UEFI Variable Interface for Secure Diagnostics

Resolve Bottlenecks,
Find Innovative SolutionsGenerate Solutions

Solution Overview

Problem

Existing UEFI-compliant computing devices lack advanced management and diagnostic capabilities without requiring changes to the operating system code, and existing firmware interfaces do not provide sufficient security and flexibility for accessing special system management and diagnostic functions.

Innovation Solution

An extended UEFI variable interface is introduced, allowing firmware service calls with unique parameters to access special management and diagnostic functions, using authenticated variables for security and redirecting service calls based on encrypted command, timestamp, and session ID, enabling secure and flexible system management and diagnostics without OS code changes.

Engineering Contradictions & Design Principles

VSEngineering Contradiction Analysis

1Adaptability or versatility

If existing UEFI firmware interfaces are used, then device compatibility is maintained, but management and diagnostic capabilities are insufficient

Engineering Contradiction:

Improvemanagement and diagnostic capabilitiesVSAvoidsecurity

Core Design Contradiction:

Adaptability or versatilityVSReliability

Solution Approach 1:

The firmware interface is segmented into standard UEFI variables and extended authenticated variables. The extension allows specialized management and diagnostic functions to be accessed through a distinct authenticated interface, separating general-purpose firmware access from security-sensitive operations while maintaining compatibility with existing UEFI-compliant systems.

Inventive Principle:

Principle #1Segmentation

Solution Approach 2:

An authenticated variable interface acts as an intermediary layer between software agents and firmware functions. This intermediary requires authentication credentials, thereby securing access to management and diagnostic capabilities while presenting a standardized interface to calling software without requiring OS code changes.

Inventive Principle:

Principle #24Intermediary (Mediator)

2Adaptability or versatility

If new hardware is added to enhance management and diagnostic capabilities, then functionality is improved, but device complexity increases

Engineering Contradiction:

Improvemanagement and diagnostic capabilitiesVSAvoidhardware complexity

Core Design Contradiction:

Adaptability or versatilityVSDevice complexity

Solution Approach 1:

The patent replaces potential hardware additions with a software-based authenticated interface extension. Instead of adding new hardware components for management and diagnostics, the solution uses firmware-level software mechanisms (authenticated variables, cryptographic verification) to provide enhanced capabilities, thereby avoiding increased hardware complexity.

Inventive Principle:

Principle #28Mechanics substitution (Replace mechanical system)

Solution Approach 2:

The authenticated variable interface provides multi-functional capabilities for both system management and diagnostics through a single unified mechanism. This universal interface can handle multiple types of firmware interactions (management, diagnostic, configuration) without requiring separate hardware subsystems for each function.

Inventive Principle:

Principle #6Universality (Multi-functionality)

3Adaptability or versatility

If OS code changes are made to access special firmware functions, then access capability is improved, but software compatibility is reduced

Engineering Contradiction:

Improvefirmware access capabilityVSAvoidsoftware complexity

Core Design Contradiction:

Adaptability or versatilityVSDevice complexity

Solution Approach 1:

The authenticated variable interface is designed as a universal extension to the existing UEFI variable interface. Software agents can access both standard and authenticated variables through the same basic interface mechanism, allowing the system to provide enhanced capabilities without requiring different code paths or OS modifications for different types of firmware access.

Inventive Principle:

Principle #6Universality (Multi-functionality)

Solution Approach 2:

Authentication credentials and authorized access rights are established in advance during system initialization or firmware loading. This preliminary authentication setup allows software agents to access special firmware functions without requiring runtime OS code changes, as the authentication framework is already in place before software agents need to access protected functions.

Inventive Principle:

Principle #10Preliminary action

Data Source

PatentUS9477848B2System and method for managing and diagnosing a computing device equipped with unified extensible firmware interface (UEFI)-compliant firmware

Publication Date: 2016.10.25 INSYDE SOFTWARE CORP

AI summary

A computing device equipped with UEFI-compliant firmware is provided with added functionality via an extended firmware interface. The variable interface is called with special parameters, which redirect handling of firmware service calls. Embodiments use authenticated variables to provide security properties to the special interface, use the firmware interface to provide access to diagnostics, and use the firmware interface to provide access to system management.