TPM 2.0 Platform Hierarchy for UEFI Variable Security
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Despite advanced boot protocols like UEFI Secure Boot and secure cryptoprocessors, malware remains a threat to trusted computing due to vulnerabilities in BIOS software and TPMs, particularly in UEFI variables which can be susceptible to malicious attacks and lack confidentiality control.
Innovation Solution
The implementation of TPM 2.0's platform hierarchy allows firmware to access and manipulate UEFI variables securely during runtime, enabling secure enable/disable of secure enclaves, preventing roll-back attacks, and toggling between OSes by cryptographically binding variables to the TPM, providing strong access controls and integrity protection.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Ease of operation
If UEFI variables are stored in flash memory without cryptographic binding, then ease of operation is improved, but security is worsened due to susceptibility to malicious attacks
Solution Approach 1:
The TPM acts as an intermediary between the UEFI variables and the system, providing cryptographic binding and access control. The TPM stores authenticated versions of variables and verifies signatures before allowing access, mediating between the simple flash storage and the security requirements without complicating the operational interface.
Solution Approach 2:
The patent replaces the mechanical/trust-based security model with cryptographic mechanisms. Instead of relying on physical security or trust in the firmware, the system uses digital signatures, hash functions, and cryptographic verification to protect UEFI variables, substituting cryptographic proof for traditional security mechanisms.
2Adaptability or versatility
If firmware can freely access and manipulate UEFI variables during runtime, then adaptability is improved, but security is worsened due to lack of access controls
Solution Approach 1:
The system implements dynamic access control where the TPM evaluates authentication criteria at runtime and selectively grants access to UEFI variables. The authentication policies are flexible and can adapt to different contexts, allowing legitimate firmware to access variables while blocking unauthorized access, thus providing both adaptability and security.
Solution Approach 2:
The TPM serves as a mediator that sits between firmware and UEFI variables, implementing access control policies. When firmware needs to access or manipulate variables, the TPM verifies authentication criteria and either permits or denies the operation, providing controlled adaptability without compromising security.
3Device complexity
If UEFI variables lack cryptographic authentication, then device complexity is reduced, but integrity protection is worsened making systems vulnerable to roll-back attacks
Solution Approach 1:
The system creates authenticated copies of UEFI variables stored in the TPM. The original variables remain in flash memory for simplicity, while the TPM maintains cryptographically signed versions that serve as authenticated copies. This allows the system to maintain simple storage while having verified copies for security-critical operations.
Solution Approach 2:
The patent substitutes cryptographic authentication mechanisms for simple storage. Instead of relying solely on the physical integrity of flash memory, the system uses digital signatures and hash-based message authentication codes (HMAC) to verify variable integrity, replacing physical security assumptions with cryptographic proof.
4Productivity
If multiple entities can access the TPM simultaneously, then productivity is improved, but security is worsened due to potential conflicts and unauthorized access
Solution Approach 1:
The system implements dynamic access control policies that are evaluated at runtime based on the specific authentication criteria. The TPM can handle multiple concurrent access requests by evaluating different authentication policies for different entities, dynamically granting or denying access based on real-time verification rather than static permissions.
Solution Approach 2:
The TPM implements feedback mechanisms where authentication criteria are evaluated and access decisions are made based on verified credentials. The system provides feedback to requesting entities about whether access is granted or denied, and maintains audit trails of access attempts, enabling secure concurrent access through continuous verification and monitoring.
Data Source
Figure 1
Figure 2
Figure 3
AI summary
An embodiment includes an apparatus comprising: an out-of-band cryptoprocessor coupled to secure non-volatile storage; and at least one storage medium having firmware instructions stored thereon for causing, during runtime and after an operating system for the apparatus has booted, the cryptoprocessor to (a) store a key within the secure non-volatile storage, (b) sign an object with the key, while the key is within the cryptoprocessor, to produce a signature, and (c) verify the signature. Other embodiments are described herein.