Support Processor BIOS Authentication via Hash Verification
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Current methods for authenticating Basic Input/Output System (BIOS) in information handling systems do not effectively prevent hackers from replacing BIOS firmware, either through physical tampering or compromising signing keys, leading to potential execution of corrupted boot instructions.
Innovation Solution
Incorporating a support processor with a unique key that calculates and verifies hash values for BIOS instructions, ensuring that only authenticated BIOS instructions are executed by the host processor, and providing secure storage for encrypted hash values to prevent unauthorized changes.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If signed images are used to prevent malicious BIOS firmware, then protection against certain hacking scenarios is improved, but protection against physical tampering and signing key compromise is not achieved
Solution Approach 1:
The system separates authentication functions into two independent components: a host processor that executes BIOS and a support processor that performs authentication. The support processor contains a secure unique key that is isolated from the host BIOS, creating segmented security boundaries. This segmentation prevents attackers from compromising both the BIOS and the authentication key through the same attack vector.
Solution Approach 2:
A support processor is introduced as an intermediary between the BIOS firmware and the host processor. This intermediary independently verifies the authenticity of BIOS images using a secure unique key stored in its embedded memory, acting as a trusted mediator that neither the host processor nor external attackers can easily compromise.
2Reliability
If a support processor with unique key is added for hash verification, then BIOS firmware authentication is improved, but device complexity increases
Solution Approach 1:
The authentication logic and secure key storage are extracted from the main host processor and placed in a separate support processor. This extraction allows the host processor to focus on executing BIOS instructions while the support processor handles security-critical operations, simplifying the overall system architecture despite adding a component.
Solution Approach 2:
The support processor performs self-authentication of the BIOS by independently calculating hash values and comparing them against securely stored reference values. This self-service authentication mechanism eliminates the need for the host processor to implement complex verification logic, reducing overall system complexity.
Data Source
AI summary
An information handling system (IHS) prevents execution of corrupted bootup instructions in flash memory. A memory component contains basic input/output system (BIOS) instructions to execute during boot up of the IHS. A host processor is in communication with the memory component via the system interconnect to execute the BIOS instructions to configure the IHS. A support processor executes instructions to configure the IHS to: (a) calculate a current hash value for the BIOS instructions; (b) access a trusted encrypted hash value and the unique key from a secure storage; (c) decrypt the trusted encrypted hash value using the unique key to obtain a trusted hash value; (d) determine whether the current hash value is identical to the trusted hash value; and (e) allow execution of the BIOS instructions by the host processor in response to determining that the encrypted current hash value is identical to the trusted hash value.