Secure Boot Chain Validation for BIOS Malware Protection
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Current security protocols for computing devices are inadequate in protecting against malware infections, particularly in the BIOS, which can lead to permanent damage and denial of service due to vulnerabilities in the boot process, with existing solutions lacking centralized management of secure boot keys.
Innovation Solution
A method and system that establish a chain of trust by validating digital trust certificates pre-registered with a centralized certificate authority and policy server, ensuring only trusted components execute during the boot process, using a digital trust certificate to authenticate firmware and prevent unauthorized changes.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If BIOS is updated periodically to fix bugs and patch vulnerabilities, then system security is improved, but unauthorized or unauthenticated updates may expose the system to new vulnerabilities
Solution Approach 1:
The patent implements Secure Boot functionality that pre-validates firmware authenticity before execution. Digital signatures and certificate verification are performed in advance during the boot process, ensuring that only authenticated firmware updates can be applied, thus preventing unauthorized updates before they can cause harm.
Solution Approach 2:
The patent introduces a certificate authority and digital signature mechanism as an intermediary between firmware updates and the BIOS execution. This intermediary layer verifies the authenticity of updates through cryptographic signatures, ensuring that only authorized updates from trusted sources can modify the BIOS, thus resolving the contradiction between updating for security and preventing unauthorized access.
2Duration of action of stationary object
If BIOS is stored on flash memory for persistent storage, then system functionality is maintained, but malware can persist in BIOS even after reformatting or replacing hard drives
Solution Approach 1:
The patent implements pre-boot validation where digital signatures of firmware components are verified before execution. This preliminary authentication ensures that only signed, authorized firmware can run, preventing malware from persisting in the BIOS even though the firmware remains stored in flash memory for system functionality.
Solution Approach 2:
The patent separates the authentication mechanism from the storage medium. By using cryptographic signatures and certificate verification, the system extracts the security validation function from the physical flash memory, allowing persistent storage while preventing unauthorized code execution through digital authentication.
3Reliability
If centralized certificate authority and policy server are implemented for managing secure boot keys, then protection against malware is improved, but system complexity increases
Solution Approach 1:
The patent introduces a centralized certificate authority and policy server as an intermediary for key management. This external authority handles the complex tasks of certificate issuance, validation, and policy enforcement, allowing the local computing device to maintain security with simplified on-device components while benefiting from centralized management capabilities.
Data Source
AI summary
This disclosure relates method and system for protecting a computing device from a malware. In one embodiment, the method may include determining a digital trust certificate of a set of computing instructions to be executed by the computing device. The set of computing instructions may form a part of a boot process of the computing device, and may be a firmware, a boot loader, a kernel, a system driver, a start-up file, or an antimalware. The method may further include establishing a chain of trust by validating the digital trust certificate with the computing device. The digital trust certificate may be pre-registered with a local database, accessible by the computing device, by communicating with a centralized certificate authority and policy server. Upon a positive establishment of the chain of trust, the method may further include allowing an execution of the set of computing instructions by the computing device.