Method for generating and executing encrypted BIOS firmware and system therefor
View Patent ↗A firmware image is received at an information handling system. A symmetric key is generated and stored at a trusted platform module (TPM). The firmware image is encrypted using the symmetric key. The encrypted firmware image is stored in a non-volatile memory.
1. A method comprising:
receiving an unencrypted firmware image at system memory at an information handling system;
generating a symmetric key;
storing the symmetric key at a trusted platform module (TPM);
encrypting a first portion of the unencrypted firmware image using the symmetric key to provide an encrypted firmware image the first portion including instructions executed during a Driver Execution Environment (DXE) phase of a platform innovation framework for extensible firmware interface (EFI) boot sequence; and
storing the encrypted firmware image in a non-volatile memory.
2. The method of claim 1 , further comprising storing the symmetric key sealed to a first TPM platform configuration register (PCR) state corresponding to a pre-extensible firmware interface (PEI) phase of the platform innovation framework for EFI boot sequence.
3. The method of claim 1 , further comprising storing the symmetric key during a pre-extensible firmware interface (PEI) phase of the platform innovation framework for EFI boot sequence.
4. The method of claim 1 , wherein a second portion of the encrypted firmware image that is to be executed during a pre-extensible firmware interface (PEI) phase of the platform innovation framework for EFI boot sequence is not encrypted.
5. The method of claim 1 , further comprising initiating a system boot at the information handling system after receiving the unencrypted firmware image and before generating the symmetric key.
6. The method of claim 1 , wherein receiving the firmware image further comprises:
storing the unencrypted firmware image at a system memory;
setting a firmware update flag;
initiating a boot process at the information handling system; and
determining the firmware update flag is set.
7. The method of claim 1 , further comprising encrypting the unencrypted firmware image during the DXE phase of the platform innovation framework for EFI boot sequence.
8. The method of claim 1 , wherein generating the symmetric key further comprises:
storing the symmetric key at a system memory; and
deleting the symmetric key from the system memory after encrypting the firmware image.
9. The method of claim 1 , further comprising:
retrieving the symmetric key from the TPM;
retrieving the encrypted firmware image from the non-volatile memory; and
decrypting the first portion of the encrypted firmware image using the symmetric key.
10. The method of claim 9 , wherein retrieving the symmetric key further comprises un-sealing the symmetric key at the TPM based on a current TPM platform configuration register (PCR) state corresponding to a pre-extensible firmware interface (PEI) phase of the platform innovation framework for EFI boot sequence.
11. A method comprising:
initializing a trusted platform module (TPM) and system memory at an information handling system;
retrieving a symmetric key from the TPM during a pre-extensible firmware interface (PEI) phase of a platform innovation framework for extensible firmware interface (EFI) boot sequence;
retrieving an encrypted firmware image from a non-volatile memory, wherein a first portion of the encrypted firmware image that includes instructions executed during a Driver Execution Environment (DXE) phase of the platform innovation framework for EFI boot sequence is encrypted, and wherein a second portion of the encrypted firmware image that is to be executed during a pre-extensible firmware interface (PEI) phase of the platform innovation framework for EFI boot sequence is not encrypted;
decrypting the first portion of the encrypted firmware image using the symmetric key to provide a decrypted firmware image;
decompressing the decrypted firmware image;
measuring the decompressed firmware image to a TPM platform configuration register (PCR) during the PEI phase of the platform innovation framework for EFI boot sequence; and
executing the decompressed firmware image to complete booting of the information handling system.
12. The method of claim 11 , wherein retrieving the symmetric key further comprises un-sealing the symmetric key based on a current PCR state corresponding to the PEI phase of the platform innovation framework for EFI boot sequence.
13. The method of claim 11 , wherein retrieving the symmetric key further comprises:
storing the symmetric key in a system memory; and
clearing the symmetric key from the system memory after the decrypting.
14. An information handling system comprising:
a trusted platform module (TPM)
a system memory;
a non-volatile memory; and
a processor coupled to the TPM and the non-volatile memory, the processor configured to execute instructions to:
receive an unencrypted firmware image at the information handling system;
generate a symmetric key;
store the symmetric key at the TPM;
encrypt a first portion of the unencrypted firmware image using the symmetric key to provide an encrypted firmware image, wherein the first portion includes instructions executed during a Driver Execution Environment (DXE) phase of a platform innovation framework for extensible firmware interface (EFI) boot sequence, and a second portion of the encrypted firmware image that is to be executed during a pre-extensible firmware interface (PEI) phase of the platform innovation framework for EFI boot sequence is not encrypted; and
store the encrypted firmware image in the non-volatile memory.
15. The information handling system of claim 14 , wherein the processor is further to store the symmetric key sealed to a first TPM platform configuration register (PCR) state corresponding to the PEI phase of the platform innovation framework for EFI boot sequence.
16. The information handling system of claim 14 , wherein the processor is further to store the symmetric key during the PEI phase of the platform innovation framework for EFI boot sequence.
17. The information handling system of claim 14 , wherein the processor is further to initiate a system boot at the information handling system after receiving the unencrypted firmware image and before generating the symmetric key.
18. The information handling system of claim 14 , wherein the processor is further to encrypt the unencrypted firmware image during the DXE phase of the platform innovation framework for EFI boot sequence.
19. The information handling system of claim 14 , wherein the processor is further to:
retrieve the symmetric key from the TPM;
retrieve the encrypted firmware image from the non-volatile memory; and
decrypt the first portion of the encrypted firmware image using the symmetric key.
20. The information handling system of claim 19 , wherein retrieving the symmetric key further comprises un-sealing the symmetric key at the TPM based on a current TPM platform configuration register (PCR) state corresponding to the PEI phase of the platform innovation framework for EFI boot sequence.