Out-of-band UEFI Secure Boot Variable Management via BMC
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Existing systems for managing UEFI secure boot variables in BIOS face challenges in maintaining their integrity and synchrony during out-of-band BIOS updates, particularly in platforms that utilize statelessness and require secure, robust, and compliant storage and updates across re-provisioning and firmware updates.
Innovation Solution
The method involves storing UEFI secure boot variables in a baseboard management controller as a signed blob, which can be updated by a management server, and using system management mode to communicate changes back to the BIOS, ensuring that these variables are securely stored and preserved across BIOS updates and platform reboots.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If secure boot variables are stored in BIOS, then they are easily accessible during boot, but they become vulnerable to corruption during out-of-band BIOS updates
Solution Approach 1:
The patent segments the storage architecture by separating secure boot variables from BIOS memory and placing them in dedicated NVRAM. This segmentation isolates the critical security data from updates and modifications to the BIOS, ensuring that BIOS updates cannot corrupt the secure boot variables while maintaining reliable access during the boot process.
Solution Approach 2:
The patent introduces an intermediary mechanism (NVRAM with dedicated secure storage) that acts as a buffer between the BIOS update process and the secure boot variables. This intermediary protects the variables from direct exposure to update operations while still allowing controlled access when needed, resolving the conflict between update safety and data accessibility.
2Reliability
If secure boot variables are stored in NVRAM outside BIOS, then they are protected during BIOS updates, but access during boot process becomes more complex
Solution Approach 1:
The patent implements preliminary action by pre-configuring the NVRAM with dedicated secure storage regions and establishing access protocols before the boot process begins. The system prepares the secure storage infrastructure in advance, ensuring that when the boot process needs to access secure boot variables, the pathway is already established and access can proceed efficiently without ad-hoc complexity.
3Productivity
If BIOS updates are performed asynchronously, then system availability is maintained, but synchronization of secure boot variables becomes difficult
Solution Approach 1:
The patent implements feedback mechanisms where the system continuously monitors the state of secure boot variables and BIOS update progress. This feedback loop enables the system to detect when synchronization is needed and trigger appropriate actions, ensuring that secure boot state remains consistent even during asynchronous updates without compromising system availability.
Data Source
AI summary
A method is provided in one example embodiment and includes storing secure boot variables in a baseboard management controller; and sending the secure boot variables to a basic input/output system (BIOS) during a power on self-test, where the BIOS utilizes the secure boot variables during runtime to authenticate drivers and an operating system loader execution. In particular embodiments, the secure boot variables may be included in a white list, a black list, or a key list and, further, stored in erasable programmable read only memory.