Runtime UEFI Image Loading via OEM File List and Sync Module
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
The existing UEFI boot process requires reflashing the entire platform firmware whenever a UEFI image or Secure Boot key is added or updated, which is cumbersome and inefficient.
Innovation Solution
Incorporating an OEM file list within the platform firmware that maps file GUIDs to public keys, allowing for the creation and verification of UEFI images at runtime, and a sync module that updates Secure Boot databases during the DXE phase to ensure secure boot verification without reflashing the firmware.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If the Secure Boot database is updated to include a new UEFI image signature, then the new UEFI image can be verified during Secure Boot verification, but the entire platform firmware must be reflashed which is time-consuming and cumbersome
Solution Approach 1:
The patent segments the Secure Boot database into two parts: (1) the original Secure Boot database stored in platform firmware that remains unchanged, and (2) a runtime Secure Boot database stored in a file on the filesystem that can be updated independently. This segmentation allows the runtime database to be modified without reflashing the entire platform firmware, resolving the contradiction between maintaining Secure Boot verification reliability and reducing firmware update time
Solution Approach 2:
The patent introduces an intermediary component - the DXE module - that acts as a bridge between the original Secure Boot verification mechanism and the new runtime database. The DXE module loads the runtime Secure Boot database from the filesystem and integrates it with the original Secure Boot database, enabling dynamic updates without firmware reflashing while maintaining the security guarantees of the original verification process
2Reliability
If the platform firmware is reflashed to add a Secure Boot key, then the UEFI image can be properly verified, but the process is cumbersome and inefficient
Solution Approach 1:
The patent transforms the static Secure Boot database embedded in platform firmware into a dynamic runtime database that can be modified and updated during system operation. The runtime database is stored as a regular file on the filesystem, allowing it to be edited, updated, and reloaded without requiring firmware reflashing or complex operational procedures, thus improving ease of operation while maintaining verification reliability
Solution Approach 2:
The patent performs preliminary actions by pre-configuring the runtime Secure Boot database file with the necessary signature information before system boot. The DXE module is designed to automatically load and integrate this pre-prepared runtime database with the original Secure Boot database during the boot process, eliminating the need for manual firmware updates and simplifying the overall process
3Productivity
If Secure Boot databases are updated at runtime, then firmware refashing is avoided, but additional verification mechanisms are needed to ensure security
Solution Approach 1:
The patent merges the original Secure Boot verification mechanism with a new runtime database loading mechanism through the DXE module. The DXE module combines the immutable original Secure Boot database from platform firmware with the mutable runtime Secure Boot database from the filesystem, creating a unified verification process that leverages both approaches. This merging allows runtime updates without firmware reflashing while maintaining security through the integrated verification process
Data Source
AI summary
UEFI images can be securely loaded at runtime so that it is unnecessary to flash the entire platform firmware whenever a UEFI image is added or updated. The platform firmware can include an OEM file list that maps file GUIDs to public keys. When it is desired to add a UEFI image, the OEM can employ one of the file GUIDs in the OEM file list and a private key corresponding to the mapped public key to create the UEFI image. During the PEI phase of the boot process, a verification module in the platform firmware can verify any added UEFI image using the OEM file list. Additionally, to ensure that the added UEFI images will pass the subsequent Secure Boot verification, a sync module can add custom Secure Boot keys for the added UEFI images to the Secure Boot databases during the DXE phase of the boot process.