UEFI Boot Loader Key Container for OS Chain of Trust
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
The UEFI secure boot mechanism is not traditionally extendable to verify operating system packages, software packages, software device drivers, applications, or other data, as it primarily signs and verifies only firmware drivers and boot loaders, lacking a chain of trust for these components.
Innovation Solution
A mechanism is introduced where a UEFI boot loader verifies a key container binary object using a platform key, extracts and passes a public key to the operating system kernel, which then uses this key to verify signatures of packages, device drivers, and applications, establishing a chain of trust from the UEFI CA to these components.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If the UEFI secure boot mechanism is used to sign and verify firmware drivers and boot loaders, then the security of the boot process is improved, but the mechanism cannot be extended to verify operating system packages, software packages, device drivers, and applications
Solution Approach 1:
The patent makes the UEFI secure boot mechanism universal by introducing a key container that can hold multiple public keys (UEFI CA, non-UEFI CA, application publisher keys). This allows the same secure boot infrastructure to verify not only firmware drivers and boot loaders but also operating system packages, software packages, device drivers, and applications, thus achieving multi-functionality without compromising the original security function
2Reliability
If the UEFI certificate authority signs only firmware drivers and boot loaders, then the security verification is maintained for these components, but the trusted platform key cannot be used to verify most data of an operating system
Solution Approach 1:
The patent introduces a key container as an intermediary between the UEFI CA and various software components. The key container is signed by the UEFI CA and contains public keys that can verify signatures from multiple sources (UEFI CA, non-UEFI CA, application publishers). This intermediary structure allows the trusted platform key to indirectly verify operating system packages, software packages, device drivers, and applications while maintaining the original UEFI CA signing process for firmware drivers and boot loaders
Data Source
AI summary
A processing device searches executing at least one of a boot loader or a kernel for the operating system searches for an extensible firmware interface (EFI) binary object. Responsive to finding a first EFI binary object, the processing device verifies that a first signature associated with the first EFI binary object is valid using a platform key. Responsive to verifying that the first signature for the first EFI binary object is valid, the processing device performs the following operations: identifying a first public key encapsulated in the first EFI binary object, wherein the first public key is associated with a non-EFI certificate authority; extracting the first public key from the first EFI binary object; and performing at least one of a) passing the first public key to a kernel of an operating system (OS) or b) exposing the first public key to a user space of the OS.