System and method for intercept of UEFI block I/O protocol services for BIOS based hard drive encryption support

1. A method for performing Unified Extensible Firmware Interface (UEFI) block input/output (I/O) access to storage devices that can be encrypted, the method comprising:

installing a block I/O driver during UEFI-initiated storage device discovery;

installing an interceptor block I/O driver in response to determining that a discovered storage device is at least partially encrypted, wherein the block I/O driver is chained through the interceptor block I/O driver, which also is communicatively connected to an encryption-decryption module;

intercepting, by a UEFI interceptor block I/O driver, a caller-initiated block I/O command for I/O access to one or more target block addresses on a storage device;

identifying whether any of the one or more target block addresses is for an encrypted storage block;

in response to identifying an encrypted storage block among the one or more target block addresses, forwarding data associated with the encrypted target storage block to the encryption-decryption module to perform one of an encryption and a decryption of corresponding data; and

performing final handling of the block I/O command and associated data using the block I/O driver;

wherein I/O data stored within the encrypted storage block targeted by the block I/O command is first identified by the UEFI interceptor block I/O driver and processed by the encryption-decryption module before final handling of the block I/O command is performed by the block I/O driver.

2. The method of claim 1 , further comprising:

identifying the block I/O command as a write command including unencrypted write data; and

in response to at least a portion of the unencrypted write data being forwarded for storage to an identified encrypted storage block, triggering the encryption-decryption module to encrypt the portion of the unencrypted data that is to be stored within the identified encrypted storage block to generate encrypted data.

3. The method of claim 2 , wherein the performing final handling of the block I/O command comprises:

writing the encrypted data to the identified encrypted storage block; and

writing any remaining unencrypted data to a corresponding block address that is not for an encrypted storage block.

4. The method of claim 2 , further comprising:

placing the encrypted data within a first section of a write buffer; and

placing any remaining unencrypted data within a second section of the write buffer; and

wherein performing final handling of the block I/O commands comprises writing all data content of the write buffer to their associated block addresses targeted by the block I/O command.

5. The method of claim 1 , further comprising:

identifying the block I/O command as a read command for return of read data that includes at least some encrypted data stored within corresponding encrypted storage blocks;

in response to at least a portion of the read data being encrypted data:

triggering the encryption-decryption module to decrypt the encrypted data to generate unencrypted data; and

performing final handling of the block I/O command by: providing the unencrypted data processed by the encryption-decryption module to a caller that issued the block I/O command; and providing any remaining read data that was not stored within an encrypted block address to the caller.

6. The method of claim 5 , wherein providing the unencrypted data and providing the remaining read data comprises:

placing the any remaining read data within a first section of a read buffer; and

placing the unencrypted data within a second section of the read buffer; and

wherein performing final handling of the block I/O comments comprises forwarding the read buffer to a caller that issued the I/O block command.

7. The method of claim 1 , wherein the encryption-decryption module is an encryption-decryption card and forwarding data to the encryption-decryption module comprises forwarding the data with specific processing instructions to the encryption-decryption card.

8. The method of claim 1 , wherein identifying whether any of the one or more block addresses targeted by the block I/O command is encrypted comprises: accessing a high water mark record stored in a master boot record of the storage device; and comparing the block addresses targeted by the block I/O command to the high water mark.

9. The method of claim 1 , wherein performing final handling of the block I/O commands comprises:

receiving a completion signal from the encryption-decryption module that indicates that processing by the module of data associated with a targeted encrypted block address has completed; and

in response to receiving the completion signal, forwarding the block I/O command along with the processed data to the block I/O driver.

10. An information handling system comprising:

a storage device;

a memory device

a processor communicatively coupled to the storage device and the memory device and which: installs a block I/O driver during UEFI-initiated storage device discovery; and installs an interceptor block I/O driver in response to determining that a discovered storage device is at least partially encrypted, wherein the block I/O driver is chained through the interceptor block I/O driver, which also is communicatively connected to the encryption-decryption module

an encryption-decryption module accessible to the processor; and

a block input/output (I/O) driver maintained on the memory device and which can execute on the processor; and

a Unified Extensible Firmware Interface (UEFI) that executes on the processor and which includes the UEFI interceptor block I/O driver that:

intercepts a caller-initiated block I/O command for I/O access to one or more target block addresses on a storage device;

identifies whether any of the one or more target block addresses is for an encrypted storage block;

in response to identifying an encrypted storage block among the storage accessed by the one or more target block addresses, forwards data associated with the encrypted block address to an encryption-decryption module to perform one of an encryption and a decryption of the data; and

performs final handling of the block I/O command and associated data using the block I/O driver;

wherein I/O data stored within the encrypted storage block targeted by the block I/O command is first identified by the UEFI interceptor block I/O driver and processed by the encryption-decryption module before final handling of the block I/O command is performed by the block I/O driver.

11. The information handling system of claim 10 , wherein the interceptor block I/O driver further:

identifies the block I/O command as a write command including unencrypted write data; and

in response to at least a portion of the unencrypted write data being forwarded for storage to an identified encrypted storage block, triggers the encryption-decryption module to encrypt the portion of the unencrypted data that is to be stored within the identified encrypted storage block to generate encrypted data.

12. The information handling system of claim 11 , wherein performing the final handling of the block I/O command comprises the block I/O driver configuring the processor to:

write the encrypted data to the identified encrypted storage block; and

write any remaining unencrypted data to a corresponding block address that is not an address of an encrypted storage block.

13. The information handling system of claim 11 , wherein the block I/O driver:

places the encrypted data within a first section of a write buffer;

places any remaining unencrypted data within a second section of the write buffer; and

performs final handling of the block I/O commands by writing all data content of the write buffer to their associated block addresses targeted by the block I/O command.

14. The information handling system of claim 10 , wherein the UEFI interceptor block I/O driver further:

identifies the block I/O command as a read command for return of read data that includes at least some encrypted data stored within corresponding encrypted block addresses; and

in response to at least a portion of the read data being encrypted data:

triggers the encryption-decryption module to decrypt the encrypted data to generate unencrypted data; and

performs final handling of the block I/O command by: providing the unencrypted data processed by the encryption-decryption module to a caller that issued the block I/O command; and providing any remaining read data that was not stored within an encrypted storage block to the caller.

15. The information handling system of claim 14 , wherein to provide the unencrypted data and provide the remaining read data comprises configuring the processor to:

place the any remaining read data within a first section of a read buffer; and

place the unencrypted data within a second section of the read buffer; and

wherein to perform final handling of the block I/O comments the processor forwards the read buffer to a caller that issued the I/O block command.

16. The information handling system of claim 14 , wherein the encryption-decryption module is an encryption-decryption card and forwarding data to the encryption-decryption module comprises forwarding the data with specific processing instructions to the encryption-decryption card.

17. The information handling system of claim 10 , wherein to identify whether any of the one or more block addresses targeted by the block I/O command is encrypted, the interceptor block I/O driver: accesses a high water mark record stored in a master boot record of the storage device; and compares the block addresses targeted by the block I/O command to the high water mark.

18. The information handling system of claim 10 , wherein to perform final handling of the block I/O commands the UEFI interceptor block I/O driver:

receives a completion signal from the encryption-decryption module that indicates that processing by the module of data associated with a targeted encrypted block address has completed; and

in response to receiving the completion signal, forwards the block I/O command along with the processed data to the block I/O driver.