UEFI Application Certificate Verification for Secure Data Access
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Existing methods for supplying data from UEFI BIOS to applications in electronic apparatuses lack security, allowing any application to acquire data if the GUID or protocol is known, posing a risk of unauthorized access to sensitive information.
Innovation Solution
An electronic apparatus and method that includes a processor and memory storing certificates associated with permission data for each application, verifying the certificate's signature data upon system startup to ensure safe data supply to authorized applications, and either storing data in a volatile memory or installing a protocol for secure data transfer.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Ease of operation
If data is supplied to applications using GetVariable or protocol location methods, then data accessibility is improved, but security deteriorates because any application can acquire the data if the GUID or protocol is known
Solution Approach 1:
The patent introduces a certificate-based authentication mechanism as an intermediary between the UEFI BIOS and applications. The certificate, stored in the UEFI variable store, acts as a mediator that verifies the application's identity before allowing data access. This resolves the contradiction by maintaining ease of data access for authenticated applications while preventing unauthorized access from unauthenticated applications, thus improving security without completely blocking data accessibility.
2Reliability
If certificate verification is implemented for each application, then security is improved, but system complexity increases due to additional verification steps
Solution Approach 1:
The patent implements certificate verification during the system startup process, specifically during the UEFI BIOS initialization phase. By performing the certificate verification in advance before any data access operations, the system establishes security credentials beforehand. This preliminary action reduces the complexity of continuous verification during runtime, as the authentication state is determined once at startup and can be reused for subsequent data access operations.
3Speed
If data is stored in volatile memory for application access, then data access speed is improved, but data security deteriorates due to potential unauthorized access
Solution Approach 1:
The patent applies local quality by differentiating the access permissions for different applications based on their certificate authentication status. The UEFI BIOS checks the certificate of each application individually and grants or denies data access accordingly. This allows the system to store data in volatile memory for fast access while maintaining security, because only authenticated applications with valid certificates can access the data, even though it resides in volatile memory. The security control is applied locally at the application level rather than restricting the storage medium itself.
Data Source
AI summary
An electronic apparatus includes a processor, a memory that stores a certificate associated with information indicating permission to supply data to an application, for each application, in which the processor, upon system startup, checks whether the certificate for the application running on the system is stored in the memory, and when the certificate for the application is stored in the memory and verification of signature data of the certificate is successful, the processor supplies data to the application.