UEFI Secure Boot OS File Validation and Recovery
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Current data backup systems, such as DellEMC Data Domain, lack a mechanism to validate and recover OS boot files during OS upgrades, leading to unbootable issues and increased processing overhead due to deduplication techniques.
Innovation Solution
Implementing a secure boot validation and recovery mechanism that works in conjunction with UEFI secure boot, utilizing an OS Boot Files (OBF) monitor and a Secure OS Boot Files copy (SOBF copy) to automatically validate and recover OS boot files during runtime, installation, and upgrades.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Object-affected harmful factors
If UEFI secure boot strict checks are implemented for OS boot files, then system security is improved, but system reliability deteriorates due to inability to handle boot file corruptions
Solution Approach 1:
The patent implements a boot file monitoring mechanism that performs preliminary validation and integrity checks on OS boot files before they are executed. The monitor detects corruptions early in the boot process and triggers recovery procedures, preventing unbootable states before they occur. This preliminary action allows the system to maintain strict UEFI secure boot checks while having a safety net to handle any corruptions that occur.
Solution Approach 2:
The patent establishes a feedback loop where the boot file monitor continuously monitors the integrity of boot files and provides feedback to the recovery mechanism. When corruptions are detected, the system receives feedback about the specific corruption and automatically initiates recovery procedures. This feedback mechanism ensures that the system can respond to boot file issues while maintaining the security benefits of strict UEFI checks.
2Quantity of substance
If deduplication techniques are used to reduce storage overhead, then storage requirements are reduced, but processing overhead increases
Solution Approach 1:
The patent extracts the boot file validation and monitoring functions from the main deduplication backup process. By separating these critical functions into a dedicated monitor component, the system can perform storage-efficient deduplication operations while the monitor independently handles boot file integrity checks without adding processing overhead to the deduplication pipeline.
3Device complexity
If no boot file validation and recovery mechanism is implemented, then device complexity is reduced, but loss of information increases due to boot file corruptions
Solution Approach 1:
The patent implements a monitoring mechanism that creates and maintains copies of boot file integrity information. The monitor validates boot files against known good versions and maintains backup copies for recovery purposes. This copying approach protects against information loss from corruptions while adding minimal complexity compared to complete redundancy systems.
Data Source
AI summary
A secure boot monitoring and validation process during operating system (OS) upgrade operations from a previous OS version. A validated copy of OS boot files is made during OS installation. A checksum comparator or OS boot file filesystem check (FSCK) component validates the boot files upon initial installation of the OS. Any validation failure indicates corruption or unwanted modification of the boot file data. In case of a failure, an autorecovery operation using different boot partitions is attempted, and the OS boot filesystem check is performed again. If the second filesystem check fails a critical alert notification is sent, otherwise a warning alert notification is sent. The file system for storing user data is also shutdown to prevent any potential damage of user data.