UEFI Secure Boot Variable Synchronization via BMC Backup
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Existing secure boot management systems fail to preserve changes made to UEFI secure boot variables during BIOS updates, as these updates often erase or overwrite the secure boot variables stored in non-volatile random-access memory (NVRAM), leading to loss of authentication data and potential security breaches.
Innovation Solution
A method and apparatus that actively manage secure boot variables by recording changes in a separate physical memory, such as a baseboard management controller (BMC), allowing for the restoration of secure boot variables to their pre-update state using a 'record and playback' functionality, ensuring that authentication data like white and black lists, platform keys, and key exchange keys are preserved across BIOS updates.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Adaptability or versatility
If BIOS is updated (flashed over), then BIOS functionality is improved/updated, but secure boot variables stored in NVRAM are overwritten and lost
Solution Approach 1:
The patent creates and maintains a copy of the secure boot variables in a separate storage location (NVRAM or file system) that is independent of the BIOS image. This copy serves as a backup that can be restored after BIOS updates, preventing loss of authentication data while allowing BIOS updates to proceed.
Solution Approach 2:
The system performs preliminary actions by backing up secure boot variables before BIOS updates occur. The backup mechanism is established in advance, capturing the state of secure boot variables so they can be restored after the BIOS update, thus preventing information loss.
2Reliability
If secure boot variables are stored in NVRAM on BIOS, then authentication data is preserved, but BIOS updates erase or overwrite these variables
Solution Approach 1:
The patent segments the storage of secure boot variables from the BIOS image itself. Instead of storing them together in BIOS NVRAM, the system separates them into independent storage locations (separate NVRAM regions or file system), allowing the BIOS to be updated without affecting the secure boot variables.
Solution Approach 2:
The system introduces an intermediary storage mechanism that mediates between the BIOS update process and secure boot variable preservation. This intermediary (separate NVRAM or file system) acts as a buffer that protects authentication data from being erased during BIOS updates.
3Adaptability or versatility
If OS modifies white and black lists during runtime, then system security is customized, but BIOS update destroys these changes
Solution Approach 1:
The system creates and maintains copies of the customized white and black lists in a separate storage location that is independent of the BIOS image. When the OS modifies these lists during runtime, the changes are captured and stored in the separate location, preserving them against BIOS updates.
Solution Approach 2:
The system performs preliminary backup of the customized security lists before BIOS updates. By establishing the backup mechanism in advance and capturing the state of modified lists, the system ensures that runtime customizations are preserved even when BIOS updates occur.
Data Source
AI summary
Techniques are provided for actively managing secure boot variables. Such techniques include receiving a request from an entity to modify a portion of a basic input/output system (BIOS), the request including a data segment, and verifying that the requesting entity is authorized to modify a portion of the BIOS. In response to verifying that the requesting entity is authorized, the portion of the BIOS is modified based on the received request and the data segment, and a copy of the data segment is stored in a file on a physical memory that is communicatively coupled to the BIOS. If the BIOS is updated, thereby erasing part or all of the secure boot variables that are stored in the BIOS, the record of changes of the secure boot variables along with default authenticated variables may be used to restore the secure boot variables to a state prior to the BIOS update.