:
The authentication mechanism implements self-service by having the authentication callback function automatically verify driver authorization and control I/O access. This self-contained approach improves data security while minimizing added complexity by leveraging existing UEFI driver framework components
Data Source
AI summary
A disclosed method installs an I/O trap protocol to provide an authentication callback function for handling I/O trap events. I/O trap events may include write operations accessing any of one or more identified I/O addresses. An I/O trap event may be registered with the authentication callback function for each of one or more identified I/O addresses. Original values of data may be stored in a memory resource. Any occurrences of an I/O trap event triggers the authentication callback function to perform I/O trap operations. The I/O trap operations may include determining whether the I/O trap event is associated with an approved driver and, if not, restoring data stored at the identified I/O address to an original value. Installing the I/O trap protocol may include installing the I/O trap protocol during a system management mode (SMM) phase of a UEFI boot sequence.