Platform Key Hierarchy for Secure BIOS Authentication
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Computing systems' BIOS instructions are vulnerable to malware attacks, compromising their integrity and security, especially when external services attempt to manipulate or replace the original BIOS.
Innovation Solution
Implementing a platform key hierarchy within an embedded controller that includes a public platform key stored in ROM, a key bit list in OTP memory, and a blocked/revoked key bit mask to verify and manage private platform keys, ensuring only authorized keys are used for authentication and preventing unauthorized BIOS execution.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Adaptability or versatility
If BIOS instructions are stored in external memory for easy updating, then adaptability is improved, but security and reliability deteriorate due to vulnerability to malware attacks
Solution Approach 1:
The system segments the trust verification process into multiple components: a root of trust in hardware, a key hierarchy with multiple key pairs, and separate verification of BIOS instructions. This segmentation allows the system to maintain reliability through hardware-based verification while enabling adaptability through authorized BIOS updates.
Solution Approach 2:
The system performs preliminary actions by pre-storing public platform keys in the embedded controller before BIOS execution. This preliminary setup enables the embedded controller to verify the authenticity of BIOS instructions before they are executed, ensuring that only authorized BIOS versions can be loaded and executed, thus maintaining security while allowing updates.
2Ease of operation
If a single platform key is used for BIOS authentication, then ease of operation is improved, but adaptability deteriorates when supporting multiple platform generations
Solution Approach 1:
The system implements a dynamic key hierarchy where multiple private platform keys and their corresponding public keys can be registered and managed. The embedded controller can verify BIOS instructions signed by any authorized private key in the hierarchy, allowing the system to adapt to different platform generations and BIOS versions while maintaining a unified verification process.
Solution Approach 2:
The embedded controller is designed with universal verification capability that can authenticate BIOS instructions from multiple different private keys through a single public key verification process. This multi-functionality allows the same hardware controller to support multiple platform generations and BIOS vendors without requiring separate verification mechanisms for each.
3Ease of manufacture
If platform keys are stored in volatile memory, then ease of manufacture is improved, but reliability deteriorates due to potential key compromise
Solution Approach 1:
The system implements a nested security structure where the public platform key is stored in non-volatile memory within the embedded controller, providing a secure root of trust. Private platform keys are stored separately in secure elements or protected memory regions. This nested arrangement ensures that even if private keys are compromised, the root of trust remains secure, and unauthorized BIOS execution cannot be performed.
Data Source
AI summary
In one example, a system for a platform key hierarchy includes an embedded controller to, store a first public platform key with a key bit list corresponding to a number of valid private platform keys, and verify a second public platform key by comparing a key number corresponding to a private platform key to the key bit list.