Secure Boot Validation for Non-PE Kernel Components
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Current secure boot systems in UEFI-based operating systems primarily protect files in Portable Executable (PE) format, leaving non-PE format files like initramfs vulnerable to tampering, even when secure boot is enabled, leading to potential security breaches.
Innovation Solution
The method involves modifying the Machine Owner Key (MOK) list to include a trusted certificate, using a modified Grub and Shim files to validate kernel components, and executing a secure boot process without altering the kernel, thereby protecting both PE and non-PE format files by separating the signature from the kernel and storing it in a separate file.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If secure boot is enabled in UEFI-based systems, then PE format files are protected from tampering, but non-PE format files remain vulnerable to attacks
Solution Approach 1:
The patent segments the secure boot protection mechanism by separating the signature validation process from the kernel loading process. It introduces a distinct signature file (e.g., .sig or .auth) that is separate from the kernel image, allowing independent validation of non-PE files like initramfs while maintaining compatibility with existing PE file protection mechanisms.
Solution Approach 2:
The patent introduces an intermediary signature file that acts as a mediator between the kernel and the verification process. This signature file contains cryptographic signatures that validate the integrity of non-PE kernel components, enabling secure boot protection for files that were previously unprotected without modifying the kernel itself.
2Ease of operation
If digital signatures are attached directly to kernel images, then verification is simplified, but the kernel file size increases and modification becomes difficult
Solution Approach 1:
The patent divides the kernel system into separate components: the kernel image itself and a distinct signature file. This segmentation allows the kernel to remain unchanged and unmodified, while the signature file contains all verification information, simplifying both verification and kernel maintenance.
Solution Approach 2:
The patent extracts the digital signature information from the kernel image and places it in a separate signature file. This extraction eliminates the need to modify the kernel file structure, keeping the kernel size unchanged and maintaining its original format while still enabling verification through the external signature file.
3Reliability
If non-PE files are protected with signatures, then security is improved, but the boot process complexity increases
Solution Approach 1:
The patent implements a self-service mechanism where the boot loader automatically reads and validates the separate signature file against the non-PE kernel components during the boot process. This automated validation occurs without requiring manual intervention or complex configuration, maintaining boot process simplicity while adding security protection.
Data Source
AI summary
A computer-implemented method for protecting a kernel for secure boot of an operating system includes preparing a kernel component with a signature for a secure boot. A processing unit modifies a machine owner key (MOK) file to include a trusted certificate. The MOK is separate from the kernel file. The processing unit validates the kernel component using a modified Grub file, a modified Shim file, and the MOK, and executes a secure boot using the validated kernel component. The kernel is unchanged by the secure boot process. The kernel component that is protected may be either a program executable (PE) file or a non-PE file.