SMI Identifier Authentication for BIOS Protection
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Malicious software can easily exploit system management interrupts (SMIs) by obtaining IO port addresses, leading to system instability or BIOS damage, as these interrupts are not adequately protected from unauthorized access.
Innovation Solution
A method is implemented where a first identifier is generated and stored in a system management mode block during the power-on self-test (POST), and a second identifier is stored in an operating system block. When an SMI is requested, both identifiers are compared for matching, and only if they match, the SMI is executed, with optional encryption for enhanced security.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Ease of operation
If the IO port address of the SW SMI is stored in a fixed ACPI description table (FACP) or obtained through a manufacture identifier of a south bridge chip, then the SW SMI can be easily accessed and executed, but malicious software can exploit this ease of access to spoil the system or damage the BIOS
Solution Approach 1:
The patent applies preliminary action by generating and storing an identifier in the system management mode block during the POST process before the operating system is loaded. This identifier is then used during OS operation to authenticate SMI requests, preventing malicious software from exploiting the system without proper authorization mechanisms in place beforehand.
Solution Approach 2:
The patent introduces an identifier as an intermediary element between the SMI request and the execution of the SMI handler routine. This identifier acts as a mediator that verifies the legitimacy of the request, blocking malicious software while allowing authorized operations to proceed through the authentication mechanism.
2Reliability
If an identifier verification mechanism is implemented to prevent malicious software from using SW SMI, then system security is improved, but the complexity of the SMI execution process increases due to additional verification steps
Solution Approach 1:
The patent applies self-service by having the operating system itself manage the identifier storage and retrieval process. The OS stores the identifier in its block during initialization and uses it to authenticate SMI requests, eliminating the need for external verification systems and reducing overall system complexity while maintaining security.
Solution Approach 2:
The patent merges the identifier verification process with the existing SMI execution flow. The comparison of identifiers is integrated into the SMI handling routine, and the verification steps are combined with the normal OS operation sequence, reducing the perceived complexity by embedding security checks within existing processes rather than adding separate verification systems.
Data Source
AI summary
A method for executing a system management interrupt (SMI) is provided. When a power on self test (POST) is executed, a first identifier is generated and stored into a system management mode block of a memory. During a process for starting an operating system (OS), the first identifier is read from the system management mode block as a second identifier, and the second identifier is stored into an OS block of the memory. When the OS wants to use a system management interrupt, the first identifier and the second identifier are respectively read from the system management mode block and the OS block. Afterwards, it is determined whether the first identifier and the second identifier are the same. If the first identifier and the second identifier are the same, the SMI is executed.