UEFI Interceptor Driver for Encrypted Block I/O
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Existing information handling systems using Unified Extensible Firmware Interface (UEFI) protocols face challenges in accessing and managing encrypted data, as they lack efficient mechanisms for intercepting and processing block input/output commands for encrypted storage devices.
Innovation Solution
The implementation of a UEFI interceptor block I/O driver that intercepts block I/O commands, identifies encrypted target block addresses, and forwards data to an encryption-decryption module for processing before final handling by the block I/O driver, enabling secure access to partially or fully encrypted storage devices.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If traditional BIOS or UEFI protocol is used for disk access, then system initialization and standard block I/O operations are performed, but encrypted data cannot be accessed or managed efficiently
Solution Approach 1:
The patent introduces a UEFI interceptor block I/O driver as an intermediary layer between the standard UEFI block I/O protocol and the encrypted storage device. This interceptor driver captures block I/O commands, identifies encrypted target block addresses, and redirects them to appropriate encryption-decryption handlers, thereby enabling secure encrypted data access while maintaining compatibility with standard UEFI protocols
Solution Approach 2:
The patent segments the block I/O processing into distinct phases: standard UEFI block I/O command processing for unencrypted data, and intercepted encryption-decryption processing for encrypted data. The UEFI interceptor driver divides the handling of block I/O commands based on whether the target addresses are encrypted, allowing each segment to be processed through the appropriate pathway
2Adaptability or versatility
If a UEFI interceptor block I/O driver is implemented to intercept and process encrypted block I/O commands, then encrypted data access is enabled, but system complexity increases
Solution Approach 1:
The UEFI interceptor block I/O driver is designed to handle multiple functions within a single component: it intercepts block I/O commands, identifies encrypted versus unencrypted target addresses, routes commands appropriately, and coordinates with encryption-decryption modules. This multi-functionality reduces the need for separate specialized drivers for different scenarios
Solution Approach 2:
The system performs preliminary identification of encrypted target block addresses before executing the actual block I/O operation. The UEFI interceptor driver examines the target addresses in advance, determines which blocks are encrypted, and prepares the appropriate handling path beforehand, preventing errors and reducing the need for complex runtime decision-making
3Reliability
If block I/O commands are intercepted and processed through encryption-decryption modules, then data security is enhanced, but I/O operation speed decreases
Solution Approach 1:
The UEFI interceptor driver implements partial processing by selectively applying encryption-decryption operations only to the specific encrypted block addresses that are targeted, rather than processing all block I/O commands through encryption-decryption. For unencrypted blocks, the standard fast I/O path is used, minimizing overhead
Data Source
AI summary
An information handling system and method performs Unified Extensible Firmware Interface (UEFI) interception and pre-processing of data associated with block input/output (I/O) commands targeting encrypted storage devices. A UEFI interceptor block (IB) I/O driver intercepts each block I/O command targeting block addresses on a storage device and identifies whether any of the target block addresses is encrypted. In response to identifying an encrypted block address among the target block addresses, the UEFI IB I/O driver forwards data associated with the encrypted block address to an encryption-decryption module to perform one of an encryption and a decryption of the data. Final handling of the block I/O command is performed using a block I/O driver chained to the UEFI IB I/O driver. Data associated with I/O commands targeting encrypted block addresses is first processed by the encryption-decryption module before final handling of the I/O command is performed by the block I/O driver.