Secure Boot Telemetry Encryption in Heterogeneous SoC Platforms
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Existing Information Handling Systems (IHSs) face challenges in securing boot telemetry during the boot sequence, as this sensitive information can be misused to compromise the operation of the system, and existing security measures are not effective during the boot process.
Innovation Solution
The IHSs are equipped with a System-on-Chip (SoC) that includes a security device for encrypting boot telemetry generated during the UEFI boot sequence, which is stored in an SSD after collection in a Non-Volatile Random-Access Memory (NVRAM), ensuring the telemetry remains secured throughout the boot process.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If boot telemetry is collected and stored in plaintext during the boot sequence, then telemetry collection is simple and efficient, but the IHS security is compromised as the telemetry can be misused to compromise the booting procedures
Solution Approach 1:
The patent applies preliminary action by encrypting boot telemetry data before it is stored in NVRAM during the boot sequence. The security device encrypts the telemetry data using cryptographic keys before storage, preventing unauthorized access while the data is still in the boot process. This proactive encryption approach secures the data before potential threats can exploit it, resolving the contradiction between simple telemetry collection and security protection.
Solution Approach 2:
The patent introduces a security device as an intermediary component between the boot telemetry generation and storage processes. This dedicated security device handles encryption and key management, separating the security functions from the main boot process. The intermediary security device protects the telemetry data without significantly complicating the overall boot sequence, as it operates as a specialized component with dedicated security responsibilities.
2Reliability
If boot telemetry is encrypted using a dedicated security device, then the telemetry security is strengthened, but the boot sequence time increases
Solution Approach 1:
The encryption of boot telemetry is performed as a preliminary action during the boot sequence itself, rather than as a post-processing step. The security device encrypts the telemetry data before it is stored in NVRAM, ensuring security is established early in the boot process. This timing allows the system to benefit from hardware acceleration of cryptographic operations, minimizing the time penalty while achieving strong security protection.
3Reliability
If boot telemetry is stored in NVRAM without encryption, then the storage and retrieval is fast and simple, but the telemetry can be accessed by unauthorized entities compromising the IHS operation
Solution Approach 1:
The security device serves as an intermediary between the boot telemetry generation and the NVRAM storage. It encrypts the telemetry data using cryptographic keys before the data is written to NVRAM, and manages the decryption process when authorized retrieval is needed. This intermediary layer protects the telemetry data in storage without requiring changes to the NVRAM hardware itself, maintaining storage speed while adding security protection through dedicated cryptographic processing.
Data Source
AI summary
Systems and methods include an Information Handling System (IHS) that is adapted to collect boot telemetry in a secure manner. Boot code of the IHS is executed to initiate a boot sequence that includes the generation of boot telemetry. The boot telemetry is collected in a partition of an NVRAM (Non-Volatile Random-Access Memory) of the IHS. When the capacity of the partition of the NVRAM reaches a threshold, the boot telemetry is transmitted from the NVRAM to a security device of an SoC (System-on-Chip) of the IHS for encryption of the boot telemetry. The encrypted boot telemetry is stored in an SSD (Solid-State Drive) of the IHS.