Systems and methods for secure delivery of public keys for operating system drivers
View Patent ↗In accordance with these and other embodiments of the present disclosure, an information handling system may include a processor and a basic input/output system (BIOS) comprising a program of instructions executable by the processor and configured to cause the processor to initialize one or more information handling resources of the information handling system. The BIOS may be further configured to authenticate a signature of a BIOS driver associated with an information handling resource of the information handling system, and, in response to authenticating the signature of the BIOS driver, extracting a vendor public key from the BIOS driver and storing the vendor public key to a key database of the BIOS, wherein the vendor public key may be used by an operating system to authenticate one or more signed operating system drivers signed with a private key corresponding to the vendor public key.
1. An information handling system comprising:
a processor; and
a basic input/output system (BIOS) comprising a program of processor-executable BIOS instructions that, when executed, cause the processor to:
initialize one or more information handling resources of the information handling system; and
perform extended BIOS operations, comprising:
receiving a BIOS driver update, comprising an update of a BIOS driver configured to provide an interface between the BIOS and hardware or firmware of an information handling resource of the information handling system;
authenticating a signature of the BIOS driver update;
extracting a vendor public key from the BIOS driver update and storing the vendor public key to a key database of the BIOS; and
authenticating, in accordance with the vendor public key, a signed operating system driver, distinct from the BIOS driver and the BIOS driver update.
2. The information handling system of claim 1 , wherein the BIOS comprises a Unified Extensible Firmware Interface (UEFI).
3. The information handling system of claim 2 , wherein the BIOS driver update includes information, compliant with an Extensible Firmware Interface (EFI) adapter protocol, to determine presence of the vendor public key and to retrieve the public key from the BIOS driver.
4. The information handling system of claim 1 , wherein the BIOS driver, the BIOS driver update, and the signed operating system driver are all provided by a particular vendor and wherein the vendor public key comprises a public key of the particular vendor.
5. The information handling system of claim 1 , wherein a firmware management protocol (FMP) portion of the BIOS driver includes a public key index indicative of a location of the vendor public key within the BIOS driver.
6. The information handling system of claim 5 , wherein extracting the vendor public key comprises invoking a get image function of the BIOS in accordance with the public key index.
7. The information handling system of claim 1 , wherein extracting the vendor public key comprises extracting the vendor public key from a tail of the BIOS driver update in accordance with a predetermined size of the public key.
8. The information handling system of claim 1 , wherein the BIOS driver update includes processor-executable code for writing the vendor public key to the key database of the BIOS.
9. A method comprising:
initializing one or more information handling resources of an information handling system;
receiving a basic input/output system (BIOS) driver update, comprising an update of a BIOS update configured to provide an interface between the BIOS and hardware or firmware of an information handling resource of the information handling system;
authenticating a signature of the BIOS driver update;
extracting a vendor public key from the BIOS driver update; and
authenticating, in accordance with the vendor public key, a signed operating system driver, distinct from the BIOS driver and the BIOS driver update.
10. The method of claim 9 , wherein the BIOS comprises a Unified Extensible Firmware Interface (UEFI).
11. The method of claim 10 , wherein the BIOS driver update includes information, compliant with an Extensible Firmware Interface (EFI) adapter protocol, to determine presence of the vendor public key and to retrieve the public key from the BIOS driver.
12. The method of claim 9 , wherein the BIOS driver, the BIOS driver update, and the signed operating system driver are all provided by a particular vendor and wherein the vendor public key comprises a public key of the particular vendor.
13. The method of claim 9 , wherein a firmware management protocol (FMP) portion of the BIOS driver includes a public key index indicative of a location of the vendor public key within BIOS driver.
14. The method of claim 13 , wherein extracting the vendor public key comprises invoking a get image function of the BIOS in accordance with the public key index.
15. The method of claim 9 , wherein extracting the vendor public key comprises extracting the vendor public key from a tail of the BIOS driver update in accordance with a predetermined size of the public key.
16. The method of claim 9 , wherein the BIOS driver update includes processor-executable code for writing the vendor public key to the key database of the BIOS.
17. An article of manufacture comprising a non-transitory computer readable medium including processor-executable instructions that, when read and executed by the processor, causing the processor to perform operations comprising:
receiving a basic input/output system (BIOS) driver update, comprising an update of a BIOS driver configured to provide an interface between a BIOS of an information handling system and hardware or firmware of an information handling resource of the information handling system;
authenticating a signature of the BIOS driver update;
extracting a vendor public key from the BIOS driver update and; and
authenticating, in accordance with the vendor public key, a signed operating system driver, distinct from the BIOS driver and the BIOS driver update.
18. The article of claim 17 , wherein the BIOS comprises a Unified Extensible Firmware Interface (UEFI).
19. The article of claim 17 , wherein the BIOS driver, the BIOS driver update, and the signed operating system driver are all provided by a particular vendor and wherein the vendor public key comprises a public key of the particular vendor.
20. The article of claim 17 , wherein a firmware management protocol (FMP) portion of the BIOS driver includes a public key index indicative of a location of the vendor public key within BIOS driver and further wherein extracting the vendor public key comprises invoking a get image function of the BIOS in accordance with the public key index.