Multi-owner Firmware Image Deployment via Segmented Signing

Resolve Bottlenecks,
Find Innovative SolutionsGenerate Solutions

Solution Overview

Problem

The existing BIOS and firmware update processes are limited by the need for a single entity to sign and manage the entire firmware image, which restricts the ability to update specific code modules and increases security risks due to the involvement of multiple parties in the distribution chain, especially with the proliferation of malware.

Innovation Solution

A method for deploying a signed firmware image that allows different entities to sign individual code modules, enabling updates to specific BIOS or platform firmware components, with an access control list managing authorization for each module, allowing multiple owners to authenticate and update their respective modules securely.

Engineering Contradictions & Design Principles

VSEngineering Contradiction Analysis

1Device complexity

If a single entity signs and manages the entire firmware image, then the firmware update process is simple to manage, but the ability to update specific code modules is restricted and security risks increase due to multiple parties in the distribution chain

Engineering Contradiction:

Improvefirmware update process complexityVSAvoidability to update specific code modules

Core Design Contradiction:

Device complexityVSAdaptability or versatility

Solution Approach 1:

The firmware image is divided into multiple code modules, each signed by different entities. The system maintains an access control list that maps code owners to specific modules, allowing selective updates of individual modules without requiring updates to the entire firmware image. This segmentation enables multiple parties to independently update their respective modules while maintaining overall system integrity.

Inventive Principle:

Principle #1Segmentation

2Reliability

If a single entity signs and manages the entire firmware image, then the firmware distribution is centralized and secure, but the efficiency of updating critical components is reduced due to monolithic image requirements

Engineering Contradiction:

Improvefirmware securityVSAvoidupdate efficiency of critical components

Core Design Contradiction:

ReliabilityVSProductivity

Solution Approach 1:

The firmware is segmented into updateable modules with individual digital signatures. When a critical component needs updating, only that specific module is updated and re-signed, rather than requiring a complete firmware image update. The access control list ensures that only authorized code owners can update their respective modules, maintaining security while improving update efficiency.

Inventive Principle:

Principle #1Segmentation

Solution Approach 2:

Code modules are pre-signed by their respective owners before being included in the firmware image. The access control list is pre-configured with code owner identifiers and authorized module ranges. This preliminary preparation enables rapid updates of critical components without requiring centralized re-signing of the entire firmware image, thus improving productivity while maintaining reliability.

Inventive Principle:

Principle #10Preliminary action

3Adaptability or versatility

If multiple parties are involved in firmware distribution, then the firmware can be customized and improved by different entities, but security risks increase due to the proliferation of malware and distribution chain complexity

Engineering Contradiction:

Improvefirmware customization capabilityVSAvoidsecurity risks from multiple distribution parties

Core Design Contradiction:

Adaptability or versatilityVSObject-affected harmful factors

Solution Approach 1:

Each code module is digitally signed by its respective code owner before distribution. The digital signature serves as a preliminary security measure that verifies the authenticity and integrity of each module. When modules are updated, the new modules must also be digitally signed by authorized owners, creating a chain of trust that prevents malware injection while allowing multiple parties to contribute customized firmware components.

Inventive Principle:

Principle #10Preliminary action

Solution Approach 2:

The system implements verification feedback by checking digital signatures and access control list permissions before allowing firmware module updates. This feedback mechanism ensures that only authenticated code owners can update their authorized modules, providing continuous security validation throughout the distribution and update process, thereby mitigating security risks while maintaining customization capabilities.

Inventive Principle:

Principle #23Feedback

Data Source

PatentEP2395449B1Multi-owner deployment of firmware images

Publication Date: 2019.02.13 INTEL CORP

Figure 1~2B
Figure 2C~2F
Figure 3

AI summary

A method, apparatus, system, and computer program product for multi-owner deployment of firmware images. The method includes obtaining a signed firmware image that comprises a first code module signed by a first code owner and a second code module signed by a second code owner. The method further includes obtaining an updated first code module comprising updated code for the first code module, verifying that the updated first code module is signed by the first code owner, and updating the signed firmware image with the updated first code module in response to verifying that the updated first code module is signed by the first code owner. The signed firmware image may further comprise an access control list that authorizes updates to the first code module by the first code owner and updates to the second code module by the second code owner.