UEFI Variable Restoration via Backup Copy and Detection Flag
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
The transition from legacy BIOS to UEFI firmware has made it challenging to protect and restore critical configuration and global variables essential for booting a computer, as they can be inadvertently rewritten or erased due to errors or malware, and are vulnerable to power supply noise, leading to boot failures.
Innovation Solution
A method is introduced to save a set of variables at a normal boot state and detect alterations, replacing them with the saved set during boot to restore the original state, using a detection flag and cryptographic digests for verification, and storing the restoration code and variables in a non-volatile memory separate from the firmware ROM.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Speed
If configuration variables and global variables are stored in firmware ROM to enable immediate access during boot, then boot speed and system initialization efficiency are improved, but the variables become vulnerable to corruption from power supply noise and unauthorized modification
Solution Approach 1:
The patent creates a backup copy of the variable set and stores it in a separate storage area before any corruption can occur. This preliminary action ensures that a valid copy is available for restoration if the primary variables become corrupted during boot or operation.
Solution Approach 2:
The patent creates and stores a backup copy of the variable set in a separate area of the firmware ROM or non-volatile memory. This copying mechanism allows the system to restore corrupted variables by retrieving the intact backup copy, thereby maintaining variable integrity while keeping the primary variables accessible for fast boot.
2Ease of operation
If the variable area in firmware ROM is made freely writable by OS and applications to allow customization and debugging, then system flexibility and ease of operation are improved, but the risk of erroneous rewriting and boot failure increases
Solution Approach 1:
The patent creates a backup of the variable set before allowing any write operations to occur. This preliminary backup ensures that even if subsequent write operations cause corruption, the original valid state can be restored, thus maintaining boot reliability while allowing flexible variable modification.
Solution Approach 2:
The patent implements a detection mechanism that monitors whether the current variable set matches the backup copy. When a mismatch is detected indicating corruption, the system automatically triggers restoration of the backup variables, providing feedback-based protection against boot failures caused by erroneous writes.
3Reliability
If authentication service is implemented to protect configuration variables from overwriting, then variable security is improved, but the complexity of the system increases
Solution Approach 1:
Instead of implementing complex authentication mechanisms, the patent uses a simpler approach by creating and storing a backup copy of the variable set. This copying mechanism provides protection against corruption without requiring complex authentication services, thus improving variable reliability while minimizing system complexity.
Solution Approach 2:
The patent implements a recovery mechanism that automatically discards corrupted variables and recovers from the backup copy when corruption is detected. This approach provides robust protection against unauthorized or erroneous modifications without requiring complex authentication, thereby improving variable protection while keeping the system relatively simple.
4Reliability
If a backup copy of the variable set is created and stored in a separate area, then the ability to restore corrupted variables is improved, but the storage space requirement increases
Solution Approach 1:
The patent segments the firmware ROM storage into distinct areas: one for the active variable set and another for the backup copy. This segmentation allows the system to maintain both the primary variables for fast access and the backup for restoration purposes, optimizing the use of available storage space while ensuring restoration capability.
Solution Approach 2:
The patent creates a backup copy of the variable set and stores it in a separate area of the firmware ROM or non-volatile memory. This copying approach ensures that a complete backup is available for restoration while utilizing the existing storage infrastructure efficiently, balancing restoration capability with storage space constraints.
Data Source
AI summary
A set of variables referred to by unified extensible firmware interface (UEFI) firmware is restored. The UEFI firmware stored in a read-only memory (ROM) is firstly executed after power-up. The UEFI firmware writes a variable set related to boot, into a variable area. As an operating system (OS) also writes a set of variables into the variable area, the boot-related variable set may be altered. The variable set is saved into a prescribed area, such as a universal serial bus (USB) memory key, when the computer boots normally. If alteration of the variable set in the reference area is detected during a boot of the computer, the variable set in the reference area is replaced with the saved variable set. The variable set alteration may be detected using a detection flag which is set immediately after a boot is started and reset immediately before an OS is loaded.