SMM BIOS Code Integrity Monitoring Controller

Resolve Bottlenecks,
Find Innovative SolutionsGenerate Solutions

Solution Overview

Problem

Existing mechanisms fail to provide continuous protection against unauthorized modifications of System Management Mode (SMM) BIOS code during extended operation of a computing device, making it difficult to detect breaches and ensuring secure execution of BIOS code.

Innovation Solution

A controller monitors the expected functionality of SMM BIOS code execution to detect any changes or deviations, enabling the identification of potential unauthorized modifications and ensuring the integrity of the BIOS code.

Engineering Contradictions & Design Principles

VSEngineering Contradiction Analysis

1Reliability

If SMM BIOS code runs at highest privilege level, then it can perform critical system management functions, but it becomes vulnerable to undetectable compromise and unauthorized modifications

Engineering Contradiction:

Improvesystem management function reliabilityVSAvoidunauthorized modification vulnerability

Core Design Contradiction:

ReliabilityVSObject-affected harmful factors

Solution Approach 1:

A controller is introduced as an intermediary component that monitors the execution of SMM BIOS code independently. The controller receives indications of execution and compares actual behavior against expected functionality, providing a mediation layer that detects compromises without interfering with the high-privilege operations of SMM BIOS code

Inventive Principle:

Principle #24Intermediary (Mediator)

Solution Approach 2:

The system implements feedback by having the controller continuously monitor execution indications from SMM BIOS code and compare them against stored expected functionality. When deviations are detected, the system generates alerts or takes corrective actions, creating a closed-loop feedback mechanism that enhances security while maintaining operational reliability

Inventive Principle:

Principle #23Feedback

2Reliability

If existing integrity check mechanisms are used, then protection is provided during low powered states, but continuous protection during extended operation is not achieved

Engineering Contradiction:

ImproveBIOS code integrity protectionVSAvoidprotection duration

Core Design Contradiction:

ReliabilityVSDuration of action of moving object

Solution Approach 1:

The controller is designed to continuously monitor SMM BIOS code execution throughout the entire operational period of the computing device, not just during low powered states. This continuous monitoring ensures that integrity protection is maintained across all operational states including extended operation, boot processes, and runtime modifications

Inventive Principle:

Principle #20Continuity of useful action

3Productivity

If SMM BIOS code executes without continuous monitoring, then system operation is efficient, but compromised code cannot be detected

Engineering Contradiction:

Improvesystem operation efficiencyVSAvoidcompromise detection accuracy

Core Design Contradiction:

ProductivityVSMeasurement precision

Solution Approach 1:

The controller serves as a non-intrusive intermediary that monitors SMM BIOS code execution without disrupting its high-privilege operations. It receives execution indications and performs background comparison against expected functionality, enabling detection of compromises while maintaining system operation efficiency

Inventive Principle:

Principle #24Intermediary (Mediator)

Solution Approach 2:

The system replaces direct intervention in SMM BIOS code execution with an indirect monitoring approach using a separate controller. This substitution allows the high-privilege code to execute efficiently while the controller independently verifies its behavior through comparison with expected functionality

Inventive Principle:

Principle #28Mechanics substitution (Replace mechanical system)

Data Source

PatentEP3198399B1Detecting a change to system management mode BIOS code

Publication Date: 2019.04.03 HEWLETT PACKARD DEVELOPMENT COMPANY LP

Figure 1
Figure 2
Figure 3

AI summary

Examples herein disclose monitoring an expected functionality upon execution of a system management mode (SMM) BIOS code. The examples detect whether a change has occurred to the SMM BIOS code based on the monitoring of the expected functionality. The change indicates that the SMM BIOS code is compromised.