UEFI Secure Boot Device Identification via Hash Mapping
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
In previous information handling systems, users cannot easily identify devices in the secure boot allowed and denied databases as only hash values are displayed, making it difficult to determine which devices are allowed or denied and requiring updates or replacements.
Innovation Solution
The BIOS creates a lookup table associating device firmware hashes with unique device identification strings, allowing the display of both hash values and identification strings for each device in the allow and deny lists, enabling users to identify and manage devices effectively.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If only hash values are displayed in secure boot databases, then security verification is maintained, but user ability to identify devices is poor
Solution Approach 1:
The patent introduces an intermediary mapping mechanism that connects the cryptographic hash values (used for security verification) with human-readable device identification strings. This mapping table acts as a mediator, allowing the system to maintain security through hash verification while enabling users to identify devices through descriptive strings without compromising the security architecture.
Solution Approach 2:
The patent creates a copy or representation of device information in the form of identification strings that mirror the functionality of hash values for identification purposes, while the original hash values remain for security verification. This allows users to work with user-friendly copies rather than the raw cryptographic data.
2Ease of operation
If device identification strings are added to secure boot databases, then device identification becomes easier, but database complexity increases
Solution Approach 1:
The patent segments the database into two distinct components: the core secure boot database storing hash values for security verification, and a separate mapping table storing the association between hash values and device identification strings. This segmentation allows the security-critical portion to remain simple while the identification portion handles the complexity of user-friendly device descriptions.
Data Source
AI summary
An information handling system includes a memory and a basic input/output system (BIOS). The memory stores a lookup table to associate each of a plurality of device firmware hashes with a corresponding one of a plurality of device identification strings. The BIOS calculates the each of the device firmware hashes. Each device firmware hash is associated with a different device firmware. The BIOS creates the lookup table based on the calculated device firmware hashes and the device identification strings. Based on the lookup table, the BIOS displays a secure boot allowed devices database list on a display device.