SMM Privilege Protection via Pre-boot Hash Verification
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
The privilege level of system management mode (SMM) in computer systems is vulnerable to malicious programs, which can rewrite main code and pose a serious threat to system security since the operating system cannot recognize which program uses the SMM privilege.
Innovation Solution
A method where a system management mode program is loaded into a special memory area, and a reference hash value is determined and stored before booting. After booting, the computed hash value is compared to the reference hash value, and only if they match is the program executed, ensuring that only legitimate code operates in SMM, thus preventing malicious programs from gaining SMM privilege.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Adaptability or versatility
If SMM privilege is provided for system management control, then system management capability is improved, but system security deteriorates because malicious programs can acquire and misuse SMM privilege
Solution Approach 1:
The patent applies preliminary action by computing and storing hash values of legitimate SMM programs before the system boots. These pre-computed hash values are stored in a protected area, enabling later verification of program integrity without requiring complex runtime analysis or user intervention.
Solution Approach 2:
The patent implements feedback through a verification mechanism that compares the hash value of the currently executing SMM program against the pre-stored reference hash value. This feedback loop ensures that only authenticated programs can execute in SMM, automatically preventing unauthorized or malicious code from gaining privileged access.
2Reliability
If hash value verification is implemented for SMM programs, then system security is improved, but system complexity increases due to additional verification steps
Solution Approach 1:
The patent replaces complex mechanical or procedural security verification mechanisms with a computational hash-based verification system. Instead of using intricate access control lists, permission checks, or manual authentication procedures, the system uses cryptographic hash functions to verify program integrity, significantly simplifying the verification logic while maintaining high security.
Solution Approach 2:
The patent changes the verification parameter from complex program analysis or permission checking to a simple hash value comparison. By transforming the security verification problem into a parameter-based comparison task, the system achieves high security with minimal computational overhead and simplified control logic.
Data Source
AI summary
A method for protecting a privilege level of a system management mode (SMM) of a computer system is disclosed. A SMM program is loaded into a special memory (SMRAM) area within a system memory of a computer. A first program, a second program, and a vector table are loaded into a general area of the system memory. Before the booting process of the computer has been completed, a reference hash value of the first program is determined by the SMM program, and the reference hash value is stored in the SMRAM area. A hash value of the first program is the computed by the SMM program. After the computer has been operating under an operating environment of an operating system, the computed hash value is compared to the reference hash value. When the computed hash value matches the reference hash value, the first program is called by the SMM program.